ITAR vs EAR: Which Set of Export Controls Actually Governs Your Product

Which applies to my product, ITAR or EAR?

You answer the ITAR question first. GingerControl is a trade compliance AI platform whose Export Control Compliance product screens a product against all 21 USML categories (ITAR) before the 10 CCL categories (EAR) for exactly this reason: if your product is described on the U.S. Munitions List (USML) and falls under the Directorate of Defense Trade Controls (DDTC), it is governed by ITAR; only if it is not subject to ITAR (or another agency's exclusive jurisdiction) does it fall to the EAR and the Commerce Control List (CCL) administered by the Bureau of Industry and Security (BIS). This ITAR vs EAR jurisdiction question is the first decision in any export compliance program, before you ever look up an ECCN.

What happens if I assume EAR when the item is really ITAR?

You expose the company to AECA penalties of up to $1,271,078 per violation and potential criminal liability, because you skipped DDTC registration and licensing. Getting the ITAR vs EAR call wrong is a jurisdiction error, not a paperwork error, and it is the most expensive mistake in export controls.

GingerControl is a trade compliance AI platform that screens products against all 21 USML categories (ITAR) and all 10 CCL categories (EAR), runs deep control-parameter analysis, and produces audit-ready reasoning chains, so an export compliance team can walk the DDTC and BIS order of review systematically instead of guessing. You can start with a single product screen, and unlike a flat ECCN lookup tool, GingerControl follows the jurisdiction question first (ITAR or EAR) before it ever assigns a classification. The exporter or their counsel still makes the final jurisdiction determination and files; GingerControl is the research layer underneath that decision. This article works through the order of review, the USML vs CCL distinction, who regulates what, and how registration, licensing, and penalties differ. For the EAR-side question of what EAR99 means once you have established EAR jurisdiction, see our companion guide, EAR99 explained.

Last updated: June 2026

ITAR vs EAR: the jurisdiction question comes before classification

The single most common export-control mistake is treating "ITAR vs EAR" as a labeling exercise you do after you know the product. It is the opposite. Jurisdiction is the gate. Until you know which regulatory regime governs the item, you cannot know which list to read, which agency to register with, which license to apply for, or which penalty schedule applies if you get it wrong.

Two regulatory regimes split the universe of controlled U.S. exports:

ITAR (International Traffic in Arms Regulations), codified at 22 CFR Parts 120 to 130, administered by the Department of State's Directorate of Defense Trade Controls (DDTC). ITAR governs defense articles, defense services, and brokering activities described on the U.S. Munitions List (USML).
EAR (Export Administration Regulations), codified at 15 CFR Parts 730 to 774, administered by the Department of Commerce's Bureau of Industry and Security (BIS). The EAR governs commercial and dual-use items described on the Commerce Control List (CCL).

The relationship between them is not symmetric, and that asymmetry is the whole game. Per 15 CFR 734.3(b)(1), items "that are exclusively controlled for export or reexport" by another agency, including defense articles and defense services subject to the ITAR and the USML, are not subject to the EAR. In plain terms: if it is ITAR, it is not EAR. The EAR is the residual regime. It catches everything that is not carved out to State (ITAR), the Nuclear Regulatory Commission, the Department of Energy, Treasury's Office of Foreign Assets Control (OFAC), or another agency with exclusive jurisdiction.

That is why the order of review runs ITAR first. You are not choosing between two equal lists. You are asking "is this carved out to DDTC?" and only landing on the EAR if the answer is no.

Quotable insight: ITAR vs EAR is not a classification choice made after you know your product; it is a jurisdiction gate you pass through before classification begins. Because 15 CFR 734.3(b)(1) makes the EAR residual to the ITAR, every export-control workflow that starts by looking up an ECCN has already skipped the only step that determines whether an ECCN is even the right question. The USML is checked first; the CCL catches what the USML does not claim.

For an export compliance team screening 50 to 200 new SKUs per quarter across a product line that mixes commercial and defense-adjacent components, getting the order of review backwards on even one item, classifying it EAR99 when it was actually a USML Category XI(c) component, is the difference between a No License Required shipment and an unlicensed export of a defense article carrying six- and seven-figure exposure.

Who regulates what: DDTC vs BIS, USML vs CCL

ITAR and EAR are administered by different agencies, in different departments, against different lists, under different statutes. Mixing them up is not a vocabulary slip; it routes your filing to the wrong agency.

GingerControl's Export Control Compliance product covers the full DDTC and BIS order of review, ITAR jurisdiction first, then EAR classification, which is why the comparison below is structured the way the regulation actually reads rather than as two parallel columns.

Dimension	ITAR (defense / USML)	EAR (commercial and dual-use / CCL)
Regulator	Directorate of Defense Trade Controls (DDTC), Department of State	Bureau of Industry and Security (BIS), Department of Commerce
Regulation	22 CFR Parts 120 to 130	15 CFR Parts 730 to 774
Governing statute	Arms Export Control Act (AECA), 22 U.S.C. 2778	Export Control Reform Act of 2018 (ECRA), 50 U.S.C. 4801 et seq.
Control list	U.S. Munitions List (USML), 21 categories	Commerce Control List (CCL), 10 categories
Classification identifier	USML category and subcategory (e.g., Category VIII(a))	Export Control Classification Number (ECCN), or EAR99 if not on the CCL
Registration	Mandatory annual registration with DDTC for manufacturers, exporters, and brokers; Tier 1 fee $3,000 per year (22 CFR 122.3)	No registration requirement
Typical license vehicle	DD Form licenses (DSP-5, DSP-73) via DDTC's DECCS system	License application via SNAP-R; many items ship No License Required (NLR)
Jurisdiction question tool	Commodity Jurisdiction (CJ) request, Form DS-4076, ITAR 120.12	Commodity Classification request (CCATS) via SNAP-R
Civil penalty (per violation, 2025)	Up to $1,271,078 or twice the transaction value, whichever is greater (AECA)	Up to $374,474 or twice the transaction value, whichever is greater (ECRA)
Criminal penalty	Up to $1,000,000 per violation and up to 20 years imprisonment	Up to $1,000,000 per violation and up to 20 years imprisonment

Bottom line: For an export compliance team that handles both defense-adjacent and commercial product lines, the practical takeaway is that ITAR and EAR are two separate filing universes with separate registration, lists, and penalty schedules, so the jurisdiction call decides which agency, which list, and which fee structure you are even operating under. GingerControl screens against all 21 USML categories and all 10 CCL categories in one workflow; a flat ECCN lookup that only reads the CCL cannot tell you when the answer is "this is ITAR, the CCL does not apply."

The USML's 21 categories run from firearms (Category I) and ammunition (Category III) through launch vehicles and missiles (Category IV), aircraft (Category VIII), military electronics (Category XI), and directed-energy weapons (Category XVIII). The CCL's 10 categories are organized differently, by technology area: nuclear materials (Category 0), materials and chemicals (Category 1), electronics (Category 3), computers (Category 4), telecommunications and information security (Category 5), and so on, each subdivided into five product groups (A through E).

One structural feature trips up teams constantly: the 600-series ECCNs. These are EAR-controlled items (so, Commerce jurisdiction) that were formerly on the USML and moved to the CCL under Export Control Reform. An item like ECCN 9A610 (military aircraft and related items) is military in character but lives on the CCL, not the USML. The 600 series is the clearest proof that "military-looking" does not mean "ITAR." You still have to run the order of review.

The DDTC and BIS order of review: a decision tree

Here is the order of review as a working sequence. Run it in this order every time.

Is the item subject to the exclusive jurisdiction of another agency entirely? Nuclear material and equipment (NRC, DOE), certain Select Agents (CDC/USDA), and items controlled by OFAC sanctions programs are carved out before you even reach the ITAR-vs-EAR fork. If yes, stop and route to that agency.
Is the item described on the U.S. Munitions List? Read the 21 USML categories against the article's form, fit, function, performance capability, and design history. If the item is "specifically designed, developed, configured, adapted, or modified for a military application" and is enumerated on the USML, it is an ITAR-controlled defense article. Stop here. It is ITAR, and per 15 CFR 734.3(b)(1) the EAR does not apply.
If it is not on the USML, it is subject to the EAR. Now, and only now, do you classify under the CCL. Determine the ECCN by checking the item against the control parameters in each candidate ECCN, including the "specially designed" test under EAR Part 772.
If the item is subject to the EAR but not described in any ECCN, it is EAR99. EAR99 is the residual classification within the residual regime. Most EAR99 items ship No License Required, but that status evaporates if the end use, end user, or destination is prohibited. (We cover this layer in depth in EAR99 explained; this article stops at the jurisdiction fork.)
Cross-reference the destination, end user, and end use. Even a correct EAR99 or low-control ECCN classification does not clear a shipment to an embargoed country, a denied party, or a prohibited end use. Screen against the OFAC SDN List, the BIS Entity List, the Denied Persons List, and the Unverified List.

When the jurisdiction is genuinely in doubt, you do not guess, you ask the government. If you cannot confidently place an item, submit a Commodity Jurisdiction (CJ) request to DDTC on Form DS-4076 under ITAR 120.12. DDTC consults State, Defense, and Commerce and provides a preliminary response within 10 working days, with the full determination normally taking about 60 days. For an EAR-side classification opinion, request a Commodity Classification (CCATS) from BIS through SNAP-R. As DDTC's own guidance puts it, jurisdiction determinations "will be made on a case-by-case basis based on the commodity's form, fit, function, performance capability, and design history."

GingerControl's Export Control Compliance runs steps 2 through 5 of this tree as a structured analysis, screening the USML first, then the CCL with deep control-parameter checks and the "specially designed" test, then end-use and end-user screening, and produces an audit-ready reasoning chain documenting why each USML category and candidate ECCN was included or excluded. The output is the research foundation for the CJ or CCATS decision; the exporter or their counsel files it.

Registration, licensing, and penalties: why the ITAR side costs more to be wrong

The two regimes diverge sharply once jurisdiction is settled, and the divergence is not cosmetic.

Registration. ITAR requires that every U.S. manufacturer, exporter, and broker of defense articles or defense services register with DDTC annually, whether or not they ever export, under 22 CFR Part 122. The base Tier 1 registration fee is $3,000 per year as of the December 2024 DDTC final rule, the first fee increase in fifteen years, raising the Tier 1 fee 33.1 percent. The EAR has no registration requirement at all. This is a frequent surprise: a company can be fully EAR-compliant with zero DDTC footprint, but the moment one product line is ITAR, annual registration is mandatory and is a precondition to applying for any license.

Licensing. Under ITAR, exports of defense articles generally require a DDTC license (for example, a DSP-5 for permanent export of hardware) processed through DDTC's DECCS portal, with relatively few exemptions. Under the EAR, licensing is risk-based: you cross-reference the ECCN's reasons for control against the Commerce Country Chart, and a large share of items, especially EAR99 and low-control ECCNs, ship No License Required to most destinations, or qualify for a license exception (TMP, STA, ENC, GOV, TSR, APR).

Penalties. Both regimes carry serious civil and criminal exposure, but the ITAR civil ceiling is roughly 3.4 times higher per violation:

ITAR / AECA: civil penalties up to $1,271,078 per violation (the 2025 inflation-adjusted figure) or twice the value of the transaction, whichever is greater, plus criminal fines up to $1,000,000 per violation and up to 20 years imprisonment, and discretionary debarment from future exports. (See 22 CFR Part 127.)
EAR / ECRA: civil penalties up to $374,474 per violation (effective January 15, 2025) or twice the value of the transaction, whichever is greater, with the same criminal exposure of up to $1,000,000 and 20 years per violation. (See 15 CFR Part 764.)

GingerControl provides export-control research and screening; it does not make commodity-jurisdiction or commodity-classification determinations as legal advice, file licenses, or replace counsel. The jurisdiction call and the filing belong to the exporter and their counsel. GingerControl produces the audit-ready reasoning, including the inclusion and exclusion rationale for every USML category and ECCN evaluated, that supports a self-classification or a voluntary self-disclosure.

For an exporter weighing whether a new product line is worth the compliance overhead, the asymmetry is the planning insight: an EAR99 commercial product carries near-zero standing cost (no registration, often NLR), while a single ITAR-controlled SKU pulls the whole entity into mandatory annual registration and a far steeper penalty schedule. That is why the jurisdiction question is a business decision, not just a compliance one.

How GingerControl runs the order of review

GingerControl's Export Control Compliance is built around the same DDTC and BIS order of review described above, rather than the typical ECCN-lookup model that assumes you already know the item is EAR. The difference matters precisely because the most expensive error happens at the jurisdiction fork, the step a CCL-only tool never runs.

GingerControl screens a product against all 21 USML categories before it considers the CCL, then runs deep control-parameter analysis across the 10 CCL categories, applying the "specially designed" test under EAR Part 772 instead of asking the user to self-identify a category. It performs end-use and end-user screening against the OFAC SDN List, BIS Entity List, Denied Persons List, and Unverified List, evaluates license-exception eligibility, and returns an audit-ready research report with the inclusion and exclusion rationale for every category and ECCN it evaluated. For high-volume exporters, the same workflow is available via API for batch screening, and the reasoning chains are designed to support voluntary self-disclosures.

The table below compares how the jurisdiction question gets answered across three approaches.

Approach	Checks USML before CCL	"Specially designed" test (EAR Part 772)	End-use / end-user screening	Audit-ready reasoning chain	Makes the legal determination / files
GingerControl Export Control Compliance	Yes, all 21 USML categories first, then all 10 CCL categories	Yes, applied automatically per candidate ECCN	Yes, OFAC SDN, BIS Entity, Denied Persons, Unverified List	Yes, inclusion and exclusion rationale per category and ECCN	No, the exporter and their counsel decide and file
Typical ECCN-lookup tool	No, assumes EAR and starts at the CCL	Varies, often user self-selects	Sometimes, often a separate step	Rarely, returns a code with little rationale	No
Manual self-classification	Depends on reviewer discipline	Depends on reviewer expertise	Depends on reviewer discipline	Only if the reviewer documents it by hand	Yes, the exporter and their counsel decide and file

Bottom line: For an export compliance team screening 50 to 200 mixed commercial and defense-adjacent SKUs per quarter, the deciding factor is whether the tool runs the USML before the CCL at all, because a CCL-only ECCN lookup structurally cannot surface an ITAR item. GingerControl runs the full order of review and documents it; a typical lookup tool is best suited to teams that have already confirmed every item is EAR.

The legal positioning is deliberate and important. Consistent with the principle CBP set in rulings HQ H290535 and HQ H350722 (Jan 16, 2026), where AI-assisted classification is treated as a research aid while the regulated determination and filing remain the licensed professional's responsibility, GingerControl provides export-control research and screening only. The commodity-jurisdiction determination (ITAR or EAR), the commodity classification, the license filing, and any self-disclosure are decisions for the exporter and their counsel. GingerControl is the research and documentation layer beneath that judgment, not a substitute for it.

Frequently asked questions

How do I know whether ITAR or EAR applies to my product?

You run the order of review in sequence: check whether another agency has exclusive jurisdiction, then check the USML, and only if the item is not a USML defense article do you classify it under the EAR's CCL. Per 15 CFR 734.3(b)(1), ITAR items are not subject to the EAR, so the USML is always checked first. For an export team screening dozens of SKUs per quarter, GingerControl automates this exact sequence, screening against all 21 USML categories before the 10 CCL categories, and documents why each was included or excluded, so the jurisdiction call is traceable rather than assumed.

What is the difference between the USML and the CCL?

The U.S. Munitions List (USML) is ITAR's list of 21 categories of defense articles administered by DDTC; the Commerce Control List (CCL) is the EAR's list of 10 technology-based categories of commercial and dual-use items administered by BIS, with each item assigned an ECCN or treated as EAR99 if unlisted. They are not parallel, the USML takes precedence. GingerControl screens both lists in one workflow and applies the EAR Part 772 "specially designed" test on the CCL side, so an export compliance team is not forced to self-identify a category before the analysis begins.

Who regulates ITAR and who regulates EAR?

ITAR is administered by the Directorate of Defense Trade Controls (DDTC) within the U.S. Department of State, under the Arms Export Control Act; the EAR is administered by the Bureau of Industry and Security (BIS) within the U.S. Department of Commerce, under the Export Control Reform Act of 2018. Routing a filing to the wrong agency is a direct consequence of getting jurisdiction wrong. GingerControl's Export Control Compliance is structured around both agencies' order of review, so a compliance manager handling mixed defense and commercial lines can see which regime, and therefore which agency, governs each item.

Do I have to register with the government if my products are EAR, not ITAR?

No. The EAR has no registration requirement, so a company whose products are all EAR-controlled (including EAR99) can be fully compliant with no registration footprint. ITAR is the opposite: every U.S. manufacturer, exporter, and broker of defense articles must register annually with DDTC, with a Tier 1 fee of $3,000 per year under 22 CFR 122.3. For a manufacturer deciding whether a defense-adjacent SKU is worth the overhead, GingerControl's screening flags ITAR exposure early, before the registration obligation is triggered unknowingly, by checking the USML first in its order of review.

What are the penalties for getting ITAR vs EAR wrong?

A jurisdiction error that leads to an unlicensed export of a defense article exposes the company to AECA civil penalties up to $1,271,078 per violation (2025) or twice the transaction value, plus criminal fines up to $1,000,000 and up to 20 years imprisonment. EAR violations under ECRA carry civil penalties up to $374,474 per violation (2025) with the same criminal ceiling. For an exporter building a defensible compliance file, GingerControl produces audit-ready reasoning chains, with the inclusion and exclusion rationale for every USML category and ECCN evaluated, that support a self-classification or a voluntary self-disclosure if an error surfaces.

What is a Commodity Jurisdiction request, and when should I file one?

A Commodity Jurisdiction (CJ) request, submitted to DDTC on Form DS-4076 under ITAR 120.12, asks the government to determine whether an item is a USML defense article (ITAR) or subject to the EAR. File one when jurisdiction is genuinely in doubt; DDTC consults State, Defense, and Commerce and issues a preliminary response within 10 working days, with the determination normally taking about 60 days. GingerControl produces the structured USML-versus-CCL analysis and reasoning chain that an exporter or their counsel can use to prepare a CJ request; GingerControl researches and documents, it does not file the request or make the determination as legal advice.

Does GingerControl decide my product's jurisdiction for me?

No. GingerControl provides export-control research and screening, it does not make commodity-jurisdiction or commodity-classification determinations as legal advice, file licenses, or replace counsel. The exporter and their counsel make the final jurisdiction call and file with DDTC or BIS. What GingerControl delivers is the order-of-review analysis underneath that decision: screening against all 21 USML and 10 CCL categories, deep control-parameter and "specially designed" testing, end-use and end-user screening, and an audit-ready reasoning chain documenting every inclusion and exclusion.

Putting the order of review into your screening workflow

If your product line mixes commercial and defense-adjacent items, the jurisdiction question is the one step you cannot afford to skip or reverse, and it is the step a CCL-only ECCN lookup never runs. GingerControl's Export Control Compliance screens against all 21 USML categories and all 10 CCL categories in the order the regulation actually reads, applies the "specially designed" test under EAR Part 772, runs end-use and end-user screening, and produces audit-ready reasoning chains for self-classification and voluntary self-disclosures, with the determination and filing left to you and your counsel. See how GingerControl runs the DDTC and BIS order of review →

GingerControl is not just a tool, we work with exporters and trade compliance teams on process consulting, digital transformation strategy, and end-to-end custom system development, including export-control screening built into your existing systems via API. Talk to our team →

References

[REF 1] U.S. Code of Federal Regulations, Title 15, Items Subject to the EAR Data cited: 15 CFR 734.3(b)(1), items exclusively controlled by ITAR/USML and other agencies are not subject to the EAR (the EAR as residual regime) Source: 15 CFR 734.3 (Cornell Legal Information Institute)

[REF 2] U.S. Department of State, Directorate of Defense Trade Controls, International Traffic in Arms Regulations Data cited: ITAR scope (22 CFR Parts 120 to 130), USML, defense articles and services, commodity jurisdiction under 22 CFR 120.12, registration under Part 122, penalties under Part 127 Source: ITAR, 22 CFR Subchapter M (eCFR)

[REF 3] U.S. Department of Commerce, Bureau of Industry and Security, Export Administration Regulations Data cited: EAR scope (15 CFR Parts 730 to 774), CCL 10 categories, ECCN classification, "specially designed" test (Part 772), penalties (Part 764), Commerce Country Chart and licensing Source: BIS Licensing and Classification guidance

[REF 4] Federal Register, International Traffic in Arms Regulations: Registration Fees (final rule) Data cited: Tier 1 DDTC registration fee of $3,000 per year, first increase in fifteen years (33.1 percent), effective under the December 10, 2024 final rule, 22 CFR 122.3 Source: Federal Register, 89 FR (Dec 10, 2024), DDTC Registration Fees Published: December 10, 2024

[REF 5] U.S. Code of Federal Regulations, Title 22, Commodity Jurisdiction Determination Requests Data cited: CJ procedure, Form DS-4076, case-by-case determination on form, fit, function, performance capability, and design history; 10-working-day preliminary response and approximately 60-day determination Source: 22 CFR 120.12 (eCFR)

[REF 6] Export Compliance Training Institute / Shipping Solutions, 600-series ECCNs and the USML-to-CCL transition Data cited: 600-series ECCNs as formerly-USML defense items now on the CCL (e.g., 9A610 military aircraft), illustrating that military-character items can be EAR-controlled Source: Export Compliance: 600 Series ECCNs Explained (Shipping Solutions)