Industrial Policy & Trade Monitor· 2665 actions· ✨ 90 recent

On November 4, 2021, BIS added four entities to the Entity List under a policy of denial: NSO Group and Candiru (Israel), Positive Technologies (Russia), and Computer Security Initiative Consultancy PTE (Singapore). NSO Group and Candiru were designated for supplying commercial spyware to foreign governments used to maliciously surveil government officials, journalists, activists, and academics; Positive Technologies and CSIC for trafficking cyber tools enabling unauthorized access to information systems. All four entities now require BIS licenses for any export, re-export, or in-country transfer of EAR-controlled items, with a presumption of denial.

BIS published an interim final rule on October 21, 2021 establishing new Export Control Classification Numbers (ECCNs 4A005, 4D004, 4E001.c, and 5A001.j) for intrusion software systems, command-and-control platforms, and IP network surveillance tools, implementing the Wassenaar Arrangement 2017 cybersecurity decisions into the Export Administration Regulations (EAR). The rule simultaneously created License Exception ACE (Authorized Cybersecurity Exports), codified at § 740.22, to authorize exports to most destinations while imposing licence requirements — or outright prohibitions — for sales to Country Groups E:1/E:2 governments and certain D-group government end-users. Carve-outs for vulnerability disclosure and cyber-incident-response activities were included to protect legitimate security research. The effective date was subsequently delayed from January 19, 2022 to March 7, 2022 by a separate interim rule (FR 2022-00448), and the rule was finalized with revisions on May 26, 2022 (FR 2022-11282).

The Bureau of Industry and Security amended the Export Administration Regulations by adding six Russian technology entities to the Entity List, all designated consistent with Executive Order 14024 on blocking property associated with harmful foreign activities of the Russian government. The designated entities operate in Russia's technology sector and have been determined to support Russian intelligence services, including notable cybersecurity firms and defense-innovation institutions. All items subject to the EAR require a BIS licence for export, reexport, or transfer to these parties, subject to a presumption-of-denial review policy with no licence exceptions available. The rule also corrects an existing FSB entry to reference updated General Licence No. 1B.

Regulation (EU) 2021/821, adopted 20 May 2021 and applied from 9 September 2021, establishes the Union regime for controlling exports, brokering, technical assistance, transit, and transfer of dual-use items, repealing Regulation (EC) No 428/2009. Annex I lists controlled items implementing internationally agreed dual-use controls under the Wassenaar Arrangement, MTCR, Australia Group, NSG, and Chemical Weapons Convention. The regulation introduces a new catch-all control on cyber-surveillance technologies that could facilitate human-rights violations (Art. 5 and Annex IV), and strengthens cooperation between Member States and the European Commission, placing specific obligations on exporters. It serves as the statutory anchor for all EU export licences, every multilateral-regime transposition into EU law, and coordination mechanisms with US BIS, UK ECJU, JP METI, and KR MOTIE export-control regimes.