The EU Dual-Use Regulation (2021/821): Annex I, catch-all controls and the Union General Export Authorisations

What counts as dual-use

Dual-use items are goods, software and technology usable for both civil and military purposes — a definition that reaches from machine tools to encryption libraries. Regulation (EU) 2021/821, in force since 9 September 2021, is the EU’s single rulebook for their export, brokering, technical assistance, transit and transfer. Article 3 states the core duty: exporting an item listed in Annex I requires an authorisation.

The map of the Regulation

The architecture is compact. Articles 3 to 11 set when authorisation is needed — listed exports, the catch-all cases, brokering, technical assistance, transit, and intra-EU transfers of the most sensitive items. Article 12 names the authorisation types. Annex I is the control list; Annex II holds the Union General Export Authorisations; Annex IV is the short list whose movement even inside the EU needs a licence.

Enforcement, penalties and the issuing desk stay national: in Germany that desk is BAFA, and each member state appoints its own competent authority.

Reading Annex I

Annex I sorts controlled items into ten categories (0 nuclear materials through 9 aerospace and propulsion), with product groups A to E inside each — equipment, test gear, materials, software, technology. Entries carry five-character codes such as 5A002, inherited from the multilateral regimes the list implements: Wassenaar, MTCR, the Nuclear Suppliers Group and the Australia Group.

The codes often match their US ECCN cousins digit for digit while differing in scope — a resemblance that has misled more than one engineer. Parameter-level reading is the job, and it is the job Thylon’s classification module drafts with the entry text cited beside every judgement.

The catch-all clauses

Unlisted does not mean uncontrolled. Article 4 lets authorities require a licence for non-listed items when the exporter knows, or has been informed, they are intended for weapons-of-mass-destruction purposes, for military end use in an arms-embargoed destination, or as parts of illegally exported military items. Article 5 extends the logic to cyber-surveillance items, and Articles 9 and 10 let member states add national controls.

The practical consequence: end-use red flags are a classification input, not an afterthought — which is why Thylon’s screening and classification read the same file.

Authorisations, including EU001–EU008

Article 12 recognises individual, global and national general authorisations — and the eight Union General Export Authorisations of Annex II, usable from any member state. EU001 covers exports of most Annex I items to Australia, Canada, Iceland, Japan, Liechtenstein, New Zealand, Norway, Switzerland, the United Kingdom and the United States. The others cover defined lanes: EU007 intra-group software and technology transfers, EU008 encryption items, and so on.

Using a UGEA is declared on the customs declaration, and member states attach their own registration and notification duties. Which authorisation fits a transaction — and whether you may not need an individual licence at all — is the first question Thylon’s licensing module answers, in writing.

Intra-EU transfers

Movement inside the single market is licence-free for almost everything: only Annex IV items — the most sensitive subset — need authorisation for intra-EU transfers under Article 11. The border that matters is the customs frontier of the Union, which is also why a GB shipment has needed a licence since 2021 while the same box to Vienna does not.

The list keeps moving

Annex I is replaced wholesale by Commission delegated regulation, normally once a year. Delegated Regulation (EU) 2025/2003 has applied since 15 November 2025, adding quantum-computing items and cryogenic components, semiconductor manufacturing equipment, additive-manufacturing items and high-temperature coatings. The 2026 update was adopted on 14 September 2026 and enters into force the day after publication in the Official Journal — still pending as of this page’s date. A classification is therefore a dated statement, which is why every Thylon determination records the list version it was made against.

What changed in 2025–2026

• 15 Nov 2025 — Delegated Regulation (EU) 2025/2003 replaced Annex I in full — quantum computing, semiconductor manufacturing equipment, additive manufacturing and high-temperature coatings entered the list.
• 14 Sep 2026 — The Commission adopted the 2026 Annex I update (C(2026) 6323), aligning the list with 2025 decisions of the Wassenaar Arrangement, the Australia Group and the NSG; it takes effect the day after Official Journal publication, pending as of November 2026.

Primary sources

• EUR-Lex — Regulation (EU) 2021/821
• DG TRADE — 2025 update of the EU control list
• DG TRADE — 2026 update of the EU control list
• BAFA — Annex II Union General Export Authorisations

Where this fits

Export control rarely means one regime at a time. The pages below cover the rest of the map, and the product pages show how Thylon turns each list and licence type into drafted, cited work your officer signs off.