ITAR, EAR and Offshore CNC Machining: What a Buyer Can Legally Send

ITAR CNC machining cannot go to an offshore shop unless the US party holds a State Department authorization, because sending the drawing is itself an export of technical data. Most machined parts bought by defense-adjacent programs are not ITAR controlled, though. Many are EAR99 or carry an ECCN under the Commerce Department’s EAR, and each case has different rules. This article sets out what a buyer can and cannot send offshore, who decides the classification and why milcnc.com refuses ITAR data outright.

This is general information, not legal advice. Confirm your classification with your export compliance function or counsel before sharing technical data.

Two regimes: ITAR and the EAR

ITAR and the USML

The International Traffic in Arms Regulations (22 CFR parts 120 to 130) are administered by the State Department’s Directorate of Defense Trade Controls (DDTC). The US Munitions List in part 121 has 21 categories covering defense articles, technical data and defense services. Exporting a USML item, releasing its technical data to a foreign person or providing manufacturing help for it requires an authorization: a licence for the data, or a Technical Assistance Agreement (TAA) or Manufacturing License Agreement (MLA) for defense services. Manufacturers of defense articles must also register with DDTC under part 122.

EAR, the CCL and ECCNs

The Export Administration Regulations (15 CFR parts 730 to 774) are administered by the Commerce Department’s Bureau of Industry and Security (BIS). Controlled items are listed on the Commerce Control List (Supplement No. 1 to part 774) under five-character Export Control Classification Numbers. The first digit is the category, the letter is the product group (A for equipment and parts, E for technology) and the last three digits identify the entry.

Whether an ECCN needs a licence depends on its reasons for control, the destination (the Commerce Country Chart in Supplement No. 1 to part 738), the end user and the end use.

EAR99

An item subject to the EAR but not listed on the CCL is EAR99. Most commercial machined parts fall here. EAR99 items generally ship without a licence, except to embargoed destinations, to parties on restricted lists such as the Entity List or for prohibited end uses under part 744.

The 600-series

Export Control Reform, which began in 2013, moved many less sensitive military parts and components from the USML to the CCL. They sit in “600-series” entries such as 9A610 (military aircraft parts and components) and 0A606 (military ground vehicle parts and components). The matching technology entries end in E, for example 9E610. Most 600-series items need a licence for nearly every destination, with narrow exceptions, and some “.y” paragraphs carry lighter controls. Treat any 600-series classification as controlled until you have read the specific entry.

Both regimes use a “specially designed” test, defined in 22 CFR part 120 and 15 CFR 772.1. A simple bracket can be controlled if it was specially designed for a controlled end item.

Technical data versus the physical part

Buyers often assume export control is about shipping hardware. For offshore machining, the first export usually happens earlier, when the drawing is sent.

• The drawing and model. Under ITAR, drawings, models and process instructions for a USML part are technical data. Emailing them to a foreign machine shop, or letting a foreign person view them in a shared folder, is an export. Explaining how to make the part can also be a defense service.
• Where the part goes afterwards does not matter. Parts that return to the US do not undo the export of the data.
• Under the EAR, technology is controlled separately. For a 600-series part, the “production” technology is usually controlled under the matching E entry, so the drawing may need a licence even if the finished part would not. For EAR99 parts, the production technology is generally EAR99 as well.
• Release to foreign persons inside the US (a deemed export) is also an export under both regimes.

The practical rule: classify the part and its technical data before the first file is shared, not before the first shipment.

CUI and DFARS 252.204-7012: a separate gate

Controlled Unclassified Information is not an export classification, but it can stop a drawing from moving just as effectively. DoD handles CUI under 32 CFR part 2002 and DoD Instruction 5200.48. Defense contracts include DFARS 252.204-7012, which requires contractors to protect covered defense information using NIST SP 800-171, report cyber incidents to DoD within 72 hours and flow the clause down to subcontractors that handle that information. Related clauses (252.204-7019 and 7020) cover assessment scores, and CMMC requirements under 252.204-7021 are being phased into contracts.

DoD drawings also carry distribution statements A to F under DoD Instruction 5230.24. Statement A means approved for public release. Statements B to F restrict distribution, and many drawings also carry an export-control warning notice.

The consequence for buyers: a drawing for an EAR99 bracket can still be CUI. Sending it to a supplier that does not meet NIST SP 800-171 may breach your contract even though no export rule is broken. Treat a CUI marking or a statement B to F as a stop sign. Without written release permission from the contracting officer or prime, do not send it to milcnc.com or anyone else.

Classification is the buyer’s responsibility

The party sending technical data abroad is the exporter and owns the classification. In practice that is the buyer or the design owner, not the machine shop and not a matching service.

A defensible classification follows the EAR order of review (Supplement No. 4 to part 774):

1. Check the USML. If the part is enumerated or specially designed for a USML article, it is ITAR controlled and the review stops.
2. If not, check the 600-series and 9x515 entries.
3. Then check the rest of the CCL.
4. If nothing applies, the item is EAR99.

If jurisdiction is unclear, request a Commodity Jurisdiction determination from DDTC (form DS-4076) or a classification from BIS (a CCATS). The design owner or prime contractor may already hold a classification; ask them in writing. Keep the records: both regimes require export records to be retained for five years.

Decision table for offshore machining

Situation	Governing rules	Can the drawing go to an offshore shop?	milcnc.com position
Part on the USML or specially designed for a USML article	ITAR	Only with a DDTC authorization held by the US party	Refused in all cases
Firearm parts, munitions, missile or night vision hardware	ITAR, or EAR 0A501 and similar entries	Depends on entry; always licence-sensitive	Out of scope regardless of classification
600-series ECCN part or its production technology	EAR	Only with a BIS licence or a valid licence exception	Refused unless the buyer holds and provides the authorization
Other ECCN with a licence requirement for the destination	EAR	Only with a BIS licence	Refused unless the buyer holds the authorization
ECCN with no licence required for the destination	EAR	Yes, subject to end-user and end-use checks	Accepted after screening
EAR99, no restricted parties or prohibited end use	EAR	Generally yes	Accepted after screening
Any classification, but CUI-marked or distribution B to F	Contract (DFARS 252.204-7012), DoDI 5230.24	Only with written release permission	Send only after release is confirmed
Not yet classified	Unknown	Do not send	Not reviewed until classified

Why milcnc.com refuses ITAR data

milcnc.com matches RFQs with CNC suppliers, mainly in Vietnam. Those suppliers are foreign persons under both ITAR and the EAR. Releasing ITAR technical data to them requires an authorization naming them, obtained by a registered US party. milcnc.com does not hold DDTC registration and does not manage TAAs or licences, and we do not claim any defense registration or approval for ourselves or for matched suppliers.

Because even a screening review is a release if a foreign person sees the file, the refusal happens at intake. We ask buyers to classify before sending, we decline drawings that carry USML or ITAR markings and we decline other export-controlled data unless the buyer holds the required authorization. Penalties are the other reason for a firm line: criminal penalties under the Arms Export Control Act and the Export Control Reform Act can reach USD 1 million and 20 years imprisonment per violation, and civil penalties are adjusted for inflation each year (check current figures).

What we do accept: non-controlled parts such as ground support equipment housings and brackets, training simulator hardware, range and target components, non-firearm rails and mounts, optics enclosures, communications chassis and non-controlled UAV structural parts. Our export compliance page lists what is accepted and refused. For parts that pass, the next step is a clean package; the defense RFQ drawing package checklist covers what to include, and the mil-spec CNC machining guide explains the spec callouts. If you have already classified your part as EAR99, you can send the RFQ now.

How to send an RFQ once the part is classified

State the classification in the RFQ: EAR99 or the ECCN, with a one-line basis (for example “EAR99, commercial GSE bracket, not specially designed for a USML or 600-series item”). Confirm the drawing carries no CUI marking or restrictive distribution statement, or that you hold release permission. For dual-use items, include end-use and end-user information so it can be confirmed with the supplier.

Upload STEP or IGES models and PDF, DWG or DXF drawings. A mutual NDA comes first, then an export sensitivity check and a completeness review. Complete RFQs are matched with up to three qualified suppliers, and quotes arrive within 24 business hours. You contract directly with the supplier. Submit your RFQ.