U.S. Export Controls On Software License Keys

With the many updates to U.S. export controls in the past few months, it would be easy to miss a recent update concerning software keys. The U.S. Commerce Department Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) to add new Sec. 734.19 of the EAR, specifying how and when license requirements apply to:

1. Software license keys allowing a user the ability to use software or hardware; and 
2. Software keys that renew existing software or hardware use licenses.  

 Sec. 734.19 specifies that such software keys are classified and controlled under the same Export Control Classification Numbers (ECCNs) as the corresponding software or hardware to which they provide access, imposing the same controls and authorization requirements. For hardware, BIS provided that “the software key would be classified under the corresponding ECCN in the software group (e.g., a software license key that allows the use of hardware classified under ECCN 5A992 would be classified under ECCN 5D992).”

As a result of this clarification, companies that provide software keys to their customers should review their export compliance programs to ensure they have appropriate controls not only around the provision of software, but also around corresponding license keys. For instance, companies should be aware that even if no authorization was required for the release of the initial software license key, renewal use licenses may be subject to authorization requirements to the extent circumstances changed (e.g., if the end user was added to the Entity List).  

This change is particularly noteworthy given the EAR's license requirement for the export, reexport, or transfer (in-country) to or within Russia or Belarus of many types of software, including certain EAR99 software.