Export control is the compliance layer that sits above quality, cost and lead time in any defence, aerospace or dual-use electronics programme — and it is the one most likely to stop a shipment that is otherwise perfect. A board can pass first article, meet IPC Class 3, and still be held at the border if its technical data or its finished function falls under an export-control regime that the supplier cannot satisfy.
This guide explains how the two main regimes interact with PCB and PCBA sourcing, what ITAR and ECCN classification actually mean for a build, the documentation a buyer should request from a supplier, and the structural choices that keep a controlled programme compliant. It is written for procurement and hardware engineers sourcing boards for regulated markets, not as legal advice.
The Two Regimes That Matter
Two distinct regimes govern electronics exports from the United States and, by extension, the sourcing decisions of companies in its supply chain. They are frequently conflated, but they have different scopes and different consequences for a PCB programme.
ITAR — defence articles and services
The International Traffic in Arms Regulations control the export of defence articles and defence services listed on the United States Munitions List. The critical feature is that ITAR governs technical data, not just hardware. Sending a Gerber file, a schematic, a layout database or even a detailed engineering description to a foreign manufacturer can itself constitute a controlled export, regardless of whether the finished board is military. A PCB that performs a purely commercial function can carry ITAR-controlled technical data if it is part of a defence system.
EAR and ECCN classification
The Export Administration Regulations cover dual-use items — commercial technology with potential military or surveillance application. Each item carries an Export Control Classification Number. Most ordinary PCBs fall under the mass-market or EAR99 categories and face minimal restriction, but certain high-speed, high-density or radiation-hardened boards can carry a specific ECCN that imposes licensing conditions. The classification attaches to the item's capability, not to the customer's industry.
Key Takeaway: The controlling question is not "is my product military?" but "is my technical data or my item's capability controlled?" A commercial-looking board destined for a defence programme, or a high-speed board with a dual-use ECCN, both carry obligations. Establish the classification before sending any design data to a supplier, because the export happens at the moment of transmission.
Why This Changes the Sourcing Decision
Export control does not automatically rule out offshore manufacturing, but it changes how the relationship has to be structured. The practical constraints are specific and worth understanding before committing to a supply chain.
ITAR technical data generally cannot go offshore
A design whose technical data is ITAR-controlled normally cannot be sent to a non-US manufacturer without a licence or an approved Technical Assistance Agreement. In practice this confines ITAR-controlled fabrication and assembly to facilities inside the United States or to a small number of approved allied locations. For a defence programme, the compliance question is often decided before any cost comparison begins.
EAR-controlled designs need a documented framework
Boards under a specific ECCN can often be built offshore where the destination is not embargoed and the supplier contractually accepts the applicable restrictions. The framework typically requires a technology-control plan, restricted access to design data, and a prohibition on the supplier using the technology for its own products. Without those clauses the arrangement is non-compliant even where the destination itself would be permitted.
End-use and end-user screening applies regardless
Separately from the item classification, most jurisdictions screen the end use and end user. A supplier's or a customer's presence on a restricted-party list blocks a transaction even for EAR99 goods. Buyers should expect to provide end-use declarations and should confirm that their supplier performs its own restricted-party screening as part of order intake.
The practical effect is that export control is a due-diligence item alongside quality and financial checks, not a separate legal exercise. The supplier due diligence guide and the aerospace and defence PCB guide cover the adjacent verification work.
Documentation to Request from a Supplier
Compliance is demonstrated with documents, not assurances. A supplier participating in a controlled programme should be able to produce the following, and a buyer should request them before releasing a first order rather than after a hold at the border.
| Document | What it demonstrates | When to request |
|---|---|---|
| Technology Control Plan | How controlled design data is segregated, stored and access-restricted | Before any design data is transmitted |
| NDA and IP ownership agreement | Design remains the buyer's; supplier has no reuse rights | At quotation stage |
| Restricted-party screening record | Supplier screens end users and parties against denied-party lists | At order intake |
| End-use / end-user declaration | The declared application and destination for the goods | With the purchase order |
| Country-of-origin statement | Origin of the board and of the components used | With shipping documents |
| Classification confirmation | The ECCN or EAR99 status of the items supplied | At quotation stage |
Two of these are frequently skipped and cause the most trouble. The technology control plan matters because the export happens on transmission — a supplier without one cannot demonstrate that design data was handled within a controlled environment. Country-of-origin statements matter because origin affects duty treatment and can affect eligibility for certain programmes, as covered in the import duty and landed cost guide. Component origin is also an integrity concern, discussed in the counterfeit detection guide.
How to Structure a Controlled Programme
Where a design is export-controlled but offshore assembly remains permissible, the arrangement is normally structured to minimise the amount of controlled information that leaves the buyer's control. Three techniques do most of the work.
Split the design: keep controlled data onshore
The most common approach is to keep the controlled design work — and any ITAR-technical-data portion of it — with a domestic partner, while routing uncontrolled sub-assemblies offshore. A board whose controlled function is confined to a small subcircuit can sometimes be partitioned so that only the uncontrolled portion is outsourced. The contract manufacturing IP protection guide covers the agreements that enforce the split.
Restrict the data actually transmitted
Where full design data must be shared, reduce what travels. Gerber and drill files alone reveal far less than a complete schematic and layout database, and IPC-2581 or ODB++ packages can be prepared with the netlist intelligence removed. Send the minimum data set the supplier needs to build, not the archive the design team holds. The data format guide covers what each format contains.
Contract the constraints explicitly
The agreement should state the classification, prohibit use of the technology for any other purpose, prohibit sub-contracting to third parties without written approval, require notification of any restricted-party match, and require return or certified destruction of controlled data at programme end. Generic confidentiality clauses do not cover export-control obligations; the constraint has to be named.
Traceability is the fourth pillar and the one that regulators examine during an audit. Every unit should be traceable to its production lot, its material batch and its inspection records, so that a controlled build can be reconstructed end to end. The PPAP guide describes the documentation structure that supports this, and the serialisation and traceability guide covers unit-level marking.
Procurement tip: Ask for the classification and the technology control plan in the same message as your RFQ, before you send any design data. A supplier who has answered this question before will respond with documents. A supplier who has not may ask you to send the Gerbers first to "check feasibility" — which is the moment the controlled data leaves your control, and the moment the compliance question has already been answered the wrong way.
Red Flags in a Supplier Relationship
Most export-control failures are structural rather than deliberate, and they show up as specific behaviours early in a supplier conversation. The signals worth acting on:
No familiarity with classification
A supplier who cannot state whether a product is EAR99 or falls under an ECCN, and who cannot explain how it handles controlled data, is not set up for controlled work. This is not dishonesty — many capable commercial factories simply operate outside this regime and have no process for it.
Requests for more data than the build requires
Fabrication and assembly need Gerbers, drill files, a BOM and an assembly drawing. A request for a full schematic set or firmware images on a board where neither is needed is a signal to reduce the data package rather than a reason to comply.
Sub-contracting without disclosure
Export-control obligations do not survive silent sub-contracting. Confirm in writing which processes are performed on site and which are outsourced, and require approval before any change. The dual sourcing guide covers how a second source should be qualified rather than added ad hoc.
Summary / Next Steps
Export control sits above cost and quality in a regulated programme, and it turns on classification rather than on whether a product looks military. Establish whether the design's technical data is ITAR-controlled or the item carries an ECCN before transmitting anything. Where offshore assembly is permissible, restrict the data transmitted, contract the constraints explicitly, and require a technology control plan and restricted-party screening from the supplier. Documentation is what demonstrates compliance — request it at quotation stage, not after a hold at the border.
Huaxing PCBA supports commercial and dual-use programmes with documented NDAs, IP ownership agreements, restricted-party screening and country-of-origin statements, from a facility running 8 SMT lines and 4 DIP lines under IATF 16949 and ISO 9001. Controlled ITAR programmes require domestic sourcing and are outside the scope of an offshore build. Send your Gerber and BOM with your classification requirements for a compliance-aware quote within 24 hours.
