Almost certainly, though usually in a manageable way. US export controls reach any software, technology or hardware your startup ships, lets people download or shares with foreign engineers, and US sanctions bar dealings with sanctioned regions and listed people however small the deal. Most SaaS and AI application companies need no export license for most customers, but every one should classify its product, block sanctioned regions and screen customers, because sanctions liability doesn’t depend on what you knew.
Key takeaways
- Export controls cover shipments, downloads, and source code or technology shared with foreign nationals, even inside the US.
- Most SaaS products use standard encryption and qualify as “mass market,” which can go almost anywhere without a license or filing.
- BIS stopped enforcing the AI Diffusion Rule and hasn’t replaced it, but advanced AI chips still need licenses for China-headquartered companies anywhere.
- OFAC sanctions are strict liability. Block Cuba, Iran, North Korea and the Crimea, Donetsk and Luhansk regions of Ukraine, and screen customers, payees and contractors.
- Syria is no longer comprehensively sanctioned, but many Syrian people and entities still are.
- Investors and acquirers ask, and a problem found late can delay or kill a deal.
What counts as an export?
Export controls ask what an item is and where it’s going. Sanctions ask who is on the other side. The Export Administration Regulations (EAR), run by the Commerce Department’s Bureau of Industry and Security (BIS), cover nearly all commercial software and hardware, and treat as an export any shipment or transmission out of the US, such as a customer abroad downloading your app or code emailed to an overseas contractor. Releasing technology or source code to a foreign national inside the US is a “deemed export” to that person’s most recent country of citizenship or permanent residence. Green card holders count as US persons. Letting someone run object code isn’t a deemed export, but showing them source code or build know-how can be.
Pure SaaS is different. BIS advisory opinions from 2009 and 2014 say that letting users run software in the cloud, without downloading it, is not an export of the software. But most SaaS products also ship an app or CLI, and a bill letting BIS regulate remote access passed the House in January 2026 and awaits the Senate.
Items on the Commerce Control List have an Export Control Classification Number (ECCN), such as 5D992 for mass market encryption software, which tells you which countries need a license. Everything else is EAR99 and can go most places without a license, but never to embargoed destinations, prohibited end uses or restricted parties. You normally self-classify and document why.
Does encryption make my software export controlled?
Almost every product uses encryption, so it falls in Category 5, Part 2 of the Commerce Control List. But standard encryption in a commercially available product is usually “mass market”: it is sold to the public through ordinary channels, users can’t easily change the cryptography, and it installs without substantial vendor support. Mass market software (5D992.c) and hardware (5A992.c) can go to nearly every country without a license.
A March 29, 2021 BIS rule removed most of the paperwork, so most mass market products now need no classification request and no annual report. Mass market components, such as chipsets, and their executable software still go on an annual self-classification report, due by February 1 for the prior calendar year. Non-mass-market encryption products, such as some network security tools, use License Exception ENC, which requires that annual report or a classification request and a 30-day wait, and sometimes semiannual sales reports. Proprietary or non-standard cryptography loses most of these shortcuts.
Two traps. Mass market status doesn’t override sanctions or the Entity List. And ENC lets you share most encryption technology with foreign national employees and contractors, but not to nationals of Cuba, Iran, North Korea or Syria.
What are the rules for AI chips and AI models?
The January 2025 AI Diffusion Rule would have required licenses for advanced AI chips across most of the world and controlled the weights of the most powerful closed models (ECCN 4E091). BIS announced on May 13, 2025 that it would not enforce the rule. It never published a formal rescission, and BIS has since signaled no replacement is coming, so the text, including the model weights control, sits in the regulations unenforced.
What applies instead is a patchwork. Older controls on high-end GPUs and servers (ECCNs 3A090 and 4A090) still require licenses for China, Macau, Russia, other arms-embargoed countries and many Middle East destinations. BIS guidance of May 31, 2026 stressed that they also apply to any company headquartered in China or Macau, or whose ultimate parent is, wherever it operates. A January 15, 2026 rule moved chips at roughly Nvidia H200 performance to case-by-case review for China and Macau, with volume caps and third-party testing, while more advanced chips still face a presumption of denial. And a July 2026 rule lets the UAE government, approved UAE AI companies and UAE subsidiaries of certain US hyperscalers receive advanced chips license-free.
May 2025 guidance adds two warnings: using Huawei Ascend chips anywhere risks violating the EAR, and supplying chips, compute or support knowing they will train models for China-headquartered companies can require a license where military or weapons uses are involved.
For AI startups building on cloud APIs, none of this usually requires a license. It matters if you buy or resell GPUs, run compute abroad, sell training or inference capacity, or have China-headquartered customers.
What is the Entity List, and what changed in 2025?
The Entity List names companies, universities and people, many in China and Russia, that can’t receive some or all EAR items without a license, which is often denied. It and OFAC’s Specially Designated Nationals (SDN) list are searchable free on the government’s Consolidated Screening List.
In September 2025, BIS’s Affiliates Rule extended Entity List restrictions to any company owned 50% or more, directly or indirectly, by listed parties, even if unnamed. BIS suspended it as part of a trade truce with China, and the US has signaled it may extend the suspension along with the truce, so for now it doesn’t apply, but check before relying on that. If you sell into China, start asking larger customers who owns them.
Does ITAR apply to my startup?
The International Traffic in Arms Regulations (ITAR) apply only if you work on defense articles or services on the US Munitions List, such as items specially designed for military use. A US manufacturer of defense articles must register with the State Department even if it never exports, and sharing ITAR technical data with any foreign national, including employees, needs authorization. If jurisdiction is unclear, ask the State Department for a commodity jurisdiction ruling. Settle this early: ITAR status limits whom you can hire and which investors you can take.
How do OFAC sanctions work?
Sanctions run by the Treasury Department’s Office of Foreign Assets Control (OFAC) are strict liability: you can be penalized for a violation you didn’t know about. Maximum civil penalties exceed $375,000 per violation or twice the transaction value, whichever is greater, and the statute of limitations is now 10 years.
Comprehensive sanctions bar almost all dealings with a place. As of October 2026 they cover Cuba, Iran, North Korea and the Crimea, so-called Donetsk People’s Republic and so-called Luhansk People’s Republic regions of Ukraine. Syria came off the list: a June 30, 2025 executive order ended the sanctions program, Congress repealed the Caesar Act in December 2025, and Syria’s state sponsor of terrorism designation was rescinded on August 24, 2026. Assad, his associates and many others remain on the SDN list, and most exports to Syria still need a BIS license or license exception.
Russia, Belarus and Venezuela aren’t comprehensively sanctioned, but the rules are broad and shifting. US companies can’t, for example, provide cloud-based enterprise management or design software to anyone in Russia. List-based sanctions block the people and companies on the SDN list wherever they are. Under OFAC’s 50% rule, any entity owned 50% or more in total by blocked persons is blocked too, even if it isn’t listed.
What does sanctions compliance look like for a software company?
OFAC expects you to use the data you already have. In September 2025 it penalized a crypto exchange $750,000 for more than 17,000 apparent violations, mostly with users in Iran, because it collected IP addresses showing where users were but didn’t screen them. OFAC told companies to build sanctions compliance in from the beta stage.
That means geo-blocking sanctioned regions at signup, login and checkout, at the region level for Crimea, Donetsk and Luhansk. Check billing addresses and card-issuing countries, and don’t assume your payment processor’s screening covers you. Screen business customers, resellers, vendors and investors at onboarding and periodically after. Put export and sanctions terms in your terms of service and customer contracts so you can terminate misuse. Tell your support team never to suggest a VPN to a blocked user.
Hiring raises the same issue in reverse. Paying a contractor who lives in Iran, Cuba, North Korea or the sanctioned Ukraine regions is generally a prohibited import of services, however small. Sanctions mostly turn on where someone lives, deemed exports on citizenship, so an Iranian citizen in Toronto usually raises no sanctions problem but sharing controlled technology with them can still need a license. See How Do I Hire Someone Outside the US? and Startup Contractor Agreement.
Is open-source software subject to export controls?
Generally not. Software and technology that is “published,” meaning made available to the public without restrictions on further dissemination, such as a public GitHub release or open-weight model, isn’t subject to the EAR.
Encryption has caveats. Publicly available encryption source code is not subject to the EAR, and since 2021 you needn’t notify the government when you post it unless it implements non-standard cryptography, in which case you email BIS and the NSA its location. Compiled encryption code escapes the EAR only if its source code is public too. Code shared privately before release isn’t published, so it’s an ordinary export. And publication doesn’t solve sanctions: hosting and paid support for users in sanctioned regions need their own analysis. See Open Source: What It Is and How It Works.
What do common situations look like?
| Situation | Rule that applies | What to do |
| A SaaS signup from Iran | OFAC Iran sanctions | Block it. If one got through, cut off access, don’t move money without counsel, and consider disclosure. |
| A Chinese national engineer joins the team | EAR deemed exports | Most SaaS code needs no license. Check first if they’ll see technology for advanced chips or other controlled items. |
| Shipping a dev kit to a partner in India | EAR export and screening | Classify it (often EAR99 or 5A992), screen the recipient, and file Electronic Export Information if any Schedule B line exceeds $2,500 or a license is needed. |
| Open-sourcing a library or model weights | EAR “published” exclusion | Generally not subject to the EAR once public. Notify BIS and the NSA if it uses non-standard cryptography. |
| A purchase order says “no Israeli-origin components” | Antiboycott rules | Never certify that goods aren’t Israeli-origin, get advice before agreeing, and report the request to BIS. |
| A foreign sales agent wants a large commission paid offshore | FCPA | Stop and diligence the agent. Pay only into its own account in its country. |
| A foreign VC wants a board seat | CFIUS | Check whether your technology triggers a mandatory filing before you sign. |
Do the antiboycott rules apply to me?
Rarely. US law bars US companies from cooperating with foreign boycotts the US doesn’t support, chiefly the Arab League boycott of Israel. Requests turn up in purchase orders, letters of credit and contracts. Don’t agree to it without advice, never certify that goods aren’t of Israeli origin, and report most requests to BIS quarterly.
What about bribery when selling abroad?
The Foreign Corrupt Practices Act (FCPA) makes it a crime for US companies and their people to offer anything of value to a foreign official to win business. Employees of state-owned hospitals, universities and telecom carriers count. It also reaches payments through agents and distributors when you knew, or deliberately ignored, the signs.
A February 10, 2025 executive order paused new FCPA enforcement for 180 days. DOJ’s June 9, 2025 guidelines restarted it with a narrower focus on cartels, harm to US competitors, national security and serious misconduct, not routine business courtesies. DOJ has brought fewer cases since but hasn’t stopped, and the five-year statute of limitations can outlast an administration’s priorities.
Before signing a foreign agent or distributor, check who owns it and whether any owner is a government official, and pay commissions only against real invoices into its own account in its own country. Put anti-bribery promises, audit rights and termination rights in the contract.
What if we find a violation?
Stop the activity, preserve records and talk to counsel first. Each agency rewards voluntary self-disclosure. Under OFAC’s enforcement guidelines, it halves the base penalty. BIS lets companies report minor or technical violations in a short filing, often closed with a warning letter, and treats a deliberate decision not to disclose a significant violation as an aggravating factor. For possible crimes, DOJ’s March 2026 corporate enforcement policy offers a declination to companies that self-disclose, cooperate and fix the problem. In June 2026, a company that disclosed years of shipments to Huawei affiliates paid a $36 million BIS penalty but avoided prosecution.
Why do investors and acquirers diligence this?
Because they inherit the risk. Financing documents usually include representations about anti-corruption, sanctions and export compliance, and a buyer takes on the company’s past violations. Expect questions about where your users are, how your product is classified and whether you use foreign sales agents. A problem found in diligence can mean a special indemnity, a delayed closing or no deal. See Startup Due Diligence.
CFIUS is a separate regime about who invests in you, not where your product goes, but it relies on your export classification. If you develop “critical technologies,” including items that would need a US export license to reach an investor’s home country, a foreign investment giving control, a board or observer seat, or access to material nonpublic technical information can require a mandatory filing before closing.
What compliance setup does a seed or Series A startup need?
Not a department. One owner, usually the COO or head of finance working with outside counsel, and a short list:
- Classify each product, including apps, SDKs and hardware, and record why.
- Geo-block sanctioned regions at signup, login and checkout, and keep logs.
- Screen customers, resellers, vendors, contractors and investors.
- Add export and sanctions terms to your terms of service and customer and contractor agreements.
- Check whether technology is controlled before sharing source code with a foreign national. H-1B petitions ask you to certify this.
- Vet foreign sales agents and distributors and contract for anti-bribery protections.
- Keep export records for at least five years and sanctions records for ten.
For more, see NDA: What It Means for Startups and Startup Acquisitions.
If you’re selling abroad, hiring outside the US or building hardware or AI infrastructure, contact us to set up a compliance program that fits your stage.
