Question · ITAR
Are AI model outputs considered ITAR or EAR controlled technical data?
The ITAR, administered by the State Department's Directorate of Defense Trade Controls (DDTC), control exports, temporary imports and brokering of items on the US Munitions List, including technical data and defense services.
01 / The answer
The short answer
They can be. Classification depends on content, not on whether AI produced it. Output that is technical data for a US Munitions List defense article, such as design or manufacturing details, is ITAR-controlled. Output that is technology for a Commerce Control List item may be controlled under the EAR; other output may be EAR99 or not subject to controls at all, and public general information is generally not controlled. The EAR's January 2025 model-weights control (ECCN 4E091) is not being enforced and BIS has said it will rescind it.
02 / The rule
What ITAR requires
The ITAR, administered by the State Department's Directorate of Defense Trade Controls (DDTC), control exports, temporary imports and brokering of items on the US Munitions List, including technical data and defense services. For AI work, putting ITAR technical data into prompts, training sets, models or cloud tools that foreign persons or foreign servers can reach can be an unlicensed export.
- 01Register with DDTC if manufacturing, exporting or brokering defense articles or services.
- 02Obtain DDTC licences or agreements, or use an exemption, before exporting defense articles, technical data or services.
- 03Prevent release of technical data to foreign persons, including inside the US, without authorization.
- 04Protect technical data in transit and storage abroad, e.g., using qualifying end-to-end encryption.
03 / Records
Records to keep
- 01DDTC registration and licences or agreements
- 02Jurisdiction and USML classification records
- 03Access controls limiting technical data to authorized persons
- 04Export records and voluntary disclosure files
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Federal Register
RELATED
Related: ITAR: the full guide · Does auditing my model risk an ITAR deemed-export of the weights?