For space companies working across borders, one wrong move with a satellite part, a software file, or even a technical drawing can trigger a federal investigation, massive fines, or worse - losing your ability to do business altogether. Two U.S. regulations, ITAR and EAR, are the gatekeepers of what can leave the country, and they’re not optional. They’re mandatory. And as of 2026, the rules have changed - again.
What’s the difference between ITAR and EAR?
Think of ITAR and EAR as two different security doors leading out of the U.S. One is a vault. The other is a checkpoint with varying levels of scrutiny.
ITAR is the International Traffic in Arms Regulations, managed by the U.S. Department of State’s Directorate of Defense Trade Controls (DDTC). It controls items specifically designed for military use - things like rocket engines for ICBMs, satellite imaging systems for reconnaissance, or guidance systems for missiles. If it’s on the U.S. Munitions List (USML), it’s ITAR. And once it’s ITAR, it’s locked down. No exceptions. Not even for allies.
EAR is the Export Administration Regulations, run by the Bureau of Industry and Security (BIS) under the Commerce Department. It covers dual-use items - things that can be used for civilian and military purposes. Think GPS chips, high-speed data processors, or advanced composite materials used in both commercial satellites and military drones. These are listed on the Commerce Control List (CCL) and assigned an ECCN - an Export Control Classification Number.
The key? You can’t have both. An item is either ITAR or EAR. Never both. Getting this wrong means you’re breaking the law before you even ship anything.
Why does this matter for space companies?
Space companies aren’t just launching rockets. They’re building global supply chains. A sensor made in Germany might end up in a satellite built in Texas. A software update for a launch control system might be sent to a partner in Japan. Every transfer - even an email - could be an export.
Here’s the real problem: many space startups assume their tech is "just commercial." But if that satellite has a camera that can resolve objects smaller than 30 centimeters from orbit, it’s likely ITAR-controlled. If it uses a processor that runs at 10 teraflops, it’s probably EAR-controlled. And if you don’t know which, you’re already in violation.
Before 2024, nearly every satellite component fell under ITAR. That made international collaboration nearly impossible. Now? A major shift happened.
What changed in 2024-2025?
The U.S. government realized its own rules were strangling innovation. So in late 2024, the EAR Interim Final Rule came in - and it changed everything for space.
- License exceptions expanded: Exports of certain space items to the 40 Wassenaar countries (including Canada, Japan, Australia, and most of Europe) no longer require licenses - if they’re under the new ECCN 9A515.x and 9A004.v, .x, .s. This covers things like commercial communications satellites, non-sensitive ground station tech, and lower-tier propulsion systems.
- New ECCN 9A515.w: This was created to catch items that are still too sensitive to be eased. If your tech used to be under 9A515.x but still poses a risk, it’s now under 9A515.w - and still needs a license.
- License Exception CSA: Proposed in 2025, this new exception allows U.S. companies to export certain space-related tech without a license - if it’s for civil purposes. Think space tourism, scientific research, or commercial launch services. As long as it’s not military, and you’re not sending it to a banned country, you’re covered.
ITAR didn’t sit still either. Categories IV and XV - which cover spacecraft and launch systems - were revised to move some items from ITAR to EAR. That means fewer companies now need DDTC approval just to talk to their international partners.
But don’t celebrate yet
Just because some rules got looser doesn’t mean compliance got easier. In fact, it got more complex.
Now you have to:
- Classify every component - not just the final product
- Track which ECCN applies to each part
- Know if your customer is in a Wassenaar country
- Verify if your tech is truly "civilian" under CSA
- Update your internal documentation every time the CCL or USML changes
And if you’re working with the U.S. government? You’re now also under CMMC Level 2.
CMMC Level 2 is the Cybersecurity Maturity Model Certification Level 2, required for any company handling Controlled Unclassified Information (CUI), which includes ITAR and EAR data. As of November 10, 2025, the Department of Defense enforces this. If you store, process, or transmit export-controlled data - even as a subcontractor - you must be audited by a C3PAO and prove you meet NIST SP 800-171 standards. No certification? No contracts.
What do you need to do right now?
Compliance isn’t a one-time project. It’s a system. Here’s what every space company must build:
- Item Classification: Run every part, software, and technical document through the Order of Review: Check USML first. If it’s not there, check the CCL. If it’s not on either, it’s not controlled. But don’t guess - use official BIS and DDTC classification tools.
- End-User Screening: Use the BIS Entity List and DDTC’s Debarred Parties List. If your customer is on either, stop. No exceptions. Even if they’re a university.
- License Management: Track every license application. Keep copies. Know the processing time - DDTC can take 60-90 days. BIS is faster, but still not instant.
- Training: Every employee who handles tech, emails, or export documents needs annual training. Not just legal. Engineers, project managers, even HR.
- Record Keeping: You must keep records for five years. Not "maybe." Five years. And they must be accessible for audit.
And if you’re unsure? Hire a specialist. Don’t rely on your in-house legal team. Export control is a niche field. Most lawyers don’t understand ECCNs. You need someone who’s done this before.
What happens if you mess up?
Penalties aren’t just fines. They’re existential.
- ITAR violations: Up to $1 million per violation, 20 years in prison, and debarment from U.S. government contracts.
- EAR violations: Up to $300,000 per violation or twice the value of the transaction, whichever is higher. Debarment. Criminal charges.
And it’s not just about money. Your reputation is gone. Investors pull out. Partners walk away. And if you’re working with NASA or the DoD? Your contract is terminated. No second chances.
Final thought: Compliance is your competitive advantage
Most companies see export controls as a cost. The smart ones see them as a filter.
If you’ve built a system that handles ITAR and EAR correctly, you’re not just compliant - you’re trustworthy. You’re the company that can work with European partners. You’re the one that gets priority on U.S. government bids. You’re the one that can scale.
The space industry is growing. But only those who understand the rules will be left standing.
Are ITAR and EAR only for U.S. companies?
No. Any company - anywhere in the world - that uses U.S.-origin technology, software, or components must comply. That includes European satellite manufacturers, Australian launch providers, or Japanese component suppliers. If your product contains even a single U.S.-made chip or uses U.S. technical data, it’s subject to U.S. export laws. Ignorance isn’t a defense.
Can I export space tech to allies without a license?
Sometimes. Since late 2024, exports of certain lower-sensitivity space items to the 40 Wassenaar countries (like Canada, Japan, Germany, Australia) no longer require a license - if they fall under the new ECCN categories (9A515.x, 9A004.v, .x, .s). But if your item is on the new 9A515.w list, or if the end-user is military, you still need a license. Always check the latest CCL.
What’s the difference between a license exception and a license?
A license is a formal approval from DDTC or BIS to export a controlled item. A license exception is a pre-approved permission to export without applying for a license - but only if you meet strict conditions. For example, License Exception CSA allows exports for civil space activities without a license, but you must document the purpose, end-user, and ensure no military use. You still need to comply with all other rules.
Do I need CMMC Level 2 if I’m not working with the DoD?
Yes - if you handle ITAR or EAR-controlled information. CMMC Level 2 applies to any company that stores, processes, or transmits Controlled Unclassified Information (CUI), regardless of whether you have a DoD contract. If your satellite software is ITAR-controlled, and you email it to a partner, you’re handling CUI. You need CMMC Level 2 certification by law as of November 2025.
How often do ITAR and EAR rules change?
Constantly. The U.S. government updates the USML and CCL at least twice a year. Major changes - like the 2024-2025 space rule revisions - happen every 1-2 years. Companies that rely on outdated checklists are already non-compliant. Subscribe to BIS and DDTC updates. Set up alerts. Review your classification every quarter.
11 Responses
So let me get this straight if your satellite has a chip made in Texas you cant even email a schematic to your cousin in Berlin without a 90 day wait
Oh sweetie you think this is hard try working with ITAR when you dont even have a compliance officer just some intern who Googled "ECCN" last week
Compliance is your competitive advantage lol
More like compliance is your tax on being American
Meanwhile China just builds satellites in their garage and laughs at our paperwork
Hey everyone I just wanted to share a quick win from our team
We built a simple internal tool that auto-checks every component against the latest CCL and USML
It pulls from official BIS feeds daily so we never miss a change
Even our engineers use it now to tag parts before they even start designing
It saved us from a near-miss last quarter when a German supplier sent us a sensor we thought was EAR but turned out to be 9A515.w
Just a little automation goes a long way
And yes it was built on Google Sheets at first
Now its a proper web app but the heart is still the same
You dont need fancy software you just need to care enough to track it
Start small
Document everything
Train your team like theyre about to go to space
bro i just export stuff to usa and they ask for 12 forms
why do they make it so hard
we just want to sell our antennas
Stop coddling foreign entities
ITAR exists because America built this tech
If you cant handle the rules go build rockets in Russia
Every license exception is a betrayal
Our innovation is not a gift
Its our birthright
And we dont hand it out like candy
Let me tell you about the time I had to classify a single resistor
It was a 10k ohm 0805 SMD from a US-based supplier
It was used in a ground station receiver for a commercial weather satellite
But the resistor had a trace of tantalum
And tantalum is on the CCL
So I had to dig into the supplier's MSDS
Then cross-reference it with ECCN 1A007.b
Then check if the end-user was on the Entity List
Then verify the final destination was not in a restricted zone
And all this for a resistor that cost 12 cents
I cried
Not because of the work
But because I realized we are now a civilization that polices electronic components like they are nuclear warheads
For anyone feeling overwhelmed
Start with your most common export
Classify it
Document the process
Train one person
Then expand
Compliance isn't about being perfect
Its about being consistent
You don't need to know every ECCN
Just know where to find the answer
And keep a paper trail
That's all they ask for
And if you're still stuck
Find a mentor
There are so many of us out here who've been there
Just had a call with our Japanese partner
They said their engineers are now taking export control training
Not because they have to
But because they respect how seriously we take it
That's the quiet win
People notice when you play by the rules
And they want to work with you
Wait so if I use a US-made processor in a satellite built in India do I need a license even if the satellite is never sold in the US
Or is it just about the origin
Just fixed a typo in the CCL document I downloaded
Turns out the BIS site had a missing period in ECCN 9A515.x
That caused our system to flag 3 components incorrectly
So now I have a script that checks for punctuation errors in export docs
Because if the government can't spell
How are we supposed to comply