A question people ask · answered against the Corpus of 2026-08-29
Does encryption in my product need an export licence?
Encryption puts you on 5A002 by default, but most commercial products move under a licence exception with a filing.
Almost every connected hardware product ships with cryptography in it. TLS in the firmware, an encrypted radio link, a signed bootloader. All of that is in scope of ECCN 5A002 when the cryptography is above the defined thresholds.
5A002.a controls information security equipment using symmetric algorithms above 56 bits, asymmetric above the stated key lengths, or elliptic curve above 112 bits. Modern defaults are comfortably above all 3.
The practical route for mass-market and publicly available products is Licence Exception ENC at 15 CFR 740.17, with a self-classification report or a classification request to BIS depending on the product. That filing obligation is the part small teams miss, not the licence itself.
There is also a note structure that releases items where the cryptography is ancillary to the primary function. Whether your product qualifies is a reading of the notes against your firmware, not a guess.
What decides it
- 01What algorithms and key lengths does the product use, in firmware and on the link?
- 02Is the cryptography the primary function, or ancillary to it?
- 03Is the product mass-market or publicly available under the Category 5 Part 2 notes?
- 04Has a self-classification report or a BIS classification request been filed?
Free, no account. Dossier $249 if you want the record.
The entries this turns on, opening text as it reads today
a. Designed or modified to use 'cryptography for data confidentiality' having a 'described security algorithm', where that cryptographic capability is usable, has been activated, or can be activated by any means other than secure “cryptographic activation”, as follows: a.1. Items having “information security” as a primary function; a.2. Digital communication or networking systems, equipment or components, not specified in paragraph 5A002.a.1; a.3. Computers, other items having information storage or processing as a primary function, and components therefor, not specified in paragraphs 5A002.a.1 or .a.2; N.B. : For operating systems see also 5D002.a.1 and .c.1. a.4. Items, not specified in paragraphs 5A002.a.1 to a.3, where the 'cryptography for data confidentiality' having a 'described security algorithm' meets all of the following: a.4.a. It supports a non-primary function of the item; […]
Skenai never shows unquoted regulation. This page is research and documentation, not legal advice, and it is not a determination on your product.
People who ask this also ask
- Is a telemetry radio export controlled?Usually yes, in the light sense: 3A991 or 5A002 rather than the USML.
- What does EAR99 mean?It means the item is subject to the EAR but is not listed on the Commerce Control List. It is a residual, not a clearance.
- Does my drone need an export licence?It depends on the ECCN and the destination country, not on the drone alone.
A general answer is not your answer.
The Interview asks 5 to 9 questions about your product, only the ones the entries turn on, and names the Determination free. The Dossier is the dated, cited record of how it was reached — the thing an investor or a prime asked for.
Free, no account. Dossier $249 if you want the record.