- within International Law, Transport, Media, Telecoms, IT and Entertainment topic(s)
- with Inhouse Counsel
In today's geopolitical climate, navigating export control and sanctions is becoming increasingly difficult and complex. With technology increasingly being implemented in software or in the cloud, relevant technology for export control purposes has moved beyond movement of tangible goods across borders. Many companies will now need to consider it, for example in relation to provision of goods or services, international research and development and supply chain security.
This article considers some of these issues. We have used the UK export control regime as an example, but in practice similar issues will arise under international regimes wherever relevant technology is being moved across borders.
Export controls in the UK
The UK export control regime restricts the export of controlled goods, software and technology from the UK, and in some cases the trafficking and brokering of goods which do not cross the UK border. The UK Government notes that export controls are a widely used and established economic tool used to protect the UK's national security, citing national security overall as "the foundation of national prosperity"1. The UK government's aim is to prevent the export of controlled goods, software and technology that might be used for purposes which could undermine the UK's national security. Failure to obtain a licence when required is a criminal offence. As such, the consequences are severe: penalties include licence revocation, seizure of goods, fines, and in some cases, imprisonment of up to 10 years. Therefore, export controls should be seen as an essential compliance pillar for any business dealing in controlled goods, software and technology
UK export control regime: the law
The UK's export control regime regulates controlled goods, software and technology, which are generally either dual-use items, i.e. those that can be used for both military and civilian purposes, or military items. The regime includes the following legislation:
- The Export Control Act 2002 (ECA 2002). This enables export controls to be imposed.
- The Export Control Order 2008 (SI 2008/3231) (ECO 2008). This imposes different types of controls depending on the nature of the items and also provides the legal basis for licensing and enforcement.
- The Dual-Use Regulation (428/2009/EC) (UK Dual Use Regulation) – the UK retained this direct EU legislation post-Brexit which supplements the controls on dual use items in the ECO 2008.
Items which are controlled pursuant to the UK's export control regime are specified in the relevant legislation and listed for reference in the UK Strategic Export Control List. At the time of writing, this highly-technical document runs to almost 400 pages, covering such areas of technology as nuclear, electronics, computers, telecommunications, materials processing, sensors and lasers, navigation and avionics, marine, aerospace and propulsion.
Goods which are not themselves listed may also all under export controls if they are or may be intended for use in connection with the production of chemical, biological or nuclear weapons, other nuclear explosive devices or missiles, under 'end use controls', or in some cases if they are the principal component of non-controlled goods.
The body with the responsibility for export licences, both licensing itself and monitoring compliance, is the Export Control Joint Unit (ECJU). Breaches are investigated and enforced by HMRC.
In practice, export control dovetails with trade sanctions legislation. In particular, there may be relevant restrictions relation to both strategic goods and a broader class of controlled goods within the various sanctions regulations made pursuant to the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), which may be relevant depending on the goods' destination.
Responsibility for trade sanctions licensing and enforcement is split between HMRC and the Office of Trade Sanctions Implementation (OTSI), an agency that was launched in October 2024. OTSI is responsible or issuing licences for the provision of sanctioned standalone services, including professional and business services, and for civil enforcement of sanctions relating to the movement of non-strategic goods which do not cross the border (for example, the supply of controlled but non-strategic goods by a UK person from a non-UK country to a UK-sanctioned jurisdiction would fall within the remit of OTSI rather than HMRC). Importantly, certain types of firms are subject to mandatory reporting obligations to OTSI in respect of trade sanctions breaches.
A particular transaction might also engage financial sanctions restrictions – for example depending on the identity of the intended recipient of the goods. Financial sanctions are also contained within the regulations made under SAMLA, but are the responsibility of the Office of Financial Sanctions Implementation – OFSI – in the UK.
As a result, a complex web of legislation may need to be considered in parallel in respect of any given transaction.
A moving landscape
The UK export control regime is not static and is regularly updated. For example, changes came into force on 16 December 2025 to align requirements between Great Britain and Northern Ireland, where EU controls apply directly2. Other changes were made effective in May 20253. There are also frequent changes to General Licences, which provide important permissions for the export of controlled goods that would otherwise infringe the export control regime, subject to compliance with the terms and conditions of those licences.
As noted above, relevant restrictions may also be introduced via sanctions regulations, which are also subject to change. For example, Russia's invasion of Ukraine led to sanctions banning the export of a wide variety of items to Russia. The government has been particularly focussed on the supply of so-called Common High Priority List (CHPL) items to Russia, and in August 2025 OTSI updated its guidance on countering Russian sanctions evasion to note that where CHPL items are included on the UK Strategic Export Control List, the government is minded to refuse applications with uncertain end uses where there is a risk of diversion to Russia4.
It is essential that businesses remain vigilant and keep up with any changes to the relevant export control regimes that apply to them. For multi-national companies, for example, moving goods, software or other relevant technology between multiple jurisdictions, a number of different regimes are likely to be relevant. Failure to comply is not only a criminal offence with the potential consequences listed above but can also lead to loss of reputation and trade for a business.
Export controls and intellectual property
Export control considerations are also relevant in the context of intellectual property, R&D, collaboration agreements and business-as-usual trading.
For example, many organisations will consider where to put research and development teams and facilities. Export control is becoming an increasingly important consideration there – there is no point in setting up an R&D facility in a particular jurisdiction if the export control regimes in that jurisdiction are such that it is going to be difficult or impossible to get the technology out.
Where R&D or collaboration agreements are concerned, as well as considering and negotiating the use of background IP, and the ownership status of any foreground IP developed, the parties involved need also to carefully consider whether any of the activities are an "export" of controlled goods, software or technology pursuant to the relevant export control regimes (for example, if any subsequently developed controlled items need to exported as a result of a collaboration, or where background IP is being provided into a JV or other organisation across jurisdictional boundaries).
Many export control regimes also define export (and an exporter) widely, including the UK Dual-Use Regulation. For example, it includes a person (natural or legal) transmitting or making available software or technology by electronic media, including via telephone (such a video conference) or email. Technology, as an example, is also defined widely, and includes models, diagrams, formulae, and instructions5.
Given the broad definitions of exporter and technology, export control considerations are relevant at all stages of the R&D process:
- The initial arrangement process – for example, controlled technology contained in a document and described in an audio or video conference in such a way as to achieve substantially the same result would be an export;
- The development process – for example, sharing controlled software via email during the development process; and
- Post-development – for example, exporting developed items from the place of development.
The UK Strategic Export Control List covers a wide range of different technologies, including semiconductors, quantum technology, certain software such as cryptography, advanced materials, and biotechnology. Therefore, there is considerable scope for a wide range of research, development and collaboration activities to require adherence with the UK export control regime. The same will often be true of other export control regimes too.
Therefore, those undertaking research and development or collaborations with persons or entities overseas need to take particular care and planning to ensure compliance with the export control regime. Consideration of export controls should be done before entering into any arrangements in relation to controlled technology to ensure that the parties are adequately prepared to obtain the requisite licences for their activities and can meet the compliance requirements of such licences. As noted above, the application of export control could also be a factor in where R&D, JVs or other entities are set-up.
Supply chain considerations
Export control is also relevant to the supply chain. For example, if a business wants to use relevant technologies within their products which fall within the UK Strategic Export Control List (even if that technology is actually part of another third-party component), and the supply chain requires these to be exported from the UK to a third country for sale, or to be incorporated into another product, then the appropriate licences may be required to ensure that the export can take place.
Businesses should also be aware that even if an item is not controlled, a licence may still be required under 'end-use' controls, for example if there is a risk the item is intended for military use in a destination that is subject to an arms embargo6.
Also, where a business's products, raw materials, or product parts are controlled goods, software, or technology and export licences are required in the supply chain, supply chain dependencies also become very important.
For example, in the context of the UK, compliance is required with UK export controls, sanctions and with any third country export controls that may be engaged within a supply chain. Given, as we note above, that sanctions and export control (and the applicable technologies and third parties involved) can evolve with national security considerations and geo-political risk, there is a risk that products, services or technologies upon which your supply chain depends can become unavailable.
A well-publicised example of this in practice is the case of Huawei. In 2020, the UK government announced7 that UK operators should stop the purchase of Huawei equipment affected by certain US sanctions and that there would be a ban on the purchase of new Huawei kit for 5G from the following year, and that Huawei equipment would be completely removed from 5G networks by the end of 2027. This followed an analysis by the National Cyber Security Centre in the UK (part of GCHQ) that noted that, due to the consequences of US sanctions imposed on Huawei, Huawei would "need to do a major reconfiguration of its supply chain as it will no longer have access to the technology on which it currently relies and there are no alternatives which we have sufficient confidence in. [The NCSC] found the new restrictions make it impossible to continue to guarantee the security of Huawei equipment in the future".
Therefore, supply chains should also be assessed as to whether there may be any relevant sanctions or other trade restrictions that may impact the supply chain, either now or in the future.
More generally, all aspects of the supply chain should be assessed to determine whether there is a controlled item being exported at any point within the supply chain, and the correct licences obtained and complied with. Businesses should aim to ensure that this is fully considered before a supply chain is set up, to avoid issues, security of supply and ensure compliance with the relevant export control regimes.
Footnotes
1. https://www.gov.uk/government/publications/uk-trade-strategy
6. https://www.gov.uk/guidance/uk-strategic-export-controls
7. https://www.gov.uk/government/news/huawei-to-be-removed-from-uk-5g-networks-by-2027
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
