ITAR compliance updates: Recent changes and new regulations
In today's regulatory landscape, you can't take a set-it-and-forget-it approach to compliance. Companies across industries—from manufacturing to technology, healthcare to finance—are grappling with a constant influx of new regulations. Since 1981, the U.S. has averaged one new manufacturing-related regulation per week. This makes it tough for businesses to keep up with the latest changes to compliance standards. This is especially true with the International Traffic in Arms Regulations (ITAR).
What is ITAR compliance?
ITAR is a set of U.S. government regulations that control the export and import of defense-related technology and services. Compliance entails registering with the Directorate of Defense Trade Controls (DDTC), ensuring ITAR data stored in the cloud is not accessed by foreign entities, and implementing strict access controls. If your business deals with items on the United States Munitions List (USML), you must comply with ITAR.
The State Department’s DDTC manages the list of businesses that can deal in USML services and goods. But it's up to each business to establish the right policies to ensure they are ITAR compliant.
Recently, the U.S. Department of State has made amendments to ITAR. Among other things, these updates provide better governance and clearer definitions of current laws. As the U.S. refines and expands ITAR, businesses must stay vigilant in addressing new changes.
Recent changes to ITAR compliance
Over the past few years, the State Department has attempted to make it easier to comply with ITAR. They've introduced new amendments that have accomplished just that. Below are some of the most recent and consequential updates made to ITAR.
Defining which activities aren’t exports
On March 25, 2020, the State Department added amendments that clarified the “activities that are not exports.” For instance, unclassified technical data that is transferred outside the U.S. (using end-to-end encryption) is no longer defined as an “export.”
With the rise of cloud storage, adhering to ITAR posed challenges for businesses. Before the changes, data storage and transfer overseas required a specific license from the Directorate of Defense Trade Controls. However, cloud storage locations created concerns that companies might be unable to protect sensitive data from foreign entities. The March 2020 update lets companies under ITAR export rules migrate data to the cloud as long as the data is fully encrypted from start to finish.
Announcement of “multi-year multi-rule” project
On March 23, 2022, the State Department launched a “multi-year multi-rule project” to revise the ITAR. The plan restructures and consolidates ITAR to improve organization and clarity. More specifically, this plan improves ITAR by eliminating redundant provisions, clarifying language, and simplifying the regulatory framework.
Updates to Part 120
On September 6, 2022, the first update came into effect. The new rule restructures part 120 of the ITAR to “better organize the purposes and definitions of the regulations.”
Responses and minor amendments
The State Department received and reviewed the response to the new changes. On February 27, 2023, they finalized the latest changes and made minor amendments in response to public comments. These changes aim to clarify the regulations and ensure consistency with definitions and approved information collections.
Expansion of the types of defense articles and services that may be exported
The State Department has expanded the types of defense articles and services that can be transferred under certain treaties and Canadian exemptions. Effective May 12, 2023, the amendments include specific changes to defense articles related to torpedoes, submarine combat control systems, and other categories. These updates aim to improve trade relations with allies, including the U.K. and Australia.
Revisions to the U.S. Munitions List
Effective May 21, 2023, the State Department made changes to the USML. These updates include the removal of specific high-energy storage capacitors from the USML Category XI, the clarification of which capacitors still require control under USML, and the introduction of a 125-volt criterion for these capacitors. The updates to ITAR focus on defining the items that no longer provide a critical military or intelligence advantage. These changes are part of ongoing efforts to ensure that ITAR aligns with current technological standards and commercial practices.
Debarment on individuals convicted of violating the Arms Export Control Act
Effective June 15, 2023, the State Department imposed a debarment on individuals convicted of violating the Arms Export Control Act (AECA). These individuals are prohibited from participating in activities regulated by the ITAR for three years unless reinstated. This change underscores the importance of compliance with export control laws and the consequences of violations.
Staying up to date on the latest ITAR developments
Keeping up with ITAR compliance is essential, especially given that the “multi-year multi-rule project” is still underway. Recent amendments (e.g., updates to policies on handling technical data) can be enormously consequential. It’s good practice to re-examine your company’s process for handling international data and exports. That way, you can make sure to check all the boxes for the latest ITAR requirements.
—
Are you interested in diving deep into workplace compliance? Check out our recent eBook, “Outdated workplace compliance management is a threat to business success,” to learn more.