A thermal sensor manufacturer near Grenoble has been selling industrial inspection cameras to construction and maintenance customers for six years. A civil product, a civil customer base, no commercial ambiguity. In January 2026, an integrator based in the United Arab Emirates asked for a version whose resolution and frame rate slightly exceed the usual models. No one in the company had reopened the control list since 2023. Those characteristics, however, bring the product under licence, and an export made without authorisation is a customs offence, whatever use the customer actually makes of it.
Export control is the field in which exporters most often go wrong in good faith, because they reason in terms of intended use while the text reasons in terms of technical characteristics. This page explains how to determine whether a civil product is controlled, what the catch-all controls cover, which authorisations exist, and what the company must keep.
1. The definition catches more products than you would think
Dual-use items are items, including software and technology, which can be used for both civil and military purposes (Regulation (EU) 2021/821, article 2(1)). The definition says nothing about the intention of the manufacturer or the usual customer base. It describes a capability. A sensor, an oscilloscope, a carbon fibre, simulation software, cryptographic equipment, a high precision machine tool fall within the scope by their characteristics, not by their market.
The regulation also identifies a separate category, cyber-surveillance items, defined as dual-use items specially designed to enable the covert surveillance of natural persons by monitoring, extracting, collecting or analysing data from information and telecommunication systems (same regulation, article 2(20)). That category has its own control logic, developed in point 3 below.
The reflex to install is therefore to start from the technical data sheet and not from the purchase order. The question is not what your customer intends the product for, but whether the parameters of the product meet the technical thresholds set out in the control list. That work is done once per reference, is documented, and is done again whenever the product changes and whenever the list is updated.
2. The control list changes every year, and it has just changed
The export of the dual-use items listed in Annex I to the regulation is subject to authorisation (Regulation (EU) 2021/821, article 3(1)). That annex transposes the lists drawn up in the international control regimes, and it is revised each year by delegated regulation of the Commission.
The version applicable today results from Commission Delegated Regulation (EU) 2025/2003 of 8 September 2025, in force since 15 November 2025. On 14 September 2026 the Commission adopted a further update, which is neither published in the Official Journal of the European Union nor in force: it is subject to the two-month scrutiny period open to the European Parliament and the Council, at the end of which, absent objection, it will be published. A regular exporter must therefore put an annual review of its classification in its compliance calendar, in the same way as a year-end closing.
A warning about sources is called for. The explanatory sheet circulated by the French customs administration on dual-use items still cites, as at the date of writing, Delegated Regulation (EU) 2022/1 as the latest update of Annex I. It is several annual revisions out of date. A classification based on that page would be wrong, and the mistake would not be excusable, since the consolidated version of the regulation is public.
Classifying a product and filing the export declaration are often discussed with customs: see our customs law page.
3. Catch-all controls, or the trap of formal compliance
The regime does not stop at the list, and that is the point most internal procedures leave out. An authorisation is also required for non-listed items where the exporter has been informed by the competent authority, or is aware, that they are or may be intended for use in connection with nuclear, chemical or biological weapons or their delivery systems, for a military end use in a country under an arms embargo, or as parts or components of military items exported without authorisation (Regulation (EU) 2021/821, article 4(1)).
A comparable mechanism exists for non-listed cyber-surveillance items, where the exporter has been informed that the items are or may be intended for use in connection with internal repression or the commission of serious violations of human rights and international humanitarian law (same regulation, article 5). In both cases the trigger is not a technical characteristic but information about the end use.
The practical consequence is counter-intuitive. The more a company knows about the actual use of its product, the more exposed it is, since knowledge is precisely what triggers the obligation. That obviously does not license wilful blindness: deliberate ignorance is dealt with elsewhere, in sanctions law, with increasing severity. What it does require is organising the flow of information inside the company, so that a salesperson who learns something unusual knows whom to tell and so that the decision is taken and recorded.
These controls operate alongside sanctions regimes, which may prohibit an export even where it is licensed as dual-use: see our international sanctions page.
4. Four authorisations, and an internal compliance programme
The choice between an individual and a global authorisation is not an administrative question but a structural decision. The individual authorisation covers one transaction, one consignee, one quantity: it suits the occasional exporter and leaves the administration in control of the tempo. The global authorisation covers a set of items to a set of consignees or countries, which frees the company from applying order by order, but shifts the burden of control onto it, since it must then show that it has the internal procedures to verify what the administration no longer verifies upstream. A manufacturer shipping several times a month to a stable distributor network has every interest in the second route, provided it accepts what that implies: a written programme, an identified officer, recorded checks and a periodic internal audit.
The regulation provides for four types of authorisation: individual, global, national general and Union general, the latter set out in sections A to H of Annex II (Regulation (EU) 2021/821, article 12(1)). Union general export authorisations cover, among others, exports to a group of partner countries, exports after repair or replacement, temporary export for exhibition or fair, telecommunications, certain chemicals, intragroup technology transfers and encryption.
Individual and global authorisations are granted for up to two years, extended to four years for large projects (same regulation, article 12(3)). Above all, an exporter using a global authorisation must implement an internal compliance programme, unless the competent authority considers it unnecessary (same regulation, article 12(4)). That programme is defined as the ongoing effective, appropriate and proportionate policies and procedures adopted by the exporter (same regulation, article 2(21)).
In France the competent authority is the dual-use items service, a national service attached to the directorate general for enterprise, and applications are filed on the EGIDE platform. It handles Union general authorisations, national general licences, individual and global licences, as well as classification requests and referrals on catch-all controls. At customs clearance, the link between the declaration system and the authorisation platform runs through the national single window.
5. Intangible exports, the ones no freight forwarder sees
A common belief has it that control bears on goods crossing a border. The text also covers technology and software, and subjects technical assistance relating to controlled items (Regulation (EU) 2021/821, article 8) and brokering (same regulation, article 6) to authorisation. A design file sent by email, remote access granted to an engineer located in a third country, training delivered by video conference, technical documentation placed on a shared drive: these are exports, and they appear on no customs declaration.
Transfers inside the Union are not systematically free either, since those concerning the items in Annex IV are themselves subject to authorisation (same regulation, article 11). A group moving technology between two European sites may therefore have to apply for an authorisation it does not imagine to be necessary.
For an industrial company the organisational consequence is clear. Export control cannot be left to the logistics department alone, which sees only physical flows. It has to reach the design office, the IT department and human resources, since access by an employee who is a third-country national to controlled technology may itself raise a question.
6. Records, audits and penalties
The expected content of those records deserves to be spelt out, because it goes beyond what a company keeps spontaneously. An invoice and a delivery note identify neither the end use nor the end user, although the text requires both where they are known. The file must therefore contain the end-use statement where one was requested, the classification sheet for the reference with the version of Annex I applied and its date, a copy of the authorisation used, and the record of the checks carried out on the consignee. That file is worth nothing as long as nothing happens. On the day something happens, it is the only thing that counts.
Exporters keep detailed records of their exports, including the commercial documents allowing the description and quantity of the items, the name and address of the exporter and of the consignee and, where known, the end use and the end user to be identified. Those records are kept for at least five years from the end of the calendar year in which the export took place, and three years for intra-Union transfers of Annex I items (Regulation (EU) 2021/821, article 27). The same obligation rests on brokers and providers of technical assistance.
Five years, where the Union Customs Code requires three and French commercial law requires ten for accounting documents. It is the longest period that governs archiving, which is one more reason to build a single file per transaction rather than scatter the documents between logistics, accounts and the design office.
As for the penalty, it comes not from the European regulation but from national law. Exporting an item subject to authorisation without having obtained it falls under the customs offences of export of prohibited goods without declaration, now codified, since the recodification in force on 1 May 2026, at articles L. 512-7 and L. 513-1 and following of the customs code. Where the transaction also crosses a restrictive measures regime, the penalties of article L. 542-1 apply, namely five years of imprisonment and a fine equal to twice the amount to which the offence relates.
The firm assists industrial companies with their classification work and in their dealings with the administration, as part of its international trade law practice.
One more change to put in the compliance calendar: Regulation (EU) 2026/2108 replaces the 2013 Union Customs Code from 21 September 2027. See Le nouveau code des douanes de l’Union : ce qui change concrètement pour les entreprises (Village de la Justice, 22 September 2026, in French).
This analysis is part of a set on exporting from France: start with the legal checklist before you sign, and see also international sanctions and what must be proved and Incoterms, risk and retention of title.
Frequently asked questions
Can software be a dual-use item?
Yes, and the text says so expressly, since it covers items including software and technology (Regulation (EU) 2021/821, article 2(1)). Encryption software, simulation software, computer-aided design software for certain applications, and intrusion software appear on the control list depending on their characteristics. Making software available by download or by remote access is an export in the same way as delivery on a physical medium, which makes the control invisible to the logistics department and requires it to sit elsewhere in the organisation.
What does a company risk if it exports without the required authorisation?
The characterisation is a customs one, export of prohibited goods without declaration, with the penalties of articles L. 513-1 and following of the customs code in the numbering resulting from the recodification of 1 May 2026. Confiscation of the goods and of the means of transport may be ordered, as may prohibition penalties. The company also exposes itself to the suspension or revocation of its current authorisations which, for a regular exporter, often costs more than the fine itself.
How long does a licence take?
The regulation sets no uniform time limit and practice varies with the sensitivity of the file, the destination and the need to consult other Member States, a consultation the text organises (Regulation (EU) 2021/821, article 14). A complete file, supported by a documented classification and a precise end-use statement, is processed appreciably faster than one the administration has to work up from incomplete material. Anticipating the application during the commercial negotiation, rather than after signature, is therefore the only variable the exporter really controls.
Is a transfer to my subsidiary inside the Union controlled?
In principle intra-Union transfers are free, but the regulation reserves the case of the items in Annex IV, whose transfer from one Member State to another remains subject to authorisation (Regulation (EU) 2021/821, article 11). Annex IV must therefore be checked before concluding that a movement within the single market escapes control. The question is particularly acute for technology transfers between establishments of the same group, which give rise to no customs formality and go unnoticed for that reason.
Can I ask the administration to classify my product?
Yes. The dual-use items service is the classification authority and receives requests to that effect through its platform, in the same way as licence applications. That is the route to prefer where the product sits close to a technical threshold, a situation in which an internal assessment, however serious, leaves a residual risk. The answer obtained becomes part of the compliance file and is worth, in an audit, infinitely more than an internal note written after the event.