ITAR technical data, EAR99 and CUI: what stays out of a manufacturing data license

What counts as ITAR technical data: definition and examples

The International Traffic in Arms Regulations control defense articles on the US Munitions List and the technical data about them. Section 120.33 defines technical data as information, other than software, “required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles,” including information in the form of blueprints, drawings, photographs, plans, instructions or documentation (source: 22 CFR 120.33, technical data). Classified information about defense articles and 600-series items is also technical data. The definition excludes general scientific, mathematical and engineering principles commonly taught in schools, information in the public domain, and basic marketing information on function or purpose.

In a shop that makes parts for defense programs, ITAR technical data examples usually include:

• The customer's drawings, 3D models and specifications for a controlled part.
• Process specifications, special-process requirements and flow-down documents from the prime.
• Inspection plans, first article inspection (AS9102) reports and CMM programs built from that print.
• Setup sheets, work instructions and travelers that describe how the part is made.
• Photographs of the part, the fixture or the setup.
• NCRs and corrective actions that describe the part's features and failure modes.

CNC programs written for a controlled part are a gray area that needs classification, in our reading; until that is done, treat them as controlled. Section 122.1 requires anyone in the business of manufacturing or exporting defense articles to register with the State Department's Directorate of Defense Trade Controls, and says a manufacturer that does not export must register anyway (source: 22 CFR 122.1, registration requirement). If your shop is registered, assume part of your archive is controlled until you have sorted it.

Deemed exports: why AI buyers refuse controlled records

The ITAR defines an export to include “releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)”, and says such a release is deemed an export to every country where that person holds citizenship or permanent residency (22 CFR 120.50(a)(2) and (b)) (source: 22 CFR 120.50, export (deemed export)). A foreign person is anyone who is not a lawful permanent resident or protected individual, plus foreign companies and governments (source: 22 CFR 120.63, foreign person). The EAR has the same concept for controlled technology and source code (15 CFR 734.13(a)(2) and (b)) (source: 15 CFR 734.13, export and deemed export (EAR)).

Apply that to an AI data deal. A buyer receives your records, people review and label them, the records are used to train a model, and the model is offered to customers worldwide. You will not know the nationality of every annotator, contractor or lab employee who sees a record. In our view, that is why buyers tend to refuse controlled records rather than try to screen them. Buyer program E lists “Defense and export-controlled work” under what it is not accepting right now (source: program terms, Regulr buyer directory). Each such term is a program's own published term; our buyer directory lists the programs and links to their published terms.

EAR99 vs ITAR: what the classification means for your records

The Export Administration Regulations cover dual-use items and much more. Section 730.3 says the EAR “control any item warranting control that is not exclusively controlled” by another agency, including purely civilian items and military items outside the ITAR (source: 15 CFR 730.3, dual use and the scope of the EAR). Items with an Export Control Classification Number (ECCN) on the Commerce Control List carry specific controls. Under 15 CFR 734.3(c), “items subject to the EAR which are not listed on the CCL are designated as EAR99” (source: 15 CFR 734.3(c), EAR99).

Most commercial job shop work (hydraulic fittings, agricultural parts, food equipment, general industrial components) is EAR99 in practice, which is why commercial shops are the core of this category. EAR99 is still subject to the EAR, so sanctioned destinations and restricted end users still matter. If your customer has told you a part has an ECCN other than EAR99, treat its records like controlled data.

CUI vs ITAR, and what DFARS 7012 adds

Controlled Unclassified Information is a government category, not an export category. Under 32 CFR 2002.4(h), CUI is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation or government-wide policy requires or permits to be safeguarded or controlled. It expressly does not include information a non-executive branch entity holds in its own systems that did not come from, and was not created for, an executive branch agency (source: 32 CFR 2002.4(h), Controlled Unclassified Information).

Export-controlled information is one CUI category. The National Archives CUI Registry says the Export Controlled category includes items identified in the EAR and the ITAR and the munitions list, marked CUI//SP-EXPT or EXPT (source: National Archives CUI Registry, Export Controlled category). So is all ITAR data CUI? Not automatically: ITAR data a prime sends you under a DoD subcontract is usually both, while technical data your company developed on its own, outside any government contract, is not CUI under the definition but can still be ITAR controlled.

Defense subcontractors meet CUI through DFARS 252.204-7012. The clause covers “covered defense information”, meaning unclassified controlled technical information or other information that needs safeguarding and is marked or identified in the contract, or is collected, developed or stored in support of performance. It requires NIST SP 800-171 on contractor systems, defines rapid reporting as “within 72 hours of discovery of any cyber incident,” and must be flowed down to subcontracts that involve covered defense information (paragraph (m)) (source: DFARS 252.204-7012 (May 2024), safeguarding covered defense information). If a purchase order carries 7012, the records from that job stay out.

Build to print vs build to spec: customer drawings and IP

Export rules are not the only reason records stay out. In build-to-print work, the customer supplies a complete design and the shop makes it, so the drawing, model and specification are the customer's property, and RFQ, purchase-order and supplier terms usually make them confidential. In build-to-spec work, the shop develops more of the design to meet the customer's requirements, and who owns the result depends on the contract.

Buyers say the same thing. Buyer program O, the program in our registry built for industrial records, takes customer or supplier drawings only “if you hold the rights to them and no confidentiality agreement stands in the way” (source: program terms, Regulr buyer directory). And some customer drawings may already sit in a vendor's model: Paperless Parts says it has “used a random sample of technical drawings uploaded to Paperless Parts to train proprietary models,” and that customers can ask to be left out of aggregated model improvement (source: Paperless Parts, Artificial Intelligence in Paperless Parts (updated May 1, 2026)). If your customers' prints pass through a quoting tool, check its AI settings as part of your screen.

What a build-to-print shop owns is its own work around the print: how it quoted the job, the routing and setups it chose, the hours and scrap it recorded, the inspection results, the corrective actions it wrote, and the maintenance that kept the machines running. That is most of what buyers want, as our manufacturer data licensing guide lays out.

Screening shop records: what usually stays in and what comes out

Machine-level maintenance history is the record most often kept even in a mixed shop, because a spindle rebuild log or a coolant change does not describe a part. Anything that names the part, its features or the program it belongs to goes with the controlled side.

Mixed commercial and defense shops: how the split usually works

Plenty of shops run both: defense parts for a prime alongside commercial parts for industrial customers. A license is still possible if the two can be cleanly separated. In our view, the split works best when it follows lines your systems already draw:

• By customer. Exclude every job, quote, NCR and email for defense primes and their subcontract chains.
• By part. Exclude any part flagged ITAR, ECCN or 7012 in your ERP or on the purchase order, across all customers.
• By system area. If you keep controlled work in a separate enclave, file share or ERP company, leave that whole area out instead of filtering it record by record.
• By time. Some shops only took defense work in certain years; those years can come out whole.

Expect a buyer to ask for a written representation that the package holds no controlled technical data, and decide the scope in writing before any export runs. The export itself should be run by your own staff, who already know which jobs are controlled. Our guide to machine shop ERP, PDM and QMS data terms covers how to export by customer or part from the common shop systems. If export controls are a reason you are weighing a sale instead, our guide to selling a machine shop covers what an acquirer will ask.

Checklist: an export-control screen before a data license

1. Confirm whether the company is registered with DDTC and whether any purchase orders carry DFARS 7012.
2. List every customer that is a defense prime, a defense subcontractor or a government agency.
3. Pull every part flagged ITAR, ECCN, 600-series or CUI in the ERP, and every part those customers ordered.
4. Decide whether to exclude by customer, by part, by system area or by year, and write it down.
5. Detach all customer drawings, models and specs, whatever the export status.
6. Check quoting and QMS tools for AI settings that may already include customer prints.
7. Have your own staff run the export and spot-check a sample before anything leaves.

Once the commercial side is clear, our data value checker shows what moves the price, and you can see what your commercial production records could qualify for. Programs differ in how they treat mixed shops; our buyer directory lists the programs and links to their published terms.

Frequently asked questions

Sources

Federal rules read on Cornell LII, acquisition.gov and the National Archives CUI Registry on October 18, 2026; the Paperless Parts page read the same day. Program exclusions checked on their own pages on October 15, 2026; our buyer directory lists the programs and links to their published terms.

1. 22 CFR 120.33, technical data
2. 22 CFR 120.50, export (deemed export)
3. 22 CFR 120.63, foreign person
4. 22 CFR 122.1, registration requirement
5. 15 CFR 730.3, dual use and the scope of the EAR
6. 15 CFR 734.3(c), EAR99
7. 15 CFR 734.13, export and deemed export (EAR)
8. 32 CFR 2002.4(h), Controlled Unclassified Information
9. National Archives CUI Registry, Export Controlled category
10. DFARS 252.204-7012 (May 2024), safeguarding covered defense information
11. Paperless Parts, Artificial Intelligence in Paperless Parts (updated May 1, 2026)
12. program terms, Regulr buyer directory