ECCN Classification: How to Find Your Export Control Number

You export a product from the United States. You check the rules. Your item is not on the Commerce Control List. You mark it as EAR99 and ship it without a license. Six months later, the Bureau of Industry and Security (BIS) sends you a letter. Your product needed a specific Export Control Classification Number (ECCN). The fine can be as high as $374,474 per violation, or twice the value of the deal (BIS, January 2025). This guide explains what an ECCN is, how to determine yours, and what happens when you get it wrong.

What Is an ECCN and Why Does It Matter?

An ECCN (Export Control Classification Number) is a five-character alphanumeric code used by the U.S. Department of Commerce to identify items subject to export controls under the Export Administration Regulations (EAR). It determines whether your product needs a license before it can leave the country. ECCNs are listed on the Commerce Control List (CCL), which is maintained by the Bureau of Industry and Security.

Unlike an HS Code (Harmonized System Code), which customs authorities use to calculate duties and tariffs, an ECCN focuses on national security and foreign policy. Two products with the same HS Code can have completely different ECCNs — because the ECCN is based on what the product can do, not what category it falls into for tariff purposes.

According to the Bureau of Industry and Security, ECCNs categorize items based on "the nature of the product, i.e. type of commodity, software, or technology and its respective technical parameters." This means the classification depends on technical specifications, intended use, and the potential for military or dual-use applications.

How Is the ECCN Structure Organized?

Each ECCN follows a consistent five-character format. The first digit (0–9) represents the category, and the second character (A–E) represents the product group. Together, they tell you exactly where the item sits on the Commerce Control List.

The ten categories cover nuclear materials and facilities (0), materials and chemicals (1), materials processing (2), electronics (3), computers (4), telecommunications (5), sensors and lasers (6), navigation and avionics (7), marine (8), and aerospace and propulsion (9). The five product groups are equipment, assemblies, and components (A), test, inspection, and production equipment (B), materials (C), software (D), and technology (E).

For example, ECCN 3A001 refers to electronic components in category 3, product group A. ECCN 5D002 refers to encryption software in category 5, product group D. Understanding this structure helps you search the CCL efficiently instead of browsing hundreds of entries at random.

What Does EAR99 Mean — and What Are Its Limits?

EAR99 is the default designation for items that fall under the EAR but are not listed on the Commerce Control List. Most commercial products — consumer electronics, basic industrial equipment, standard office supplies — are EAR99. According to the Bureau of Industry and Security, "EAR99 items generally consist of low-technology consumer goods and do not require a license in most situations."

But EAR99 does not mean exempt. Three conditions can still trigger a license requirement:

• Embargoed or sanctioned countries. Shipping EAR99 items to North Korea, Iran or Cuba needs a license in most cases. Since September 2025, EAR99 items can go to Syria under License Exception SPP (15 CFR 740.5).

• Denied parties or entities of concern. Even low-technology goods cannot go to parties on the Entity List or Denied Persons List without authorization. For parties on the Unverified List, you must first get a signed UVL statement (15 CFR 744.15).

• Prohibited end-uses. If you know or have reason to know the item will be used in weapons development, nuclear activity, or other restricted applications, a license is required regardless of the ECCN.

As the Reidel Law Firm notes, a common classification mistake is "relying solely on product descriptions provided by suppliers or manufacturers." Just because your supplier says a product is EAR99 does not release you from verifying it independently.

What Happens When You Classify Incorrectly?

Wrong classification can trigger administrative penalties, criminal charges, and loss of export privileges. The consequences are not theoretical — BIS enforcement is accelerating in 2025 and 2026, with record-setting fines and congressional proposals to raise penalty ceilings even higher.

Administrative penalties: As of January 15, 2025, the maximum is $374,474 per violation or twice the value of the transaction, whichever is greater. This amount is adjusted annually for inflation.

You will also see the figure $300,000 quoted for the same penalty, and both numbers are correct — they are the same ceiling at two different points. 50 U.S.C. §4819(c) sets the statutory civil penalty at “not more than $300,000 or an amount that is twice the value of the transaction … whichever is greater,” and the Federal Civil Penalties Inflation Adjustment Act then raises that number by notice. The Commerce Department’s most recent adjustment, 89 FR 106308, effective January 15, 2025, moved the 50 U.S.C. 4819 maximum “from $364,992 to $374,474.” That is still the most recent Commerce adjustment on the Federal Register as of September 2026, so $374,474 remains the operative ceiling. It is the kind of number that moves by notice rather than by headline, so check the current adjustment before you quote it.

Criminal penalties: Under the Export Control Reform Act (ECRA), 50 U.S.C. §4819(b) provides that a willful violator “shall be fined not more than $1,000,000” and that an individual “shall be imprisoned for not more than 20 years,” or both.

Denial of export privileges: BIS can suspend or revoke a company's ability to participate in any export transaction subject to the EAR. A denial order affects not just the violator but every business partner in the supply chain.

How Big Are the Fines in Practice?

Recent enforcement actions show that BIS is not issuing warnings. It is issuing penalties in the hundreds of millions. The scale of these cases makes clear that export classification errors carry real financial consequences — even for companies with existing compliance programs.

In February 2026, Applied Materials agreed to pay $252.5 million to settle allegations of 56 violations involving the export of semiconductor manufacturing equipment to a restricted Chinese entity. According to BIS, the penalty equaled twice the transaction value of approximately $126 million — the statutory maximum. It was the second-largest penalty BIS has ever imposed, following Seagate Technology's $300 million settlement in 2023.

In July 2025, Cadence Design Systems reached a combined resolution exceeding $140 million in criminal penalties, civil fines, and forfeitures for illegally exporting electronic design automation technology to a Chinese military university on the Entity List. The BIS civil settlement alone covered 61 admitted violations.

These are not small companies making careless errors. These are major corporations with compliance teams, legal departments, and established export processes. The penalties came anyway.

Are Penalties Going Up?

Yes. Both Congress and BIS leadership have signaled that current penalty levels are not high enough. Legislative and enforcement trends point toward significantly stricter consequences for misclassification and other export control violations in the near future.

In October 2025, Representatives Keith Self and Michael McCaul introduced the ECRA Penalty Increase Act (H.R. 5853). The bill would raise the maximum civil penalty from $300,000 to $1.2 million per violation and increase the transaction-based penalty from twice to four times the value of the violation. The bill is currently pending before the House Committee on Foreign Affairs.

In February 2026, BIS Assistant Secretary for Export Enforcement David Peters told a House subcommittee hearing that even the proposed $1.2 million cap may not be enough. He called for "dramatically higher" maximum penalties and a doubling of the statute of limitations from five to ten years.

How Do You Determine Your ECCN?

There are three main methods to determine the correct ECCN for your product. Each has trade-offs between speed, cost, and certainty. The right approach depends on your product's complexity and your risk tolerance.

1. Self-classify using the Commerce Control List. Search the CCL for all terms that describe your product's technical specifications and intended function. Do not search with just one or two general terms — be thorough. According to Trade.gov, exporters should look at "any and all terms that may describe the details of what the product is." If your product does not appear on the CCL, it is likely EAR99.

2. Ask your manufacturer or supplier. If you purchase items for export, your vendor may already know the ECCN. U.S. manufacturers who export their products should have classified them previously. However, you remain responsible for verifying the classification independently.

3. Request a formal classification from BIS. If you cannot determine the ECCN yourself, submit a classification request through BIS's SNAP-R (Simplified Network Application Process – Redesigned) system. BIS will review your product and issue a formal determination. This takes longer but provides the highest level of certainty and can serve as a defense in future enforcement actions.

Whichever method you use, document every classification decision. Record the rationale, the sources consulted, the date, and the person responsible. If BIS ever audits your exports, documentation is your first line of defense.

Can Your ECCN Change After You Classify It?

Yes — and it can change without anyone touching the product. The Commerce Control List is amended by rule. When BIS moves a control parameter, every exporter whose item sits near that line is reclassified on the rule’s effective date, not on the day they notice.

A recent case is specific enough to check. On August 14, 2026, BIS published a final rule titled “Streamlining Export Controls for Drone Exports” (91 FR 52501), effective August 13, 2026 — the day before it appeared in the Federal Register. It rewrote ECCN 9A012.a for unmanned aerial vehicles. It follows an interim final rule from January 2026 (91 FR 2467), whose policy changes the August rule leaves in place.

• Wind gust tolerance is gone as a control parameter. BIS removed it from item paragraph .a.1.b.

• The endurance threshold moved to 3 hours. Paragraph .a.1 now covers UAVs with a maximum endurance of less than 3 hours, and paragraph .a.2 was revised from “1 hour or greater” to “3 hours or greater.”

• The National Security Column 2 control was removed for .a.1 items. In the rule’s own words this “greatly reduces the number of destinations requiring a license” for those UAVs, which are now controlled for antiterrorism (AT1) reasons only — provided they are not capable of a maximum range of at least 300 kilometers regardless of payload and do not otherwise meet the parameters of ECCN 9A120.

• Software and technology followed the hardware. BIS removed the NS reason for control in ECCNs 9D001, 9D002, 9D004, and 9E001 for those items, which it says lets much of the civilian software — “including operating software updates for widely available commercial UAVs” — be exported no license required (NLR) to most destinations.

Two catches sit inside the same rule, and both are the kind a stale classification file misses.

The payload can override the airframe. Regardless of endurance, a UAV stays controlled for NS1 and AT1 reasons if it incorporates certain thermal imaging equipment (ECCN 6A003), certain lasers (6A005), or navigational equipment incorporating gyroscopes described in ECCNs 7A001, 7A002, 7A003, or 7A005. BIS wrote that carve-out explicitly, so that adversaries cannot acquire sensitive optical or navigational equipment “by purchasing inexpensive, low-endurance drones that have high-performance, easily-removable payloads or equipment installed or attached.” A camera change on your bill of materials can put the control back.

“NLR” is not “no screening.” The same rule added ECCNs 9A012, 9D001, 9D002, 9D004, and 9E001 to supplement no. 2 to part 744, which keeps the military end-use and end-user license requirements of §744.21 in force for the relevant destinations. The license code on your filing may have changed; the end-use and denied-party checks behind it did not.

BIS also issued a correction on August 28, 2026 (91 FR 55457) — a typographical fix in Supplement No. 1 to Part 774, not a substantive change. It is worth knowing the correction exists for the same reason it is worth knowing the rule does: the CCL text you printed last year is not the CCL text in force today.

What this means for your paperwork. An ECCN is not a fact about your product. It is a fact about your product under the Commerce Control List as it currently reads. In practice:

• Give every classification decision a review date, not just a decision date, and re-check it when BIS amends the category your item sits in.

• Re-check when the product changes too, not only when the rule does. A different camera, sensor, or navigation module can move the ECCN while the model number stays the same.

• When the code moves, it has to move everywhere it is written down. The Electronic Export Information filing, the commercial invoice, and the destination control statement all carry the same value, and a stale copy in one of them is the one a reviewer will find.

That last point is a document problem rather than a legal one, and it is the part we work on: ovrseas builds each export document from one master file, so a value you correct once does not have to be re-typed into the next four documents. It will not classify your product — nothing automated should — but it removes the step where a corrected code reaches three documents out of five.

ECCN vs. HS Code: Quick Reference

• Purpose: ECCN controls exports for national security. HS Code classifies goods for tariffs and trade statistics.

• Authority: ECCN is managed by BIS under the EAR. HS Code is based on the international Harmonized System maintained by the World Customs Organization.

• Structure: ECCN is five alphanumeric characters (e.g., 3A001). HS Code is six digits internationally, extended to ten digits in the U.S. (HTS).

• Applicability: Not every product has an ECCN (most are EAR99). Every product crossing a border has an HS Code.

• Consequence of error: Wrong ECCN can lead to BIS penalties, criminal charges, and export denial. Wrong HS Code typically results in duty underpayment or overpayment and potential customs penalties.

Bottom Line

ECCN classification is not optional paperwork. It is a legal obligation with escalating consequences. The gap between "I thought it was EAR99" and "BIS disagrees" can cost hundreds of thousands — or hundreds of millions — of dollars. Search the Commerce Control List, verify with your supplier, request a formal ruling when needed, and document everything. The cost of getting it right is minimal. The cost of getting it wrong is not.