Export Controls in the European Union

Introduction

Export controls can be described as restrictions on international trade in certain sensitive goods, software and technology (hereinafter, Items). Generally, this involves licensing requirements or prohibitions on the cross-border movement of Items identified on specified control lists established at national or international level, or when sensitive end uses are involved, with potentially severe consequences for non-compliance.

In the European Union (EU), export controls include both EU-wide restrictions provided for through EU legislation, as well as EU Member State-specific export controls set out at a national level. In each case, these controls are administered and enforced at national Member State level, resulting in certain variations in how export controls are applied across the EU.

This chapter gives an overview of export control rules under EU law, covering the key types of controls on Items subject to EU export controls; the circumstances in which export controls apply; export licensing requirements and practicalities; and the potential consequences of non-compliance.

Overview of EU export controls

EU export controls consist of a patchwork of EU-wide rules set out pursuant to EU legislation and local rules applied by individual Member States. These rules predominantly implement export controls on Items agreed pursuant to international frameworks to which the EU or its Member States are party (i.e., the Wassenaar Arrangement, the Australia Group (chemical weapons), the Nuclear Suppliers Group and the Missile Technology Control Regime).

In line with these international frameworks, EU export controls apply to both tangible and intangible exports of controlled Items (i.e., types of goods, software or technology specifically identified on relevant export control lists, such as the EU list of dual-use controlled Items as described below). Each of these controlled Items will be classified under a relevant export control regime, with a specific control entry (the EU equivalent of a US Export Control Classification Number); otherwise, the item will be classified as ‘NLR’ (no licence required). EU export control rules can also apply to exports of non-listed Items (i.e., those that do not specifically appear on export control lists) if there is knowledge, awareness or (in some cases) suspicion of a sensitive end use (known as ‘catch all’ end-use controls). This includes certain end uses relating to the military sector or weapons of mass destruction.

The two main export control regimes in the EU are those in relation to (1) dual-use export controls (i.e., Items that can be used for commercial or civilian purposes but also for military purposes) and (2) military export controls, generally in relation to listed Items that are specially designed or modified for military use. As noted below, certain other regimes apply in the EU, including in relation to torture equipment.

Key questions for assessing transactions under EU export control rules

When considering any transaction under EU export control rules, key questions to consider include the following:

• Classification: are any Items involved in the transaction classified on any relevant EU export control list (and, if so, which list and which specific export control entry applies)? This analysis can be complex, requiring detailed understanding of both the export control lists and the technical specifications of the Items in question, given both the breadth and detail of relevant export control lists (which also often include various exceptions and exemptions).
• End use: is there evidence indicating that the Items may be intended for a controlled end use?

In some cases, an exporter may be informed by a relevant authority or clearly aware of a controlled end use, and will thus need to apply for a licence; in other cases, there may be red flags in a transaction that give rise to suspicion of a controlled end use, which must be carefully considered in each individual case under the relevant laws.

• Export: Is there a licensable ‘export’ or other controlled activity?

Only certain types of dealings with controlled Items (or transactions involving controlled end uses) will require a licence under export controls. For example, in respect of EU dual-use export controls, a licence is generally required for any physical shipment or intangible transfer of a controlled dual-use Item from within to outside the territory of the EU. In certain more sensitive cases, transfers of items between EU Member States (or even within an individual EU Member State), or the arrangement or negotiation of transfer between third countries, may require an export licence.

• Destination and end user: where and to whom will the Item be exported?

These questions will often determine which type of licence may be required or may be available, or whether the relevant authority will grant a licence at all. In this respect, EU export controls often overlap with EU sanctions where the destination or end user are subject to restrictive measures under an EU sanctions regime. In assessing transactions, it is also important to consider the risk of an Item being diverted to a destination or end user other than those intended.

• Exporter: which entity is the exporter?

This will often depend on which party holds the contract and has the power to determine the export of an Item. The exporter will be responsible for obtaining any necessary export licence and be at risk of penalties in the event of any breach of export control rules. Under EU dual-use export controls, the country of establishment of the exporter will also determine which EU Member State will be responsible for licensing in respect of the relevant export.

• Licensing: what kind of export licence may be available (if any), and which conditions and requirements apply?

Even if an exporter can obtain or register to use a relevant export licence, it is imperative to ensure that its exports are within the scope of that licence and that all conditions are fully complied with (including in respect of registration, record-keeping and end-user undertakings).

EU dual-use export control regime

In the EU, the key dual-use export control legislation is currently the ‘EU Dual-Use Regulation’.^[2] This sets out EU-wide controls that are directly applicable in all EU Member States, including controls on specifically listed dual-use Items and in respect of exports relating to controlled end uses.

EU dual-use items

Definition and scope of dual use

Under the EU Dual-Use Regulation, dual-use items are defined as ‘items, including software and technology, which can be used for both civil and military purposes, and includes items which can be used for the design, development, production or use of nuclear, chemical or biological weapons or their means of delivery, including all items which can be used for both non-explosive uses and assisting in any way in the manufacture of nuclear weapons or other nuclear explosive devices’.^[3]

The EU Dual-Use Regulation sets out lists of specific types of dual-use Items for which a licence (referred to within the Regulation as an ‘authorisation’) must be obtained in advance of export. Items covered by the EU Dual-Use Regulation include:

• goods (i.e., physical items);
• software – defined to cover a collection of one or more ‘programmes’^[4] or ‘micro- programmes’^[5] fixed in any tangible medium of expression. This includes software stored on computer hardware, and on removable storage such as USB drives, CDs and DVDs; and
• technology – defined to cover specific information necessary for the ‘development’, ‘production’ or ‘use’ of goods (or software), with those terms further as defined within the EU Dual-Use Regulation.^[6] This information takes the form of ‘technical data’^[7] or ‘technical assistance’.^[8]

Annex I of the EU Dual-Use Regulation

The main list of controlled Items can be found in Annex I, which, in summary, specifies Items for which a licence must be obtained before they are exported from within to outside the EU territory. Certain record-keeping and paperwork requirements also apply in respect of intra-EU transfers of Items listed in Annex I.

Annex I currently consists of 10 categories of controlled Items on more than 300 pages of the Regulation, with control entries including specific technical parameters (such as detailed definitions, exemptions and exceptions). The Items controlled in Annex I include various goods, software and technology used in a range of sectors, including marine, aerospace, chemicals, oil and gas, mining, pharmaceutical and nuclear. Statistical estimates published by the European Commission indicate that, in 2018, authorised dual-use trade amounted to €36.6 billion, representing 2 per cent of total extra-EU exports.

In line with international export control frameworks as noted above, the 10 categories in Annex I to the EU Dual-Use Regulation are as follows:

• Category 0: Nuclear materials, facilities and equipment
• Category 1: Special materials and related equipment
• Category 2: Materials processing
• Category 3: Electronics
• Category 4: Computers
• Category 5: Telecommunications (Part 1) and Information security (Part 2)
• Category 6: Sensors and lasers
• Category 7: Navigation and avionics
• Category 8: Marine
• Category 9: Aerospace and propulsion

Each of these categories is further subdivided into sections, covering:

• A: systems, equipment and components;
• B: test, inspection and production equipment;
• C: materials;
• D: software; and
• E: technology.

Each of these sections is then further subdivided into individual control entries for particular Items, often very technical and detailed in nature, with certain exceptions and exemptions. There are also a number of general exceptions from export control. These cover, for example, software and technology that is in the public domain.

By way of example of an Annex I dual-use Item, a server with controlled encryption functionality may be caught within Annex I control list entry 5A002a1, denoting that:

• this is an ‘information security’ Item (Category 5, Part 2);
• this is a piece of ‘equipment’ (sub-category A, within Category 5, Part 2); and
• the server meets the specific control parameters of entry 5A002a1 (a control entry derived from the Wassenaar Arrangement).

Annex IV of the EU Dual-Use Regulation

A much shorter list of more sensitive Items is set out at Annex IV to the EU Dual-Use Regulation. Annex IV is divided into two Parts. Items listed in Part I can be transferred within the EU on the basis of a National General Authorisation. In contrast, Part II contains Items for which a licence is also required for intra-EU transfers. These Items include highly sensitive Items, such as cryptanalytic Items, most nuclear-related Items, stealth-related technology, and Items relating to missiles and chemical warfare.

Additional national Member State dual-use controls

In addition to control lists set out under the EU Dual-Use Regulation, EU Member States may also set out their own lists of controlled dual-use Items. Germany, for instance, has done so by including some dual-use Items on the national export list^[9] that are not already covered by the EU Dual-Use Regulation, if they are to be exported to certain countries. One example is entry 6A908, which refers to radar-based navigation or surveillance systems for shipping or air traffic or components thereof that are not already covered under Annex I of the EU Dual-Use Regulation, if the destination of the Items is Iran.

End-use controls under the EU Dual-Use Regulation

As noted above, a licence may be required in respect of Items that are not controlled under a relevant list, when the transaction may involve a controlled end use. These are the ‘catch all’ controls, since any Item could in theory be subject to a licensing requirement depending on the end use.

Key end-use controls under the EU Dual-Use Regulation include the following:

• weapons of mass destruction-related end use (WMD end use): a licence will be required if an exporter has been informed by a competent Member State authority, or is aware, that an Item is or may be intended, in its entirety or in part, ‘for use in connection with the development, production, handling, operation, maintenance, storage, detection, identification or dissemination of chemical, biological or nuclear weapons or other nuclear explosive devices or the development, production, maintenance or storage of missiles capable of delivering such weapons’.^[10] Member States may extend this control to apply when a person has grounds for suspecting this type of end use;
• military end use: a licence will be required if an exporter has been informed, or is aware, that an Item is or may be intended, in its entirety or in part, for a specified ‘military end-use’. In short, these military end uses cover situations in which (1) the Item is or may be intended for use with military equipment in a destination subject to an EU or OSCE^[11] arms embargo or (2) the Item may be intended for use as parts of military goods illegally obtained from the EU, irrespective of destination;
• a licence will be required if an exporter has been informed, or is aware, that a cyber-surveillance Item is or may be intended, in its entirety or in part, for use in connection with internal repression and/or the commission of serious violations of human rights and international humanitarian law. Cyber-surveillance Items are dual-use Items specially designed to enable the covert surveillance of natural persons by monitoring, extracting, collecting or analysing data from information and telecommunications systems.

In addition, under Article 9 of the EU Dual-Use Regulation, EU Member States may decide to prohibit or impose an authorisation requirement on the export of non-listed Items for reasons of public security, including the prevention of acts of terrorism, or human rights considerations.

Types of activities controlled under the EU Dual-Use Regulation

Exports

A licence will be required for any export of Annex I-listed Items or of any non-listed items in respect of a controlled end use.^[12] The concept of an export captures both (1) shipments of tangible (physical) goods from within to outside the territory of the EU (including hand carries of Items), and (2) intangible transfers of controlled software or technology from within the EU to legal and natural persons and partnerships outside the EU. These exports can occur intra-group and need not involve any sale, consideration or transfer of ownership.

The concept of an intangible transfer under EU export controls is particularly broad and is a common area in which companies can fall foul of the rules. Examples include:

• sending or making available controlled software or technology to a recipient in another country by email or file transfer protocol;
• reading controlled technology to a person in another country over a voice transmission medium; and
• placing controlled software or technology on a server or shared drive and making that software or technology accessible in another country, such as over an intranet site (including if the server to which the Items are uploaded is in the same country).

Brokering and transit controls

Licences are also required in certain circumstances when a person or entity in the EU is involved in brokering (e.g., negotiating or arranging) the sale or supply of Items between two third (i.e., non-EU) countries.^[13] Provided they carry out brokering services from the EU into the territory of a non-EU country, this also applies to non-EU persons or entities. These controls typically apply when the relevant EU broker has been informed or is aware of a controlled WMD or military end use in respect of a listed Annex I Item. However, Member States are also permitted to extend brokering controls to capture:

• non-listed dual-use items that are or may be intended for a controlled WMD or military end use; and
• circumstances in which there are grounds for suspecting a WMD or military end use.

Likewise, while Items in transit through the EU (i.e., passing through the EU from and to a non-EU destination) are not subject to EU dual-use export controls, Member States may prohibit Items in transit if they are or may be intended for a controlled WMD or military end use.

Intra-EU transfers

As the EU is a single customs territory allowing for free movement of goods, export controls principally apply to exports of dual-use Items from the EU to a destination outside the EU. Intra-EU movements of most dual-use Items do not normally require a licence. However, there are a few important points to note:

• As noted below, military controlled items generally require a licence for transfers between EU Member States, as these controls are set at national level.
• As noted above, certain sensitive dual-use Items as listed under Annex IV of the EU Dual-Use Regulation require an authorisation to be transferred between EU Member States. Those Items listed in Part 1 of Annex IV can be transferred on the basis of a National General Authorisation while Items listed in Part 2 of Annex IV cannot.
• Licences may be required for intra-EU movements of dual-use Items when the Items will be re-exported from the EU without being further processed, and a licence would be required to export them from the EU. This is an optional control that only certain EU Member States have implemented.
• All intra-EU transfers of Items listed in Annex I to the EU Dual-Use Regulation must be accompanied by a statement that the Items are subject to control if exported from the EU. The statement should appear in the relevant commercial documents (e.g., contracts, order confirmations, invoices and dispatch notes). Additionally, records of intra-EU transfers must be kept for at least three years from the end of the calendar year in which the transfer took place and shall be produced, on request, to the competent authority.

Technical assistance

Licences are also required in certain instances where an entity provides technical assistance related to Items listed in Annex I from the territory of the EU into the territory of a third country; or an EU entity provides technical assistance within the territory of a third country or to a resident of a third country temporarily present in the EU. These controls typically apply when the relevant supplier has been informed or is aware of a controlled WMD or military end use in respect of the Items in question.

Technical assistance is any technical support related to repairs, development, manufacture, assembly, testing, maintenance, or any other technical service, and may take forms such as instruction, advice, training, transmission of working knowledge or skills or consulting services, including by electronic means as well as by telephone or any other verbal forms of assistance.

Military export controls in the European Union

Export controls in relation to military Items are the preserve of each EU Member State. The EU does maintain a common military list, setting out a list of military Items subject to export controls. This list is adopted annually by the Council, pursuant to Council Common Position 2008/944/CFSP defining common rules governing control of exports of military technology and equipment. However, this list is non-binding, and it is up to each Member State to legislate for and implement its own, national military export controls.

Generally, controls on military Items as adopted by individual Member States – and pursuant to the EU common military list – capture items that are either ‘specially designed’ or ‘modified’ for military use. These terms are not currently defined on a pan-EU basis but are generally very broadly interpreted. This can apply (for example) to Items that are simply developed or customised for a military customer even if they have civilian applications.

The EU common military list currently captures 22 categories of military-controlled Items, again capturing goods, software and technology. Items caught by this list are set out in entries ML1 to ML22, inclusive, covering a range of Items such as weapons and firearms; ammunition; bombs, rockets, missiles and other explosives and explosive devices; military vehicles, vessels, aircraft and drones; chemical and biological agents and radioactive materials; armoured or protective equipment; imaging equipment and other electronic equipment; and certain software and technology (in each case specifically designed or modified for military use). Germany, for example, distinguishes between military Items and war weapons. All military Items are subject to a licence requirement for exports. However, some of these Items are also war weapons, which are subject to further restrictions under the German War Weapons Control Act.

Additional types of controlled Items in the EU

In addition to dual-use and military Items, a number of other Items may be controlled under separate export control lists either at EU or Member State level.

By way of example, the EU’s Anti-torture Regulation^[14] is a reflection of the EU’s commitment to eradicate torture and the death penalty. The measures seek to prevent the trade in certain goods that could be used for capital punishment, torture or other cruel, inhuman or degrading treatment. The Regulation:

• prohibits the import, export, transit, brokering or advertising of goods that have no practical use other than for the purpose of capital punishment or for the purpose of torture and other cruel, inhuman or degrading treatment or punishment;
• requires a prior export authorisation for any export of goods that could be used for capital punishment, torture or for cruel, inhuman or degrading treatment or punishment; and
• regulates the trade in certain pharmaceutical chemicals that could be used in lethal injection executions, without limiting trade of those chemicals for legitimate purposes.

As a specific example of the dynamic nature of export controls, during 2020 we also saw the introduction and subsequent removal of controls in relation to personal protective equipment (PPE), in response to the covid-19 pandemic, which have been terminated already.^[15] In 2021, export control restrictions in relation to the covid-19 vaccine were implemented (Commission Implementing Regulation (EU) 2021/442) and are currently in force until the end of June 2021.

Licensing and compliance under EU export controls

Within the EU, individual Member States are each responsible for licensing in respect of exports (whether in respect of EU-wide controls on dual-use Items, or national controls). There is no EU-wide export licensing body.

For example, in Germany, the central authority responsible for issuing licences is The Federal Office for Economic Affairs and Export Controls (BAFA).^[16] BAFA offers an online tool through which licences can be obtained and can assist in classifying goods. There are a number of very useful general export authorisations available in Germany, in addition to the EU-wide general export authorisations explained below.

Different types of licences may be available depending on the Item and transaction in question (including, in particular, the relevant destination). The EU Dual-Use Regulation sets out certain common forms for licences as follows:

• individual export authorisations (i.e., an authorisation granted to one specific exporter for one end user or consignee in a third country and covering one or more dual-use Items);
• global export authorisations (i.e., an authorisation granted to one specific exporter in respect of a type or category of dual-use Item that may be valid for exports to one or more specified end users, and in one or more specified third countries);
• large project authorisations (i.e., an individual export authorisation or a global export authorisation granted to one specific exporter, in respect of a type or category of dual-use Item that may be valid for export to one or more specified end user in one or more specified third country for the purpose of a specified large-scale project); and
• general export authorisations (i.e., an off-the-shelf export authorisation for exports to certain countries of destination available to all). These may be EU-wide or granted by individual Member States. In particular, EU-wide general export authorisations (GEAs) are publicly available licences set forth in Sections A to H of Annex II to the EU Dual-Use Regulation and available, on registration, for exports of certain less sensitive Items to specific countries, subject to certain conditions. By way of example, the original EU GEA 001 covers all items listed in Annex I of the EU Dual-Use Regulation, with certain exceptions, covering exports to Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland, including Liechtenstein, the United Kingdom and the United States. Five additional, more limited, EU GEAs were introduced in January 2012 and two GEAs with the recast of the Dual-Use Regulation in 2021.

Each licence covers exports of certain Items, to certain destinations, in some cases only to certain end users or consignees. In addition, each licence will have specific conditions, exclusions and requirements. These include obligations to obtain written undertakings from consignees or end users prior to export. For example, these undertakings can include certifications from the end user that they are the intended end user of the goods to be supplied by the licensee, and that the goods will not be used for any purpose connected with chemical, biological or nuclear weapons, or missiles capable of delivering those types of weapons. It is critical for exporters to ensure full compliance with the terms of any export licence. This is a typical area of non-compliance, with authorities in the EU commonly conducting audits in which they scrutinise exports for compliance with all licence conditions.

Certain licences may only be granted when the EU exporter can demonstrate that it has implemented an internal compliance programme (i.e., sufficient export compliance policies and procedures). Again, export authorities may audit exporters to determine whether appropriate policies and procedures are in place. In 2019, the European Commission made specific recommendations in respect of the key elements it would expect to see in an internal compliance programme,^[17] which include the following:

• top-level management commitment to compliance;
• organisation structure, responsibilities and resources;
• training and raising awareness;
• transaction screening process and procedures;
• performance review, audits, reporting and corrective actions;
• record-keeping and documentation; and
• physical and information security.

Under the EU Dual-Use Regulation, the relevant export licence must be obtained by the exporter from the Member State authority in which it is established (e.g., where it is incorporated) or, if the exporter is established outside the EU, by the competent authority of the Member State where the Items are located. A licence granted in one EU Member State should be valid for exports from any other Member State (although, certain local restrictions can apply in practice). The exporter is currently defined to include (in summary):

• in respect of physical shipments, the party that holds the contract with the consignee in the third country and has the power for determining the sending of the Item out of the customs territory of the EU; and
• in respect of intangible transfers, the party that decides to transmit or make available software or technology to a destination outside the customs territory of the EU.^[18]

Determining which entity is the exporter, and in which EU Member State it is established (and thus from which Member State’s competent authority the relevant export licence must be obtained), is a key matter that is not always straightforward in more complex supply chains. Different Member States can also take different approaches to the concept of ‘establishment’.

Consequences of non-compliance with EU export controls

The EU has in place an enforcement coordination mechanism with a view to establish direct cooperation and exchange of information between competent authorities and enforcement agencies. However, the implementation and enforcement of export controls in the EU is also the responsibility of individual EU Member States. The EU Dual-Use Regulation states that each Member State shall take appropriate measures to ensure proper enforcement, including penalties that are effective, proportionate and dissuasive.

Penalties for breaches of export controls can include civil or criminal penalties, or broader legal and practical consequences, varying by jurisdiction. Typical penalties may involve:

• civil or criminal fines;
• imprisonment;
• disqualification of company directors;
• seizure of items that were the subject of the violation; or
• revocation of export licences (including the ability to use general licences).

More broadly, export violations may damage an exporter’s relationships with relevant licensing authorities, potentially hampering the ability to obtain export licences in the future (which can significantly affect business activities). Export violations may also damage relationships with banks and other counterparties and key stakeholders, as well as a company’s reputation.

Footnotes