ITAR

ITAR is a set of regulations issued by the US government. It determines which militarily usable goods may leave the United States for other countries and which may not. The abbreviation stands for International Traffic in Arms Regulations, meaning roughly “regulations for international arms trade.” This applies not only to finished weapons but also to components, blueprints, software, and technical knowledge. Anyone who passes on such items without authorization to a person who is not a US citizen violates the law. The penalties for this are severe: fines in the millions and prison sentences are possible.

Why a spreadsheet can become a weapon

The crucial point about ITAR is its broad definition of “export.” You don’t need to physically move anything across a border. It is enough for protected information to become accessible to a person without a US passport. This is called a “deemed export” – a transaction treated as an export. An engineer in an office in California who shows a design drawing to a German colleague can already trigger an export event.

For technology companies, this has enormous consequences. When data is stored in a cloud, meaning on rented servers on the internet, it must be clear where these servers are located and who maintains them. That is why providers like Amazon or Microsoft operate their own isolated cloud regions for customers from the defense sector. There, only personnel with US citizenship and security clearance are allowed to work. Such offerings are considerably more expensive than standard cloud services.

A common misconception is that ITAR only applies to American companies. The opposite is true: the rules attach to the product, not the company. A European satellite manufacturer that uses even a single ITAR-controlled US component is subject to US regulations for that component. This is precisely why some manufacturers explicitly advertise “ITAR-free” products.

The Munitions List and the path to approval

At the heart of ITAR is the United States Munitions List. This is a catalog with 21 categories, ranging from firearms to missiles to space technology and encryption for military purposes. If a product appears on this list, the rules apply automatically. Responsibility for implementation lies with the US State Department, specifically an agency called the DDTC.

Companies that trade in such goods must first register with this agency. After that, they need a license for each individual export. The application states what is being delivered, to whom, and for what purpose. The agency reviews the request and can deny it, for example if the destination country is under an embargo. Such procedures often take months.

It is important to distinguish this from the EAR, the Export Administration Regulations. These cover dual-use goods, meaning items that can be used for both civilian and military purposes. High-performance graphics cards for AI data centers, for example, fall under EAR, not ITAR. The EAR are somewhat more flexible and are administered by the Department of Commerce. For companies, correct classification is one of the first and most important questions.

What this means for AI companies and investors

In business news, ITAR usually comes up in two contexts. First, in cases of violations: corporations like Boeing or RTX have in the past paid fines in the hundreds of millions of dollars. Second, in connection with defense contracts, where ITAR compliance is a prerequisite for bidding.

For AI companies, this issue is becoming increasingly important. Companies like Palantir, Anduril, or Anthropic offer models and software to government agencies and the military. Such systems must run in isolated environments, and development teams are subject to personnel restrictions. This noticeably slows down cross-border collaboration.

European defense projects are also feeling the effects. Anyone who incorporates US technology needs Washington’s approval to resell it to third countries. Export deals have already fallen through precisely because of this. That is why Europe is specifically investing in its own components without US content – one reason why “technological sovereignty” appears so often in the news.