ITAR or EAR: Start With Classification
Defense articles and technical data fall under ITAR and the US Munitions List, with relevant entries including categories covering fire control, laser and imaging systems, and spacecraft. Commercial and dual-use items fall under the EAR, with optics and lasers appearing in Category 6, including entries for optical components, sensors and lasers. Many shops build to a customer print and assume the customer classified it, but the manufacturer still has obligations for what it exports, who touches the data and whom it ships to.
Ask for the classification in the RFQ and record it against the part number.
- Record USML category or ECCN on the item and the customer order
- If unsure, ask the customer, a qualified export attorney or consultant, or the agencies
- Re-check when the customer changes the specification or end use
Deemed Exports and Foreign Persons
Releasing controlled technical data to a foreign person inside the US, including an employee, contractor or visitor, can be treated as an export. Optics shops often have diverse engineering and operator teams and share files over email, chat and cloud storage. Map who can access controlled drawings, test data and process recipes, and restrict access by role.
A technology control plan should cover visitors, shared drives, remote support and any vendor who can see your systems.
Customers, Destinations and Screening
Before you quote or ship to a foreign customer, screen the party and destination against the government restricted-party lists and confirm whether a license or exception applies. Optics sold into research labs, universities and distributors can be re-exported without your knowledge, so collect end-use and end-user statements where the item is sensitive. Keep records of screenings, licenses and shipments for the required retention period.
Try it here, free
EAR ECCN Self-Classification Worksheet
An editable worksheet to document how each part or technology was classified under the EAR: USML check, CCL category, ECCN, reasons for control and the evidence you relied on.
Where Systems and AI Tools Create Exposure
Controlled drawings and specifications flow through your ERP, email, CAD, quoting spreadsheets and increasingly through AI assistants. Uploading a controlled print to a public AI service or an uncontrolled SaaS tool can create a potential unauthorized release. If you use AI, keep processing inside your own controlled environment, enforce the same access rules as your document store and log what was processed.
Netray's approach is private, on-prem deployment so the customer controls the boundary, but the customer remains responsible for its own compliance program.
When This Is Not a Big Concern
A shop that makes only visible-light commercial optics from open catalogs, ships domestically and has no controlled customers may carry little export burden beyond restricted-party screening. Do not assume that is true of your work without checking classification, because a single customer program can change your exposure. Document the reasoning so a future audit or customer questionnaire has an answer.
Frequently asked questions
Are optical components subject to ITAR?
Some are. Optics specially designed for defense articles, certain infrared, night-vision, laser and space applications can be on the USML, while many others fall under the EAR. Classification depends on the item and its performance, so check the customer's classification and, if unclear, seek formal determination.
What is a deemed export?
A deemed export is the release of controlled technology or technical data to a foreign person within the United States. It is treated as an export to that person's home country. Optics shops should control access to controlled drawings, recipes and test data accordingly, including for employees, contractors and visitors.
Can I use cloud AI tools with export-controlled optics drawings?
Generally no, not unless the service is built and contracted to meet the relevant export and security requirements. Sending controlled technical data to an uncontrolled external service risks an unauthorized release. A private deployment inside your own boundary, with access controls and logging, is the safer pattern.
If you want AI-assisted quoting or document search over drawings without sending controlled data outside your network, talk to Netray about an on-prem design that fits your own compliance plan.