What Does ITAR Mean for a Buyer Sending a Part to a Supplier?
If the part or its drawing is a defense article under the ITAR, the supplier making it must be registered with DDTC, only U.S. persons may see the technical data unless an authorization applies, and both sides must keep records. This page is general information for buyers, not legal advice; your export compliance team or counsel decides.
Updated
What does ITAR mean when you send a part to a supplier?
It means the drawing is controlled just like the hardware. Under the International Traffic in Arms Regulations (22 CFR 120 to 130), a defense article includes technical data and models that reveal it, so the moment you send a controlled drawing to a shop, you are handling an ITAR transaction, even if nothing ever leaves the country.
Four questions decide almost everything: is it on the U.S. Munitions List, is the supplier registered, who will see the data, and can both sides prove what happened afterward.
This is general information to help buyers ask the right questions. It is not legal advice. Jurisdiction, classification, licensing and the use of any exemption are decisions for your export compliance function or counsel, and for the design owner as to its own data.
Is your part, or only its drawing, a defense article?
Often both. 22 CFR 120.31 defines a defense article as any item or technical data designated in the Munitions List at 121.1, including technical data in any physical form and models or mockups that reveal it, plus forgings, castings, extrusions and machined bodies once they are clearly identifiable as defense articles.
Technical data is defined in 120.33 as information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles, including blueprints, drawings, photographs, plans, instructions and documentation, plus software directly related to defense articles. It does not include general scientific and engineering principles taught in schools, public domain information, or basic marketing information on function or purpose.
That means a machined bracket, its STEP model, the CNC program written from that model and the inspection plan can all be controlled at once. Treat every derivative file the supplier creates as controlled too.
Who decides? The design owner classifies its own data. If there is real doubt about whether something is on the Munitions List, the commodity jurisdiction procedure in 120.4 is the formal route. Many military aircraft and space parts now sit under the Export Administration Regulations in the 600 series or 9x515 instead, which changes the rules but not the need for care. Get the jurisdiction in writing before any file moves.
Have a part like this?Send it in under a minute. A person replies within 1 business day.Who must register with DDTC, the buyer or the supplier?
Whoever manufactures, exports or temporarily imports defense articles, or furnishes defense services, in the United States. Under 22 CFR 122.1(a), one occasion is enough, and a manufacturer that never exports must still register. So the shop that machines your ITAR part must be registered, whatever your own status.
Many primes and subs that buy controlled parts are registered already because they manufacture or export themselves. A buyer whose business is limited to purchasing, with no manufacturing, exporting or defense services, may not fall under 122.1 at all; that is a question for your compliance team, not for the supplier. Two points matter either way:
- The regulation's exemptions are narrow. 122.1(b) exempts, for example, persons whose pertinent business is confined to producing unclassified technical data only, and persons fabricating articles solely for experimental or scientific purposes, including research and development. Exempt persons still need registration before they can get a license.
- 22 CFR 120.15(a) requires anyone otherwise required to register to do so before using any exemption.
Ask for evidence of current registration before release, not after award. How registration works, what it costs and how often it renews are covered in our ITAR registration guide for suppliers, so we do not repeat them here.
Can you send ITAR drawings to a U.S. supplier?
Yes, to U.S. persons in the United States. 22 CFR 120.54(a)(2) says transferring technical data to a U.S. person in the United States from a person in the United States is not an export. The risk sits inside the supplier: releasing that data to a foreign person, even an employee at the same plant, is an export.
Section 120.50(a)(2) calls this a deemed export, and 120.50(b) says it is deemed an export to every country where that person has held or holds citizenship or permanent residency. Section 120.56 defines release broadly: visual inspection of a defense article that reveals technical data, oral or written exchanges, and giving someone the access information (a password or decryption key) that lets them view unencrypted data. A machinist who is not a U.S. person looking at the traveler counts.
A U.S. person under 120.62 is a lawful permanent resident under 8 U.S.C. 1101(a)(20), a protected individual under 8 U.S.C. 1324b(a)(3), which includes U.S. citizens, or an entity incorporated to do business in the United States. Everyone else is a foreign person under 120.63, including a foreign subsidiary of a U.S. company.
What the buyer should get from the supplier before release: confirmation that only U.S. persons will access the data, a named access list for the job, how files are stored and who administers the systems, and whether any sub-tier processor (plating, heat treat, NDT) will see the drawing. Section 120.54(a)(5) also has conditions under which sending or storing properly encrypted unclassified technical data is not an export; section 120.54 was amended by a rule published August 28, 2026, so have compliance confirm the current text before you rely on it for cloud storage or email.
When can an exemption be used, and why only with counsel?
Use an ITAR exemption only when your export compliance team or counsel has confirmed it applies and documented why. An exemption is claimed by the exporter rather than approved in advance by DDTC, so a wrong claim is an unauthorized export.
The general rules in 22 CFR 120.15 set the guardrails. A person required to register must register before using an exemption. Exemptions are unavailable where any party is generally ineligible under 120.16 or the destination is proscribed under 126.1. Each exemption is limited by its own text. Every export under an exemption must be recorded, including the description of the article or data, end user, the natural person responsible, end use, date and method of transmission. To claim a technical data exemption, such as one in 125.4, the exporter must certify that the export is covered by the cited paragraph.
Buyers usually meet exemptions in a few situations: sending data to a foreign supplier or a foreign national engineer, sharing data with a foreign customer, or a supplier wanting to move dual nationals or third-country nationals onto your job under 126.18. None of these is a purchasing decision. If a supplier tells you an exemption covers its foreign staff or an overseas affiliate, send that claim to your compliance team before releasing anything.
How should you mark ITAR technical data before release?
Mark every controlled file, page and drawing so anyone who opens it knows it is controlled and who may see it. The ITAR does have a specific statement for export shipping documents in 22 CFR 123.9(b), covered in our export shipping guide, but for drawings and models the marking usually comes from your contract and your own procedures.
On DoD programs, technical documents carry a distribution statement under DoD Instruction 5230.24. DTIC's 2023 marking guide shows that the export controlled reason can be used with Statements B, C, D and E, not with Statement A, which is approved for public release. Documents that are also controlled unclassified information carry CUI banner markings, with export control markings added as required. Your program office or prime contract tells you which statement and legend to use.
Practical rules that keep marking from failing:
- Put the legend on every sheet of the drawing and in the model's file properties, not only on the cover page.
- Label file names and transfer packages so controlled files are obvious before anyone opens them.
- Require the supplier to carry the marking onto everything it derives: CAM programs, travelers, inspection reports and photos.
- Never paste controlled content into quote email, chat or a marketplace upload, and do not put it in an RFQ that goes to unvetted suppliers.
What records do you need to keep?
Registrants must keep records of the manufacture, acquisition and disposition of defense articles and technical data, the provision of defense services, and exemption exports, for five years. 22 CFR 122.5 sets that period from the expiration of the license or other approval, or from the date of the transaction for exports under an exemption.
The same section requires electronic records to be reproducible on paper, legible, and stored so that no entry can be altered without recording the change, who made it and when. Records must be available for inspection by DDTC, or by persons it designates such as the Diplomatic Security Service, and by Immigration and Customs Enforcement or Customs and Border Protection.
For a buyer, a defensible file for each controlled job usually holds: the written jurisdiction and classification, the NDA, the supplier's registration evidence, the access list, what data was released to whom and when, the transfer channel used, any exemption analysis from counsel, and the return or destruction certificate at closeout.
What should a buyer check before releasing ITAR data?
Before any controlled drawing leaves your hands, work through these steps in order, and stop at the first one you cannot close.
| Step | What the buyer does | Reference |
|---|---|---|
| 1 | Get jurisdiction and classification in writing from the design owner or compliance | 22 CFR 120.4, 120.31, 120.33 |
| 2 | Confirm the supplier's current DDTC registration | 22 CFR 122.1 |
| 3 | Get the supplier's U.S. person confirmation and named access list, including sub-tier processors | 22 CFR 120.50, 120.56, 120.62 |
| 4 | Execute the NDA and flow down export clauses on the PO | Your contract and PO terms |
| 5 | Have counsel approve any exemption before it is used | 22 CFR 120.15, 125.4, 126.18 |
| 6 | Mark the data and agree an approved transfer channel | DoDI 5230.24; 22 CFR 120.54(a)(5) |
| 7 | Record the release, and get a return or destruction certificate at closeout | 22 CFR 122.5 |
Our aerospace RFQ checklist shows where the export classification line goes, and the supplier qualification guide covers screening a new shop.
How does our controlled program process handle ITAR work?
We never take controlled technical data through the website. For an ITAR job you send program facts only, and we work through a documented set of release steps with you before any data moves.
In short: your team confirms jurisdiction in writing, NDAs are executed, a U.S. person access list is recorded, and for each supplier we verify the authorization the work needs, such as current DDTC registration for ITAR manufacturing, along with its cybersecurity status where your contract requires it. Flow-down clauses go to the supplier in writing, the transfer channel is one your security team approves, and data is returned or destroyed at closeout with a certificate on file. The full ten steps are on controlled programs. Where an activity requires our own registration or authorization, we obtain it before performing that activity.
Related reading: sourcing for defense contractors, DFARS specialty metals and what a CAGE code is.
Start a controlled request without sending data
If you have an ITAR part to source, start with the request form and send program details only: jurisdiction if known, quantities, need date, the clauses that flow down and your preferred transfer method. No drawings. A person replies within 1 business day, and we take the release steps with your compliance team before anything technical changes hands. See confidentiality for how NDAs and files are handled.
Send the job. A person replies within 1 business day.
Part, quantity and date are enough to start. Drawings and the mutual NDA follow by reply, and controlled programs never send technical data through this site.
We have it.
Reference . A person replies within 1 business day. Watch for our email from [email protected].
Questions
Do I need to be ITAR registered to buy ITAR parts?
Not necessarily. 22 CFR 122.1 requires registration from anyone engaged in the business of manufacturing, exporting or temporarily importing defense articles, or furnishing defense services. A company that only purchases may fall outside that, but many primes and subs that buy controlled parts also manufacture or export, so they register anyway. Your compliance team should make that call. The supplier that manufactures the part must be registered either way.
Is emailing an ITAR drawing to a U.S. machine shop an export?
Sending technical data to a U.S. person in the United States is not an export under 22 CFR 120.54(a)(2). It becomes an export if the data is released to a foreign person, including the shop's own employees who are not U.S. persons. Whether ordinary email is an acceptable channel depends on your contract, your CUI obligations and your company procedures, so use the transfer method your security team approves.
What is a deemed export?
A deemed export is the release of technical data to a foreign person inside the United States. 22 CFR 120.50 treats it as an export to every country where that person has held or holds citizenship or permanent residency. Release includes letting someone view a drawing or a part that reveals technical data, talking it through, or giving them the password that unlocks the files.
Can a supplier with foreign national employees work on my ITAR part?
Only if the controlled data and hardware are kept away from those employees, or if a license or a valid exemption covers them. Ask the supplier how it restricts access, request a named U.S. person access list for your job, and send any claim that an exemption such as 22 CFR 126.18 applies to your compliance team or counsel before releasing data.
How long do ITAR records have to be kept?
Five years. 22 CFR 122.5 requires registrants to keep records of the manufacture, acquisition and disposition of defense articles and technical data, defense services and exemption exports for five years from the expiration of the license or other approval, or from the transaction date for exemption exports. Records must be producible on request, and electronic records must show any change, who made it and when.
Who decides whether a part is ITAR or EAR?
The design owner is responsible for the jurisdiction and classification of its own data and hardware, usually through its export compliance team. If there is genuine doubt about whether an item is on the U.S. Munitions List, the commodity jurisdiction procedure in 22 CFR 120.4 is the formal way to get a determination from the State Department. Suppliers should not be guessing at a buyer's classification.
Is this page legal advice?
No. It is general information to help buyers understand how the ITAR applies when parts and drawings go to suppliers, with citations so you can read the regulation yourself. Jurisdiction, classification, licensing, exemptions and recordkeeping decisions belong to your export compliance team or counsel. The regulation is amended from time to time, so check the current text on eCFR before acting.
Related
Sources
- eCFR, 22 CFR 120.31 Defense article
- eCFR, 22 CFR 120.33 Technical data
- eCFR, 22 CFR 120.50 Export, and 120.56 Release
- eCFR, 22 CFR 120.54 Activities that are not exports
- eCFR, 22 CFR 120.62 U.S. person
- eCFR, 22 CFR 120.15 Exemptions
- eCFR, 22 CFR 122.1 Registration requirements
- eCFR, 22 CFR 122.5 Maintenance of records by registrants
- eCFR, 22 CFR 125.4 Exemptions of general applicability
- DTIC, Guide to Marking Documents (2023), DoDI 5230.24 distribution statements
- Directorate of Defense Trade Controls (DDTC)
Ready to
source it?
A person replies within 1 business day. NDA first.
Request a quote