en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States
1 correction found
A BIS review is required for typical items to get the 5A992 or 5D992 classification.
This overstates BIS review requirements. Many mass-market encryption items can be classified as 5A992.c or 5D992.c by self-classification; a BIS review is required only for some categories, not for typical 740.17(b)(1) items.
Full reasoning
Current BIS guidance says mass-market encryption items are split between self-classifiable items under EAR §740.17(b)(1) and items that require a BIS classification request under §740.17(b)(3). BIS’s own mass-market guidance states that items under 740.17(b)(1) can be self-classified with an annual self-classification report, while only certain other mass-market items (for example some chips, components, and SDKs under 740.17(b)(3)) require a classification request to BIS.
The current EAR text also says that eligible mass-market items are classified under ECCN 5A992 or 5D992 following self-classification or classification by BIS. So a BIS review is not categorically required to reach 5A992/5D992 status.
2 sources
- BIS – Mass market (Section 740.17)
Whether an item is 5x002 or 5x992.c ... the submission requirements are the same and therefore described in a single place under 740.17(b)(1) (self-classifiable) and (b)(3) (requires classification request to BIS) ... Mass market items that are described under in 740.17(b)(1) can be self-classified with an annual self-classification report.
- EAR Part 740 – License Exceptions
Items described in paragraphs (b)(1) and (b)(3)(i), (b)(3)(ii) or (b)(3)(iv) ... are classified under ECCN 5A992 or 5D992 following self-classification or classification by BIS and are no longer subject to 'EI' and 'NS' controls.