New Regulation on Export of EU Dual-Use Products Enters into Force

New Definition of Dual-Use Products

A dual-use product is defined as a product that can be used for both civilian and military applications.

With the Regulation, the definition of military use has been extended to include all products, in the category of software and technology, including all such items that can be used for (1) design, development and production or use of nuclear, chemical, or biological weapons, and (2) non-explosive and assisting in the manufacturing of nuclear weapons or similar.



Authorisations

Generally, authorisations are required to export dual-use products to certain countries outside of EU territory, including Russia, Iraq, Iran, and Pakistan and others.

Generally, the EU General Export Authorisations (EUGEA) is an authorisation granted to an exporter of dual-use products exported to certain destinations such as Australia, the United Kingdom, the United States of America, Japan, Norway, and Switzerland, among others. The authorisation is granted on certain conditions, including the condition that the end-user of the dual-use products, to the exporter’s knowledge, will not use such products for the development of, and services related to, biological, nuclear weapons or other military end-use. The EUGEA authorisation is granted based on the category of the dual-use product or service provided.

With the Regulation the following have been included under the EUGEA:

1. Intra-group exports of software and technology
   
   The intra-group authorisation relates to dual-use products within the category of software and technology, such as IP network communications surveillance systems, or telecommunication jamming equipment. To obtain an EUGEA authorisation, the parent company and the ultimate controlling owner must be a resident of or established in an EU member state, and the end-user of the product is a subsidiary or sister company to the exporter. Further, it is a condition that internal compliance programmes have been implemented (see below for a description of the internal compliance programme).
   
   
2. Export of encryption
   
   This authorisation is related to a range of encryption products exported to all destinations. Encryption products might be software or technology used for the encryption of data. Authorisation cannot be granted if the equipment products process or store classified information or have national security classification marking, or if the encryption equipment has been designed for government use. The authorisation requires certain bookkeeping obligations, meaning that the exporter of encryption equipment must submit technical data of any export planned or conducted if the EU member state from where the authorisation is issued requests such data.
   

Generally, there are 4 different types of authorisations. It is the exporter’s responsibility to obtain the necessary and relevant authorisation before the export of dual-use products. In Denmark, it is possible to obtain guidance on this matter from the Danish Business Authority (the relevant authority in Denmark).

All items which require authorisation for export are listed the Annex I to the Regulation. This is for example products within the category of nuclear materials, electronics, computers, marine, telecommunication and information security (not an exhaustive list).

 

Cyber-Surveillance

New end-use control on cyber-surveillance equipment is introduced with the Regulation.

Cyber-surveillance equipment is equipment designed to monitor persons by way of monitoring, extracting, collecting and analysing data from information and telecommunication systems.

The end-use control applies when the exporter is aware or has been informed that exported cyber-surveillance equipment, in part or in its entirety, is or could be intended for serious violations and breaches of human rights and international humanitarian law, and/or repression.

If the exporter becomes aware of the above-mentioned use of its exported products, the exporter is obliged to inform the relevant national authority to obtain an authorisation to export its products as soon as possible. Such authorisation will be granted in accordance with the conditions set out in the Regulation and on the same basis as to all other authorisations no matter when in the process the exporter has been aware of the requirement.

 

Technical Assistance

With the Regulation, technical assistance relating to dual-use products outside of the EU territory also requires an authorisation to comply with the Regulation, provided that the assistance is intended for any use related to:

1. Military end-use if the destination is subject to an arm embargo;
2. The use of parts or components of military items listed on the national military list;
3. The use in connection with services etc. related to chemical, biological, or nuclear weapons or other nuclear explosive devices.

 

Internal Compliance Policies and Due Diligence

An exporter must comply with the “due diligence” principle as part of their internal compliance programme according to the Regulation. Such principle means that the exporter is obligated to carry out an assessment on the risk related to the export of dual-use products through a transaction-screening in order to act in conformity with the Regulation.

The internal compliance programme contains ongoing effective, appropriate, and proportionate policies and procedures for the exporter in order to comply with the rules set out in the Regulation, and any terms and conditions set out by the relevant national authority. It is not, in general, a requirement to implement an internal compliance programme, however, it is a requirement to obtain a global export authorisation. 



National Control List

The Regulation provides each EU member state with an optional authorisation regime based on national control lists. A national control list is a list of dual-use products which, according to the Regulation, do not require an authorisation, but which the individual EU member state has concluded should be included in the list. This could be to secure national public security or human rights.

If an EU member state establishes national control lists in accordance with the Regulation, it is a requirement that such list is being disclosed to both the European Commission and other EU member states. To simplify the increased regulatory burden of companies which is a result of this matter, the European Commission is obligated to publish a compilation of all national control lists.

 

Our Comments

Companies that have not been subject to export controls before the enforcement of the Regulation will now have to review and consider whether it could be subject to requirements on obtaining an authorisation for the export of dual-use products. This could be the case for companies exporting software and technology, cyber-surveillance, or technical assistance, as these are new categories subject to export control.

For companies now being subject to export control, it will be necessary to (1) assess whether the export of dual-use products will fall within the scope of the Regulation and if yes, which authorisations will be required, and (2) conclude whether they are aligned with the Regulation, including whether sufficient compliance programmes are in place. In the end, this could mean that the exporter will have to obtain an authorisation and/or implement internal compliance programs among other things.

Furthermore, companies active within dual-use products will fall within the scope of the Danish Act on Screening of Foreign Investments. For a foreign investor to complete an acquisition of a Danish company within the scope of such regulation the clearance must be obtained from the Danish Business Authority prior to the conclusion of an acquisition.

Read more about the Danish Foreign Direct Investment scheme in our newsletters here, here and here.