United States (federal) · regulation
ITAR: what it requires, and the records to keep
The ITAR, administered by the State Department's Directorate of Defense Trade Controls (DDTC), control exports, temporary imports and brokering of items on the US Munitions List, including technical data and defense services. For AI work, putting ITAR technical data into prompts, training sets, models or cloud tools that foreign persons or foreign servers can reach can be an unlicensed export.
01 / What it requires
What ITAR requires
US manufacturers, exporters and brokers of defense articles, technical data and defense services on the US Munitions List, and anyone handling ITAR-controlled technical data.
- 01Register with DDTC if manufacturing, exporting or brokering defense articles or services.
- 02Obtain DDTC licences or agreements, or use an exemption, before exporting defense articles, technical data or services.
- 03Prevent release of technical data to foreign persons, including inside the US, without authorization.
- 04Protect technical data in transit and storage abroad, e.g., using qualifying end-to-end encryption.
- 05Keep ITAR records for five years and disclose violations voluntarily where found.
02 / AI work
Where it touches AI work
AI tools and cloud services that store or process ITAR technical data must restrict access to authorized US persons and approved locations; AI models trained on technical data may need the same controls as the data.
03 / Dates
The dates that matter
AUKUS licensing exemption for Australia and UK finalized
Interim final rule moves some suppressors off USML Category I (effective 20 Nov 2026)
Rule clarifies policies of denial and updates major non-NATO ally list
Syria removed from ITAR policy-of-denial countries
04 / Enforcement
Who enforces it
DDTC (civil) and DOJ (criminal). Civil penalties up to $1,271,078 per violation or twice the transaction value; criminal penalties up to $1 million and 20 years' imprisonment; debarment.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01DDTC registration and licences or agreements
- 02Jurisdiction and USML classification records
- 03Access controls limiting technical data to authorized persons
- 04Export records and voluntary disclosure files
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Does auditing my model risk an ITAR deemed-export of the weights?+
It can, if the weights embody ITAR technical data. Under the ITAR, releasing technical data to a foreign person, even inside the United States, is an export that needs DDTC authorization, and so is sending it to a foreign location. An audit that lets foreign-person staff, a foreign vendor or servers abroad access the weights could therefore be a violation. Keep the work in an environment limited to authorized US persons, or get authorization first. Whether specific weights are technical data is a classification question for export-control counsel. Read the full answer
Are AI model outputs considered ITAR or EAR controlled technical data?+
They can be. Classification depends on content, not on whether AI produced it. Output that is technical data for a US Munitions List defense article, such as design or manufacturing details, is ITAR-controlled. Output that is technology for a Commerce Control List item may be controlled under the EAR; other output may be EAR99 or not subject to controls at all, and public general information is generally not controlled. The EAR's January 2025 model-weights control (ECCN 4E091) is not being enforced and BIS has said it will rescind it. Read the full answer
SOURCES
Go back to the source
Federal Register
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: ITAR for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4