What is dual-use export control (EU 2021/821)?
Dual-use export control is the licensing regime for items that serve both civilian and military ends. In the EU it is governed by Regulation (EU) 2021/821: exporting anything listed in its Annex I, and in some cases unlisted items: outside the Union requires an authorisation from a member-state authority. “Items” is broader than hardware: software and technology, including intangible transfers by email or cloud access, are squarely covered.
What tech companies actually trip over
Three recurring surprises. Encryption: products using cryptography fall under Category 5, Part 2 of Annex I: though the widely used “mass-market” and general-purpose exemptions decontrol most consumer software after classification. Cyber-surveillance: 2021/821 added a catch-all requiring authorisation where the exporter knows items may be used for internal repression or human-rights violations. Intangible transfers: giving a non-EU engineer access to controlled technology on a shared repo can itself be an export.
The Türkiye angle
Türkiye is not bound by the EU regulation but participates in the Wassenaar Arrangement and other supplier regimes, and operates its own dual-use licensing through the Ministry of Trade (with defence-related items under separate authority). A Turkish company shipping into the EU, or an EU-headquartered group with a Turkish dev subsidiary, must map both regimes: the intra-group transfer of controlled technology to Türkiye is an EU export.
Scope and Legal Basis
Regulation (EU) 2021/821 recast the previous Regulation 428/2009. Dual-use controls cover the export, re-export and transfer of goods, software and technology that have both civilian and military applications; examples include semiconductors, encryption, AI systems, certain materials, cyber-surveillance tools and aerospace components.
Further Features of the EU Regime
- EU General Export Authorisations (EUGEAs): simplified licences for low-risk destinations and items.
- Catch-all for unlisted items: items not on the control list still require a licence where the end use raises WMD or military concerns.
The US Export Administration Regulations
The US regulates dual-use items through the Export Administration Regulations (EAR, 15 CFR Parts 730-774), administered by BIS at the Department of Commerce.
- Commerce Control List (CCL): US dual-use items, identified by Export Control Classification Number (ECCN).
- Deemed export rule: sharing controlled technology with foreign nationals inside the US counts as an export.
- De minimis rule: a US-content threshold; below it, foreign-made items can fall outside US re-export controls.
- Entity List: specific foreign entities subject to additional licensing requirements.
Turkish products that incorporate US-origin components (25%+ US content under the de minimis calculation) fall within US re-export controls; Türkiye-Iran and Türkiye-Russia transactions carry particular risk.
Compliance Practice
- Classify every export against both EU Annex I and the US CCL.
- Run an internal compliance programme with screening, training and record-keeping, and document end-user statements to mitigate catch-all risk.
- Do not rely on the product description alone: technical parameters (encryption bit length, processing speed, dual-use software functionality) drive classification, not product marketing.
- For Turkish technology and defence-adjacent companies selling to or sourcing from the EU and the US, dual-use screening (classifying the product, checking destinations and end users) should be a standard step before every cross-border transfer, not an afterthought.
How do I know if my product is dual-use?
Classify it against Annex I categories (0-9). If your product uses non-standard cryptography, targets ICS/aerospace, or handles surveillance-adjacent capability, get a formal classification before signing foreign contracts.
What happens if you export without a licence?
Administrative fines, export bans and criminal exposure for managers in most member states, and a diligence red flag that can reprice or block an acquisition.
Related: sanctions screening.