What Is Deemed Export?
Also known as: deemed exports, foreign person access, technology release to foreign national
Definition
A deemed export is the release or transfer of export-controlled technology or source code to a foreign person located in the United States. It is treated as an export to that person's home country and may require a license or other authorisation.
Deemed Export Explained
Export control law applies to information as well as shipments. Handing controlled technical data to a foreign national employee, visitor or contractor in the US, whether by showing drawings, sharing files, discussing in a meeting or giving system access, can count as an export. Under the EAR the release is treated as an export to the person's most recent country of citizenship or permanent residency. The ITAR treats such a release as an export as well, under its own definitions.
Which rules apply depends on classification. Items on the US Munitions List fall under ITAR, administered by the State Department. Items on the Commerce Control List fall under the EAR, administered by the Commerce Department. Each has exemptions, and a lawful permanent resident or protected individual is generally not a foreign person for these purposes. Companies should rely on their empowered official or export counsel for determinations.
Hiring and access control are the practical battlegrounds. HR screening for citizenship status, role-based access to document repositories, segregated project sites, and visitor controls reduce risk. Remote support also matters: an offshore IT or ERP consultant with admin rights may see controlled technical data in database tables, attachments or reports.
ERP and AI add new surfaces. A natural-language assistant that indexes drawings, BOMs and work instructions can answer a question for any user who can reach it, so access must follow the same classification and role rules as the source data. Running models inside the company boundary and filtering retrieval by user entitlement are common design choices.
Why It Matters
- Unauthorised release to a foreign person can be a violation even if nothing leaves the building.
- Penalties can be severe and can include fines and loss of export privileges.
- Support, consulting and cloud arrangements often create unnoticed exposure through admin access.
- AI search and chat tools can widen who sees controlled data unless entitlements are enforced.
In Practice
Example: a supplier of defense components runs its ERP with a third-party support team. Before granting database access, the company confirms where each engineer is located and their status, restricts attachment tables holding controlled drawings, and logs access. For an internal AI assistant, retrieval is filtered so users without clearance for a program never see its drawings in answers. The gotcha is a shared mailbox or shared folder that nobody classified.
Frequently Asked Questions
Is giving drawings to a foreign employee in the US an export?
It can be. Release of controlled technical data to a foreign person in the US is treated as an export to their country, and may require authorisation depending on classification.
Are green card holders foreign persons?
Generally no. U.S. lawful permanent residents and certain protected individuals are not treated as foreign persons under the rules, but confirm with your export compliance officer.
Does an AI assistant create deemed export risk?
It can if the assistant exposes controlled data to users or operators who are not authorised. Entitlement-aware retrieval and in-boundary hosting reduce the risk.
Related Terms
ITAR
ITAR (International Traffic in Arms Regulations) is the US State Department regulation, at 22 CFR Parts 120-130, that controls the export of defense articles, defense services, and related technical data listed on the United States Munitions List.
EAR (Export Administration Regulations)
EAR (Export Administration Regulations) is the US Commerce Department regulation, at 15 CFR Parts 730-774, that controls the export, reexport, and transfer of dual-use commercial items, software, and technology through the Commerce Control List.
CUI (Controlled Unclassified Information)
CUI (Controlled Unclassified Information) is unclassified information created or possessed by the US government, or by a contractor on its behalf, that laws, regulations, or government-wide policy require to be safeguarded or restricted in dissemination.
NIST SP 800-171
NIST SP 800-171 is the National Institute of Standards and Technology publication that defines the security requirements for protecting Controlled Unclassified Information in nonfederal systems, and it is the technical baseline behind DFARS 252.204-7012 and CMMC Level 2.
Technical Data Package (TDP)
A technical data package (TDP) is the controlled set of drawings, models, specifications, standards, quality requirements and related documents that fully defines a product so it can be manufactured, inspected and accepted.
Go Deeper
ITAR Compliance Checklist for Manufacturers
A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
Free ToolExport Control Screening Checklist
A 28-point checklist for screening every order, party, and shipment against EAR and ITAR requirements - restricted parties, classification, end-use, licensing, and documentation.
Free ToolITAR AI Workload Compliance Assessment
Score your AI deployments across eight dimensions of ITAR exposure, from technical data classification and US persons access control to technology control plan coverage.
Working with Deemed Export in a live environment? Our engineers do this every day - and our AI agents automate most of it.