The first surprise for a software company is that the Export Administration Regulations treat software as an export, and the second is that the export happens when the code is made available, not when it is shipped. Uploading controlled software to a server where a foreign person can download it is an export. Giving a foreign national access to a repository that holds controlled code is an export. The medium does not matter, and the fact that the code never crossed a border does not matter either, because the regulation follows the technology, not the truck.
The classification question is the same as for hardware: what does it do, and what is it specially designed for? Encryption software carries its own ECCNs, and the controls turn on the strength and the function of the encryption. Software for the development, production, or use of a controlled item takes the ECCN of the item it supports. Software that performs a controlled function, like the navigation software in a controlled aircraft, carries its own control. The BIS classification guidance is the starting point, and the ECCN is the answer, or the answer is EAR99, which means the software is subject to the EAR but does not carry a specific control.
The deemed export rule is the one that catches companies that think they have no exports at all. Releasing controlled technology or source code to a foreign national inside the United States is deemed to be an export to that person's home country, even though nothing leaves the United States and the person may have lived here for years. The rule applies to employees, contractors, interns, and visitors, and it applies to the source code they can read, not just the software they can run.
The practical consequence is that a company with foreign national engineers working on controlled code needs a license, or a license exception, or a technology control plan that keeps the controlled code away from the people who would need a license to see it. The plan has to be real: access controls on the repository, training for the team, and a record of who accessed what. A plan that exists on paper and not in the repository is not a plan, and BIS will ask for the access logs before it asks for the policy document.
Most commercial software does not need a license, because it falls under a license exception or because the ECCN is EAR99 and the destination is not restricted. But the exception has to be claimed correctly, and the claim has to be documented. Encryption software, for example, often qualifies for License Exception ENC, but the exception requires a classification request or a self-classification, and the record has to show which one was used. A company that ships encryption software without ever classifying it is not using an exception. It is guessing, and the guess is the violation.
The sequence is short and worth following in order. Classify the software, and get the ECCN in writing. Check the destination and the end user against the restricted-party lists. Determine whether a license or a license exception applies, and document the determination with the order. And if a foreign national will work on the code, run the deemed export analysis before they get access, not after. For the hardware side of the same question, ECCN versus EAR99 covers the license check itself, and denied party screening for exports covers the lists that decide whether the end user can receive the shipment at all.
Yes. Software is controlled as an export when it is specially designed for a controlled purpose, and the export includes making the code available for download, not just shipping it on a disk. The regulation follows the technology, not the truck.
Releasing controlled technology or source code to a foreign national inside the United States, which is deemed to be an export to that person's home country. It applies to employees, contractors, and visitors, and to the source code they can read, not just the software they can run.
It depends on the ECCN and the destination. Much commercial encryption software qualifies for License Exception ENC, but the exception requires a classification request or a self-classification, and the record has to show which one was used.
It means the item is subject to the Export Administration Regulations but does not carry a specific ECCN control. EAR99 items can still require a license for a restricted destination or a listed end user, so the classification is not the end of the analysis.