Securiti launches Gencore AI, a holistic solution to build Safe Enterprise AI with proprietary data - easily

View

ITAR Exemptions: Navigating the Regulations to Avoid Penalties

Contributors

Anas Baig

Product Marketing Manager at Securiti

Adeel Hasan

Sr. Data Privacy Analyst at Securiti

CIPM, CIPP/Canada

Listen to the content

Treading the path of international defense articles or services trading is fairly challenging due to stringent arms regulations. The International Traffic in Arms Regulations (ITAR) is one such comprehensive and complex set of provisions in the United States that regulates the trade (export and import) of defense-related articles, services, and even sensitive data.

Businesses that are engaged in defense-related goods and data have to go through a strict set of requirements for ITAR compliance and be eligible for defense export. For instance, ITAR-covered businesses must get registered with the regulatory authority, obtain export or import permits, and keep a record of all ITAR-related activities, to name a few.

Under all those intricate webs of requirements exists an elbow room that can make the compliance process significantly faster and smoother for certain items or services. This leeway is called the ITAR exemption.

Remember, ITAR applies not only to businesses that directly deal in defense-related articles, such as manufacturers or sellers of military arms, equipment, software, and data, it also applies to vendors, suppliers, etc. Therefore, it is critical for any business engaged in defense-related articles, either directly or indirectly, to understand the requirements and exemptions of ITAR-covered transactions to make compliance seamless and streamline defense commerce.

What is an ITAR Exemption?

The International Traffic in Arms Regulation (ITAR) is governed, overseen, and enforced by the Directorate of Defense Trade Controls (DDTC) at the US Department of State. The regulation is established to govern the export or temporary import of sensitive military-grade items, services, and data for the national security of the country.

ITAR applies to a specific list of military or government-level arms, equipment, software, services, or data covered under the United States Munition List (USML). The list carries up to 21 categories of items that include fully-assembled items to spare parts, patents, blueprints, technical documents, and software. However, not every item on the list demands ITAR-covered businesses to apply for and obtain export permits.

Businesses are often quick to jump when it comes to obtaining licenses which is a fairly laborious and time-consuming process. Instead, businesses must first consider the exemptions provided on certain USML-covered items.

So, what exactly does an exemption mean under ITAR? By definition, an ITAR exemption refers to specific situations where businesses can undertake the export, reexport, retransfer, temporary import, or brokering of a specific defense article or defense service without a license or other written authorization.

The government has allowed the exemptions to relax the regulations on certain items that it believes are safe to export and don’t harm the US national security. That being said, there is a wide range of exemptions under ITAR that facilitate some limited transactions without the need for an export or temporary import license by the DDTC.

Types of ITAR Exemptions & Eligibility

Exemptions can be found in varying Parts under the ITAR provisions. Let’s take a quick look at those ITAR exemptions and the related eligibility requirements.

Exemptions in Part 123 - Export or Temporary Import of Defense Articles

Part 123.4 outlines the exemptions for the temporary import of defense articles that are to be imported for servicing purposes, such as repairing, testing, overhauling, and upgrading of the article or exhibition for marketing in the United States. The exemption applies to only unclassified items that are of US-origins.

Similarly, Part 123.16 lists the exemptions for exporting unclassified defense articles or components that are less than $500 in value. The items listed in this section must not be shipped to a distributor but only to a previously approved and authorized entity. The exporter must not make more than 24 shipments per year.

It is also to be noted that ITAR-covered entities must only be exported to embargoed or sanctioned destinations. Further, exemptions can be nullified with a congressional notification requirement.

To use the exemption, the businesses must meet the eligibility criteria mentioned under Part 123.16 for approvals of export or temporary imports. Moreover, as general criteria for all exemptions, the covered entities are required to file an Electronic Export Information (EEI). In this case, the EEI must have the consignee's name on it, which should be the same as the end-user.

Exemptions in Part 124 - Defense Services (Training & Military Service)

This part mandates seeking approval from the DDTC by way of submitting a proposed agreement before furnishing defense services. However, the provision of training in the basic operation and maintenance of defense articles lawfully exported or authorized for export to the same recipient is exempt from this requirement. Similarly, no permits or licenses are required for training or military services for NATO countries, including Australia, Japan, and Sweden. Furthermore, NATO foreign persons are also allowed to receive technical data or maintenance training without fulfilling the requirements under this part.

Exemptions in Part 125 - Export of Technical Data

As per the exemptions provided under this part, a covered entity doesn’t require a license or a permit for sharing technical data (classified or unclassified) with US persons. However, the exemption applies not for export authorization but to further an agreement containing scope and limitation. It is also important to note that the exempted technical data doesn’t include data that is associated with the development or production of a defense article.

Apart from that, there are certain other restrictions related to the export exemption of technical data provided under part 125.4(9). For instance, the exported, reexported, or retransferred data can only be possessed by a US person or any unauthorized foreign person. Classified data, which is transferred outside the US, must be in accordance with the guidelines provided by the Department of Defense National Industrial Security Program Operating Manual. Lastly, unclassified technical data is also exempted from any licensing requirements and can be exported to NATO nationals, such as in Australia, Sweden, or Japan.

Exemptions in Part 126 - USG & Country-Specific Exemptions

Part 126 of ITAR covers exemptions associated with the United States Government (USG) agencies and some sanctioned countries. For instance, export or import licenses are not required for defense-related items or services when the request is made by a department or agency or a person of the US Government. However, for export clearance, it is essential to file an EEI to the U.S. Customs and Border Protection.

Similarly, Part 126 further lists exemptions related to certain countries like Canada, the United Kingdom, Australia, and some NATO nations. These exemptions allow permanent or temporary export of defense-related goods, services, as well as data.

The processes and eligibility requirements in ITAR exemptions vary greatly, depending on the specific exemption. Therefore, it is necessary for businesses to thoroughly go through the specifications in each provision to make the best use of the exemption they are seeking.

Speed Up & Streamline ITAR Compliance with Securiti

Securiti Data Command Center helps businesses derive sensitive data insights across their corporate data landscape to streamline their privacy operations. Speed up ITAR compliance by getting visibility of your ITAR data, what regulations and exemptions apply to it, and how you can automate compliance.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


Share


More Stories that May Interest You

Videos

View More

Mitigating OWASP Top 10 for LLM Applications 2025

Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...

View More

DSPM vs. CSPM – What’s the Difference?

While the cloud has offered the world immense growth opportunities, it has also introduced unprecedented challenges and risks. Solutions like Cloud Security Posture Management...

View More

Top 6 DSPM Use Cases

With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...

View More

Colorado Privacy Act (CPA)

What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...

View More

Securiti for Copilot in SaaS

Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...

View More

Top 10 Considerations for Safely Using Unstructured Data with GenAI

A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....

View More

Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes

As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...

View More

Navigating CPRA: Key Insights for Businesses

What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...

View More

Navigating the Shift: Transitioning to PCI DSS v4.0

What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...

View More

Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)

AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...

Spotlight Talks

Spotlight 47:42

Cybersecurity – Where Leaders are Buying, Building, and Partnering

Rehan Jalil
Watch Now View
Spotlight 46:02

Building Safe Enterprise AI: A Practical Roadmap

Watch Now View
Spotlight 13:32

Ensuring Solid Governance Is Like Squeezing Jello

Watch Now View
Spotlight 40:46

Securing Embedded AI: Accelerate SaaS AI Copilot Adoption Safely

Watch Now View
Spotlight 10:05

Unstructured Data: Analytics Goldmine or a Governance Minefield?

Viral Kamdar
Watch Now View
Spotlight 21:30

Companies Cannot Grow If CISOs Don’t Allow Experimentation

Watch Now View
Spotlight 2:48

Unlocking Gen AI For Enterprise With Rehan Jalil

Rehan Jalil
Watch Now View
Spotlight 13:35

The Better Organized We’re from the Beginning, the Easier it is to Use Data

Watch Now View
Spotlight 13:11

Securing GenAI: From SaaS Copilots to Enterprise Applications

Rehan Jalil
Watch Now View
Spotlight 47:02

Navigating Emerging Technologies: AI for Security/Security for AI

Rehan Jalil
Watch Now View

Latest

View More

Accelerating Safe Enterprise AI with Gencore Sync & Databricks

We are delighted to announce new capabilities in Gencore AI to support Databricks' Mosaic AI and Delta Tables! This support enables organizations to selectively...

View More

Building Safe, Enterprise-grade AI with Securiti’s Gencore AI and NVIDIA NIM

Businesses are rapidly adopting generative AI (GenAI) to boost efficiency, productivity, innovation, customer service, and growth. However, IT & AI executives—particularly in highly regulated...

Key Differences from DLP & CNAPP View More

Why DSPM is Critical: Key Differences from DLP & CNAPP

Learn about the critical differences between DSPM vs DLP vs CNAPP and why a unified, data-centric approach is an optimal solution for robust data...

DSPM Trends View More

DSPM in 2025: Key Trends Transforming Data Security

DSPM trends in 2025 provides a quick glance at the challenges, risks, and best practices that can help security leaders evolve their data security...

The Future of Privacy View More

The Future of Privacy: Top Emerging Privacy Trends in 2025

Download the whitepaper to gain insights into the top emerging privacy trends in 2025. Analyze trends and embed necessary measures to stay ahead.

View More

Personalization vs. Privacy: Data Privacy Challenges in Retail

Download the whitepaper to learn about the regulatory landscape and enforcement actions in the retail industry, data privacy challenges, practical recommendations, and how Securiti...

Nigeria's DPA View More

Navigating Nigeria’s DPA: A Step-by-Step Compliance Roadmap

Download the infographic to learn how Nigeria's Data Protection Act (DPA) mapping impacts your organization and compliance strategy.

Decoding Data Retention Requirements Across US State Privacy Laws View More

Decoding Data Retention Requirements Across US State Privacy Laws

Download the infographic to explore data retention requirements across US state privacy laws. Understand key retention requirements and noncompliance penalties.

Gencore AI and Amazon Bedrock View More

Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock

Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...

DSPM Vendor Due Diligence View More

DSPM Vendor Due Diligence

DSPM’s Buyer Guide ebook is designed to help CISOs and their teams ask the right questions and consider the right capabilities when looking for...

What's
New