U.S. Export Controls Risk: How the EAR and the Entity List Work and What They Mean for Companies and Governments

Air cargo being loaded into an aircraft hold at night — Export controls follow the item, the technology, and the end user. Photo: Envato.

Export controls decide who gets the technology. Sanctions cut off money; export controls cut off chips, tools, software, and know-how, and with them a rival’s ability to build. The governing statute says so plainly: “The national security of the United States requires that the United States maintain its leadership in the science, technology, engineering, and manufacturing sectors, including foundational technology that is essential to innovation” (50 U.S.C. § 4811). Since 2019 the Commerce Department has used that authority to reshape the semiconductor industry, reach factories in Asia and Europe, and set the terms on which advanced artificial intelligence chips are sold. For a company, the risk is not only shipping the wrong item. It is a customer added to a list overnight, a foreign-made product that turns out to be “subject to the EAR,” or an engineer in your own lab who counts as an export.

This page explains how U.S. export controls work, how they became an instrument of technology competition, what enforcement looks like, and what executives and the officials who advise exporters should do about it. It is the second in a series on enforcement risk; sanctions have their own page, and investment screening, foreign agent registration, foreign bribery, forced-labor import bans, and data security get theirs. This is a general overview of public law and agency records, not legal advice. Anyone facing a specific question should talk to export control counsel.

U.S. export controls at a glance

Legal basis: the Export Control Reform Act of 2018 (ECRA), enacted in the fiscal 2019 defense authorization act (Pub. L. 115-232), is the permanent statute for “dual-use” items, those with civilian and military uses. Unlike its predecessors, it has no expiration date (Congressional Research Service). Defense articles fall under the Arms Export Control Act.
Who runs it: the Commerce Department’s Bureau of Industry and Security (BIS) writes the Export Administration Regulations (EAR), issues licenses, keeps the restricted-party lists, and enforces. The State Department’s Directorate of Defense Trade Controls administers the International Traffic in Arms Regulations (ITAR) for the U.S. Munitions List, where “a license is required for nearly all USML exports” (CRS). The Justice Department prosecutes willful violations.
What is controlled: items on the Commerce Control List carry an Export Control Classification Number (ECCN) that, read against the destination, determines whether a license is needed (15 C.F.R. part 774). Items subject to the EAR but not on the list are EAR99. EAR99 is not a free pass: such goods generally need a license for embargoed destinations (IHK Region Stuttgart), and many need one for Russia (Bass, Berry & Sims).
The lists: the Entity List names foreign parties for which there is “reasonable cause to believe, based on specific and articulable facts,” that they pose a significant risk of activities “contrary to the national security or foreign policy interests of the United States” (15 C.F.R. § 744.11); most listings require a license for every item subject to the EAR. The Military End-User List covers listed military end users in Burma, Cambodia, China, Nicaragua, and Venezuela (§ 744.21). The Unverified List names parties BIS could not verify through an end-use check; exporters must first obtain a signed “UVL statement” (§ 744.15).
Reach beyond U.S. borders: the EAR follow U.S.-origin items through reexports and transfers abroad. Foreign-made items are caught two main ways. Under the de minimis rules, controlled U.S. content above 25 percent of value, or 10 percent for certain embargoed destinations, brings a foreign product under the EAR, and some items have no de minimis level at all (15 C.F.R. § 734.4). Under the foreign direct product rules, an item made with specified U.S. technology, software, or equipment can be covered with no U.S. content inside.
Deemed exports: “Any release in the United States of ‘technology’ or source code to a foreign person is a deemed export to the foreign person’s most recent country of citizenship or permanent residency” (§ 734.13(b)).
Civil penalties: the greater of a set amount or “twice the value of the transaction” per violation, plus license revocation and denial of export privileges (50 U.S.C. § 4819). The inflation-adjusted figure, effective January 15, 2025, is $374,474 (Federal Register); the Office of Management and Budget told agencies on April 17, 2026, that they “will continue using the 2025 civil monetary penalty levels” (OMB M-26-11). Under the ITAR, the maximum is “the greater of $1,271,078 or the amount that is twice the value of the transaction” (Federal Register).
Criminal penalties: willful ECRA violations carry fines of up to $1,000,000 and, for individuals, up to 20 years in prison (§ 4819(b)).
Records and disclosure: EAR records “must be retained for five years” (§ 762.6). Under BIS rules effective September 16, 2024, minor violations can be self-disclosed in an abbreviated narrative, a voluntary self-disclosure caps the base penalty in egregious cases at half the statutory maximum, and a deliberate decision not to disclose a significant violation is an aggravating factor (Dechert).

How export controls became a strategic instrument

How U.S. Export Controls Grew: timeline chart of key laws, rules, and cases — How U.S. Export Controls Grew. Chart: Competitive Futures.

Peacetime controls began with the Cold War. The Export Control Act of 1949 created “the first comprehensive system” of them, and the Export Administration Act of 1979 served as the dual-use authority until it last expired in 2001; presidents then kept the system running under emergency powers, most recently Executive Order 13222 (CRS). Multilateral coordination moved to the Wassenaar Arrangement, founded in 1996 and now 42 states, where “All Plenary decisions are taken by consensus” and each state acts at its “national discretion” (Wassenaar Arrangement).

ECRA, signed in August 2018, made the system permanent and directed an interagency process to identify “emerging and foundational technologies” for control (CRS). The turn to technology competition came quickly. On May 16, 2019, BIS added Huawei and 68 non-U.S. affiliates to the Entity List (Federal Register). When Huawei kept sourcing chips from foreign foundries, BIS amended the foreign direct product rule on May 15, 2020, and widened it on August 17, 2020, to reach foreign-made items destined for Huawei that were produced with specified U.S. technology, software, or tools (Mayer Brown).

The tool was then applied to a whole economy. On October 7, 2022, BIS issued rules to “restrict the PRC’s ability to obtain advanced computing chips,” supercomputer capabilities, and advanced chipmaking equipment (BIS). It tightened them on October 17, 2023 (BIS), and on December 2, 2024, added 24 types of chipmaking equipment, high-bandwidth memory, 140 Entity List entries, and two new foreign direct product rules (BIS). Russia controls expanded in parallel after February 2022; BIS, the European Union, Japan, and the United Kingdom publish a Common High Priority List of 50 items “that Russia seeks to procure for its weapons programs” (BIS).

AI chip policy has changed repeatedly. BIS announced in May 2025 that it would rescind the January 2025 “AI Diffusion” rule and warned that using Huawei Ascend chips “risks violating General Prohibition 10” (Wiley). Effective January 15, 2026, BIS moved license review for chips such as the Nvidia H200 and AMD MI325X to China and Macau from a presumption of denial to case-by-case review, conditioned on U.S. supply certifications, a cap of 50 percent of the computing power shipped to U.S. customers, customer diligence, and U.S. third-party testing; reexports from other countries stay under a presumption of denial (Federal Register). On July 14, 2026, BIS’s under secretary told a House committee that H200 shipments had begun but were “very few” (Reuters via Yahoo Finance).

The newest change concerns ownership. On September 29, 2025, BIS extended Entity List and Military End-User restrictions to foreign entities 50 percent or more owned by listed parties, an export-control counterpart to OFAC’s 50 Percent Rule (Pillsbury). After U.S.-China talks in South Korea, BIS suspended this “Affiliates Rule” effective November 10, 2025: “The suspension is set to end November 9, 2026, absent a future extension” (Federal Register). China suspended its October 2025 extraterritorial rare earth controls until November 10, 2026 (Jones Day). On September 23, 2026, the Treasury secretary said the truce would run two more months, to January 10, 2027, but as of late October BIS had not published a notice changing the rule’s date (Pillsbury; Miller Canfield).

What the risk looks like in practice

The cases below run in date order. Most are administrative settlements with BIS; guilty pleas and criminal charges are noted, and charges are allegations until proven. Several involve foreign subsidiaries or foreign-made goods, the exposures companies most often miss.

ZTE (2017–2018): a broken promise reactivates the ban

In March 2017 the Chinese telecom maker settled over exports to Iran and North Korea, including 283 shipments of controlled items to North Korea, with a BIS civil penalty of $661 million, $300 million of it suspended, and a seven-year suspended denial order (Commerce Department); ZTE pleaded guilty to the criminal charges (Treasury). In April 2018 BIS activated the denial order after finding that ZTE had said it “would or had disciplined” employees while instead paying them bonuses. A June 2018 settlement added a $1 billion penalty, $400 million in escrow, and compliance coordinators “selected by and answerable to the Department” for 10 years (Commerce Department). Lesson: a settlement is an ongoing obligation, and a denial order can stop a supply chain within days.

Seagate (2023): foreign-made does not mean free

On April 19, 2023, BIS imposed a $300 million civil penalty on Seagate Technology and its Singapore affiliate. BIS said that from August 2020 to September 2021 Seagate made 429 shipments of about 7.4 million foreign-produced hard disk drives, worth about $1.1 billion, to Huawei without authorization under the foreign direct product rule. Seagate admitted the conduct and accepted a multi-year audit requirement and a five-year suspended denial order (BIS). Lesson: if U.S. tools or technology make your product, U.S. rules can follow it, even with no U.S. parts inside.

Cadence Design Systems (2025): the alias was known

On July 28, 2025, the chip-design software company agreed to plead guilty to conspiracy to commit export control violations and to pay “criminal and civil penalties and forfeiture totaling more than $140.6 million.” Prosecutors said that from 2015 to 2021 Cadence and its Chinese subsidiary exported design tools at least 59 times to a customer the company knew was “an alias for NUDT,” a Chinese military university on the Entity List (Justice Department). The BIS civil penalty was $95,312,000, partly credited against the criminal fine and forfeiture (DLA Piper). Lesson: a clean name screen does not help when staff know who stands behind the name, and a subsidiary’s sales are the parent’s problem.

Applied Materials (2026): assembly abroad does not change origin

On February 11, 2026, BIS announced a $252,500,300 settlement with Applied Materials and its Korean subsidiary, the statutory maximum of twice the transaction value (BIS settlement documents) and the second-largest penalty in BIS history. BIS said ion implanters worth about $126 million went to Korea for assembly and then to a Chinese chipmaker on the Entity List since 2020 (BIS), identified by counsel as SMIC. BIS rejected the argument that the Korean work was a “substantial transformation” making the tools foreign (Arnold & Porter). Applied admitted the conduct and must complete two annual audits. Lesson: customs ideas of origin do not decide export-control jurisdiction, and routing through an ally does not reset it.

Super Micro-linked indictment (2026): AI servers through a third country

On March 19, 2026, federal prosecutors in Manhattan charged a co-founder of a U.S. server maker, a manager in its Taiwan office, and a broker. The indictment alleges that a Southeast Asian company bought about $2.5 billion in servers in 2024 and 2025 at the defendants’ direction, that at least about $510 million of servers with controlled graphics processors were diverted to China, and that the defendants staged “dummy” servers to pass an audit and a Commerce inspection. The charges include conspiracy to violate ECRA, and the defendants are presumed innocent (Justice Department). The company, Super Micro Computer, was not charged and said it was cooperating (Washington Times). Lesson: third-country resellers are the main diversion channel for AI hardware, and insiders can defeat a paperwork-based program.

Container Manufacturing (2026): EAR99 parts and a bank’s warning

An Ohio maker of can-production equipment agreed in August 2026 to a $1,000,000 civil penalty over $264,721 in EAR99 spare parts sent to a Russian customer from 2023 to 2025, some through a distributor in the United Arab Emirates and some naming a Turkish consignee. The company admitted the conduct (BIS order). Counsel note that it kept shipping after its bank declined Russia-related payments, and conclude that “EAR99 does not mean license-free” (Bass, Berry & Sims). Lesson: low-tech goods are controlled for Russia, a clean screen is not authorization, and a bank’s refusal is a red flag.

Smaller cases make the same points: in January 2026 Germany’s Exyte paid $1.5 million, reduced by a voluntary self-disclosure, after its Shanghai unit transferred items to an Entity List chipmaker inside China (Torres Trade Law via Legal 500). In March 2025 the commerce secretary signaled a “dramatic increase” in enforcement, and BIS leadership named diversion through China and Hong Kong to Russia, Iran, and North Korea a top priority (DLA Piper).

What it means for companies

Classification and screening are necessary and not sufficient; the cases above turned on aliases, subsidiaries, foreign production, and ignored red flags.

Microchip on a circuit board, the kind of item U.S. export controls can reach even when made abroad — Under the foreign direct product rules, U.S. export controls can follow a chip made abroad with U.S. technology. Photo: Envato.

Classify everything, including foreign-made products. Know the ECCN or EAR99 status of what you sell, and run de minimis and foreign direct product analyses on items made abroad with U.S. content, software, or equipment.
Screen ownership, aliases, and addresses. Check customers, consignees, and intermediaries against all three Commerce lists and the sanctions lists. Map which counterparties are 50 percent or more owned by listed parties now; that work takes months if the Affiliates Rule returns.
Treat red flags as stop signs. BIS guidance flags a customer who “is reluctant to offer information about the end-use of a product,” a product whose “capabilities do not fit the buyer’s line of business,” and a freight forwarder named as the final destination, and warns: “Do not put on blinders that prevent the learning of relevant information” (15 C.F.R. part 732, supp. 3).
Control technology, not only goods. Map who can reach controlled technology and source code, including foreign-national staff, visitors, and cloud repositories, and obtain deemed export licenses where needed.
Govern subsidiaries and channel partners. Extend policies, training, and audits to subsidiaries and distributors, and contract for end-use certifications, audit rights, and termination on listing or diversion.
Disclose early. A voluntary self-disclosure lowers the penalty ceiling, as Exyte’s reduced penalty shows, and deliberate silence counts against you.

Forecasting export control risk

Export controls are policy outputs, and the policy is visible before it lands. Useful signposts include BIS rules and guidance naming technologies or destinations; Entity List additions that hit a customer’s parent, peers, or suppliers; congressional letters and defense bills proposing chip or tool restrictions; enforcement releases describing diversion routes; allied lists such as the Common High Priority List; and the calendar of U.S.-China negotiations, which has visibly paced the Affiliates Rule. Competitive intelligence and foresight help by building scenarios for each key market and product line, such as a tightening, a loosening, or the listing of a top customer, and by stating in advance which indicators would change the assessment. In this regime the rules themselves move, so a program that checks only today’s list is planning for last quarter.

What it means for governments advising their companies

Trade ministries, export-promotion agencies, and embassy commercial sections increasingly hear the same question: why does U.S. law apply to goods made here? Because the EAR attach to items, not only to companies.

Stacked shipping containers at a port, where export controls on reexports and transshipment are enforced — Reexports and transshipments through third countries are where many export controls diversion cases begin. Photo: Envato.

Reach follows the item. A product made abroad can be subject to the EAR through U.S. content above de minimis thresholds, through a foreign direct product rule, or because it was U.S.-origin and only assembled locally, as Applied Materials found. Chambers that brief members say so directly: IHK Region Stuttgart tells German companies that “Das US-Exportkontrollrecht ist extraterritorial ausgestaltet” (U.S. export control law is designed with extraterritorial reach), while noting that German authorities enforce only German and EU law and that a U.S. connection is required (IHK Region Stuttgart).

Allied regimes overlap but do not match. The European Union’s dual-use list in Annex I to Regulation (EU) 2021/821 is updated yearly; the update adopted September 8, 2025, added quantum computing items and chipmaking equipment, reflecting regime decisions and commitments member states accepted to control further items uniformly (European Commission). Japan has required licenses since July 23, 2023, for 23 types of advanced chipmaking equipment under its Foreign Exchange and Foreign Trade Act, with a simpler process for 42 partner destinations (Hogan Lovells). The Netherlands introduced national licensing for advanced chipmaking equipment on September 1, 2023, and expanded it effective April 1, 2025; its trade minister said, “We believe it is important to maintain control over who gains possession of what technology” (Government of the Netherlands). Because the Dutch measure covers all non-EU destinations while U.S. rules turn on destination and end user, one machine can need a license under one system and not the other.

Home governments have their own tools. The Dutch government used its Goods Availability Act to intervene in the chipmaker Nexperia on September 30, 2025, and suspended the order on November 19, 2025 (Loyens & Loeff), and China’s 2025 rare earth controls asserted reach over foreign-made goods. Exporters can face demands from more than one capital at once.

How good briefings work. Useful advice is concrete: how to tell whether a locally made product is subject to the EAR; which U.S. lists matter for their customers; how U.S., EU, and national licensing differ; the diversion red flags BIS and allied agencies publish; and that a home-country license does not settle U.S. exposure. That service is useful whatever view a government takes of a given control.

Frequently asked questions

Do U.S. export controls apply to products made outside the United States?

Sometimes. A foreign-made item is subject to the EAR if its controlled U.S. content exceeds the de minimis level (generally 25 percent, 10 percent for certain embargoed destinations, and zero for some items), or if a foreign direct product rule applies because it was made with specified U.S. technology, software, or equipment. The Seagate and Applied Materials cases show how far this reaches.

What is the maximum civil penalty for an export control violation?

Under ECRA, the greater of $374,474 per violation or twice the transaction value, the level in effect since January 15, 2025, because the 2026 inflation adjustment was canceled. Under the ITAR, the greater of $1,271,078 or twice the transaction value. Willful ECRA violations can bring up to 20 years in prison.

Is a subsidiary of an Entity List company also restricted?

The Affiliates Rule would treat foreign entities 50 percent or more owned by listed parties as listed. It is suspended; the Federal Register notice says the suspension ends November 9, 2026, absent an extension, and a two-month extension to January 10, 2027, was announced but not yet published as of late October 2026. Even now, BIS can list subsidiaries by name, and knowing that an affiliate fronts for a listed party creates risk.

Can a company outside the United States sell EAR99 goods to anyone?

No. EAR99 items need a license for embargoed destinations, for many shipments to Russia, for listed parties, and for prohibited end uses. Container Manufacturing’s 2026 penalty involved EAR99 spare parts.

Can Nvidia H200-class chips be exported to China in 2026?

Only with a BIS license. Since January 15, 2026, BIS reviews such applications case by case, subject to volume caps, customer diligence, and U.S. third-party testing. More advanced chips, reexports from third countries, and military or listed end users remain under a presumption of denial. A BIS official said in July 2026 that “very few” H200s had shipped.