ITAR List: USML Categories, DDTC Registration & Penalties

The ITAR list is the United States Munitions List (USML), the catalog at 22 CFR Part 121 that identifies the defense articles, technical data, and defense services subject to the International Traffic in Arms Regulations. It runs to 21 categories and is administered by the State Department’s Directorate of Defense Trade Controls (DDTC). If your product, drawing, or service falls anywhere in it, you generally cannot export, broker, or disclose it to a foreign person without authorization, and in many cases you must register with DDTC even if nothing ever leaves the country.

The 21 USML Categories

The USML organizes controlled items into 21 numbered categories. Some entries name specific hardware by type and performance threshold. Others sweep in parts and components through catch-all paragraphs built on the “specially designed” test. Each category also covers the technical data and defense services directly related to the hardware it lists, so the controls follow the information as well as the item itself.¹

Categories I through VIII cover conventional military hardware:

Category I: firearms up to .50 caliber, including fully automatic firearms, automatic shotguns, and firearms with integrated fire control or automatic tracking.
Category II: guns and armament above .50 caliber, including howitzers, cannons, mortars, recoilless rifles, and grenade launchers.
Category III: ammunition, warheads, and ordnance for weapons in Categories I and II.
Category IV: launch vehicles, guided missiles, ballistic missiles, rocket systems, and associated launch equipment.
Category V: military explosives, propellants, and incendiary agents.
Category VI: surface vessels of war and special naval equipment.
Category VII: tanks, armored personnel carriers, and other military ground vehicles.
Category VIII: military aircraft, unmanned aerial systems designed for combat or intelligence roles, and associated components.

Categories IX through XXI cover electronics, protective gear, advanced systems, and specialized technologies:

Category IX: military training equipment and training, including target drones, weapon-system simulators, and air combat maneuvering instrumentation.
Category X: personal protective equipment such as body armor and helmets meeting or exceeding certain ballistic protection levels, plus clothing designed to defeat sensor detection.
Category XI: military electronics, including radar, electronic warfare, sonar, and countermeasure systems.
Category XII: fire control, laser, imaging, and guidance equipment, including targeting systems, rangefinders, and combat night-vision devices.
Category XIII: materials and miscellaneous articles, including structural materials and manufacturing equipment with specific military applications.
Category XIV: toxicological agents, meaning chemical and biological agents with military relevance and related equipment.
Category XV: spacecraft and related articles, including military and intelligence satellites, space-qualified components, and ground control systems.
Category XVI: nuclear weapons related articles, meaning components, technical data, and equipment associated with nuclear weapon design or production.
Category XVII: classified articles, technical data, and defense services not covered elsewhere.
Category XVIII: directed energy weapons, including high-power laser systems, particle beam weapons, and related power-supply equipment.
Category XIX: gas turbine engines and associated equipment developed or modified for military platforms.
Category XX: submersible vessels and related articles, including military submarines, underwater vehicles, and specialized diving equipment.
Category XXI: articles, technical data, and defense services not otherwise enumerated, a catch-all for items that warrant control but don’t fit another category.

How Unlisted Parts Get Pulled In: “Specially Designed”

Many USML paragraphs sweep in parts, components, and accessories that are “specially designed” for a listed defense article, even if no entry names them. The definition at 22 CFR 120.41 works in two steps. First, a catch step pulls in any commodity or software that either has properties responsible for achieving controlled performance described in a USML paragraph, or is a part, component, or accessory for use in or with a defense article. A component built to go inside a guided missile gets caught even if no entry mentions it specifically.²

Then a release step carves out items that shouldn’t really be controlled. An item escapes the “specially designed” label if any of the following applies:

It is a fastener or basic commodity part such as a screw, bolt, nut, washer, spring, wire, or solder.
It has the same function, performance, and form as something already used in a product that is in normal commercial use and not on the USML.
It was developed with knowledge it would be used in both defense and commercial products.
It was developed as a general-purpose commodity with no knowledge of use in any particular defense article.
A prior commodity jurisdiction determination already found it is not subject to ITAR.

The practical effect: an off-the-shelf microprocessor that ends up in a military radio is not controlled as long as it meets one of the release conditions.³

Technical Data, Defense Services, and Deemed Exports

ITAR reaches well beyond hardware. Technical data, defined in 22 CFR 120.33, includes any information needed to design, develop, produce, test, or maintain a defense article: blueprints, drawings, engineering instructions, and directly related software all qualify. A photograph of a controlled component’s internal layout can be technical data if it reveals enough to reproduce or operate the item.⁴

Defense services, defined in 22 CFR 120.32, include assistance or training to foreign persons in the design, manufacture, testing, repair, or operation of defense articles. Teaching a foreign national to maintain a listed weapon system counts, even if the training happens on U.S. soil.⁵

The concept that catches most companies off guard is the deemed export. Disclosing controlled technical data to a foreign person inside the United States is treated as an export to that person’s home country. A defense contractor sharing ITAR-controlled engineering files with a foreign-national employee or visiting engineer has made an export and needs prior authorization. This applies regardless of whether the foreign person holds a valid work visa. The only question is whether the individual qualifies as a “U.S. person” under the regulations, which requires U.S. citizenship, lawful permanent residency, or protected-individual status.⁶

Not all technical knowledge triggers ITAR. General scientific, mathematical, and engineering principles taught in schools and universities are excluded from the definition of technical data. Information already in the public domain, meaning it has been published and is generally accessible through bookstores, libraries, patent offices, or unrestricted public conferences, is also outside ITAR’s reach. Basic marketing materials that describe what a product does without revealing how it works are similarly excluded. University research qualifies for the fundamental-research exclusion only if results are ordinarily published and shared broadly; publication restrictions or access controls remove that protection.⁷

Who Has to Register With DDTC

Any person or company that manufactures, exports, temporarily imports defense articles, or furnishes defense services must register with DDTC. The rule is blunt: even a single occasion of manufacturing a defense article triggers registration, and manufacturers who never ship anything overseas still have to register.⁸

A few exemptions exist. U.S. government officers and employees acting officially don’t need to register. Neither do persons whose only ITAR activity is producing unclassified technical data, those whose manufacturing and export activities are entirely licensed under the Atomic Energy Act, or persons fabricating articles solely for experimental or scientific purposes. That last exemption has a catch: an exempt researcher who later wants to export the article must register before any license can be issued.⁸

Registration itself grants no right to export. It establishes your identity with the government and is a prerequisite for applying for licenses. Fees are assessed annually at renewal in three tiers:

Tier 1: a flat $3,000 for first-time registrants and those who received no favorable license determinations in the prior review period. A temporary initiative lets qualifying Tier 1 registrants petition for a $500 discount, bringing the fee to $2,500.
Tier 2: a flat $4,000 for registrants with five or fewer approved licenses or authorizations during the twelve-month period ending 90 days before their registration expires.
Tier 3: $4,000 plus $1,100 for each approved authorization above five. If that total exceeds three percent of the value of all approvals, the fee drops to three percent or $4,000, whichever is greater.

⁹

When You Can’t Tell: Commodity Jurisdiction Requests

When you genuinely can’t tell whether your product belongs on the USML or falls instead under the Commerce Department’s Export Administration Regulations, you can ask DDTC to make the call through a commodity jurisdiction (CJ) request. Getting an answer up front is far cheaper than discovering you guessed wrong after the fact.¹⁰

The request uses Form DS-4076 and must be submitted electronically through the Defense Export Control and Compliance System (DECCS). You’ll need detailed technical specifications, a plain-language description of what the product does, the identity of the original developer, and the funding source for the project. High-quality photographs and engineering drawings should accompany the submission. DDTC issues a preliminary response within ten business days of receiving a complete request, and the final determination letter is legally binding.¹¹

Recordkeeping

Registered entities must keep records of all ITAR-controlled transactions for at least five years. The clock starts either from the expiration date of the license or other approval used for the export, or from the date of the transaction itself when an exemption was relied on. DDTC can require a longer or shorter retention period in individual cases.¹²

The records that matter include license applications, shipping documents, technical data transmittals, and correspondence with DDTC. If an auditor asks for documentation and you can’t produce it, the absence itself becomes a compliance problem.

Penalties for Violations

ITAR enforcement carries some of the heaviest penalties in export-control law, and the government does not need to prove intent to harm national security, only that you willfully broke the rules.

Criminal Penalties

A willful violation of the Arms Export Control Act or any ITAR regulation can result in a criminal fine of up to $1,000,000 per violation and imprisonment of up to 20 years, or both. Making a materially false statement on a registration or license application triggers the same penalties. These are per-violation maximums, so a single shipment involving multiple controlled items or multiple unauthorized disclosures can compound quickly.¹³

Civil Penalties

Even without criminal prosecution, DDTC can impose civil penalties of up to $1,271,078 per violation, or twice the transaction value, whichever is greater. Civil penalties can be assessed in addition to or instead of criminal sanctions. Because no inflation adjustment was published for 2026, the 2025 ceiling carries forward.¹⁴

Administrative Debarment

The government can also debar a person or company from any defense-trade activity. Debarment typically lasts three years, and reinstatement is not automatic; you must petition and receive approval before resuming any ITAR-regulated business.¹⁵

Voluntary Self-Disclosure

If you discover a violation internally, the Department of State strongly encourages disclosure to DDTC. Self-reporting can serve as a mitigating factor when the government sets penalties, but the timing matters: the disclosure must reach DDTC before any government agency independently learns of the violation and opens an investigation. Once you notify DDTC, you have 60 calendar days to submit a complete account. Failing to disclose a known violation is treated as an aggravating factor if the government finds it later.¹⁶

1
eCFR. 22 CFR Part 121 – The United States Munitions List
2
eCFR. 22 CFR 120.41 – Specially Designed
3
eCFR. 22 CFR 120.41 – Specially Designed
4
eCFR. 22 CFR 120.33 – Technical Data
5
eCFR. 22 CFR Part 120 – Purpose and Definitions – Section 120.32
6
eCFR. 22 CFR 120.62 – U.S. Person
7
eCFR. 22 CFR 120.34 – Public Domain
8
eCFR. 22 CFR 122.1 – Registration Requirements, Exemptions, and Purpose
9
Directorate of Defense Trade Controls. Registration Payment
10
U.S. Department of State Directorate of Defense Trade Controls. Commodity Jurisdictions (CJs)
11
eCFR. 22 CFR 120.12 – Commodity Jurisdiction Determination Requests
12
eCFR. 22 CFR 122.5 – Maintenance of Records by Registrants
13
Office of the Law Revision Counsel. 22 USC 2778 – Control of Arms Exports and Imports
14
eCFR. 22 CFR 127.10 – Civil Penalties
15
eCFR. 22 CFR 127.7 – Debarment
16
eCFR. 22 CFR 127.12 – Voluntary Disclosures