Export Control Classification Numbers (ECCNs) are the mechanism by which the Bureau of Industry and Security (BIS) applies the Export Administration Regulations (EAR) to specific products. Yet many compliance teams treat ECCN assignment as a one-time administrative task—classified once, used forever. In practice, ECCNs are dynamic, context-dependent, and frequently misapplied in supply chain environments where product specifications, end-uses, and customer locations shift rapidly.
This post explains how ECCNs actually function, why they matter for semiconductors specifically, and how to build a defensible classification program.
What an ECCN Is (and Isn't)
An ECCN is a five-character alphanumeric code (e.g., 3A001, 5D001) that indicates whether a product is subject to EAR licensing requirements and, if so, which controls apply. It appears in 15 CFR Part 774 (Supplement No. 1), commonly called the Commerce Control List (CCL).
The structure is straightforward: - First character: Category (A–E, covering broad product families) - Next three characters: Product type and technical parameters - Final character: Control type (0–9, with 0 meaning "no EAR controls apply")
For example, 3A001 covers certain microprocessors and microcomputer microcircuits. The "3" indicates information security category; "A" means that the item is controlled; "001" specifies the particular technical parameter threshold.
Critically, an ECCN is not a classification of the company. It is a classification of a specific product. A semiconductor manufacturer may produce items across dozens of ECCNs simultaneously.
Why ECCN Matters for Semiconductors
Semiconductors occupy a unique position in export control. They are dual-use goods—essential to civilian infrastructure, but also core to military systems. The US government therefore controls many semiconductor ECCNs more tightly than it controls similar products in other industries.
The reasons are three:
- End-use sensitivity: Advanced semiconductors are usable in military applications, particularly for high-performance computing, radar, and guided weapons systems.
- Supply chain chokepoint: Semiconductor production is concentrated geographically. Controlling access restricts competitors' ability to field certain technologies.
- Indefinite shelf life and transferability: Unlike chemical or biological products, semiconductors do not degrade and are easily diverted after sale.
As a result, many common semiconductor ECCNs carry license requirements to specific destinations. A shipment that would be freely exportable as a machine part to most countries may require a license if destined for a sanctioned country or an entity on the BIS Entity List.
How ECCNs Are Assigned: The Regulatory Framework
BIS does not assign ECCNs to individual manufacturers. Instead, manufacturers are responsible for self-classifying their own products against the CCL. This is a critical point: classification is your legal obligation, not BIS's.
The process works as follows:
- Identify the product's technical parameters: Operating frequency, processing speed, memory size, power consumption, heat dissipation, functional capability—whatever parameters the CCL uses to define a control threshold.
- Consult the CCL: Part 774 defines each ECCN's scope. Read the control parameter definitions carefully; they are highly technical and often cumulative.
- Determine whether your product meets the threshold: If all specified parameters are met, the product falls under that ECCN. If any parameter is not met, the product does not fall under that ECCN.
- If the product does not meet any ECCN threshold, it is classified as EAR99—a residual category meaning "subject to EAR but no license required to most destinations."
This is the critical distinction: EAR99 is not "uncontrolled." It is still subject to the EAR. It simply does not require a license for most lawful end-uses and destinations.
Manufacturers sometimes confuse EAR99 with unrestricted exportability. It is not. EAR99 items cannot be exported to sanctioned countries or certain prohibited end-uses (e.g., nuclear weapons development).
Common Semiconductor ECCNs: A Typology
BIS controls semiconductors across multiple categories. The most frequently encountered are:
Category 3: Information Security
3A001 covers microprocessors and microcomputer microcircuits exceeding specified processing speed, heat dissipation, or memory capacity thresholds. This is one of the most litigated ECCNs because the parameters are cumulative and frequently revised.
As of June 2026, 3A001 controls microprocessors with more than 5,000 peak floating-point operations per second (FLOPS) or more than 32 MB of cache memory—thresholds that capture many mainstream commercial processors.
3A090 covers items not otherwise controlled in Category 3 but identified on the CCL as having national security significance. This is a catch-all category often used for emerging technologies.
Category 4: Sensors and Instrumentation
4A003 covers image sensors and focal plane arrays meeting certain quantum efficiency and pixel count thresholds. This controls infrared and night-vision applications.
Category 5: Telecommunications and Information Security
5A001 covers items usable for information security, including certain encryption chips and secure microcontrollers.
5D001 covers information security technology and software, including cryptographic source code.
Context Sensitivity: When ECCN Classification Depends on End-Use
This is where many compliance programs fail. An ECCN is not purely a function of the product's technical characteristics. End-use and destination also determine licensing requirements.
Suppose your company manufactures a processor that falls under 3A001. The technical classification is fixed. But the license requirement depends on:
- Destination: A shipment to Canada may be unrestricted; the same shipment to China may require a license.
- End-use: A shipment for use in a smartphone may be unrestricted; the same chip destined for a military research institute may require a license (and may be denied outright).
- Customer: A shipment to a listed entity on the BIS Entity List requires a license regardless of technical classification or destination.
The EAR defines prohibited end-uses that trigger license requirements or outright denial even for EAR99 items. These include:
- Nuclear weapons or chemical/biological weapons development
- Missile design or production
- Terrorist activity
Additionally, certain destinations trigger automatic license requirements for most ECCNs. These are:
- Embargoed countries: Iran, North Korea, Syria, Cuba, and the Crimea region
- Sanctioned persons and entities: OFAC SDN List, BIS Entity List, Nonproliferation Sanctions lists
A compliance program must therefore include end-use screening as part of the classification workflow, not just technical parameter review.
Building a Defensible Classification Program
Given the frequency of ECCN revision and the importance of correct classification, compliance teams should implement the following controls:
1. Maintain a Product Master File
For each product line, document: - Specific technical parameters (processor speed, memory, heat dissipation, etc.) - The CCL section and ECCN used for classification - The date of classification and the regulatory version (e.g., "15 CFR 774, Supplement No. 1, as effective June 1, 2026") - The name and title of the employee responsible for classification - Supporting technical documentation (datasheets, specifications)
This file is your first line of defense in a regulatory audit.
2. Implement Quarterly CCL Reviews
BIS updates the CCL regularly. Your technical parameters may have been accurate when classified, but regulatory thresholds change. Institute a quarterly process to: - Review BIS.gov for CCL amendments - Re-test your products against updated thresholds - Reclassify if necessary and update your product master file
3. Establish an End-Use Screening Checklist
Before a shipment leaves your facility, screen for: - Destination: Is it an embargoed country? - Customer: Is the customer on any screening list? - Stated end-use: Does it involve prohibited activities? - Customer category: Is it a government entity, military organization, or sanctioned person?
Implement this as a formal step in order acceptance. Documentation matters—if you later face an enforcement action, evidence that you asked the right questions is critical.
4. Seek Commodity Jurisdiction When Uncertain
The EAR permits you to request a Commodity Jurisdiction (CJ) determination from BIS when you are unsure of an ECCN classification. CJ submissions are confidential and can take 30–60 days. For products where misclassification risk is high, this is cheaper than regulatory exposure.
5. Train Sales and Supply Chain Teams
ECCNs are not only compliance problems; they are sales problems. Your sales team should understand: - Which customer locations and end-uses require licensing - Which questions to ask before accepting an order - How to escalate uncertain classifications quickly
Many export violations occur because sales teams accept orders without consulting compliance.
Common Classification Errors
In audits and investigations, BIS frequently encounters the same mistakes:
- Over-relying on CCL category headings: The heading of ECCN 3A001 says "microprocessors and microcircuits." Your product is a microprocessor, so it must be 3A001, right? Wrong. The detailed control parameters must be met. Read them carefully.
- Assuming EAR99 means "no restrictions": As noted above, EAR99 items are still controlled to certain destinations and end-uses.
- Classifying once and forgetting: Products evolve. Specifications change. Regulatory thresholds shift. A classification from 2023 may not be accurate in 2026.
- Ignoring customer screening results: Your technical team classifies correctly, but your order processing team accepts a purchase order from a customer who appears on a screening list. This is a violation regardless of the ECCN.
- Confusing ECCN with license determination: Classification (ECCN) is separate from licensing (whether a license is required). A product can be correctly classified but still require a license due to destination or end-use.
Practical Guidance for Your Compliance Program: Start with a comprehensive product inventory. For each product line, document the ECCN, the technical parameters used to determine it, and the regulatory source. Implement a quarterly CCL review cycle and automate screening of purchase orders against BIS lists, OFAC lists, and other relevant designations. Where uncertainty exists, use the Commodity Jurisdiction process. Train your sales and supply chain teams on the relationship between ECCN classification and licensing requirements. Keep detailed records of all classification decisions—they are your evidence of reasonable care in a regulatory investigation.