What does ITAR compliant mean?
ITAR compliant means your company follows the International Traffic in Arms Regulations: the State Department rules that control defense articles, technical data and defense services. There is no certificate. Compliance is the registration, approvals, access controls and records you keep up every day.
Three facts that define ITAR compliance
Most of what ITAR asks follows from three rules: who administers it, who has to register, and what counts as an export.
It is a State Department rulebook
The ITAR implements the Arms Export Control Act. The State Department's Directorate of Defense Trade Controls (DDTC) administers it and controls the export of defense articles and defense services.
Source: 22 CFR 120.1Manufacturers register even if they never export
Anyone in the U.S. business of manufacturing, exporting or temporarily importing defense articles, or furnishing defense services, must register with DDTC. One occasion is enough to count as being in the business.
Source: 22 CFR 122.1(a)An export can happen in your own building
Releasing technical data to a foreign person inside the United States is a deemed export. It counts as an export to every country where that person holds citizenship or permanent residency.
Source: 22 CFR 120.50
Four things the rules control
If your company touches any of these, ITAR applies to that part of your business.
Defense articles
Items on the U.S. Munitions List, which is split into 21 categories. Category I covers firearms, Category II guns and armament, Category III ammunition.
Technical data
Information needed to design, build, operate, repair, test or modify a defense article, such as blueprints, drawings, photos and instructions (22 CFR 120.33). Public domain information and basic marketing material are excluded.
Defense services
Help given to foreign persons with defense articles, such as design, engineering, manufacturing, repair or training, in the United States or abroad.
Brokering
Arranging or negotiating the sale or transfer of defense articles or services for someone else. Brokers have their own registration and approval rules in part 129.
What compliance takes, day to day
ITAR puts the duty on your company. These are the obligations most manufacturers and exporters work through.
Classify what you make
Check each product and its technical data against the U.S. Munitions List. When it is unclear, DDTC answers through a commodity jurisdiction request (22 CFR 120.4).
Register with DDTC
Registration is renewed each year. New registrants pay a set fee of $3,000 a year (22 CFR 122.3). Registration alone grants no right to export (22 CFR 122.1(c)).
Authorize exports first
Get a license or use a listed exemption before any shipment, transfer of technical data or defense service, including releases to foreign persons on your own payroll.
Control who sees technical data
Limit drawings, specs and process data to people cleared to see them, in your ERP, file storage and chat as well as in filing cabinets. Most deemed exports happen here.
Keep records for five years
Registrants keep records of regulated manufacturing, exports and approvals for five years from the transaction or from when the license expires (22 CFR 122.5).
Report problems early
DDTC encourages voluntary disclosure of possible violations and may treat it as a mitigating factor. Not reporting counts against you (22 CFR 127.12).
Where technical data lives
Access control is where most deemed exports happen, and it lives in your systems. Constaris sets up and maintains ERP, file storage and team chat for FFL and defense companies.
ITAR compliant software
What ITAR asks of the systems that hold technical data, and the questions to put to any vendor.
Read the guide
ERP
Orders, inventory, manufacturing and records in one system, with access rules set once for every module.
See ERP
Cloud
Nextcloud file storage on servers you control, with role-based folders and activity logging.
See Cloud
Communications
Mattermost team chat on hosting you choose, with teams, channels and retention set up around ITAR.
See Communications
Common questions about ITAR compliance
What does ITAR compliant mean?
It means a company follows the International Traffic in Arms Regulations for the defense articles, technical data and services it handles. In practice that means it is registered with DDTC if required, gets approval before exports, controls foreign person access to technical data and keeps the required records.
Is there an ITAR certification?
No. The State Department does not certify companies, products or software as ITAR compliant. DDTC registration is a requirement, not a certificate, and the regulation states that registration does not confer any export rights or privileges (22 CFR 122.1(c)).
Do I need to register if I only manufacture and never export?
Usually yes. The regulation says a manufacturer of defense articles who does not export must still register (22 CFR 122.1(a)). Limited exemptions exist, for example for fabrication solely for experimental or scientific purposes.
Who counts as a U.S. person under ITAR?
U.S. citizens, lawful permanent residents and other protected individuals such as refugees and asylees, plus entities incorporated to do business in the United States and U.S. government bodies (22 CFR 120.62). Everyone else is a foreign person, including a foreign national employee working at your plant.
What are the penalties for ITAR violations?
Civil penalties can reach $1,271,078 per violation or twice the value of the transaction, whichever is greater, an amount adjusted for inflation each year (22 CFR 127.10). Willful violations are criminal, with fines up to $1,000,000 and up to 20 years in prison per violation (22 U.S.C. 2778(c)).
Does ITAR apply to FFLs?
It depends on what you make. Since March 9, 2020, most non-automatic and semi-automatic firearms up to .50 caliber are controlled by the Commerce Department instead, while fully automatic firearms, suppressors and related technical data remain under ITAR. Confirm your status with export counsel.
Sources
This guide explains the regulations in plain language. It is not legal advice. For decisions about your registration, classification or a specific export, talk to export counsel.
- 22 CFR 120.1, General authorities
- 22 CFR 120.4, Commodity jurisdiction
- 22 CFR 120.33, Technical data
- 22 CFR 120.50, Export
- 22 CFR 120.62, U.S. person
- 22 CFR 121.1, The U.S. Munitions List
- 22 CFR 122.1, Registration requirements
- 22 CFR 122.3, Registration fees
- 22 CFR 122.5, Maintenance of records
- 22 CFR 127.10, Civil penalty
- 22 CFR 127.12, Voluntary disclosures
- 22 U.S.C. 2778, Control of arms exports and imports
- Federal Register, USML Categories I, II and III (January 23, 2020)
Put ITAR controls into your systems
Tell us what you run today for ERP, files and chat. We'll follow up to set up a consultation and walk through where technical data could leak.
Book a consultation