What is dual-use export control (EU 2021/821)?
Dual-use export control is the licensing regime for items that serve both civilian and military ends. In the EU it is governed by Regulation (EU) 2021/821: exporting anything listed in its Annex I — and in some cases unlisted items — outside the Union requires an authorisation from a member-state authority. “Items” is broader than hardware: software and technology, including intangible transfers by email or cloud access, are squarely covered.
What tech companies actually trip over
Three recurring surprises. Encryption: products using cryptography fall under Category 5, Part 2 of Annex I — though the widely used “mass-market” and general-purpose exemptions decontrol most consumer software after classification. Cyber-surveillance: 2021/821 added a catch-all requiring authorisation where the exporter knows items may be used for internal repression or human-rights violations. Intangible transfers: giving a non-EU engineer access to controlled technology on a shared repo can itself be an export.
The Türkiye angle
Türkiye is not bound by the EU regulation but participates in the Wassenaar Arrangement and other supplier regimes, and operates its own dual-use licensing through the Ministry of Trade (with defence-related items under separate authority). A Turkish company shipping into the EU, or an EU-headquartered group with a Turkish dev subsidiary, must map both regimes — the intra-group transfer of controlled technology to Türkiye is an EU export.
How do I know if my product is dual-use?
Classify it against Annex I categories (0-9). If your product uses non-standard cryptography, targets ICS/aerospace, or handles surveillance-adjacent capability, get a formal classification before signing foreign contracts.
What happens if you export without a licence?
Administrative fines, export bans and criminal exposure for managers in most member states — and a diligence red flag that can reprice or block an acquisition.
Related: sanctions screening.