EU Dual-Use Export Control Recast Regulation (EU) 2021/821

Mechanism

Regulation (EU) 2021/821 is the foundational EU statutory instrument governing exports, brokering, technical assistance, transit, and transfer of dual-use items — goods, software, and technology that can have both civilian and military applications. It repeals and recasts the previous framework (Regulation (EC) No 428/2009), which had been incrementally amended since 2009 and was considered insufficiently responsive to emerging technology threats.

Core structure:

• Annex I lists all EU-controlled dual-use items, implementing the four major multilateral

export-control regimes: Wassenaar Arrangement (conventional weapons and advanced civilian technology), MTCR (missiles and related equipment), Australia Group (biological and chemical weapons precursors), NSG (nuclear materials and equipment), and CWC (chemical weapons).

• Annex IV lists a subset of Annex I items subject to intra-EU transfer controls (highest-risk

categories).

• Article 5 introduces an autonomous EU "catch-all" control on cyber-surveillance technologies

not listed in Annex I, where an exporter has grounds to believe the items could be used in connection with internal repression, serious human-rights violations, or violation of international humanitarian law. This was a significant innovation over the predecessor regime.

Governance and enforcement: Member States designate national competent authorities (NCAs) for licensing. The regulation establishes a Dual-Use Coordination Group (DUCG) chaired by the Commission, which coordinates positions, information-sharing, and alignment on global licensing decisions. The European Commission may adopt delegated regulations to update Annex I when multilateral control lists change (see: Commission Delegated Regulation (EU) 2025/2003, which implements 2024 Wassenaar/MTCR/AG/NSG plenary decisions).

Downstream implications

• This regulation is the statutory parent of every EU export licence granted for dual-use items

(semiconductors, quantum, additive manufacturing, cryogenic systems, advanced materials, etc.) and every enforcement/sanctions action taken by EU Member States for unlicensed dual-use exports.

• The 2021 recast closes a coverage gap the IPTM register had: approximately 30 EU-side

export-enforcement and sanctions filings in the register derive their legal basis from this instrument, but the parent was previously absent.

• The cyber-surveillance catch-all (Art. 5) has been operationalised via targeted decisions on

surveillance technology companies (NSO Group, Candiru, etc.) and aligns with the EU's Regulation on cybersecurity certification and the NIS2 framework.

• Annex I is updated via Commission delegated acts after each calendar-year multilateral regime

plenary cycle; the most recent significant update is Delegated Regulation (EU) 2025/2003 (effective 15 Nov 2025), which added advanced semiconductor equipment, quantum, and AI hardware controls aligned with US BIS October 2024 actions.

• The regulation's coordination architecture provides the EU-side legal basis for convergence

with US BIS EAR, UK SPIRE, JP METI FEFTA, and KR MOTIE export-control perimeters, particularly for advanced semiconductor equipment targeted at China.

Open questions

• The Commission has been considering whether to introduce an EU-level "Foreign Direct Investment

+ export control" integration layer (linking outbound-investment screening with dual-use export licensing) — a structural expansion of the 2021 framework scope.

• Member State divergence in catch-all (Art. 5) cyber-surveillance licensing remains a watch

item; the Commission has proposed a more harmonised approach but no binding amending regulation has been adopted.

• Post-Ukraine, several Member States pressed for a broader "strategic autonomy" review of the

dual-use list; Commission DG TRADE initiated a consultation but outcomes remain pending.