ITAR and EAR Compliance: What Every Space Startup Needs to Know

If you're building, selling, or sharing space technology, there's a regulatory framework you absolutely cannot afford to get wrong: U.S. export controls. The International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR) govern what space-related technology, data, and services can be shared with foreign persons, and the penalties for violations can be devastating.

Fines of up to $1 million per violation under ITAR, criminal penalties including imprisonment, debarment from government contracting, and reputational damage that can kill a startup. Yet many space companies, especially early-stage startups, don't fully understand their obligations until it's too late.

This guide provides a practical overview of what space startups need to know. It is not legal advice; consult an export control attorney for your specific situation. But it will help you ask the right questions and avoid the most common mistakes.

ITAR vs. EAR: Understanding the Two Regimes

The U.S. has two primary export control regimes, administered by different agencies with different rules:

ITAR (International Traffic in Arms Regulations)

• Administered by the State Department's Directorate of Defense Trade Controls (DDTC)
• Governs items on the U.S. Munitions List (USML)
• Category IV of the USML covers "Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines"
• Category XV covers "Spacecraft and Related Articles"
• ITAR is strict liability: intent doesn't matter. If you share ITAR-controlled data with a foreign person without authorization, it's a violation
• Applies to both physical exports and "deemed exports" (sharing controlled data with foreign nationals inside the U.S.)

EAR (Export Administration Regulations)

• Administered by the Commerce Department's Bureau of Industry and Security (BIS)
• Governs items on the Commerce Control List (CCL) and EAR99 items
• Covers dual-use technology: items with both commercial and military applications
• Generally less restrictive than ITAR, with more license exceptions available
• Many commercial satellite components and earth observation technologies fall under EAR

Aspect	ITAR	EAR
Agency	State Dept (DDTC)	Commerce Dept (BIS)
Control list	USML (21 categories)	CCL (10 categories) + EAR99
Scope	Defense articles & services	Dual-use & commercial items
Default policy	Deny (must get license)	Varies by destination & item
Civil penalties	Up to $1M per violation	Up to $300K per violation
Criminal penalties	Up to $1M and 20 years	Up to $1M and 20 years
Registration	Required (DDTC)	Not required

What Space Technology Is Controlled?

The first step in compliance is determining classification: whether your item is on the USML (ITAR) or the CCL (EAR), and which specific category and subcategory applies.

Under ITAR, the following space items are typically controlled:

• Launch vehicles and their components, parts, and accessories
• Spacecraft designed for military or intelligence applications
• Radiation-hardened electronics designed for space
• Certain propulsion systems, guidance systems, and thermal protection systems
• Technical data related to the above (drawings, specifications, software source code)

Under the 2014 export control reform, many commercial satellite components were moved from the USML to the CCL, making them subject to the less restrictive EAR. This was a significant liberalization for commercial space companies, but critical items remain on the USML.

The key question: Is your technology "specially designed" for a military or intelligence application? If yes, it's likely ITAR. If it's a commercial item with potential dual-use applications, it's likely EAR. When in doubt, you can request a formal commodity jurisdiction (CJ) determination from DDTC.

Common Pitfalls for Space Startups

Based on enforcement actions and industry experience, these are the most frequent mistakes space startups make:

1. The "deemed export" trap. Sharing ITAR-controlled technical data with a foreign national employee or contractor, even inside the United States, constitutes a "deemed export" requiring prior authorization. If your engineering team includes non-U.S. citizens, you need a Technology Control Plan (TCP) that governs what information they can access.

2. Conference presentations and papers. Presenting technical details about controlled technology at conferences, even domestic ones attended by foreign nationals, can constitute an unauthorized export. Review all presentations and publications through your export compliance process.

3. Cloud storage and email. Storing ITAR-controlled data on cloud servers that may be physically located outside the U.S. (or accessible by foreign administrators) can constitute an export. Ensure your IT infrastructure meets ITAR requirements, not all cloud providers are compliant by default.

4. Fundamental research exemption misunderstanding. University research that is published openly qualifies for the fundamental research exemption. But the moment research is restricted by contract (e.g., a DoD-funded project with publication restrictions), the exemption no longer applies.

5. Not registering with DDTC. If you manufacture or export defense articles (including spacecraft components on the USML), you must register with DDTC. Registration is required even if you never actually export: it's based on what you manufacture.

Getting Started with Compliance

Here's a practical roadmap for space startups:

• Step 1: Classify your products. Determine whether each product, component, and dataset is ITAR-controlled, EAR-controlled, or EAR99 (no license required for most destinations). Engage an export control attorney or consultant for this critical step.
• Step 2: Register with DDTC if you manufacture or export USML items. Registration carries an annual fee (a few thousand dollars at the lowest tier; check DDTC's current fee schedule).
• Step 3: Develop an Export Compliance Management Program (ECMP). This includes written procedures, training, screening processes, and record-keeping. DDTC and BIS both publish guidance on effective compliance programs.
• Step 4: Screen all parties. Before any transaction with a foreign person or entity, screen them against the Consolidated Screening List (maintained by the U.S. government) for sanctioned parties, denied persons, and debarred entities.
• Step 5: Train your team. Everyone in your company, not just engineers, needs to understand export control basics. A sales team member promising technical data to a foreign customer can trigger a violation just as easily as an engineer sharing source code.
• Step 6: Implement technology controls. Restrict physical and digital access to controlled technology based on personnel authorization. Use access controls, encryption, and secure facilities as appropriate.

Resources and Further Reading

These authoritative resources can help you navigate export controls:

• DDTC website: Official ITAR guidance, USML text, and licensing information
• BIS website: EAR regulations, CCL, and license application guidance
• SIA (Satellite Industry Association): Publishes export control guides for the satellite industry
• CSIS (Center for Strategic and International Studies): Policy analysis on export control reform

For a deeper dive into compliance requirements specific to the space industry, visit our Regulatory & Compliance module and our detailed ITAR Compliance Guide.

Stay Compliant with SpaceNexus

SpaceNexus's Regulatory & Compliance module tracks export control regulations, licensing requirements, and enforcement actions relevant to space companies. Set up alerts for regulatory changes that affect your products, and access our compliance resources to keep your program current.

Create your free account and start building a compliant space business from day one.