ITAR Compliance Guide for Space Companies

The International Traffic in Arms Regulations (ITAR) represent one of the most significant regulatory challenges facing space companies, particularly those engaged in international business or employing non-U.S. persons. ITAR controls the export of defense articles, defense services, and related technical data listed on the United States Munitions List (USML), which includes a wide range of spacecraft, launch vehicles, and related technologies.

For space companies, ITAR compliance is not optional. Violations carry severe penalties, including criminal fines of up to $1,000,000 per violation, imprisonment of up to 20 years (22 U.S.C. 2778(c)), and debarment from defense trade. Even inadvertent violations, such as sharing controlled technical data with a foreign national at a conference or via an unsecured email, can trigger enforcement actions.

This guide provides a comprehensive overview of the ITAR framework as it applies to space companies: what is controlled, who must comply, how the licensing process works, the distinction between ITAR and EAR (Export Administration Regulations), common compliance pitfalls, and best practices for building a robust internal compliance program. It is designed for compliance officers, engineering managers, business development professionals, and executives at space companies who need to understand the regulatory landscape.

The International Traffic in Arms Regulations (ITAR), codified at 22 CFR Parts 120-130, derive from section 38 of the Arms Export Control Act (AECA, 22 U.S.C. 2778). ITAR is administered by the Directorate of Defense Trade Controls (DDTC) within the U.S. Department of State's Bureau of Political-Military Affairs.

ITAR controls three categories of items and activities:

A critical concept in ITAR is the "deemed export" rule. Releasing ITAR-controlled technical data to a foreign person, even inside the United States, is an export (22 CFR 120.50(a)(2)). This has profound implications for hiring, conference participation, facility access, and IT security at space companies. A foreign national engineer working at a U.S. space company cannot access ITAR-controlled data without proper authorization, whatever their employment status or physical location.

The USML is organized into 21 categories. Space-related items appear primarily in categories IV (Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines), XI (Military Electronics), and XV (Spacecraft and Related Articles).

Category IV: Launch Vehicles & Missiles

Category IV covers rockets, space launch vehicles (SLVs) and missiles, and their major components, including rocket engines, guidance systems, and re-entry vehicles. Category IV(a) enumerates rockets and SLVs of every size, from those able to deliver at least 500 kg to a range of 300 km down to the smallest (22 CFR 121.1). Because the same technology that puts satellites in orbit can deliver warheads, launch vehicles themselves remain on the USML.

Key controlled items include complete launch vehicles and SLVs, liquid and solid rocket engines with certain performance thresholds, guidance and navigation systems, thrust vector control systems, staging mechanisms, and associated software and technical data.

Category XV: Spacecraft & Related Articles

Category XV was rewritten as part of export control reform; the revised category took effect on November 10, 2014 (79 FR 27180). It lists the spacecraft that stay on the USML and sends the rest to the Commerce Control List (CCL) under EAR jurisdiction.

Under Category XV(a), spacecraft stay on the USML when they, among other things:

• Detect nuclear detonations or conduct signals or measurement-and-signature intelligence
• Autonomously detect and track moving ground, air, missile or space objects in real time
• Have remote-sensing capabilities above set thresholds (for example, visible or infrared optics with a clear aperture greater than 0.50 m)
• Provide positioning, navigation and timing signals, or autonomously perform collision avoidance
• Are specially designed to inspect, survey or service another spacecraft (spacecraft that dock only through the NASA Docking System are under the EAR)
• Are anti-satellite, carry space-to-ground weapons, or are classified

Spacecraft not identified in Category XV(a) are subject to the EAR (ECCNs 9A004 and 9A515), which covers many commercial communication satellites, lower-capability remote sensing satellites and commercial spacecraft components. Companies must still determine the jurisdiction and classification of each item, and Category XV(i) keeps some services under ITAR whatever the satellite's jurisdiction, such as helping a foreign person integrate a satellite with a launch vehicle (22 CFR 121.1).

Category XI: Military Electronics

Category XI controls certain electronic equipment and components with military applications, including some space-qualified electronics, radiation-hardened components, and certain types of sensors. Space companies should review this category carefully, particularly those developing payloads, sensors, or electronic subsystems.

Track USML and regulatory changes on SpaceNexus Compliance Hub

ITAR compliance requirements extend broadly across the space industry supply chain. The following types of entities are typically subject to ITAR:

Importantly, ITAR obligations apply regardless of company size. A two-person startup designing a novel propulsion system is subject to the same regulatory framework as Lockheed Martin. Many space startups discover ITAR compliance requirements for the first time when they attempt to hire foreign national employees, attend international conferences, or engage with non-U.S. customers or partners.

The fundamental research provision (22 CFR 120.34(a)(8)) provides important relief for universities. Information from fundamental research in science and engineering at accredited U.S. institutions of higher learning, where the results are ordinarily published and shared broadly in the scientific community, is in the public domain and therefore not ITAR technical data. The provision has limits: university research does not qualify if the university or its researchers accept other restrictions on publication, or if the research is government-funded and subject to specific access and dissemination controls.

Any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services, must register with the DDTC (22 CFR 122.1). Registration is a prerequisite for applying for export licenses (22 CFR 123.1), and a manufacturer that does not export must still register; a single occasion of manufacturing counts as engaging in the business.

The registration process involves submitting the Statement of Registration (Form DS-2032) and paying an annual fee in one of three tiers (22 CFR 122.3, as of October 2026): $3,000 a year for new registrants and for renewals with no favorable license determinations in the review period, $4,000 for renewals with five or fewer, and $4,000 plus $1,100 for each determination over five for the rest.

Registration does not, by itself, authorize any exports. It simply establishes the registrant's relationship with the DDTC and enables the company to submit license applications and agreement requests. Failure to register when required is itself a violation of ITAR.

Registration and license requests are filed electronically through DDTC's Defense Export Control and Compliance System (DECCS).

ITAR provides several authorization mechanisms for the export of defense articles, services, and technical data:

Direct Commercial Sales (DCS) Licenses

A DCS license authorizes the export of specific defense articles to a specific end user for a defined purpose: the DSP-5 for permanent exports of unclassified articles and the DSP-73 for temporary exports (22 CFR 123.1 and 123.5). License applications are submitted through DECCS and reviewed by the DDTC, often with input from the Department of Defense and other agencies. Processing times vary with the case.

Technical Assistance Agreements (TAAs)

A TAA authorizes the provision of defense services or the disclosure of technical data to foreign persons. TAAs are commonly required for international collaborations, joint ventures, and customer support activities. For example, a U.S. satellite manufacturer providing technical support to a foreign satellite operator would typically need a TAA. TAAs specify the scope of authorized activities, the foreign parties involved, and any limitations or conditions.

Manufacturing License Agreements (MLAs)

An MLA authorizes the manufacture of defense articles abroad. This is relevant for space companies that establish international manufacturing facilities or license their technology to foreign companies for production.

Exemptions

ITAR provides certain exemptions from licensing requirements for specific situations. Notable exemptions include transfers by or for the U.S. Government (22 CFR 126.4), the Canadian exemptions (22 CFR 126.5), and the exemption for defense trade among Australia, the United Kingdom and the United States (22 CFR 126.7, finalized effective December 30, 2025). However, exemptions have specific conditions and limitations, and their improper use can result in violations. Companies should carefully review exemption applicability with legal counsel before relying on them.

Technical data controls are often the most challenging aspect of ITAR compliance for space companies. ITAR-controlled technical data includes any information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. This encompasses engineering drawings, specifications, test reports, operational manuals, process documentation, and software source code.

The digital age has made technical data controls particularly complex. Cloud computing, remote work, and global collaboration tools create numerous opportunities for inadvertent exports. Companies must ensure that IT systems are configured to prevent unauthorized access to controlled data, that cloud storage complies with ITAR requirements (including restrictions on data location and access controls), and that employees understand their obligations regarding controlled information.

ITAR does exclude certain information from the definition of "technical data" (22 CFR 120.33(b)), including information in the public domain as defined in 22 CFR 120.34 (such as published material and patents available at any patent office), general scientific, mathematical, or engineering principles commonly taught in schools, colleges and universities, and basic marketing information on function or purpose or general system descriptions.

One of the most significant developments in space export control over the past decade has been the migration of certain commercial space items from the USML (ITAR jurisdiction) to the Commerce Control List (CCL, under EAR jurisdiction), part of the broader Export Control Reform (ECR) initiative.

The first step in any export control analysis is commodity jurisdiction determination -- determining whether an item is controlled under ITAR (USML) or EAR (CCL). Companies can submit a formal commodity jurisdiction determination request to the DDTC on Form DS-4076 (22 CFR 120.12) if the classification is unclear; registration is not required first. In practice, many space companies maintain internal classification processes, often with the support of specialized export control counsel.

The migration of commercial satellites and components to EAR has been broadly positive for the commercial space industry, as EAR generally provides more flexible licensing mechanisms, more available license exceptions, and lower maximum civil penalties. However, items on the CCL are still export-controlled and require careful compliance attention.

ITAR enforcement is taken seriously by the U.S. government. Criminal prosecutions are handled by the Department of Justice, while civil enforcement actions are brought by the State Department. Notable aerospace settlements include:

• Loral (2002): a $20 million settlement, without admitting or denying the charges, after its subsidiary chaired a review of the February 1996 Chinese launch failure of Intelsat 708 (Congressional Research Service).
• Hughes Electronics / Boeing Satellite Systems (2003): a $32 million civil penalty under a consent agreement resolving charges tied mainly to Hughes Space and Communications' reviews of two failed launches of commercial satellites on Chinese rockets in 1995 and 1996.
• Boeing (2006): $15 million to settle allegations over commercial jets exported with the QRS-11 gyrochip without the required licenses.
• Honeywell (2021): a $13 million settlement of 34 charges over exports of engineering drawings for aircraft, gas turbine engine and other defense programs, including to China.

In addition to financial penalties, violators may face debarment -- the loss of the ability to participate in U.S. defense trade. For a space company dependent on government contracts or international sales, debarment can be an existential threat.

The DDTC encourages voluntary self-disclosure of violations. Companies that discover and promptly report violations, implement corrective actions, and cooperate with the government typically receive more favorable treatment than those where violations are discovered through investigation.

An effective ITAR compliance program should include the following elements:

1. Senior Management Commitment

Compliance must be supported from the top. The CEO and board should understand ITAR obligations, allocate adequate resources, and establish a culture where compliance is prioritized alongside business objectives. License applications are signed by an Empowered Official: a U.S. person employed by the applicant who is empowered in writing to sign them and has independent authority to inquire into any proposed export and to refuse to sign (22 CFR 120.67).

2. Written Policies and Procedures

Document all compliance policies, including procedures for commodity classification, license application, record keeping, technology control plans, visitor screening, employee screening, and voluntary self-disclosure. These documents should be reviewed and updated annually.

3. Training

All employees who may encounter controlled articles, data, or services should receive initial and periodic ITAR training. Training should cover the basics of export controls, company-specific policies, how to identify potentially controlled items, and how to escalate compliance questions. Engineering, business development, HR, IT, and operations staff all need appropriate training.

4. Technology Control Plan (TCP)

A TCP defines how controlled technical data is identified, marked, stored, transmitted, and accessed within the organization. It should address physical security (locked areas, visitor controls), IT security (access controls, encryption, cloud storage policies), and personnel controls (screening, need-to-know restrictions). The TCP is particularly important for companies employing foreign nationals.

5. Screening and Due Diligence

Screen all parties involved in transactions against the Consolidated Screening List maintained by the U.S. government, which includes denied parties, sanctioned entities, and other restricted persons. Screen employees, customers, suppliers, partners, and conference attendees as appropriate.

6. Record Keeping

Registrants must keep records of the manufacture, acquisition and disposition of defense articles, technical data and defense services for five years from the expiration of the license or other approval, or from the date of the transaction for exports under an exemption (22 CFR 122.5). This includes license applications, licenses and their related documentation. Good record keeping is essential for demonstrating compliance and supporting any future audits or investigations.

Manage regulatory compliance on SpaceNexus · Track government contracts and procurement

The export control landscape for space companies continues to evolve in response to industry changes and geopolitical dynamics. Several developments are worth tracking:

USML Review and Decontrol

Executive Order 14268 of April 9, 2025 ("Reforming Foreign Defense Sales to Improve Speed and Accountability") directs the State Department to focus ITAR controls on the most sensitive technologies. A targeted USML revision took effect on September 15, 2025, and on October 1, 2026 the Department proposed a broader review that would move more items from the USML to the EAR and add a new licensing exemption; comments are due by November 30, 2026 (91 FR 62361). A separate October 2024 proposal to revise USML Categories IV and XV had not been finalized as of October 2026.

Allied Country Collaboration

The State Department finalized a license exemption for defense trade among Australia, the United Kingdom and the United States (the AUKUS partners), effective December 30, 2025 (22 CFR 126.7). It applies only to listed parties and activities within the three countries, and its conditions should be checked before relying on it for a space program.

Cloud Computing and Encryption

Sending, taking or storing unclassified technical data is not an export when the data is secured with end-to-end encryption meeting the rule's standard (FIPS 140-2 or successor modules, or at least AES-128 strength), is not intentionally sent to or stored in a country proscribed under 22 CFR 126.1, and is not sent from one (22 CFR 120.54(a)(5)). Giving a foreign person the keys or other access information that unlocks the data is a release that needs authorization (22 CFR 120.56). The specific configuration should be reviewed with counsel.

Monitor defense and security space developments on SpaceNexus

SpaceNexus provides regulatory and compliance tracking tools designed for space industry professionals. Our Regulatory & Compliance Hub tracks space law developments, regulatory filings, and licensing updates across major jurisdictions, helping you stay informed about the evolving compliance landscape.