ITAR / EAR (Export Controls)

The International Traffic in Arms Regulations and Export Administration Regulations govern the export of defense and dual-use technology, including some AI systems and the data they process.

What ITAR and EAR cover

ITAR (22 CFR 120-130, State Department) controls defense articles and services on the United States Munitions List. EAR (15 CFR 730-774, Commerce Department / BIS) controls dual-use items on the Commerce Control List. Together they restrict who can access, see, or use covered technology — including non-US persons working at a covered entity, regardless of physical location.

AI in scope

ITAR and EAR have expanded to AI on multiple fronts. The Oct 2022 BIS rule (and Oct 2023 update) restricts export of advanced AI chips and the manufacturing equipment to make them. Specific AI systems — facial recognition for sale to certain end users, autonomous-vehicle perception for military application — fall under ITAR USML Category XI. AI vendors handling defense-customer data or training on controlled technical data must comply.

Procurement implications

For AI vendors selling into US defense or aerospace: do you maintain ITAR-restricted compute infrastructure (US-persons-only access, restricted geographic boundary), what is your screening process for foreign nationals on engineering teams, do you offer an ITAR-compliant deployment option separate from your commercial cloud, and what is your incident response if controlled data is suspected to have flowed to an unauthorized recipient.