Question · ITAR
Does auditing my model risk an ITAR deemed-export of the weights?
The ITAR, administered by the State Department's Directorate of Defense Trade Controls (DDTC), control exports, temporary imports and brokering of items on the US Munitions List, including technical data and defense services.
01 / The answer
The short answer
It can, if the weights embody ITAR technical data. Under the ITAR, releasing technical data to a foreign person, even inside the United States, is an export that needs DDTC authorization, and so is sending it to a foreign location. An audit that lets foreign-person staff, a foreign vendor or servers abroad access the weights could therefore be a violation. Keep the work in an environment limited to authorized US persons, or get authorization first. Whether specific weights are technical data is a classification question for export-control counsel.
02 / The rule
What ITAR requires
The ITAR, administered by the State Department's Directorate of Defense Trade Controls (DDTC), control exports, temporary imports and brokering of items on the US Munitions List, including technical data and defense services. For AI work, putting ITAR technical data into prompts, training sets, models or cloud tools that foreign persons or foreign servers can reach can be an unlicensed export.
- 01Register with DDTC if manufacturing, exporting or brokering defense articles or services.
- 02Obtain DDTC licences or agreements, or use an exemption, before exporting defense articles, technical data or services.
- 03Prevent release of technical data to foreign persons, including inside the US, without authorization.
- 04Protect technical data in transit and storage abroad, e.g., using qualifying end-to-end encryption.
03 / Records
Records to keep
- 01DDTC registration and licences or agreements
- 02Jurisdiction and USML classification records
- 03Access controls limiting technical data to authorized persons
- 04Export records and voluntary disclosure files
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Federal Register
RELATED
Related: ITAR: the full guide · Are AI model outputs considered ITAR or EAR controlled technical data?