ITAR and EAR compliance for companies that handle US-controlled items and technical data.

What it is

What are ITAR and EAR?

ITAR and EAR are the two main US export control regimes. The International Traffic in Arms Regulations (ITAR) are administered by the US Department of State through its DDTC directorate and cover defence articles, defence services and related technical data. The Export Administration Regulations (EAR) are administered by the Bureau of Industry and Security (BIS) at the US Department of Commerce, sit in Title 15 of the US Code of Federal Regulations and cover the commercial and dual-use items listed on the Commerce Control List.

For most businesses the practical question is whether they can show, item by item and transfer by transfer, which rules apply and what authorises each export, re-export or release of technical data. Many organisations outside the United States first meet these rules in a contract clause from a US customer.

Status. Both regulations are amended regularly, so the current text is always read on the DDTC and BIS websites. Neither regime issues a certificate: compliance is shown by how you classify, authorise, screen, record and train.

Who it is for

Who needs ITAR and EAR compliance?

The request usually comes from a customer, a contract or a regulator, rather than from a plan. Organisations come to Sterling from three starting points:

• US manufacturers and exporters of defence articles. Registration with DDTC, licences and records need a programme that runs every day, not a file assembled for a request.
• Suppliers that receive controlled technical data. Aerospace, defence and engineering suppliers asked by a US prime to show how drawings and data are protected and who can see them.
• Technology, electronics and service firms. Dual-use products, software and outsourced engineering or IT work for US clients, where the customer questionnaire asks for classification and screening evidence.

The benefit is control you can demonstrate: fewer blocked shipments, clear answers to customer due diligence and people who know when to stop and ask.

Requirements

What do ITAR and EAR compliance require?

The regulations are long and change often, so this list does not reproduce their structure; it shows, at title level, what Sterling's compliance work covers.

• Jurisdiction and classification: a documented decision on whether each item, software or technology falls under the ITAR or the EAR, and where it sits on the Commerce Control List
• Registration: DDTC registration through DECCS where the ITAR requires it, kept current as the business changes
• Licences and authorisations: each authorisation tracked against the shipments, transfers and access it covers
• Screening: parties, destinations and end uses checked before an order, a transfer or a release of data
• Technical data control: who can access controlled data, including foreign-person employees, visitors and IT systems
• Records, training and internal review: evidence kept, people trained and the programme tested, with suspected problems escalated to your counsel

Your engagement

What your ITAR and EAR engagement includes

The route is regulatory compliance: no certificate exists, and Sterling does not certify, register or issue licences or give legal advice. We build and run the programme with your team, alongside your legal counsel.

• Scope and gap assessment

  Where export controls touch your products, data, people and sites, and what is missing.

• Compliance programme and procedures

  Classification, screening, authorisation tracking, data access and escalation, written for the people who use them.

• Effivity ISO & GRC software

  Registers, records and actions in one workspace, included with the engagement at no additional cost.

• Training and internal review

  Awareness for everyone who touches controlled items, and periodic review of the programme with findings closed.

Jurisdiction, classification and licensing decisions remain with your organisation and its legal counsel; the regulators decide on registrations and licences.

Often combined with

Standards organisations pair with ITAR / EAR

• AIAG core toolsAutomotive core tools implementation and training: APQP, Control Plan, PPAP, FMEA, MSA and SPC applied on your live parts.
• AQAP 2110AQAP 2110 compliance for defence suppliers: what the NATO contract requirement covers, AQAP 2105 quality plans, government quality assurance and an all-inclusive proposal.
• AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
• AS9110AS9110 certification for aviation maintenance organisations: the 9110 requirements, the IAQG audit route, cost and timeline factors, and Sterling's support.
• AS9120AS9120 certification for aerospace distributors and stockists: requirements, the IAQG audit route, OASIS listing, cost and timeline factors, with Sterling.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.