Encryption lawsExport controls

Encryption export controls, explained

The US controls exports of encryption under Category 5, Part 2 of its export rules. Most consumer software qualifies as "mass market" and leaves the strictest controls once it is classified.^{1, 2}

Checked 29 October 2026 against the sources. This page describes the rules. It is not legal advice.

What counts as controlled encryption

The main entries are ECCN 5A002 for equipment and 5D002 for software, in the Commerce Control List of the Export Administration Regulations (EAR).¹

Supplement No. 1 to 15 CFR part 774, eCFR, read 29 October 2026.
The trigger	Items designed or modified to use "cryptography for data confidentiality" with a "described security algorithm".¹5A002.a.
What is not data confidentiality	Authentication, digital signatures, data integrity, non-repudiation, digital rights management, encryption for entertainment, mass commercial broadcasts or medical records, and key management for those.¹5A002 Technical Note 1.
Described security algorithm	A symmetric key over 56 bits; RSA or finite-field Diffie-Hellman over 512 bits; elliptic curve over 112 bits.¹5A002 Technical Note 2.
Post-quantum algorithms	Lattice, supersingular isogeny and random code schemes are listed by name, for example Kyber and McEliece. The note says these "may be referred to as being post-quantum, quantum-safe or quantum-resistant".¹5A002 Technical Note 2.c.

The mass market note

Note 3 to Category 5, Part 2, also called the Cryptography Note, takes qualifying items out of 5A002 and 5D002.¹

An item qualifies if it meets all four tests: it is generally available to the public, sold without restriction from stock at retail, including online; its cryptographic functionality cannot easily be changed by the user; it is designed for the user to install without substantial support from the supplier; and its details will be given to the authorities on request.¹

After classification, a mass market item moves to ECCN 5A992 or 5D992 and is "no longer subject to 'EI' and 'NS' controls". 5D992 is still controlled for anti-terrorism (AT) reasons, and for regional stability (RS) in some cases.^{1, 2}

License Exception ENC and the yearly report

Most encryption items can be exported under License Exception ENC, in 15 CFR 740.17, instead of an individual licence.^{2, 3}

15 CFR 740.17, eCFR, read 29 October 2026.
Where it does not apply	Exports to, or services in, countries in Country Groups E:1 or E:2, or releasing source code or technology to their nationals.²740.17 introductory text.
Self-classified items	Items under paragraph (b)(1) can be exported straight away, subject to a self-classification report.²740.17(b)(1).
Classification request	Items under (b)(2) and (b)(3) need a 30-day classification request to BIS.²740.17(b)(2) and (3).
Who files the report	Exporters of mass market components and 'executable software', and of items that stay in 5A002, 5B002 or 5D002 after self-classification.²740.17(e)(3).
When	For each calendar year, received by BIS and the ENC Encryption Request Coordinator by 1 February the following year. If nothing new was made eligible, an email saying nothing has changed.²740.17(e)(3)(i) and (iii).
Format	A .csv file with the fields in Supplement No. 8 to part 742, sent to crypt-supp8@bis.doc.gov and enc@nsa.gov with the subject "self-classification report".²740.17(e)(3)(ii) to (iv).

Outside the US

The Wassenaar Arrangement

42 participating states coordinate their controls on transfers of conventional arms and dual-use goods and technologies. The US says it keeps control of encryption exports "consistent with our international obligations as a member".^{4, 3}

The European Union

Regulation (EU) 2021/821 sets a common EU list of dual-use items and common types of authorisation. Its EU general export authorisations include one for encryption.⁵ China's import and export rules for commercial cryptography are on our China page.

Questions people ask

Why does App Store Connect ask about encryption?

Apple says apps that use, access, contain, implement or incorporate encryption need an export compliance determination, including apps using standard algorithms or the operating system's crypto functions. It says developers are responsible for checking whether the EAR requires a formal classification from BIS.⁶

Is open source encryption code subject to export controls?

Publicly available encryption source code classified under 5D002 is not subject to the EAR. If it performs "non-standard cryptography", BIS and the ENC Encryption Request Coordinator must be told where it is posted.³

Does mass market software still need a report?

The yearly self-classification report covers mass market components and 'executable software', and items that stay in 5A002, 5B002 or 5D002.²

Which countries does License Exception ENC exclude?

Those in Country Groups E:1 and E:2 of Supplement No. 1 to part 740. The groups are set in that supplement and can change.²

Sources 6

15 CFR part 774, Supplement No. 1: the Commerce Control List, Category 5, Part 2 (ECCNs 5A002, 5D992 and Note 3), eCFR, Office of the Federal Register. Read 29 October 2026.
15 CFR 740.17: encryption commodities, software, and technology (ENC), eCFR, Office of the Federal Register. Read 29 October 2026.
15 CFR 742.15: encryption items, eCFR, Office of the Federal Register. Read 29 October 2026.
About us, The Wassenaar Arrangement. Read 29 October 2026.
Exporting dual-use items, European Commission, Directorate-General for Trade. Read 29 October 2026.
Overview of export compliance, App Store Connect Help, Apple Developer. Read 29 October 2026.

We read the rules themselves, and every status has a date. How we check