US BIS Cybersecurity Items Export Control: License Exception ACE Finalized (EAR)

Mechanism

The 2022-05-26 final rule closes the regulatory loop opened by the October 21, 2021 interim rule that first introduced controls on cybersecurity items under new ECCN categories and created License Exception ACE. The interim rule drew public comments about over-breadth and ambiguity in the "government end user" definition and about overlap with existing License Exception ENC (encryption). The final rule addresses those comments with three main changes:

1. Government end user definition tightened. The final rule adds an illustrative enumerated list to the "government end user" definition, making clear which entities qualify (e.g., national militaries, intelligence agencies, law enforcement) versus which do not (e.g., state-owned commercial entities). This matters because government-end-user transactions to Country Groups D:1–D:5 require a license regardless of whether the software would otherwise qualify for ACE.

2. Paragraph (c)(2)(i) corrected for A:6 destinations. The pre-final rule text was ambiguous about exports of "digital artifacts" (forensic evidence, content intercepted in transit) to A:6 country law-enforcement bodies. The final rule limits such exports to police and judicial bodies conducting bona fide criminal investigations — closing a loophole that could have been read to permit surveillance-tool transfers to intelligence agencies in A:6 countries.

3. ENC interaction clarified. License Exception ENC (for dual-use encryption products) is given new restrictions for certain cybersecurity items to prevent ACE/ENC overlap from creating an unintended low-control path.

Controlled ECCNs:

• 4A005 — "Systems, equipment, and components" (intrusion software, C2 platforms)
• 4D001/4D004 — Software for 4A005 systems; intrusion-software payloads
• 4E001 — Technology for development or production of 4A005/4D items
• 5A001.j — Surveillance-capable network monitoring equipment
• 5B001/5D001/5E001 — Test equipment, software, and technology for ECCN 5A001.j items

Destination framework (as of May 2022):

Scale context: 2020 AES data (the most recent available at rulemaking) showed approximately 980 annual export shipments of controlled cybersecurity items valued at $39.1 million, of which roughly 120 shipments ($1.9 million) would require licensing under the new framework. BIS estimated approximately 170 net new annual license applications.

Downstream implications

• Cybersecurity vendors exporting offense-capable tools (penetration-testing platforms,

vulnerability research tools, network-intrusion kits) must classify against the ECCNs above and assess each government-end-user transaction against the revised ACE criteria.

• The rule had practical export-controls compliance implications for vendors such as NSO

Group (already blocked) and for US-headquartered pen-testing companies (Cobalt Strike, Immunity CANVAS) exporting to government customers in D-group destinations.

• The ENC interaction clarification also affects dual-use encryption exporters — some

products that previously moved under ENC may now require ACE assessment.

Open questions

• How courts and BIS interpret "government end user" in edge cases (e.g., state-owned

telecom providers that also provide lawful-intercept infrastructure).

• Whether the 2022 framework will be expanded to cover AI-driven surveillance tools not

explicitly enumerated under current ECCNs (rulemaking was initiated via ANPRM in 2023).