European Union Implements Changes to Export Control Rules

The EU Dual-Use Regulation regulates exports outside the EU, transfers inside the EU, transit through the EU and the brokering of certain sensitive goods, services, software and technology (referred to as “items”) that are considered “dual-use.” Dual-use items have both military and civil applications. The EU has updated its export control rules for dual-use items to (1) take account of Brexit, (2) ensure consistency with recent developments in international non-proliferation regimes and export control arrangements, and (3) address cyber-surveillance and other security threats stemming from new technologies, reinforce cooperation among competent EU authorities, and impose enhanced compliance obligations (including a requirement to adopt internal compliance programs) on businesses. These updates, which are addressed in turn, will have significant implications for businesses dealing in dual-use items.

EU Guidance on Post-Brexit Export Controls

On September 16, 2020, the Commission published an updated notice on export controls after Brexit. The Notice provides guidance on the changes to export control rules, including export authorization requirements, for dual-use items. The changes will enter into force at the expiry of the transition period on December 31, 2020, when the United Kingdom will no longer be subject to EU law.

The Notice provides two key clarifications:

1. Shipments between EU Member States and the UK: All shipments of dual-use items from the EU to the UK will require an EU export authorization, as set out in the EU Dual-Use Regulation. Vice versa, all shipments of dual-use items from the UK to the EU will require a UK export authorization, as set out in the Export Control Order 2008.
   
   A specific regime will apply to Northern Ireland. Consistent with the Protocol on Ireland/Northern Ireland, the EU Dual-Use Regulation will continue to apply to and in Northern Ireland. Therefore, shipments of dual-use items from the EU to Northern Ireland, and vice versa, will be considered intra-EU transfers, which are not subject to export authorization (with the exception of certain particularly sensitive dual-use items listed in Annex IV of the EU Dual-Use Regulation). The application of the EU Dual-Use Regulation in Northern Ireland means that shipments of dual-use items from Northern Ireland to the UK or to other non-EU countries will remain subject to EU export authorization.
   
   
2. Shipments from EU Member States or from the UK to third countries: EU exporters will no longer be able to rely on UK export authorizations granted pursuant to the EU Dual-Use Regulation to ship dual-use items from the EU to other third countries. EU exporters will need to reapply for and obtain relevant authorizations from competent authorities in EU Member States. Vice versa, UK exporters will need to reapply for and obtain UK export authorizations for exports of dual-use items from the UK to third countries.

The Notice itself does not address the possibility of the EU adding the UK to the list of destinations covered by Union General Export Authorisation (GEA) EU001. Union GEA EU001 authorizes registered exporters to export multiple shipments of certain dual-use items to listed destinations (currently: Australia, Canada, Japan, New Zealand, Norway, Switzerland, and the United States), hence facilitating exports to those countries. Nonetheless, on November 4, 2020, the Commission published a proposal to include the UK in the Union GEA EU001. The proposal will become effective once formally adopted by the European Parliament and the Council of the EU. Updated December 21, 2020: the UK will be added to the list of destinations covered by the Union GEA EU001 as of January 1, 2021, pursuant to the proposal which has now been adopted by the EU institutions.

Separately, the UK has confirmed that it will allow exports of dual-use items from the UK to the EU under an Open General Export License (OGEL). The OGEL would only require exporters to register with the UK authorities, in order to be authorized to export dual-use items (other than those currently listed in Annex IIg of the EU Dual-Use Regulation) to the EU.

EU Lists of Dual-Use Items

On October 7, 2020, the Commission adopted the annual delegated regulation to update the lists of dual-use items subject to export controls under the EU Dual-Use Regulation (Delegated Regulation), to reflect recent developments in international non-proliferation regimes and export control arrangements. Specifically, the changes proposed in the Delegated Regulation result from the revisions carried out by the Australia Group, the Missile Technology Control Regime, the Nuclear Suppliers Group, and the Wassenaar Arrangement, during the period from 2019 to February 2020.

Among the numerous changes made to the lists, the most notable are new controls for a variety of items, including:

• Software specifically designed for monitoring or analysis by law enforcement
• Systems, equipment, and components for defeating, weakening, or bypassing information security
• Certain chemicals, including Novichok nerve agent precursors
• Middle East Respiratory Syndrome-related coronavirus

In addition, there are numerous changes to various control entries, including:

• Metal alloys
• Fluids and lubricating materials
• Simulation software
• Information security system

The Commission has published a summary of the changes to the control lists. The Delegated Regulation entered into force on December 15, 2020.

Companies exporting dual-use items should verify whether they are affected by the foregoing updates to the EU export control rules. Non-compliance with EU (and UK) export control rules can have serious criminal, financial, and reputational consequences for companies and their employees.

Agreement for a New EU Dual-Use Regulation

On November 9, 2020, the German presidency of the Council of the EU and representatives of the European Parliament reached an agreement on revising the current EU Dual-Use Regulation. The agreed changes to the existing EU export control framework aim to (1) promote human rights compliance by addressing cyber-surveillance and other security threats stemming from new technologies, (2) strengthen the EU common approach to export controls by reinforcing cooperation among Member State authorities, and (3) impose enhanced compliance obligations on businesses (including a requirement to adopt internal compliance programs).

The most significant changes include:

1. Stricter export controls for potential misuses of new technologies, and in particular cyber-surveillance items. An authorization will be required for exporting cyber-surveillance items capable of covert surveillance of natural persons by monitoring, extracting, collecting, or analyzing data from information and telecommunication systems, even if not listed in Annex I of the EU Dual-Use Regulation, if such items are or may be intended for use in connection with internal repression or serious violations of international human rights and international humanitarian law.
2. The introduction of two new Union GEAs, to ease the authorization process for intra-group technology transfers (EU007) and exports of cryptographic items to certain destinations (EU008).
3. New harmonized rules on certain services related to dual-use items, such as technical assistance. Providing technical assistance will require authorization if related to listed dual-use items intended for certain specific military uses, with the possibility for EU Member States to extend these requirements to non-listed dual-use items.
4. Enhanced due diligence and reporting obligations for businesses to show compliance with applicable export controls. Exporters using global export authorizations will be required to adopt and implement internal compliance programs, namely policies and procedures to ensure compliance with export controls.
5. A strengthened cooperation mechanism among EU Member State authorities to facilitate information exchange, policy alignment, and enforcement actions.

The Commission had first published a proposal for a revised EU Dual-Use Regulation (in force since 2009) in 2016. Since then, there has been heated debate among EU institutions on the opportunity to update the Regulation, and the extent of any such update. Further to the agreement reached on November 9, 2020, the text of the new EU Dual-Use Regulation now needs to be endorsed by the Permanent Representatives Committee (COREPER), and then formally adopted by the Council of the EU and the European Parliament.