Key Fact: Every company that manufactures, exports, or brokers a defense article on the United States Munitions List is legally required to register with DDTC — regardless of whether they ever ship a product overseas. Misclassification isn't a technicality. It is the root cause of the majority of ITAR enforcement actions, and it starts the moment a company decides its product isn't controlled without doing the work to confirm that.
Classification is the foundation of every ITAR compliance decision you will ever make. Get it wrong and every downstream activity — every export, every disclosure to a foreign national, every license application — is built on a defective basis. The exposure multiplies with every transaction. Companies have paid tens of millions of dollars to resolve violations that trace directly back to a misclassification made years earlier, often by someone who assumed they knew the answer without reviewing the regulation.
This guide gives you the complete framework: what ITAR is and why classification stakes are so high, how the United States Munitions List (USML) is structured, what all 21 USML categories cover, the step-by-step process for making a defensible classification determination, the critical concept of "specially designed," how to distinguish ITAR from EAR jurisdiction, when and how to use a Commodity Jurisdiction (CJ) request, the most common classification mistakes, and what to do once you confirm your product is ITAR-controlled.
What ITAR Is and Why Classification Matters
The International Traffic in Arms Regulations (ITAR), codified at 22 CFR Parts 120–130, implement the Arms Export Control Act (AECA) of 1976. ITAR is administered by the U.S. Department of State through the Directorate of Defense Trade Controls (DDTC). Its purpose is straightforward: ensure that U.S. defense technology does not flow to foreign governments, entities, or individuals in ways that could threaten U.S. national security or foreign policy interests.
ITAR applies to defense articles, defense services, and related technical data — all of which are defined in the regulations and listed on the USML. An item doesn't need to be an active weapon to be controlled. ITAR captures hardware, components, parts, software, and even the information used to design, manufacture, or operate a defense article.
The Consequences of Getting Classification Wrong
The penalty structure is severe:
- Civil penalties: Up to $1,394,010 per violation (inflation-adjusted), with each unauthorized export, transfer, or disclosure constituting a separate count
- Criminal penalties: Up to 20 years imprisonment and $1 million per count for willful violations under 22 U.S.C. § 2778
- Debarment: Loss of export privileges, deregistration from DDTC, and disqualification from U.S. government contracting
- Reputational harm: Consent agreements are publicly posted on the DDTC website, creating permanent public record of the violation
A misclassification that goes undetected for three years while a company exports its product to 12 countries can generate hundreds of individual violations. That is not a hypothetical — it is a pattern that DDTC enforcement actions have documented repeatedly. The historical record of ITAR enforcement actions and settlement amounts makes the stakes undeniable.
The USML Explained: Purpose, Structure, and Legal Authority
The United States Munitions List (USML), codified at 22 CFR Part 121, is the definitive enumeration of defense articles subject to ITAR. It has been in its current positive-list form since the Export Control Reform (ECR) initiative completed between 2013 and 2020, when items with predominant commercial uses were migrated from the USML to the Commerce Control List (CCL) under new "600 series" ECCNs.
The USML operates as a positive list, meaning an item must be specifically described in a USML category or subcategory — or meet the "specially designed" standard — to be ITAR-controlled. There is no catch-all "if it could be used militarily, it's on the USML" rule. The list is precise by design.
The USML is organized into 21 categories, each governed by specific text, notes, and the cross-cutting "specially designed" definition at ITAR § 120.41. Categories are further subdivided by paragraph — hardware items, software, technical data, defense services, and manufacturing equipment — using a lettered structure (e.g., Category VIII(a) for aircraft, Category VIII(f) for technical data).
Legal Authority Note: The USML derives its authority from the Arms Export Control Act, 22 U.S.C. § 2778, which grants the President authority to designate items as defense articles and defense services. That authority has been delegated to the Secretary of State, who administers it through DDTC. The President retains authority to add, remove, or modify USML categories by executive action.
All 21 USML Categories: What Each One Covers
Understanding the scope of the USML requires more than knowing there are 21 categories — you need to know what each covers well enough to recognize when your product might trigger a review. The descriptions below are summaries; the actual regulatory text in 22 CFR Part 121 governs and should always be consulted directly.
| Category | Title | Key Coverage |
|---|---|---|
| I | Firearms, Close Assault Weapons and Combat Shotguns | Automatic and semi-automatic firearms, combat shotguns, and related components specially designed for military use |
| II | Guns and Armament | Guns and armament of 20mm or larger caliber; military flamethrowers; rocket launchers; mortars; recoilless rifles |
| III | Ammunition and Ordnance | Ammunition for Category I and II weapons; military explosives; incendiary agents; propellants; fuses and detonators for military use |
| IV | Launch Vehicles, Guided Missiles, Ballistic Missiles, Rockets, Torpedoes, Bombs, and Mines | Complete systems and specially designed components; cruise missiles; anti-ship missiles; air-to-air and surface-to-air missiles; torpedoes; naval mines |
| V | Explosives and Energetic Materials, Propellants, Incendiary Agents, and Their Precursors | Military-grade explosives and propellants; controlled precursor chemicals; pyrotechnic compositions for military use |
| VI | Vessels of War and Special Naval Equipment | Combatant surface vessels; military submarines; ship-launched weapons systems; naval mine countermeasures; military underwater breathing apparatus |
| VII | Tanks and Military Vehicles | Military tanks; armored vehicles; infantry fighting vehicles; military all-terrain vehicles; military ballistic protection; specially designed automotive components for military ground vehicles |
| VIII | Aircraft and Associated Equipment | Military aircraft; unmanned aerial vehicles for military use; aircraft engines and engine components specially designed for military aircraft; ejection systems; life support equipment for military aircraft |
| IX | Military Training Equipment | Military simulators and trainers specially designed for combat training; ground crew trainers; aircraft combat training equipment |
| X | Protective Personnel Equipment and Shelters | Body armor; military helmets; NBC (nuclear, biological, chemical) protective equipment; military field shelters; military parachutes and related equipment |
| XI | Military Electronics | Electronic warfare systems; military jamming equipment; military countermeasures; signals intelligence (SIGINT) systems; certain military radar systems; military navigation/guidance systems not covered elsewhere |
| XII | Fire Control, Laser, Imaging, and Guidance Equipment | Military fire control systems; military laser rangefinders; thermal imaging systems; night vision devices specially designed for military use; military targeting systems |
| XIII | Materials and Miscellaneous Articles | Classified articles not captured in other categories; military camouflage; military spectrally selective coatings; stealth materials; certain hardened military-specification materials |
| XIV | Toxicological Agents Including Chemical Agents, Biological Agents, and Associated Equipment | Chemical warfare agents; biological agents; riot control agents in bulk; protective equipment for chemical/biological warfare; detection equipment for CB agents |
| XV | Spacecraft Systems and Associated Equipment | Military and intelligence satellites; spacecraft propulsion systems; certain remote sensing satellites; satellite-based military communications systems; space launch vehicles with military applications |
| XVI | Nuclear Weapons, Design and Testing Related Items | Nuclear weapon designs; nuclear weapon components; nuclear weapon testing equipment; articles specially designed for nuclear weapons |
| XVII | Classified Articles, Technical Data, and Defense Services Not Otherwise Enumerated | Catch-all for classified defense articles, technical data, and defense services not specifically enumerated in other categories — requires individual DDTC determination |
| XVIII | Directed Energy Weapons | High-energy laser weapon systems; particle beam weapons; military plasma weapons; radio frequency weapons; associated beam control and pointing systems |
| XIX | Gas Turbine Engines and Associated Equipment | Military gas turbine engines; hot section components specially designed for military engines; engine test equipment specially designed for military use |
| XX | Submersible Vessels and Related Articles | Military submarines; military-use underwater vehicles; submarine rescue systems; military underwater breathing and diving equipment |
| XXI | Articles, Technical Data, and Defense Services Not Otherwise Enumerated | Unclassified defense articles, technical data, and defense services not elsewhere enumerated on the USML — also requires individual DDTC determination |
Important note on Categories XVII and XXI: These open-ended categories exist to capture defense articles that don't fit neatly elsewhere. They are not a route to treating anything potentially military as ITAR-controlled — rather, they apply when a product has clear defense utility and no better USML home. When relying on these categories, a Commodity Jurisdiction determination is strongly advisable.
The Step-by-Step ITAR Classification Process
Classification is not a one-time review of a product name or description. It requires a structured, documented analysis that can withstand government scrutiny. Here is how to do it right.
Step 1: Gather Complete Product Information
You cannot classify a product you don't fully understand. Before opening the USML, assemble:
- Technical specifications: performance parameters, operating conditions, materials, software functionality
- Design intent and end-use: Was this product designed for military use? Does it have a civilian counterpart?
- Customer and application context: Who buys it? What do they use it for?
- Prior classification history: Has this item or a predecessor been classified before? By whom? When?
- Development history: Was it developed under a government contract? Was ITAR-controlled data used in its development?
Step 2: Review the USML Categories Systematically
Work through 22 CFR Part 121 with your product's technical specifications in hand. Do not rely on category titles alone — the operative text is in the subcategories, notes, and parenthetical qualifications. Key questions for each category:
- Does the product match a specifically enumerated item description?
- Does it meet the "specially designed" standard for any listed article or component?
- Does the category's technical data or defense services paragraph apply?
- Do any exclusionary notes remove the product from the category?
Step 3: Apply the "Specially Designed" Standard
See the dedicated section below — this is the single most consequential analytical step in any ITAR classification review.
Step 4: Check for Applicable Notes and Exclusions
Many USML categories contain "Note:" provisions that either expand or restrict coverage. Some notes explicitly exclude items that are "in production for non-military commercial applications" or that are "available in substantial quantities in the commercial market." These exclusions are precise — read them carefully and document your analysis.
Step 5: Consider Whether EAR Jurisdiction Applies
If the product is not on the USML, check the Commerce Control List (CCL) under EAR for an applicable ECCN. ITAR takes priority: if it's on the USML, stop there.
Step 6: Document Your Determination in Writing
A classification determination is only as good as the documentation supporting it. For every product, maintain a written record that includes:
- The specific USML category and subcategraph reviewed (or all 21 if the search was comprehensive)
- The analysis supporting inclusion or exclusion from each relevant category
- The technical basis for any "specially designed" determination
- The date, the name of the person who performed the review, and any external guidance consulted
- The final conclusion: ITAR-controlled (with specific USML citation), EAR-controlled (with ECCN), or EAR99
Step 7: Review and Update When Products or Regulations Change
Classification is not static. A product that was EAR-controlled can become ITAR-controlled if it is modified for military performance. Regulatory amendments can shift items between the USML and CCL. Establish a formal process to trigger re-classification when products change or regulations are amended.
The "Specially Designed" Concept: Why It Matters
No concept is more consequential — or more frequently misapplied — in ITAR classification than "specially designed." Under ITAR § 120.41, an item is "specially designed" if:
(a) Catch provisions — as a result of development, the item has properties peculiarly responsible for achieving or exceeding the controlled performance levels, characteristics, or functions in a defense article; or it is for use in or with a defense article; or it was developed in a form in which it is usable in or with a defense article; or
(b) Release provisions — despite meeting the catch criteria, the item is released from "specially designed" status if it is a commodity item in standard commercial production and sold in substantial quantities in the commercial market with no significant performance advantages for military applications compared to what is available to the general public.
Why does this matter so much? Because many defense suppliers manufacture components — machined parts, electronic assemblies, connectors, sensors — that they believe are "just commercial parts." But if those parts were developed specifically to meet military performance requirements, they may be "specially designed" under ITAR § 120.41(a) and therefore ITAR-controlled components, even if they look similar to commercial equivalents.
The "specially designed" analysis requires examining three things:
- Development history: Was the item created or modified to meet a military performance requirement?
- Performance characteristics: Does it have properties that make it peculiarly suitable for use in a defense article?
- Commercial availability: Is it genuinely available in substantial quantities in the commercial market without meaningful performance differences?
If you cannot clearly answer these questions, the analysis isn't complete. This is the exact scenario where an experienced ITAR consultant can prevent a misclassification that would otherwise compound over years of production and export.
ITAR vs. EAR: When to Use Which
ITAR and EAR are mutually exclusive at the item level. Every controlled U.S.-origin product is either ITAR-controlled (listed on the USML) or EAR-controlled (listed on the CCL or EAR99) — not both simultaneously. The hierarchy is clear: USML first, CCL second, EAR99 last.
| Factor | Points to ITAR (USML) | Points to EAR (CCL/EAR99) |
|---|---|---|
| Item is specifically listed on the USML | Yes — ITAR controls | N/A |
| Item was developed primarily for military use | Likely ITAR — review USML | May apply if transferred to CCL via ECR |
| Item has both military and commercial versions | Review "specially designed" standard | If not on USML, check CCL for ECCN |
| Item is a commercial off-the-shelf product | Unlikely — unless "specially designed" | Likely EAR-controlled or EAR99 |
| Item is a software or technical data product | ITAR if associated with USML article | EAR if associated only with CCL article |
| Item was subject to ECR migration (600 series) | Possibly — check current USML text | Yes — 600-series ECCN under EAR |
The Export Control Reform (ECR) initiative significantly shifted the jurisdictional landscape. Many items previously controlled under broad USML categories — especially in Categories VIII (aircraft), XI (electronics), XV (spacecraft), and XIX (gas turbines) — were transferred to the CCL. If your product was classified before ECR was complete (2020), the classification may need to be revisited.
For a detailed side-by-side comparison of the two regimes, see our comprehensive ITAR vs. EAR guide.
Commodity Jurisdiction (CJ) Requests: When and How to Use Them
When a product's USML status is genuinely uncertain — when it sits on the boundary between ITAR and EAR, when the regulatory text is ambiguous, or when a significant business transaction depends on a clear answer — the right tool is a Commodity Jurisdiction (CJ) request to DDTC.
What a CJ Request Does
A CJ request is a formal petition under 22 CFR § 120.4 asking DDTC to make an official determination of whether a specific product, technology, or service is subject to ITAR jurisdiction. The result is a written DDTC determination that is legally binding and provides a documented, defensible basis for your compliance decisions. It is the gold standard for jurisdictional certainty.
When to File a CJ Request
File a CJ request when:
- Your internal review leaves genuine uncertainty about whether the product is on the USML
- The product falls on the USML/CCL boundary, particularly after ECR
- A government contract, export license, or acquisition requires documented ITAR status
- A new product was developed under a DoD or other government program and the classification is unclear
- You are importing a product and need to determine whether ITAR re-export obligations apply
How to Submit a CJ Request
- Prepare a complete technical description: DDTC cannot make a meaningful determination without detailed product specifications, performance parameters, intended use, and supporting documentation
- Submit through D-Trade: DDTC's electronic licensing and registration system accepts CJ requests electronically
- Wait for DDTC determination: Standard processing is 45 days but can extend to 90 days or longer for complex items requiring interagency review
- Receive and retain the written determination: File it as a permanent part of your classification records
A CJ request is not an admission that a product is ITAR-controlled — it is the responsible path to finding out. Companies that self-classify without adequate analysis, and get it wrong, face the full force of ITAR enforcement. Companies that filed a CJ and received a determination have documented good faith.
For a detailed comparison of when to self-classify versus when to pursue a formal determination, see our analysis of Commodity Jurisdiction vs. self-classification.
Common Mistakes Companies Make During ITAR Classification
After working with over 200 clients across the defense industrial base, I've seen the same classification errors repeat with predictable frequency. Knowing them in advance is half the battle.
1. Assuming Commercial Availability Means "Not ITAR"
A product that is commercially available can still be ITAR-controlled if it was "specially designed" for a military application. Commercial availability triggers the release provision of § 120.41 only when the item is sold in substantial quantities in the commercial market and lacks meaningful performance advantages for military applications.
2. Relying on Customer Representations
Customers often tell suppliers their product "isn't ITAR." That representation has no legal weight. The obligation to determine ITAR status belongs to the manufacturer and exporter, not to the downstream customer.
3. Failing to Classify Technical Data Separately
The hardware may not be ITAR-controlled, but the technical data — drawings, specifications, test results, software — used to design or manufacture it might be. Technical data that is "required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification" of a defense article is itself a defense article under ITAR. Understanding ITAR technical data classification is a distinct analytical exercise from hardware classification.
4. Not Re-Classifying After Product Changes
A product that starts life as EAR-controlled can become ITAR-controlled if it is modified to meet a military performance requirement. Classification records must be tied to product revisions and updated when changes occur.
5. Assuming DDTC Registration Isn't Required Until First Export
Wrong. Under 22 CFR § 122.1, every company that manufactures a defense article is required to register with DDTC — regardless of whether it has exported anything. Registration obligations begin the moment you manufacture an ITAR-controlled item.
6. Ignoring the 600-Series ECR Migration
Post-ECR, some items that were previously USML-controlled are now on the CCL. Companies that updated their products after ECR but didn't update their classification records may be maintaining unnecessary ITAR controls — or, more dangerously, treating newly CCL-controlled items as ITAR without confirming whether that's still correct.
7. Treating Classification as a One-Time Event
Classification is a living record that must be maintained, reviewed, and updated. New products, product modifications, regulatory amendments, new customers, and new end-uses can all affect classification status. A classification from 2018 is not necessarily valid in 2026.
What to Do Once You Determine Your Product Is ITAR-Controlled
Confirming ITAR applicability is the beginning of the compliance journey, not the end. Here is the sequence of required actions.
1. Register with DDTC
Under 22 CFR Part 122, manufacturers and exporters of defense articles must register with DDTC. Registration is done through the D-Trade electronic system. Annual registration fees range from $2,250 to $2,750 depending on the number of licenses anticipated. Registration must be renewed annually. Failure to register is itself an ITAR violation. For a full walkthrough of the DDTC registration process, see our dedicated guide.
2. Obtain Required Export Licenses or Authorizations
Before any export, re-export, retransfer, or temporary import of an ITAR-controlled article, you must obtain the appropriate DDTC authorization — typically a DSP-5 (permanent export), DSP-73 (temporary export), Technical Assistance Agreement (TAA), or Manufacturing License Agreement (MLA). Some activities qualify for ITAR exemptions, but these must be documented and the conditions strictly met. See our detailed export license application guide for the full process.
3. Implement Access Controls for Technical Data
ITAR-controlled technical data must be protected from access by foreign nationals — whether employees, contractors, visitors, or anyone else — unless a license or valid exemption authorizes disclosure. This requires a Technology Control Plan (TCP) that establishes physical, IT, and procedural controls. Foreign national employees who will access ITAR data require either a license or a valid exemption before that access is authorized. See our guide on Technology Control Plans.
4. Designate an Empowered Official
ITAR requires each registered company to have at least one Empowered Official (EO) — a U.S. person with authority to sign license applications and other DDTC authorizations, and with the knowledge to understand the legal obligations and consequences involved. The EO role has specific regulatory requirements and cannot be delegated to someone who lacks the requisite authority and knowledge.
5. Maintain Records for Five Years
Under 22 CFR § 122.5, all export control records — licenses, shipping documentation, correspondence, classification records — must be retained for a minimum of five years from the date of export or the expiration of the authorization, whichever is later. The five-year window applies to DDTC audits and enforcement investigations.
6. Build a Compliance Program
ITAR compliance is not a single document or a one-time registration. It is an ongoing program with written procedures, regular training, internal auditing, and incident response protocols. DDTC's Compliance Program Guidelines provide the reference framework. Companies with documented, operational compliance programs receive meaningful credit in enforcement proceedings when violations do occur. If your organization is just getting started, our guide on building an ITAR compliance program from scratch is the right starting point.
Key Takeaways
Summary Box — ITAR Classification Essentials
- Classification is the foundation of all ITAR compliance. Every other obligation — registration, licensing, technical data controls — flows from classification status.
- The USML has 21 categories in 22 CFR Part 121. Each must be reviewed systematically, not by category title alone.
- The "specially designed" standard (§ 120.41) is the most consequential and most frequently misapplied concept in ITAR classification. Analyze the development history, performance characteristics, and commercial availability of every component.
- ITAR takes priority over EAR. If an item is on the USML, it is ITAR-controlled — full stop. Only items not on the USML fall under EAR jurisdiction.
- When classification is uncertain, file a Commodity Jurisdiction (CJ) request with DDTC. Self-classifying on uncertain grounds creates compounding liability.
- Classification must be documented in writing, tied to specific product revisions, and reviewed when products change or regulations are amended.
- Once a product is confirmed ITAR-controlled: register with DDTC, obtain export authorizations, protect technical data, designate an Empowered Official, and build a compliance program.
Why Working with an ITAR Consultant Matters for Classification Decisions
Classification decisions sit at the intersection of regulatory text, product engineering, and legal risk. That is an uncommon combination for any single person inside a company to navigate with confidence, especially when the stakes are measured in potential eight-figure enforcement exposure.
An experienced ITAR consultant brings three things that internal reviews typically lack:
- Regulatory pattern recognition: Having classified hundreds of products across all 21 USML categories, an experienced consultant knows which category notes trip people up, which "specially designed" determinations are genuinely arguable, and which products are clear-cut
- Documentation discipline: The ability to produce a classification record that can survive a DDTC audit or enforcement investigation is not the same as reaching the right answer. The record must be defensible in form, not just in conclusion
- Independence from organizational bias: Internal pressure to classify products as EAR rather than ITAR — because ITAR means registration fees, compliance overhead, and export restrictions — is real and affects internal classification reviews. An outside consultant's conclusions are not subject to that pressure
With more than 200 clients served, a 100% first-time audit pass rate, and credentials spanning JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, and RAC, Certify Consulting brings the depth of knowledge your classification program deserves.
Get Your ITAR Classification Right the First Time
If you manufacture, export, or distribute products that may be defense articles — or if you're building a compliance program and aren't certain of your product's USML status — the right move is a formal classification review before the next transaction, not after.
At Certify Consulting, our classification review service provides a written product-by-product USML analysis, a documented determination for every item in your portfolio, guidance on whether CJ requests are warranted, and a classification record designed to hold up under scrutiny.
Get started with a free consultation. Contact us at itarconsultant.us/contact/ or reach us directly through certify.consulting. Whether you're building a compliance program from the ground up or validating classifications you've been relying on for years, we'll give you a clear answer and a defensible record to stand behind it.
Frequently Asked Questions
How do I know if my product is on the USML?
Review the 21 USML categories in 22 CFR Part 121 and apply the "specially designed" standard under ITAR § 120.41. If your product was specifically designed, developed, configured, adapted, or modified for a military application and meets the criteria of a USML category or subcategory, it is ITAR-controlled. When uncertain, submit a Commodity Jurisdiction (CJ) request to DDTC for a formal, legally defensible determination.
What is the "specially designed" standard under ITAR?
Under ITAR § 120.41, "specially designed" means an item or component that, as a result of development, has properties peculiarly responsible for achieving or exceeding the controlled performance levels of a defense article, or that was developed for use in or with a defense article. The definition also includes release provisions that can exclude genuinely commercial items sold in substantial quantities in the commercial market.
When should I file a Commodity Jurisdiction request?
File a CJ request when your product sits on the USML/CCL boundary, when you are uncertain after reviewing the USML, or when a government contract or business transaction requires documented ITAR status. CJ requests are submitted through DDTC's D-Trade system. Standard processing takes 45 days, though complex items requiring interagency review can take longer.
What is the difference between ITAR and EAR for export classification?
ITAR (22 CFR Parts 120–130) controls defense articles, defense services, and related technical data listed on the USML. EAR (15 CFR Parts 730–774) controls dual-use commercial items on the CCL. ITAR takes jurisdictional priority: if an item is on the USML, it is ITAR-controlled. Only items not on the USML fall under EAR. ITAR requires mandatory DDTC registration; EAR does not.
What happens after my product is confirmed ITAR-controlled?
Once confirmed, you must: (1) register with DDTC as a manufacturer or exporter; (2) obtain required export licenses or authorizations before any export, re-export, or transfer; (3) implement access controls and a Technology Control Plan for technical data; (4) designate an Empowered Official; and (5) maintain records for a minimum of five years per 22 CFR § 122.5.
Last updated: 2026-04-09
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.