ITAR and EAR Checklist Before You Share CAD Files With AI

How do I check whether my CAD files are export controlled before sharing them with an AI vendor?

Classify by program, not by file. Decide whether each product line's design data falls under the ITAR, under an EAR export control classification number (ECCN), or is EAR99; remove every controlled program; then agree in writing who at the buyer may open the rest. A printable version is at the end.

This page is general information, not legal advice. It quotes the regulations and the regulators' own pages; your export compliance lead or counsel decides how they apply to your files.

To see what the uncontrolled part of an archive could be worth first, see what your data is worth or run the CAD archive calculator; no files are needed. What AI companies want from engineering data is in licensing CAD files and engineering data.

Who classifies the files: you, DDTC or BIS?

You do, first. The ITAR's order of review starts: "In order to classify an item on the USML, begin with a review of the general characteristics of the item." (22 CFR 120.11). BIS lists three ways to find an ECCN: ask the manufacturer, self-classify, or request an official classification (BIS).

Inside the company, one named person, usually the export compliance lead, should sign off each program's classification, with that product's chief engineer confirming what its files contain.

Are CAD files ITAR controlled? ITAR vs EAR vs EAR99

CAD files are controlled when the item they describe is. Under the ITAR, technical data is information required to design, build or maintain defense articles, and "This includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation" (22 CFR 120.33). Under the EAR, technology can take the form of "engineering designs and specifications, computer-aided design files, manuals or documentation" (15 CFR 772.1).

An ECCN is five characters; "The second character of the ECCN is a letter from A through E that identifies the product group." (BIS). EAR technology is information necessary to develop, produce or use an item (15 CFR 772.1), so a drawing takes the classification of the item it builds.

ITAR technical data and EAR technology: drawings, models, CAM programs and test data

Records linked to the geometry follow the item's status. Classification is still made per program.

What gets excluded from a licensed CAD package, and how to separate it

Exclude whole programs, not single files: a controlled assembly pulls in shared parts, fixtures and test data. Build the package from an allow list of cleared programs, never from a vault export minus a block list.

An example package manifest is on the CAD licensing guide. Customer-owned designs are also an ownership question; see client CAD files at design consultancies and contract manufacturers.

Deemed export: when the AI company or its labelling vendor employs foreign nationals

A US buyer is not automatically safe. ITAR export includes "Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)", an export to every country of that person's citizenship or permanent residency (22 CFR 120.50). The EAR rule is the same for controlled technology (BIS; 15 CFR 734.13).

No download is needed: access that lets a foreign person "access, view, or possess unencrypted technical data" is a release (22 CFR 120.56), and so are "Oral or written exchanges" (15 CFR 734.15). Ask the buyer in writing, covering its labelling contractors too:

• Access: will only US persons be able to open the files?
• Storage: in which countries will files, copies, backups and training sets sit?
• Sub-processors: which outside companies touch the data, under the same limits?
• Onward transfer: are resale, sublicensing and transfer to affiliates abroad barred without your consent?
• Model outputs: who may use models trained on the data, and will they be kept from reproducing your designs?

The ITAR US person definition covers "a lawful permanent resident" or "a protected individual" (22 CFR 120.62), and a protected individual includes anyone who "is a citizen or national of the United States" (8 U.S.C. 1324b). Everyone else is a foreign person (22 CFR 120.63).

Can you use AI with ITAR data?

Only where no foreign person can see the unencrypted data without a license. The ITAR says sending or storing technical data is not an export when it is "Unclassified; (ii) Secured using end-to-end encryption", meets the encryption standards the rule sets, and is "Not intentionally sent to a person in or stored in a country proscribed in § 126.1" (22 CFR 120.54). Training a model needs the data decrypted, so the question becomes who can access it then.

In practice, keep ITAR technical data out of AI data licensing. EAR-controlled programs need a license review covering every person and country with access; EAR99 programs are the usual scope.

The fundamental research exclusion and published information: why your own CAD rarely qualifies

Both rules exclude public information. Under the EAR, technology is published "when it has been made available to the public without restrictions upon its further dissemination" (15 CFR 734.7), and fundamental research is research whose results are ordinarily published and "for which the researchers have not accepted restrictions for proprietary or national security reasons." (15 CFR 734.8). The ITAR's public domain rule matches (22 CFR 120.34).

A company's own models, drawings and test data are proprietary and unpublished, which is why AI buyers want them and why these exclusions rarely apply. A paper or patent about a product does not make its CAD public.

Export controls outside the US: UK, EU, Canada, Australia and India

Companies outside the US run the same check under their own regime. Each regime below controls technology, not only goods.

Australia waives permits "for most military and dual-use goods and technology transferred between Australia, the United Kingdom and United States" (Australian Department of Defence); that does not settle who at the buyer can see the files.

Penalties for getting it wrong

They are high under both regimes. A willful ITAR violation can bring a fine of "not more than $1,000,000 or imprisoned not more than 20 years, or both" per violation (22 U.S.C. 2778), and civil penalties up to "the greater of $1,271,078 or the amount that is twice the value of the transaction" (22 CFR 127.10). The Export Control Reform Act sets the same criminal ceiling for EAR violations and civil fines of "not more than $300,000 or an amount that is twice the value of the transaction" in the statute (50 U.S.C. 4819).

Printable checklist: before CAD files go to an AI company

Work through these in order and keep the record with the license.

• 1. List every program in the vault with its customer and contract type; drop customer-owned designs and defense or government work.
• 2. Pick the programs the company owns outright as candidates.
• 3. Classify each remaining program: ITAR, EAR with an ECCN, or EAR99. Write down the reasoning.
• 4. Where unsure of ITAR or EAR, file a commodity jurisdiction request (DS-4076) with DDTC; where unsure of the ECCN, request a BIS classification (CCATS) through SNAP-R.
• 5. Have the export compliance lead sign the program list; have each program's chief engineer confirm what its files contain.
• 6. Build the package from cleared programs only; filter by part number, markings and vault folder, and check where-used for shared parts.
• 7. Get the buyer's written answers on US-person access, storage countries, sub-processors and labelling vendors, onward transfer and model outputs.
• 8. Put those answers in the license as obligations, with notice and audit rights; re-check when the buyer adds a vendor or asks for more programs.

Next step

Licensing CAD files and engineering data covers what buyers ask for; the data licensing agreement guide covers contract terms. Does your company hold records like these? See what your data is worth.