ITAR compliance: a plain-English guide for European and Taiwanese defence suppliers

What is ITAR?

The International Traffic in Arms Regulations (22 CFR Parts 120–130) implement the Arms Export Control Act and are administered by the State Department’s Directorate of Defense Trade Controls (DDTC). The regime covers defence articles, defence services and the technical data behind them — and unlike the EAR’s graduated country chart, its default posture towards most of the world is “ask first”.

The Munitions List’s 21 categories

Jurisdiction starts with the US Munitions List (22 CFR § 121.1): twenty-one categories, I through XXI, from firearms to spacecraft, cited by category and paragraph — Category XI(c)(10), say. The order of review runs USML first, then the Commerce Control List: an article described on the USML is ITAR-controlled no matter what else it resembles.

Reading your product against those paragraphs — including the carve-outs and the 2025 revisions — is a parameter exercise, and it is the first thing Thylon drafts when a programme touches US defence articles.

There is no such thing as “ITAR certification”

No agency certifies companies as ITAR-compliant, and anyone selling a certificate is selling paper. What the regulation actually demands (22 CFR § 122.1) is registration: US manufacturers, exporters and brokers of defence articles or services must register with DDTC on Form DS-2032 — even if they never export. Registration is a precondition for licences; it confers no export rights of its own.

For a non-US company the question is different: you do not register, but you inherit obligations the moment US-origin articles or data enter your programme — which is the subject of the next two sections.

Technical data and deemed exports

Technical data (§ 120.33) is the information required to develop, produce or use a defence article — drawings, specifications, software. Releasing it to a foreign person is an export to that person’s country (§ 120.50), even when the release happens in your own office. That is the deemed-export rule, and it turns hiring, subcontracting and IT access into export decisions.

A UK or German engineer joining a programme that holds ITAR data is an event the regulation sees. Thylon’s deemed-export guard exists for exactly that moment: it checks the data a new hire would touch against the authorisations you actually hold, before the first login.

Retransfers: the trap for non-US companies

Receiving ITAR-controlled articles or data under a licence or agreement is not the end of US jurisdiction — it is the beginning of yours. Reexporting or retransferring them, to a new country, a new entity or a new end use, needs DDTC authorisation first. This is the clause that catches European integrators who resell a US-origin subsystem, and Taiwanese suppliers who move production between sites.

The discipline is unglamorous: know which items and files are ITAR-tainted, know what your agreements permit, and treat every change of hands as a question. Thylon keeps that register so the question gets asked automatically.

Licences, agreements and exemptions

Permanent exports ride on the DSP-5; technical assistance and co-production run through Part 124 agreements — TAAs and Manufacturing Licence Agreements; temporary moves have their own forms. A set of exemptions, including the AUKUS exemption at § 126.7, waives individual licensing in defined lanes, each with conditions and record duties.

Which instrument fits a given transfer — and what its provisos will demand of you for years afterwards — is the analysis Thylon’s licensing module drafts for your counsel’s review.

The § 120.54 encryption carve-out

Since 25 March 2020, sending, taking or storing unclassified technical data is not an export when it is end-to-end encrypted to the standard the rule names (FIPS 140-2 compliant or equivalent, at least 128-bit), the keys are withheld from third parties, and the data is not intentionally sent to or stored in a § 126.1 country. A July 2025 rule clarified the obvious-but-necessary point that data in transit is not “stored” in the countries it passes through.

This paragraph is why a cloud product can lawfully hold ITAR technical data at all, and Thylon’s architecture is built against it — encryption to the named standard, customer-held keys on the enterprise tier, and storage that respects the country conditions.

Running the programme

The steady-state duties are concrete: records kept five years (§ 122.5), parties screened against § 126.1 and the US lists before every transfer (screening), authorisation provisos tracked, and problems disclosed voluntarily under § 127.12 — the mechanism that has saved more companies than any other paragraph in the subchapter. None of it requires mystique; all of it requires a record. That record is the product.

What changed in 2025–2026

• 7 Jul 2025 — A final rule updated §§ 120.54 and 126.1, confirming among other things that encrypted data in transit is not deemed stored in the countries it crosses.
• 15 Sep 2025 — Targeted USML revisions took effect: certain antennas left Category XI(c)(10), lead-free birdshot was removed, and a new exemption at § 126.9(u) covers defined uncrewed underwater vehicle activities.
• 1 Oct 2025 — Cyprus’s treatment under § 126.1 changed by final rule.
• 1 Oct 2026 — Syria was removed from table 1 to § 126.1(d)(1); transfers are now reviewed case by case rather than denied by policy.

Primary sources

• DDTC — Understand the ITAR
• DDTC — ITAR compliance
• eCFR — 22 CFR Subchapter M (the ITAR)
• Federal Register — USML targeted revisions (27 Aug 2025)
• Federal Register — 90 FR 29720 (7 Jul 2025)

Where this fits

Export control rarely means one regime at a time. The pages below cover the rest of the map, and the product pages show how Thylon turns each list and licence type into drafted, cited work your officer signs off.