Engineers and buyers who work on printed circuit boards meet the International Traffic in Arms Regulations at odd moments: a contract clause, a marking on a drawing, a question from a supplier about export status, a request to send files to a new fabricator. The rules themselves are long and written for every kind of defense trade, from aircraft to training. Most PCB teams need something narrower: enough of the structure and the key definitions to recognize when a board, a file or a conversation is regulated, and to know when to stop and call their compliance function.
This guide is that working map, written from the perspective of a PCB factory that regularly has to explain why it asks about export status. As a China-based manufacturer, XFPCB does not handle ITAR-controlled work; we have covered the sourcing decision between controlled and commercial boards separately. Here the focus is the regulation itself. It is a plain-language orientation, not legal advice. The authoritative text is 22 CFR Parts 120 through 130, which is amended from time to time, and determinations about your products belong to your export compliance team and counsel.
Who runs it and where it lives
The ITAR implements the Arms Export Control Act. It is administered by the Department of State's Directorate of Defense Trade Controls (DDTC). The regulations sit in Title 22 of the Code of Federal Regulations, Subchapter M, Parts 120 to 130. Part 120 was reorganized in 2022, so older articles and training slides often cite definitions by section numbers that have since moved; check against the current eCFR text.
A quick map of the parts:
- Part 120: purpose, general policies and definitions. Most of what a PCB team needs to understand lives here.
- Part 121: the U.S. Munitions List (USML) itself, in 121.1.
- Part 122: registration of manufacturers and exporters, and their recordkeeping.
- Part 123: licenses for exporting and temporarily importing defense articles (hardware).
- Part 124: agreements, such as technical assistance and manufacturing license agreements, offshore procurement, and other defense services.
- Part 125: licenses for exporting technical data and classified articles, and related exemptions.
- Part 126: general policies, including 126.1, the list of countries subject to prohibitions.
- Part 127: violations, penalties, debarment and voluntary disclosures.
- Part 128: administrative procedures for enforcement.
- Part 129: registration and licensing of brokers.
- Part 130: reporting of political contributions, fees and commissions.
The USML, read by an electronics team
The USML is organized into categories, mostly by type of system: aircraft, vehicles, spacecraft, military electronics and so on. Within a category, paragraphs generally run from end items and major systems, through parts, components, accessories and attachments, to the technical data and defense services directly related to that category.
Two features matter for boards:
Enumerated versus catch-all control. Some entries name specific items. Others are catch-all paragraphs that control parts or components only if they are "specially designed" for an enumerated item. When a board is controlled, it is more often through a catch-all paragraph than through an entry that mentions printed circuit boards.
"Specially designed" is a defined term in 22 CFR 120.41. In outline, a part or component for use in or with a defense article is specially designed unless one of the release criteria applies, for example that it was developed as a general-purpose item with no knowledge of a particular use, or was developed with knowledge it would be used in both defense and non-defense items, supported by documents from the time of development. Those criteria are why the answer for a given board depends on its development history, not on how simple or complex it looks.
Two further points are easy to miss. First, a note in 22 CFR 120.3 states that the intended military or civilian use of an item after export is not by itself the deciding factor. Second, 120.11 sets an order of review: if an item is not on the USML, it may still be subject to the Export Administration Regulations (EAR), which have their own classification process. Many military parts and components moved from the USML to the EAR's "600 series" during export control reform, so "not ITAR" does not automatically mean "not controlled."
If an item's status is genuinely unclear, a commodity jurisdiction request to DDTC (120.4 and 120.12) produces a formal determination.
What counts as technical data in a PCB package
22 CFR 120.33 defines technical data as information, other than software, required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles, including blueprints, drawings, photographs, plans, instructions and documentation. Software directly related to defense articles is included too.
Applied to a board that is a defense article or a component of one, most of the usual manufacturing package falls inside that definition:
- Schematics, layout databases, Gerber, ODB++ or IPC-2581 data, and drill files.
- Stackups, material callouts and fabrication drawings.
- Assembly drawings, work instructions and rework procedures.
- Test procedures, test programs and fixture designs.
- Firmware and software directly related to the article.
- Photographs of the board, which the definition names explicitly.
In that situation the physical board is itself a defense article, and letting a foreign person inspect it in a way that reveals technical data is a release.
The definition also has limits. It excludes general scientific, mathematical and engineering principles commonly taught in schools, information in the public domain as defined in 120.34, and basic marketing information on function or purpose. A datasheet for a commercial component does not become technical data because the component is on a controlled board; but your design that uses it may be.
Export, release and deemed export
The definition of export in 22 CFR 120.50 is broader than shipping something across a border. It includes sending technical data out of the United States, and it also includes releasing technical data to a foreign person inside the United States, called a deemed export. Under 120.56, release includes visual inspection by foreign persons, oral or written exchanges, and providing access information such as passwords or decryption keys that lets a foreign person see unencrypted data.
For a PCB team, ordinary activities map onto these definitions:
- Emailing a controlled Gerber set to an overseas fabricator is an export.
- Giving a foreign national engineer in a U.S. office access to a controlled layout is a deemed export, unless authorized.
- Walking a foreign visitor past controlled boards on a production line can be a release.
- Uploading controlled data to a supplier portal or cloud service brings in the conditions of 120.54, which treats certain end-to-end encrypted storage and transmission as not being an export, provided, among other conditions, the data is not sent to or stored in a country listed in 126.1.
Defense services are a separate trap. Under 120.32, furnishing assistance to foreign persons in the design, engineering, manufacture, assembly, testing or repair of defense articles is a defense service, as is furnishing controlled technical data to them. DFM feedback, failure analysis support or rework guidance given to a foreign party about a defense article can fall into this category.
U.S. person and foreign person are defined in 120.62 and 120.63. A company incorporated in the United States is a U.S. person, but its employees who are not U.S. citizens, lawful permanent residents or protected individuals are foreign persons for release purposes.
Registration, licenses and agreements
Anyone in the United States engaged in the business of manufacturing or exporting defense articles, or furnishing defense services, must register with DDTC under Part 122. The regulations note that a manufacturer who does not export must still register. Registration is a precondition, not an authorization: it does not itself permit any export.
Exports need a license or other approval unless an exemption applies. Hardware exports are licensed under Part 123, technical data under Part 125, and ongoing technical cooperation such as sharing data with a foreign manufacturer under an agreement approved through Part 124. Part 124 also addresses offshore procurement by U.S. persons. Exemptions exist, but they come with conditions and recordkeeping, and under 120.15 they do not apply to transfers involving countries proscribed in 126.1.
For a PCB supply chain, the 126.1 list is a practical boundary. China is among the countries for which the United States has a policy of denial for defense articles and defense services. On the EAR side, 600-series items destined for China are reviewed consistently with that policy.
Records, violations and disclosure
Registrants must keep records of their ITAR activities, generally for five years under 122.5, and anyone using an exemption must keep records of each transaction under 120.15. For engineering teams, that means being able to show what controlled data was sent, to whom, when and under what authorization.
Part 127 describes violations and penalties, which can be civil or criminal and can include debarment from defense trade. Unintentional mistakes, such as data sent to the wrong recipient, can still be violations. DDTC strongly encourages voluntary disclosure of possible violations, and 127.12 describes the process. If something has gone wrong, the right move is to involve your compliance function immediately rather than to try to quietly reverse it.
Misconceptions we hear from PCB buyers
- "Our supplier is ITAR certified." There is no ITAR certification. There is DDTC registration, plus whatever internal controls a company maintains.
- "Registration means they can export it." Registration enables applying for authorizations; it is not one.
- "It's only a bare board." Simplicity is not a release criterion. Development history and the specially designed analysis decide.
- "It's going into a commercial product, so it's fine." Intended use alone does not decide jurisdiction, in either direction.
- "The supplier is a U.S. company, so anyone there can see it." Foreign person employees of U.S. companies still require authorization.
- "We encrypted it." Encryption helps only under the specific conditions of 120.54.
- "Not ITAR means not controlled." The EAR may still apply, including the 600 series.
A starter kit for PCB teams
None of this needs to slow down ordinary work if a few habits are in place:
- Record the jurisdiction and classification of each board and assembly part number, made by your compliance function.
- Mark controlled technical data so it is recognizable in every system it passes through.
- Restrict access in EDA, PLM and file-sharing systems so controlled projects are only visible to authorized people.
- Train engineers and buyers to recognize releases and defense services, not only shipments.
- Escalate anything uncertain, including new suppliers, visitors, cloud tools and foreign national team members, to your empowered official or export counsel before acting.
A factory asking about export status before accepting files is a sign the system is working. If the answer is that the design is controlled, that factory, if it is outside the United States and not authorized, should be the first to tell you to take the work elsewhere.