Deemed Export Violations: What Companies Need to Know About Foreign National Access to Controlled Technology
Most companies associate export control laws with products crossing international borders. However, employee access, foreign investment, research collaborations, and technology sharing can all trigger deemed export obligations under U.S. export control laws.
A manufacturer ships equipment overseas. A defense contractor transfers technology to a foreign customer. A company exports software or technical data to an international business partner.
Those scenarios clearly involve exports.
What many organizations do not realize, however, is that some of the most significant export control violations occur without a shipment, without a customs filing, and without any technology ever leaving the United States.
A foreign national engineer receives access to technical specifications. A software developer is granted access to source code repositories. A foreign investor reviews proprietary technology during due diligence. A university researcher collaborates with an international partner. A foreign visitor attends a facility tour where controlled technology is discussed or demonstrated.
These transactions and interactions occur every day across technology companies, defense contractors, manufacturers, universities, research institutions, startups, and organizations seeking foreign investment. Yet many companies fail to recognize the potential export-control implications until an internal audit, government inquiry, acquisition review, licensing issue, or enforcement investigation brings the matter to light.
In this article, we explain what a deemed export is, what constitutes a release of technology, the industries and activities most commonly affected, and the legal and business consequences that can arise when foreign nationals gain access to controlled technology, software, or technical data.
What Is a Deemed Export?
A deemed export occurs when controlled technology, technical data, software, or source code is released to a foreign national within the United States.
Although the information never physically leaves the country, U.S. export control laws, specifically the Export Administration Regulations (“EAR”), administered by the Bureau of Industry and Security (“BIS”), and the International Traffic in Arms Regulations (“ITAR”), administered by the Directorate of Defense, may treat the disclosure as though the technology had been exported to the individual's country of citizenship or permanent residence.
Simply put, export-control obligations can arise based on who receives the information, not solely where the disclosure occurs.
This concept often surprises business leaders because the activity may appear entirely domestic. The individuals involved may work for the same company, participate in the same project, or be physically located in the same office, laboratory, or facility. Nevertheless, if controlled technology is involved, the disclosure may trigger licensing requirements, compliance obligations, or regulatory scrutiny.
For that reason, deemed exports remain one of the most frequently misunderstood areas of U.S. export control law.
The fact that a foreign national holds a work visa, has a security clearance application pending, or has worked for a U.S. company for years does not, without more, authorize access to controlled technology. The licensing analysis must be conducted independently, and before access is granted, not after an enforcement inquiry has begun.
What Constitutes a Release of Technology?
Many organizations assume that technology is "released" only when documents are emailed, files are transferred, or technical information is intentionally provided to another party.
The reality is considerably broader. A release of controlled technology may occur, for example, through:
Granting a foreign national employee access to source code, repositories, engineering databases, or technical documents needed to perform their job;
Having a researcher participate in a project involving controlled technology;
A training session, attended by an engineer, where sensitive technical information is discussed; or,
Observation of a manufacturing process, testing procedure, prototype, or piece of controlled equipment.
Companies should also be mindful of modern collaboration tools. Access to cloud-based platforms, shared drives, document management systems, and other digital repositories containing controlled information may create deemed export issues if appropriate safeguards are not in place. In some circumstances, merely allowing access to controlled technology may create export-control concerns.
This broad definition is one reason deemed export compliance often requires a comprehensive review of how information is stored, shared, discussed, and accessed throughout an organization.
Deemed Exports Are Not Limited to Employees.
One of the most common misconceptions is that deemed export issues arise only when companies hire foreign national employees. While employee access is often a significant consideration, it is only one part of the analysis.
Organizations may encounter deemed export risks whenever controlled technology is shared with foreign nationals, including:
Independent contractors and consultants;
Temporary personnel and staffing agencies;
Visiting scientists and researchers;
Foreign investors and board members;
International business partners;
Joint venture participants;
Potential acquirers conducting due diligence;
Foreign customers attending demonstrations;
Vendors and third-party service providers; or,
University collaborators and research partners.
In today's interconnected business environment, technology is routinely shared through virtual meetings, cloud platforms, collaborative development environments, and remote-access systems.
As a result, companies may create export-control exposure through ordinary business operations long before anyone recognizes that a deemed export issue exists.
Foreign Investment and Mergers Can Create Hidden Export-Control Risks.
Deemed export concerns frequently arise during mergers, acquisitions, private equity transactions, venture capital investments, and strategic partnerships. Before a transaction closes, prospective investors or buyers often request access to highly sensitive information, including:
Technical specifications;
Engineering documentation;
Proprietary manufacturing processes;
Research and development data;
Software architecture and source code; and,
Product testing information.
When foreign investors, foreign-owned entities, or international business partners are involved, these disclosures can raise significant export-control questions. In some situations, the due diligence process itself may require careful planning to avoid unauthorized disclosures of controlled technology. For companies operating in sensitive industries, export-control considerations should often be addressed alongside broader transaction planning and regulatory review.
Research Institutions and Universities Face Unique Challenges.
Universities and research institutions frequently engage in international collaboration, making deemed export compliance particularly important.
Researchers often work alongside foreign students, visiting scholars, international faculty members, and global research partners. While certain research activities may qualify for regulatory exclusions, those exclusions are not unlimited. Sponsored research agreements, proprietary projects, restricted technologies, government-funded programs, and publication limitations may all affect the export-control analysis.
Institutions that assume the exclusion covers their entire research program without conducting a careful legal analysis have in some cases found themselves the subject of federal investigations.
Industries Most Commonly Affected by Deemed Export Rules.
Although export-control obligations can affect nearly any business, certain industries face heightened exposure.
Technology and Software Companies:
Companies developing software, cybersecurity tools, artificial intelligence applications, encryption technologies, cloud infrastructure, and advanced computing systems often maintain valuable technical information that may be subject to export controls.
Aerospace and Defense Contractors:
Organizations working with defense-related technologies, military applications, aerospace systems, and government contracts frequently operate within highly regulated environments where foreign national access requires careful review.
Semiconductor and Electronics Companies:
Semiconductor manufacturing, chip design, fabrication technologies, and advanced electronics remain areas of significant regulatory focus.
Advanced Manufacturing and Engineering Firms:
Manufacturers developing sophisticated industrial technologies, robotics, specialized equipment, or emerging technologies often face export-control obligations that extend beyond physical products.
Startups and Emerging Technology Companies:
Rapid growth, international recruiting, foreign investment, and limited compliance infrastructure can make startups particularly vulnerable to deemed export issues. Many emerging companies do not realize they may have export-control obligations until investors, customers, government agencies, or acquisition partners raise the issue.
Why Many Companies Miss the Problem.
Most deemed export issues do not arise because a company intentionally disregards export-control laws. More often, they stem from common misconceptions about when those laws apply. Organizations often assume:
Export regulations become relevant only when products are shipped overseas;
Export-control concerns have already been addressed when an employee received his/her valid work authorization; or,
Export restrictions do not apply where employees need to have access to information necessary to perform their jobs, or technology was developed internally.
Unfortunately, those assumptions are often incorrect. Because deemed exports frequently occur through routine business activities, organizations may not recognize potential issues until years after access was first granted. By that point, the company may be evaluating historical disclosures involving multiple individuals, technologies, projects, and jurisdictions.
Organizations that employ foreign nationals, collaborate internationally, pursue foreign investment, or develop potentially controlled technologies should consider whether their current compliance procedures adequately address deemed export risks. Among other things, companies should understand:
What technologies, software, technical data, and source code may be subject to export controls;
Who has access to that information;
Whether foreign nationals are involved in relevant projects;
Whether access controls appropriately protect controlled technology;
Whether licenses or authorizations may be required; and,
Whether prior disclosures warrant review.
Because these assessments often involve both technical and legal considerations, organizations frequently seek legal guidance before making decisions regarding licensing, disclosures, investigations, or remediation efforts.
The Consequences of Getting It Wrong.
Federal agencies continue to devote substantial resources to export-control enforcement, particularly in industries involving national security, advanced technologies, semiconductors, aerospace systems, cybersecurity, artificial intelligence, and defense-related technologies.
A deemed export violation may expose companies and individuals to:
Significant civil penalties;
Criminal liability in serious cases;
Government investigations and audits;
Export-license restrictions;
Suspension or loss of export privileges;
Contracting and procurement consequences;
Costly compliance reviews and remediation efforts; and,
Reputational harm and business disruption.
The financial exposure is significant and specific. BIS civil penalties for EAR violations can reach $374,474 per violation or twice the value of the transaction, whichever is greater, with criminal penalties of up to twenty (20) years imprisonment and $1,000,000 per violation, or both. DDTC civil penalties for ITAR violations can reach $1,271,078 per violation, with criminal penalties of up to twenty (20) years imprisonment and $1,000,000 per violation for willful violations. Where a foreign national involved is from a comprehensively sanctioned country (e.g., Iran, Cuba, North Korea, Syria, or certain regions of Russia and Ukraine, the Office of Foreign Assets Control (“OFAC”) may also assert jurisdiction, meaning BIS, DDTC, and OFAC enforcement can run simultaneously from a single incident.
Navigating that exposure requires coordinated legal strategy across all three agencies, disclosing to one without understanding the effect on the others can create complications that are difficult to reverse.
Why Early Legal Guidance Matters.
Deemed export issues rarely involve a single compliance question. They often intersect with employment practices, foreign investment, government contracting, mergers and acquisitions, university research, technology licensing, internal investigations, and regulatory enforcement.
Organizations confronting potential deemed export concerns frequently must evaluate licensing obligations, disclosure requirements, technology classifications, access controls, and possible agency scrutiny.
The decisions made during the earliest stages of a potential issue can significantly affect how the matter ultimately resolves. As discussed in our previous article on Voluntary Self-Disclosure (“VSD”), VSD programs at BIS, DDTC, and OFAC can provide meaningful penalty mitigation, but only when the disclosure is properly structured, accurately scoped, and submitted at the right time. A poorly prepared disclosure can provide the government with a roadmap to violations it had not yet identified and produce outcomes worse than fully contested enforcement proceeding.
For that reason, obtaining experienced legal guidance before responding to government inquiries, conducting disclosures, or implementing corrective measures is often one of the most important steps an organization can take.
At Imperial Shield PLLC, we advise companies, universities, research institutions, government contractors, manufacturers, technology firms, and investors on export-control compliance, deemed export reviews, internal investigations, voluntary disclosures, enforcement actions, and regulatory matters involving BIS, DDTC, OFAC, and related agencies. If your organization has questions regarding foreign national access to controlled technology, software, source code, or technical data, contact us today for a free confidential consultation.
Frequently Asked Questions (FAQs):
-
A deemed export occurs when controlled technology, software, source code, or technical data is released to a foreign national in the United States and is treated as an export to that person's home country.
-
Yes. A deemed export can occur entirely within the United States and may not involve any shipment, customs filing, or international transfer.
-
No. A foreign national's immigration or work authorization status does not automatically determine whether export-control restrictions apply.
-
A release may occur through access to technical information, source code, engineering data, training sessions, research activities, or certain technical discussions.
-
No. Deemed export issues can also arise with contractors, consultants, researchers, investors, board members, business partners, and visitors.
-
Potentially. Access to shared drives, repositories, cloud platforms, and other digital systems containing controlled technology may raise export-control concerns.
-
Absolutely. Startups often recruit international talent, seek foreign investment, and develop emerging technologies, all of which can create export-control obligations.
-
Yes. During investment transactions, mergers, acquisitions, and due diligence reviews, foreign parties may request access to technical information that could be subject to export controls.
-
Depending on the circumstances, consequences may include government investigations, substantial civil penalties, criminal liability, export restrictions, and business disruption.
-
Ideally before granting access to controlled technology, responding to a government inquiry, making a disclosure, or proceeding with a transaction involving foreign nationals or foreign investors.
This article is intended for informational purposes only and does not constitute legal advice. The content herein is not a substitute for obtaining legal advice from a qualified attorney licensed in the appropriate jurisdiction. Viewing or relying upon this information does not create an attorney-client relationship. Readers should consult with legal counsel regarding their individual circumstances before taking any action based on this material.