Export classification identifies the control status of an item and determines licensing, screening and recordkeeping obligations.

Jurisdiction first. Whether the item is controlled under the commercial regime, the defense regime, or another agency’s rules. Defense-controlled items carry far stricter requirements including registration and no de minimis allowance.

Classification. Assigning the applicable control classification, or concluding that the item is not specifically listed and falls into the residual category.

Who does it. The exporter is responsible. A supplier’s statement of classification is useful evidence and does not transfer responsibility, and should be verified for the specific configuration supplied.

Self-classification versus a ruling. A formal classification request from the agency provides certainty and takes time. Self-classification requires a documented technical analysis retained in the file.

Software and technology. Source code and technical data have their own classifications, and release to a foreign national domestically is an export.

Encryption items carry specific classification, reporting and self- classification requirements.

Reviewing the determination when a product changes. Classification made at launch and never revisited as the product gained capability is a recurring compliance failure.

Records of the analysis, the decision and the reviewer, retained for the statutory period.