ITAR and Export Control Software: Why a Foreign National Opening a CAD File Is Already an Export

Why export control fails quietly, and then all at once

An engineer needs a supplier to quote a bracket, so he shares a folder link. A contractor on the CAD team holds dual nationality and opens the assembly on a Tuesday. A repair unit arrives back from an overseas customer and goes onto the shop floor because the receiving clerk saw a returned goods number and not a controlled article. None of those three people did anything they understood to be wrong, and all three are potential unlicensed exports. The Empowered Official finds out four months later during an internal audit, and then has to decide whether to file a voluntary disclosure with the Directorate of Defense Trade Controls.

This is what makes ITAR different from almost every other compliance regime a manufacturer deals with. Under 22 CFR Parts 120 to 130 a release of technical data to a foreign person, even inside your own building in the United States, is deemed an export to that person's country. There is no shipment, no customs entry, no border. The violation is a file being opened. Quality and safety failures announce themselves. Export failures do not, which is why companies discover them in batches, years deep, usually during due diligence for an acquisition.

The consequences are why this gets board attention rather than manager attention: civil and criminal penalties per violation, and debarment from federal contracting, which for a defense manufacturer is the business. In our experience this is one of the few areas where the buyer is not trying to be talked into a budget. They want the truth about what a system can and cannot prevent.

Problem 1: classification is a backlog with one qualified person at the end of it

Every part, assembly, drawing, test report and piece of software has to be classified before anyone can decide what is allowed. Is it on the United States Munitions List and in which category, or is it subject to the Export Administration Regulations with an ECCN, or is it EAR99. That decision needs the Empowered Official or a trained trade compliance analyst, and there is one of them for tens of thousands of part numbers.

So classification happens on demand, when a quote or a shipment forces it, and the answer lives in an email. The same part gets classified twice differently by two people two years apart. Nobody can produce a list of everything the company has decided is USML Category VIII.

What a custom build does: make classification an object rather than an opinion. Each part or document has a classification record with the determination, the reasoning, the regulatory citation, the approver, the date, and a review trigger when the design changes. Because it hangs off your part master rather than off a separate spreadsheet, a new revision inherits and flags for re-review, and a bill of materials rolls up to show the highest classification in an assembly. That rollup is the thing people ask for constantly and cannot produce today.

Machine learning has a supporting role here and only a supporting one. A model reading part descriptions, drawing notes and specification references can propose a category with the relevant regulation text alongside it, which turns a blank page into a review. It cannot make the determination, and the system must be built so it cannot record one. The Empowered Official signs, or nothing is classified.

Problem 2: deemed export control is an HR and IT problem wearing a trade costume

To prevent a deemed export you need three facts joined together at the moment someone clicks a file: what is this data classified as, who is this person in terms of citizenship and immigration status, and is there a license or agreement authorising this release to that nationality. Trade compliance owns the first, HR owns the second, and IT owns the enforcement point. Almost nowhere are those three joined.

This is the most important gap in the entire category and it is precisely what the incumbent products do not close. Descartes Visual Compliance is genuinely excellent at restricted party screening and is built screening first. E2open carries deep global trade content and is aimed at large enterprise supply chains. SAP Global Trade Services is powerful and it presumes SAP as the transactional core, with its strongest ground in customs and export declarations rather than in engineering system access. OCR Services EASE handles license management competently. None of them sits inside Windchill, Teamcenter, your file storage or your source repositories deciding whether this person may open this file right now, because that is not what they were built to be.

What a custom build does: maintain a person register fed from HR with nationality, status, and the licenses or agreements each individual is named on, then enforce at the systems that hold the data. In practice this is a mix of provisioning integration, group membership driven by classification and nationality, and a gateway for the systems that cannot enforce natively. Where enforcement is genuinely impossible, the system at least detects and alerts within minutes rather than at the next audit. Being honest about that distinction matters, because a vendor promising perfect prevention across every tool you own is selling you something that does not exist.

Problem 3: licenses and agreements have scope, parties and a balance

A DSP-5 authorises specific articles or technical data, to specific parties, up to a value, until an expiry. A Technical Assistance Agreement names parties and sublicensees and scopes what may be discussed. Every shipment and every technical data release draws against one of these, and if you exceed the value or ship to a party outside the agreement, you have a violation even though you hold a license.

In most companies drawdown is tracked in a spreadsheet by the trade compliance team, updated after the fact from shipping records. That works until you have thirty active authorisations and a sales engineer promises a customer a design review next week.

What a custom build does: hold authorisations as structured records with articles, parties, value, provisos and expiry, and make every controlled transaction consume against them at the moment it happens. Shipments draw value. Technical data transfers record against the TAA that permits them. Provisos become checklists that must be satisfied rather than paragraphs somebody skimmed once. The system then answers the questions people cannot answer today: how much is left on this license, which agreements expire in ninety days and have open work against them, and which parties are receiving data with no authorisation covering them.

Problem 4: screening happens once, and the world keeps moving

Most companies screen a customer at onboarding and a shipment at order entry. Restricted party lists change constantly. A supplier you cleared two years ago may now be on the Entity List, and an ownership change can bring a party into scope without their name changing at all.

What a custom build does: rescreen the entire master of customers, suppliers, freight forwarders, visitors and employees on a schedule, and on every change to the lists, with a hit review queue that records the disposition and the reasoning. False positive management is the real work, because a screening system that produces two hundred hits a day gets ignored. The value is a defensible record showing that every hit was reviewed by a named person with a reason, which is what an auditor actually asks for.

Problem 5: your developer may be your first violation

This is the part most agencies will not raise with you, so we will. If a development team includes foreign persons and those developers can see production technical data, your compliance system has itself created deemed exports. It is a genuinely common way for this to go wrong, because everybody is focused on the engineers and nobody thinks about the contractors building the tool.

The architecture has to answer it up front. Development and testing happen against synthetic data that contains no controlled technical data. Production environments sit in a US region with access restricted to US persons, commonly in a government cloud region if your contracts require it. Support access is brokered and logged rather than standing. If your contracts bring CMMC obligations and NIST SP 800-171 controls for controlled unclassified information, the hosting and access model has to be designed for that from the first sprint, not retrofitted, because retrofitting an environment boundary is close to rebuilding.

Any developer who does not raise this in the first conversation has not built for a defense manufacturer, and you should treat that as disqualifying rather than as a detail to sort out later.

What this costs and how long it takes

A first release covering the classification workspace tied to your part master, the person register with HR integration, the license and agreement register with drawdown, and immutable logging runs $90,000 to $190,000 in 14 to 20 weeks. A full platform adding enforcement integration with PLM and file storage, continuous rescreening with hit disposition, technical data transfer request workflow, visitor and facility access control, and audit and disclosure reporting runs $250,000 to $600,000 over 9 to 15 months.

Cost drivers here are unusual. The compliant hosting environment is a real line item rather than a rounding error, particularly under CMMC obligations. PLM integration depth matters because Windchill, Teamcenter and 3DEXPERIENCE each have their own permission models and none of them was designed for nationality based access. The number of systems requiring enforcement is the multiplier that people underestimate: engineering vault, file shares, email, source control, the ERP (Enterprise Resource Planning), and the shop floor viewer are six integrations, not one. What keeps cost down: start with classification and the person register, because together they are the foundation everything else needs and they deliver value on their own.

Build versus buy, honestly

Buy if your exports are occasional and mostly EAR99, you employ no foreign persons in engineering, and your main need is restricted party screening. Descartes will do that well for a fraction of a build. Buy SAP GTS if you are a large SAP shop whose primary volume is customs and export declarations rather than engineering data access, because reproducing customs content is not a sensible use of a development budget.

Build when two or more of these are true. You hold ITAR controlled technical data and employ foreign persons anywhere in the organisation. You cannot produce, today, a report of who accessed a given controlled drawing in the last year. Your classification decisions live in email. You track license drawdown in a spreadsheet after the fact. Or you have already filed a voluntary disclosure and committed to remediation, in which case you need an auditable system rather than a better process document.

How to choose a developer for export control software

Ask, in the first meeting, how they will keep controlled technical data away from their own team. If they do not have an immediate answer involving synthetic development data, a US person production boundary and brokered support access, end the conversation.

Ask them to model the objects. Classification determination, authorisation, party, person with nationality and status, controlled transaction and access event should be distinct, and the audit log should be append only by design. If they propose a permissions matrix and a document library, they are building a file sharing product.

Ask what enforcement actually looks like in your engineering vault, by product name and version, and what happens for systems that cannot enforce natively. Prefer the developer who tells you which cases are detection rather than prevention over the one who promises prevention everywhere.

Ask who owns the code, the repository and the cloud accounts, and get it in the contract before kickoff. At Digital Heroes the client owns it from the first commit. In this category you may need to demonstrate the control environment to an auditor or to a government customer, and pointing at a system your vendor controls is not a demonstration.