Deemed Export: When Sharing Information Counts as an Export
Customs will never see this kind of export. There is no shipment, no declaration, and no border crossing- only information passing from one person to another. Under US export controls, releasing controlled technology to a foreign person inside the United States is treated as an export to that person's country, and it needs the same authorization a physical shipment would.
In India, "deemed exports" means something different: goods made in India that never leave the country but qualify for export benefits under the Foreign Trade Policy and GST. This page covers the US export control meaning.
What Counts as a Deemed Export?
A deemed export is the release of controlled technology, source code, or technical data to a foreign person inside the United States. It requires the same authorization as a physical shipment to that person's country.
That authorization comes from the Bureau of Industry and Security (BIS) under the Export Administration Regulations (EAR), or from the Directorate of Defense Trade Controls (DDTC) under the International Traffic in Arms Regulations (ITAR).
Form | What it covers | Note |
|---|---|---|
Showing | Visual inspection of controlled drawings, specifications, or equipment | Includes a facility tour where controlled processes are visible. |
Telling | Oral or written exchange of controlled technical detail | A design discussion, a support call, an email thread, a training session. |
Giving access | The ability to view or download controlled technology | System access, a shared drive, a screen share, or controlled source code. |
Example
A hardware company in Austin holds a design review for a controlled encryption module. One engineer on the call is a foreign national working in the same office. Nothing ships, yet the review can be an export to that engineer's country, just as if the files had been mailed there. For teams handling controlled computing and encryption hardware, this is routine, not rare.
Nationality, Not Location
The requirement follows the person's nationality, not their location, visa, or employer. The EAR looks at their most recent country of citizenship or permanent residency. ITAR looks at all of them, which matters for dual nationals. Before anything else, determine which regime applies and the penalties each carries.
Who Counts as a Foreign Person?
US citizens do not need a deemed export license, and neither does anyone else in the US person category. The regulations define that category, and it is broader than citizenship, which is where most of the confusion lies.
US citizens are US persons. No deemed export question arises on the basis of status.
Lawful permanent residents are US persons. Green card holders do not trigger the rule, and treating them as foreign persons is a common and incorrect practice.
Protected individuals, including people granted asylum or refugee status, are US persons. Confirm status against the regulation rather than assuming.
Everyone else is a foreign person, including employees, contractors, visitors, and students. That includes people who have worked at the company for years: status does not change with tenure.
The same definition also shapes how access policy is handled more broadly, including hiring, which is a separate question from what counts as a release.
When the Rule Does Not Apply?
Most technical information shared inside a commercial business is either not caught or needs no license. Four routes take a release out of the problem.
Route out | What it covers | The detail that matters |
|---|---|---|
The technology is EAR99 | Subject to the EAR but not on the Commerce Control List, and not ITAR controlled | Releasing technology designated EAR99 rarely needs a license unless a restricted recipient or prohibited end use is involved. Most commercial technical data falls here. |
The information is public domain | Already published, or available to the public without restriction | Genuinely public information is outside the regulations altogether. The test is whether it is actually public, not whether it feels routine. |
Fundamental research | Research whose results are ordinarily published and shared openly | Relevant to universities and labs. The exclusion is lost where a sponsor can restrict or block publication. A short review only to protect patents or the sponsor's proprietary information does not by itself defeat it. |
A license exception applies | Specific authorizations written into the regulations | Some exceptions allow release to defined categories of employees for defined purposes. Each carries its own conditions and recordkeeping obligations, and none is a general exemption. |
Deemed Re-Export
A deemed re-export is the same release made outside the United States: controlled US-origin technology given to a foreign person who is a national of a third country. A design team in Dubai sharing US-origin controlled technical files with a colleague of another nationality is making one.
US controls follow US-origin technology after it leaves the country. That means a non-US company with no US presence can still be in scope, because of what the technology is rather than where the company sits.
The Question to Ask Your Service Providers
The rule does not stop at your own door. Every provider that handles your shipment sees some of your technical data, so put these questions to each one:
Classification: your technical specifications are reviewed. Who reviews them, and are they US persons?
Declaration: your product details are filed. Where is it stored, and who can access it?
Shipping controlled hardware: the provider knows exactly what the item is. Who handles the file between pickup and clearance?
Where IOR Service Fits?
We receive product technical information as the registered Exporter of Record because classifying and declaring the goods requires it. The basis for each determination is kept in the shipment record, and every question above applies to us as much as to any provider.
Final Thoughts
A deemed export is the export nobody sees: no box, no border, often no paperwork until someone asks. Most shared information is not caught, and the routes out cover far more than most companies assume.
What does the work is asking four questions in order:
1-Is the technology controlled?
2-Is the person a US person?
3-Does a route out apply?
4-Who outside the business receives the data?
Answer those, and the rule stops being a surprise.
Frequently Asked Questions
No. Deemed export requirements apply to releases of controlled technology to foreign persons. US persons do not trigger them, and the category is broader than citizenship: it includes lawful permanent residents and protected individuals such as people granted asylum or refugee status. Treating a green card holder as a foreign person is a common error. Where the recipient is a US person, no deemed export authorization is needed on the basis of status.
An export moves something across a border. A deemed export moves nothing: it happens when controlled technology or technical data is released to a foreign person, and the regulations treat that release as an export to the person's country. Under the EAR, that is their most recent country of citizenship or permanent residency. The authorization requirement matches what a physical shipment to that country would need.
By status, not by location or job title. US citizens, lawful permanent residents, and protected individuals are US persons; everyone else is a foreign person, including long-serving employees, contractors, students, and visitors. A foreign national working in a US office is still a foreign person. Under ITAR, every country of citizenship and permanent residency counts, so dual nationals need particular care.
No. Information genuinely in the public domain is outside the regulations, and releasing EAR99 technology rarely needs a license unless it involves a restricted recipient or prohibited end use. Fundamental research intended for publication is excluded too, unless a sponsor can restrict publication. Even controlled technology needs a license only where exporting it to the person's country would.
It can. Classification, declarations, and shipping arrangements all require sharing product technical information outside the company. Where that information is controlled technology, who receives it at the provider is a deemed export question. It is reasonable to ask any broker, forwarder, or entity of record how technical data is handled and who has access to it.
Latest Blogs
What is an ESMA certificate? UAE product certification explained
Many businesses preparing to sell in the UAE are told they need “ESMA approval”. They then go looking for an authority that no longer runs the scheme. The Emirates Authority for Standardization and Metrology (ESMA) was merged into the Ministry of Industry and Advanced Technology (MoIAT) in 2020. The certification it was known for still exists, and the market still calls it by the old name. Knowing where it sits now saves weeks of applying to the wrong place. An ESMA certificate, as the market calls it, is UAE product conformity approval. It shows that a regulated product meets the applicable UAE, GCC, or international standards before it is sold. Today, it is issued under two MoIAT schemes: the Emirates Conformity Assessment Scheme (ECAS) and the Emirates Quality Mark (EQM). The legal basis is Federal Law No. 28 of 2001. The schemes are federal, so the same rules apply in every emirate. Because approval comes before market entry, the scheme follows the same principle as pre-shipment conformity verification in other markets.
What is TDRA approval? UAE type approval for wireless and telecom devices
Your device may already carry CE marking, have passed its RED tests, and be sold across Europe, and still be stopped at a UAE port. Almost every device sold today has a wireless function. In the UAE, that function needs its own approval before the product can be imported, sold, or even switched on, and the application cannot start until a UAE-registered dealer is in place. TDRA approval, formally called type approval, is that authorization. It is issued by the Telecommunications and Digital Government Regulatory Authority (TDRA) and confirms that a device meets UAE technical standards and will not interfere with national networks. It applies to radio and telecommunications terminal equipment (RTTE), meaning any equipment that connects directly to a public telecommunications network or contains an intentional radio transmitter. TDRA was known as the Telecommunications Regulatory Authority (TRA) until it was renamed in 2021. It is a federal regulator, so one approval covers every emirate.
EAR99: What the Designation Means, and When it Still Needs a License
EAR99 tells you what an item is not. Under the US Export Administration Regulations (EAR), it marks goods that fall under the regulations but are not listed on the Commerce Control List (CCL). What it does not tell you is where the item may go, who may receive it, or what it may be used for. Most shipments clear all three without a license. Some do not.