# ITAR and EAR Checklist Before You Share CAD Files With AI

> Check whether your CAD files are export controlled before an AI company sees them: who classifies, ITAR vs EAR vs EAR99, deemed exports and what to exclude.

Canonical: https://origindatapartners.com/guides/itar-ear-checklist-cad-data-ai
By: Origin Data Partners
Status: Published
Published: 2026-11-13
Updated: 2026-11-14
Sources checked: 2026-11-12

## Quick answer

Classify every program before an AI vendor sees its CAD files: ITAR technical data, EAR technology with an ECCN, or EAR99. You classify them yourself, asking DDTC (commodity jurisdiction) or BIS (CCATS) when unsure. Leave controlled programs out, and confirm in writing who at the buyer can open the files: a foreign national seeing controlled data is a deemed export.

## Key points

- Your company classifies its own files; the regulators answer formal requests when you are unsure.
- ITAR technical data and EAR technology both include drawings, models and CAD files.
- Showing controlled data to a foreign national in the US, including at the buyer or its labelling vendor, is an export.

## How do I check whether my CAD files are export controlled before sharing them with an AI vendor?

Classify by program, not by file. Decide whether each product line's design data falls under the ITAR, under an EAR export control classification number (ECCN), or is EAR99; remove every controlled program; then agree in writing who at the buyer may open the rest. A printable version is at the end.

This page is general information, not legal advice. It quotes the regulations and the regulators' own pages; your export compliance lead or counsel decides how they apply to your files.

To see what the uncontrolled part of an archive could be worth first, [see what your data is worth](https://origindatapartners.com/check-fit) or run the [CAD archive calculator](https://origindatapartners.com/tools/cad-archive-value); no files are needed. What AI companies want from engineering data is in [licensing CAD files and engineering data](https://origindatapartners.com/guides/license-cad-engineering-data-ai).


## Who classifies the files: you, DDTC or BIS?

You do, first. The ITAR's order of review starts: "In order to classify an item on the USML, begin with a review of the general characteristics of the item." ([22 CFR 120.11](https://www.law.cornell.edu/cfr/text/22/120.11)). BIS lists three ways to find an ECCN: ask the manufacturer, self-classify, or request an official classification ([BIS](https://www.bis.gov/licensing/classify-your-item)).

| Situation | Who decides | How |
| --- | --- | --- |
| Commercial product, clearly not on the US Munitions List | Your company | Self-classify; record the ECCN or EAR99 and why |
| Unsure whether ITAR or EAR | DDTC | Commodity jurisdiction request, Form DS-4076 ([22 CFR 120.12](https://www.law.cornell.edu/cfr/text/22/120.12)) |
| EAR, but unsure which ECCN | BIS | Classification request through SNAP-R; BIS issues a "Commodity Classification Automated Tracking System (CCATS) number" ([15 CFR 748.3](https://www.law.cornell.edu/cfr/text/15/748.3)) |
| Defense program or defense contract work | Your company | Treat as ITAR and keep it out of a first package |

Inside the company, one named person, usually the export compliance lead, should sign off each program's classification, with that product's chief engineer confirming what its files contain.


## Are CAD files ITAR controlled? ITAR vs EAR vs EAR99

CAD files are controlled when the item they describe is. Under the ITAR, technical data is information required to design, build or maintain defense articles, and "This includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation" ([22 CFR 120.33](https://www.law.cornell.edu/cfr/text/22/120.33)). Under the EAR, technology can take the form of "engineering designs and specifications, computer-aided design files, manuals or documentation" ([15 CFR 772.1](https://www.law.cornell.edu/cfr/text/15/772.1)).

| Status | Agency and rule | What it means for CAD files | Can it go in a package? |
| --- | --- | --- | --- |
| ITAR technical data | State Department (DDTC), 22 CFR 120 to 130 | Design data and directly related software for an item on the US Munitions List | No; exporting it needs a DSP-5 license unless exempt ([22 CFR 125.2](https://www.law.cornell.edu/cfr/text/22/125.2)) |
| EAR technology with an ECCN | Commerce Department (BIS), 15 CFR 730 to 774 | Design and production data for an item on the Commerce Control List | Only after a license review covering the buyer's staff and storage countries |
| EAR99 | BIS | Subject to the EAR but not listed on the Commerce Control List ([15 CFR 734.3](https://www.law.cornell.edu/cfr/text/15/734.3)) | Usually; BIS says EAR99 items need no license "in most situations", unless the end user, end use or destination is of concern |
| Outside both | Exclusions | Published information, fundamental research, general engineering principles | Yes, but own designs rarely qualify |

An ECCN is five characters; "The second character of the ECCN is a letter from A through E that identifies the product group." ([BIS](https://www.bis.gov/licensing/classify-your-item)). EAR technology is information necessary to develop, produce or use an item ([15 CFR 772.1](https://www.law.cornell.edu/cfr/text/15/772.1)), so a drawing takes the classification of the item it builds.


## ITAR technical data and EAR technology: drawings, models, CAM programs and test data

Records linked to the geometry follow the item's status. Classification is still made per program.

| Record | Why it can be controlled | Check |
| --- | --- | --- |
| 2D drawings with tolerances and notes | Named in both definitions ("blueprints, drawings") | Classify with the part or assembly |
| Native 3D models and assemblies | The EAR names "computer-aided design files"; the ITAR covers information required for design and production | Classify with the product |
| CAM programs and toolpaths | Production information; ITAR technical data includes "Software (see § 120.40(g) ) directly related to defense articles" | Classify with the part machined, not the machine |
| Test reports and simulation results | Information required for testing, operation or modification | Classify with the product tested |
| Engineering change orders | "The modification of the design of an existing item creates a new item"; changes are design data for that item ([15 CFR 772.1](https://www.law.cornell.edu/cfr/text/15/772.1)) | Classify with the revised item |
| Marketing sheets and general descriptions | ITAR technical data "does not include basic marketing information on function or purpose or general system descriptions" | Usually outside; confirm per program |


## What gets excluded from a licensed CAD package, and how to separate it

Exclude whole programs, not single files: a controlled assembly pulls in shared parts, fixtures and test data. Build the package from an allow list of cleared programs, never from a vault export minus a block list.

| Separate by | How | What it catches |
| --- | --- | --- |
| Program or contract | Drop defense, government-funded and customer-owned programs first | ITAR work, controlled customer designs, government-rights data |
| Part number range | Filter on the numbering used for controlled programs | Shared parts reused from them |
| Markings | Search title blocks, file properties and PDFs for ITAR, EAR, ECCN and export notices | Files already marked as controlled |
| Vault folder | Export only from reviewed folders and PDM groups; check where-used for shared parts | Files stored in the wrong place |
| Classification record | Attach the signed program list to the package manifest | Gaps between review and export |

An example package manifest is on [the CAD licensing guide](https://origindatapartners.com/guides/license-cad-engineering-data-ai). Customer-owned designs are also an ownership question; see [client CAD files at design consultancies](https://origindatapartners.com/guides/product-design-consultancy-client-cad-files) and [contract manufacturers](https://origindatapartners.com/guides/contract-manufacturer-design-data-ai).


## Deemed export: when the AI company or its labelling vendor employs foreign nationals

A US buyer is not automatically safe. ITAR export includes "Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)", an export to every country of that person's citizenship or permanent residency ([22 CFR 120.50](https://www.law.cornell.edu/cfr/text/22/120.50)). The EAR rule is the same for controlled technology ([BIS](https://www.bis.gov/learn-support/deemed-exports); [15 CFR 734.13](https://www.law.cornell.edu/cfr/text/15/734.13)).

No download is needed: access that lets a foreign person "access, view, or possess unencrypted technical data" is a release ([22 CFR 120.56](https://www.law.cornell.edu/cfr/text/22/120.56)), and so are "Oral or written exchanges" ([15 CFR 734.15](https://www.law.cornell.edu/cfr/text/15/734.15)). Ask the buyer in writing, covering its labelling contractors too:

- Access: will only US persons be able to open the files?
- Storage: in which countries will files, copies, backups and training sets sit?
- Sub-processors: which outside companies touch the data, under the same limits?
- Onward transfer: are resale, sublicensing and transfer to affiliates abroad barred without your consent?
- Model outputs: who may use models trained on the data, and will they be kept from reproducing your designs?

The ITAR US person definition covers "a lawful permanent resident" or "a protected individual" ([22 CFR 120.62](https://www.law.cornell.edu/cfr/text/22/120.62)), and a protected individual includes anyone who "is a citizen or national of the United States" ([8 U.S.C. 1324b](https://www.law.cornell.edu/uscode/text/8/1324b)). Everyone else is a foreign person ([22 CFR 120.63](https://www.law.cornell.edu/cfr/text/22/120.63)).


## Can you use AI with ITAR data?

Only where no foreign person can see the unencrypted data without a license. The ITAR says sending or storing technical data is not an export when it is "Unclassified; (ii) Secured using end-to-end encryption", meets the encryption standards the rule sets, and is "Not intentionally sent to a person in or stored in a country proscribed in § 126.1" ([22 CFR 120.54](https://www.law.cornell.edu/cfr/text/22/120.54)). Training a model needs the data decrypted, so the question becomes who can access it then.

In practice, keep ITAR technical data out of AI data licensing. EAR-controlled programs need a license review covering every person and country with access; EAR99 programs are the usual scope.


## The fundamental research exclusion and published information: why your own CAD rarely qualifies

Both rules exclude public information. Under the EAR, technology is published "when it has been made available to the public without restrictions upon its further dissemination" ([15 CFR 734.7](https://www.law.cornell.edu/cfr/text/15/734.7)), and fundamental research is research whose results are ordinarily published and "for which the researchers have not accepted restrictions for proprietary or national security reasons." ([15 CFR 734.8](https://www.law.cornell.edu/cfr/text/15/734.8)). The ITAR's public domain rule matches ([22 CFR 120.34](https://www.law.cornell.edu/cfr/text/22/120.34)).

A company's own models, drawings and test data are proprietary and unpublished, which is why AI buyers want them and why these exclusions rarely apply. A paper or patent about a product does not make its CAD public.


## Export controls outside the US: UK, EU, Canada, Australia and India

Companies outside the US run the same check under their own regime. Each regime below controls technology, not only goods.

| Country | Regime | What the regulator says | Source |
| --- | --- | --- | --- |
| United Kingdom | Export Control Order 2008; UK Strategic Export Control Lists | Covers "goods, software or technology (including data, information and technical assistance)" | [GOV.UK](https://www.gov.uk/guidance/uk-strategic-export-controls) |
| European Union | Dual-Use Regulation (EU) 2021/821 | "Dual-use items are goods, software and technology that can be used for both civilian and military applications." | [European Commission](https://policy.trade.ec.europa.eu/help-exporters-and-importers/exporting-dual-use-items_en) |
| Canada | Export and Import Permits Act; Export Control List | Controls "the electronic transfer of technology contained on the ECL" | [Global Affairs Canada](https://www.international.gc.ca/controls-controles/notices_avis/exp/list_liste/151.aspx?lang=eng) |
| Australia | Defence Trade Controls Act 2012; Defence and Strategic Goods List (DSGL) | Controls "intangible goods and technology" on the DSGL, including supply "to non exempt foreign persons within Australia" | [Defence](https://www.defence.gov.au/business-industry/exporting/export-controls-framework/legislation); [Defence](https://www.defence.gov.au/business-industry/exporting/export-controls-framework/changes-export-controls) |
| India | SCOMET list | Software and technology on the list need "an export authorisation" | [DGFT](https://content.dgft.gov.in/Website/dgftprod/897c5d3d-2f16-4fad-bc3d-2362b46770ca/HBP2023%20Chapter10%20as%20on%2005062025.pdf) |

Australia waives permits "for most military and dual-use goods and technology transferred between Australia, the United Kingdom and United States" ([Australian Department of Defence](https://www.defence.gov.au/business-industry/exporting/export-controls-framework/changes-export-controls)); that does not settle who at the buyer can see the files.


## Penalties for getting it wrong

They are high under both regimes. A willful ITAR violation can bring a fine of "not more than $1,000,000 or imprisoned not more than 20 years, or both" per violation ([22 U.S.C. 2778](https://www.law.cornell.edu/uscode/text/22/2778)), and civil penalties up to "the greater of $1,271,078 or the amount that is twice the value of the transaction" ([22 CFR 127.10](https://www.law.cornell.edu/cfr/text/22/127.10)). The Export Control Reform Act sets the same criminal ceiling for EAR violations and civil fines of "not more than $300,000 or an amount that is twice the value of the transaction" in the statute ([50 U.S.C. 4819](https://www.law.cornell.edu/uscode/text/50/4819)).


## Printable checklist: before CAD files go to an AI company

Work through these in order and keep the record with the license.

- 1. List every program in the vault with its customer and contract type; drop customer-owned designs and defense or government work.
- 2. Pick the programs the company owns outright as candidates.
- 3. Classify each remaining program: ITAR, EAR with an ECCN, or EAR99. Write down the reasoning.
- 4. Where unsure of ITAR or EAR, file a commodity jurisdiction request (DS-4076) with DDTC; where unsure of the ECCN, request a BIS classification (CCATS) through SNAP-R.
- 5. Have the export compliance lead sign the program list; have each program's chief engineer confirm what its files contain.
- 6. Build the package from cleared programs only; filter by part number, markings and vault folder, and check where-used for shared parts.
- 7. Get the buyer's written answers on US-person access, storage countries, sub-processors and labelling vendors, onward transfer and model outputs.
- 8. Put those answers in the license as obligations, with notice and audit rights; re-check when the buyer adds a vendor or asks for more programs.


## Next step

[Licensing CAD files and engineering data](https://origindatapartners.com/guides/license-cad-engineering-data-ai) covers what buyers ask for; [the data licensing agreement guide](https://origindatapartners.com/guides/data-licensing-agreement) covers contract terms. Does your company hold records like these? [See what your data is worth](https://origindatapartners.com/check-fit).


## Questions and answers

### How do I check whether my CAD files are export controlled before sharing them with an AI vendor?

Classify each program before anything is shared: ITAR technical data, EAR technology with an ECCN, or EAR99. Your company does this itself; ask DDTC for a commodity jurisdiction determination or BIS for a classification when unsure. Remove controlled programs, then get the buyer's written commitments on who can access the files and where they are stored.

### Are CAD files ITAR controlled?

Only when they describe an item on the US Munitions List. ITAR technical data includes information "in the form of blueprints, drawings, photographs, plans, instructions, or documentation" required to design or build defense articles. CAD for commercial products is usually under the EAR instead, either with an ECCN or as EAR99.

### What does EAR99 mean for my engineering data?

EAR99 covers items subject to the EAR that are not listed on the Commerce Control List. BIS says EAR99 items need no license for export in most situations, but may need one for a prohibited or restricted end user, end use or destination.

### What is a deemed export?

A deemed export is the release of controlled technical data or technology to a foreign person inside the United States. Under the ITAR it counts as an export to every country where that person holds or held citizenship or permanent residency. Letting a foreign national employee of an AI company or its labelling vendor open controlled files can be one.

### What is the ITAR US person definition?

Under the ITAR, a US person is a lawful permanent resident or a protected individual, a term that includes US citizens and nationals. Companies incorporated to do business in the US are US persons too. Everyone else is a foreign person, and a foreign national does not become a US person by working for a US company, so check the people, not the employer.

### When should I file a commodity jurisdiction request or a CCATS request?

File a commodity jurisdiction request (Form DS-4076) with DDTC when you cannot tell whether an item is on the US Munitions List. File a classification request with BIS through SNAP-R, which returns a CCATS number, when you know an item is under the EAR but not which ECCN applies. Either can take time, so start before a buyer conversation.

### Does a manufacturer that never exports still have to register under the ITAR?

Yes. Anyone in the United States in the business of manufacturing or exporting defense articles, or furnishing defense services, must register with the Directorate of Defense Trade Controls, and "A manufacturer who does not engage in exporting must nevertheless register." One occasion of manufacturing a defense article is enough to count as being in that business. A company whose business is confined to producing unclassified technical data is exempt from this registration requirement.

### What does the ITAR actually control?

Mainly the defense articles, defense services and related technical data designated on the U.S. Munitions List in 22 CFR part 121. Each USML category usually lists end items, then systems, then parts and components, then the technical data and defense services directly related to them. Technical data directly related to making an item marked as Significant Military Equipment is itself Significant Military Equipment, which matters when you decide which drawings to exclude.

## Sources

- [22 CFR 120.11: ITAR order of review](https://www.law.cornell.edu/cfr/text/22/120.11)
- [22 CFR 120.12: commodity jurisdiction determination requests](https://www.law.cornell.edu/cfr/text/22/120.12)
- [22 CFR 120.33: ITAR definition of technical data](https://www.law.cornell.edu/cfr/text/22/120.33)
- [22 CFR 120.34: ITAR public domain and fundamental research](https://www.law.cornell.edu/cfr/text/22/120.34)
- [22 CFR 120.50: ITAR definition of export, including deemed export](https://www.law.cornell.edu/cfr/text/22/120.50)
- [22 CFR 120.54: activities that are not exports (end-to-end encryption)](https://www.law.cornell.edu/cfr/text/22/120.54)
- [22 CFR 120.56: ITAR definition of release](https://www.law.cornell.edu/cfr/text/22/120.56)
- [22 CFR 120.62: ITAR definition of U.S. person](https://www.law.cornell.edu/cfr/text/22/120.62)
- [22 CFR 120.63: ITAR definition of foreign person](https://www.law.cornell.edu/cfr/text/22/120.63)
- [8 U.S.C. 1324b(a)(3): definition of protected individual](https://www.law.cornell.edu/uscode/text/8/1324b)
- [22 CFR 125.2: exports of unclassified technical data (DSP-5)](https://www.law.cornell.edu/cfr/text/22/125.2)
- [22 CFR 127.10: ITAR civil penalty](https://www.law.cornell.edu/cfr/text/22/127.10)
- [22 U.S.C. 2778: Arms Export Control Act, criminal penalties](https://www.law.cornell.edu/uscode/text/22/2778)
- [15 CFR 734.3: items subject to the EAR, including EAR99](https://www.law.cornell.edu/cfr/text/15/734.3)
- [15 CFR 734.7: published information](https://www.law.cornell.edu/cfr/text/15/734.7)
- [15 CFR 734.8: fundamental research under the EAR](https://www.law.cornell.edu/cfr/text/15/734.8)
- [15 CFR 734.13: EAR definition of export, including deemed export](https://www.law.cornell.edu/cfr/text/15/734.13)
- [15 CFR 734.15: EAR definition of release](https://www.law.cornell.edu/cfr/text/15/734.15)
- [15 CFR 748.3: classification requests and CCATS numbers](https://www.law.cornell.edu/cfr/text/15/748.3)
- [15 CFR 772.1: EAR definition of technology](https://www.law.cornell.edu/cfr/text/15/772.1)
- [BIS: Classify your item (ECCN, self-classification, EAR99)](https://www.bis.gov/licensing/classify-your-item)
- [BIS: Deemed exports](https://www.bis.gov/learn-support/deemed-exports)
- [US State Department, Directorate of Defense Trade Controls](https://www.pmddtc.state.gov/)
- [50 U.S.C. 4819: Export Control Reform Act, penalties](https://www.law.cornell.edu/uscode/text/50/4819)
- [GOV.UK: UK strategic export controls](https://www.gov.uk/guidance/uk-strategic-export-controls)
- [European Commission: Exporting dual-use items (Regulation (EU) 2021/821)](https://policy.trade.ec.europa.eu/help-exporters-and-importers/exporting-dual-use-items_en)
- [Global Affairs Canada: Export and Import Permits Act, controls on technology transfer (Notice 151)](https://www.international.gc.ca/controls-controles/notices_avis/exp/list_liste/151.aspx?lang=eng)
- [Australian Department of Defence: export controls legislation (Defence Trade Controls Act 2012, DSGL)](https://www.defence.gov.au/business-industry/exporting/export-controls-framework/legislation)
- [Australian Department of Defence: changes to export controls (section 10A)](https://www.defence.gov.au/business-industry/exporting/export-controls-framework/changes-export-controls)
- [DGFT India: Handbook of Procedures, Chapter 10, SCOMET](https://content.dgft.gov.in/Website/dgftprod/897c5d3d-2f16-4fad-bc3d-2362b46770ca/HBP2023%20Chapter10%20as%20on%2005062025.pdf)
- [eCFR: 22 CFR 122.1, ITAR registration requirements](https://www.ecfr.gov/current/title-22/section-122.1)
- [eCFR: 22 CFR 120.10, introduction to the U.S. Munitions List](https://www.ecfr.gov/current/title-22/section-120.10)

## Related reading

- [Licensing CAD files and engineering data to AI companies](https://origindatapartners.com/guides/license-cad-engineering-data-ai)
- [/check-fit](https://origindatapartners.com/check-fit)
- [/tools/cad-archive-value](https://origindatapartners.com/tools/cad-archive-value)
- [Data licensing agreement: what to include](https://origindatapartners.com/guides/data-licensing-agreement)
- [Who Owns CAD Files: the Design Consultancy or the Client?](https://origindatapartners.com/guides/product-design-consultancy-client-cad-files)
- [Who Owns Contract Manufacturer Tooling and Process Data?](https://origindatapartners.com/guides/contract-manufacturer-design-data-ai)
- [Drone and EV Engineering Data for AI: CAD and Test Logs](https://origindatapartners.com/guides/drone-ev-engineering-data-ai)
- [/who-we-help/manufacturers](https://origindatapartners.com/who-we-help/manufacturers)
- [Chip Design Data for AI: What Design Firms Can License](https://origindatapartners.com/guides/chip-design-firm-data)
- [CAD Data and Quality Records for AI: Manufacturer Guide](https://origindatapartners.com/guides/engineered-product-manufacturer-data)