U.S. Export Controls for Software Teams: A First-Pass Classification Workflow

Software can raise U.S. export-control questions even when delivered online. Teams should identify the item, technology, encryption functionality, origin, users, destinations, and end use, then consult the Export Administration Regulations and qualified counsel. Do not infer that open source, cloud hosting, or a foreign employee automatically resolves classification. Maintain a decision record and screen restricted parties as required.

A practical workflow

1. Inventory source code, binaries, models, documentation, and technical assistance.
2. Determine jurisdiction and classification questions under the current EAR guidance.
3. Map developers, customers, support access, hosting, and destinations.
4. Use official screening and licensing guidance or escalate to export counsel.
5. Add release gates and record approvals, assumptions, and changes.

Before you submit, buy, or publish

• Separate marketing geography from actual access.
• Restrict repositories and support channels appropriately.
• Do not publish controlled technical data while “checking later.”
• Review encryption and open-source exceptions carefully.

Caveats that matter

Export rules and lists change frequently; violations can carry serious consequences. This is not legal advice.

Frequently asked question

Does “SaaS” mean no export occurs? Not necessarily; access, technical assistance, and data flows still matter.

Primary source

Use the official source for current eligibility, forms, dates, fees, limits, and policy changes: Open the primary source. Verify the page immediately before acting; this guide is educational and is not legal, tax, immigration, or financial advice.