Practical business implications of the EU dual-use regulation 2021
Nearly five years after the European Commission proposed to overhaul Council Regulation (EC) No 428/2009, an updated version was published in June 2021. 1EU Regulation 2021/821, referred to here as “the Recast”, is effective from 9 September 2021 – but what does it mean for industry?
The Commission proposed this Recast in 2016, having identified a lack of consensus between member states about the implementation of the original regulation. There was concern that this lack of consensus could lead to divergence by some states away from a uniform EU dual-use list.
The Recast is therefore intended to harmonise controls across member states, lessening variations in interpretation, application and enforcement. It also aims to better address the human rights aspects of export controls, though it could be argued that there is still more to be done in this area. Generally, the Recast adapts the regulation to meet the changing technological, economic and political circumstances shaping international trade over the past decade.
Businesses involved in dual-use items should be aware of the significant changes that this Recast brings. These cover a variety of areas, including a revised definition of the term “exporter”. No categories have been added to the original list of items requiring authorisation.
The most important changes fall into five key areas:
- New and expanded catch-all controls: human rights and cybersecurity
- Information exchange and greater cooperation on enforcement between member states
- Changes in the licensing architecture – two new EU General Export Authorisations (EU GEAs)
- Clarifications around technical assistance
- Internal Compliance Programmes (ICPs)
We discuss these below before suggesting some key points that businesses need to consider.
New and expanded catch-all controls: human rights and cybersecurity
Cyber-surveillance items have tended to be subject to stricter controls, supported by enhanced co-ordination between member states. An effective common system of export controls on dual-use items is necessary to ensure that member states, and the Union as a whole, comply with international commitments and responsibilities – particularly those regarding regional peace, security and stability, and respect for human rights and international humanitarian law.
As well as complying with direct controls on cyber-surveillance items, the Recast requires member states to tackle the risk that items will be used in connection with internal repression or serious violations of human rights and international humanitarian law.
This is done through a catch-all clause that enables states to require the authorisation of cyber-surveillance items not controlled under Annex I. This clause kicks in where items may be intended for use in connection with the repression or violations of human rights or humanitarian law.
The original regulation aimed to create “a Community regime for the control of exports, transfer, brokering and transit of dual-use items.” Dual-use items were defined as “items, including software and technology, which can be used for both civil and military purposes.”
This change puts the onus onto each business to ensure due diligence and transaction screening practices are fit for purpose.
Information exchange and greater cooperation on enforcement between member states
In the past, member states have had considerable autonomy regarding export controls and licensing, which has caused divergence. The Recast addresses this challenge with provisions to support information exchange and cooperation on enforcement between member states. This will be achieved through the creation of an Enforcement Coordination Mechanism managed by the existing Dual-Use Coordination Group.
This will make it easier for exporters to be aware of and observe measures from other member states, and they will have an obligation to do so. Businesses can more easily monitor relevant dual-use items and implement the necessary Internal Compliance Programmes.
Changes in licensing architecture – two new EU GEAs
The Recast includes two new EU GEAs.
GEA EU007 for intra-group software & technology authorises exports to 16 named countries and has specific conditions relating to parent/associate companies and where they are domiciled. Exporters need to understand the significance of the intercompany relationships and what they mean for the terms of the licence.
GEA EU008 authorises the export of encryption items to all destinations except approximately 30 named countries and those already covered under the earlier GEA EU001.
Sanctioned/embargoed countries are also excluded.
Clarifications around technical assistance
Technical assistance is defined as “technical support related to repairs, development, manufacture, assembly, testing, maintenance, or any other technical service”2 and includes most forms of training and consultancy. The provision of such assistance for dual-use items has often proved challenging due to difficulty of identifying which services meet the definition of technical assistance. The Recast aims to provide clarity so that businesses can ensure the correct controls and procedures are in place.
There are exceptions to this technical assistance rule. These include any activity normally covered by GEA EU001, as well as the usual exceptions for dual-use technology in the General Technology Note, such as the provision of public domain information, basic scientific research, and “minimum necessary” technology for the installation, operation, maintenance and repair of items exported under a licence.
The Recast places a focus on the knowledge, or even the suspicion, that the intended use of goods is for prohibited military purposes or those relating to weapons of mass destruction (WMD). Member states can extend controls to technical assistance related to non-listed dual-use goods and technology.
Internal Compliance Programmes (ICPs)
The earlier regulation, Council Regulation (EC) No 428/2009, included non-binding guidance on the core elements of ICPs. Similar guidance has been offered by a range of global regulators over the past decade.
Certain member states have already developed their own frameworks based on the core elements, for example BAFA in Germany, MFA/CDIU (Netherlands) and ECJU (UK).
The Recast brings due diligence into the transaction screening element. In addition to screening end-users, there is now an expectation that business partners and intermediaries will be screened. The aim is to ensure that each business knows its partners, especially from the human rights and human security perspectives.
Notable points about the requirements for an effective ICP include the need for:
- Recurring and appropriate risk assessments
- Performance reviews, audits, reporting and corrective actions
- Physical and information security
The Recast does not provide a general obligation to implement an ICP, and it is left to member states to define ICP criteria in relation to the management of export licences. However, leading practice is to review a business’s ICP against the requirements of the EU and any countries where it is active.
Key takeaways
At this point, there is no clear indication that the UK Government may consider a similar revision of its own export control rules. However, businesses located within or outside of the EU, engaged in trading dual-use items are advised to take note of the changes and to assess any implications and benefits for their organisations.
- Evaluate the end-to-end supply chain to identify all dual-use items, and then determine the impact of the Recast on each item.
- Keep on top of regulatory updates (including future updates from member states, as well as this Recast) and the potential divergence and extension of national control lists.
- Maintain an effective ICP that is correctly sized for your business and takes account of the compliance landscape in jurisdictions where you operate.
- Ensure a clear understanding of how the new GEAs apply to the business, and how to meet any relevant conditions.
- Remember that regulators expect due diligence, knowledge of business partners and transparency in transactions, and that these expectations will evolve in line with everchanging sanctions and trade restrictions.
1 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021R0821
2 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021R0821
Read the WTS Global Customs Newsletter here.
