Selling Software Overseas? Export Control Issues US Tech Startups Should Check

When we think of exporters, we often picture businesses packing products into boxes and shipping them overseas. But exporting isn't limited to physical goods. Certain software, technology and technical information can also be subject to US export controls.

If you run a SaaS or technology business, this can matter when you make your product available to customers overseas, share technology with international partners or give team members in other countries access to certain technical information.

That doesn't mean every software business needs an export license before it can operate internationally. However, if you're planning to make your technology available outside the US, it helps to understand what you're providing, where it's going, who will have access to it and what it may be used for.

In this article, we'll look at some of the first export control issues US tech founders should consider before expanding internationally.

Do Export Controls Apply To Software And SaaS Businesses?

They can.

US export controls don't only apply to physical products. The Export Administration Regulations (EAR), administered by the Bureau of Industry and Security (BIS), can also apply to software and technology.

For a technology business, that means an export doesn't necessarily involve putting something on a plane or ship. Depending on what is being provided and how it is accessed, electronically transmitting software or releasing controlled technology to someone outside the US can also fall within the export rules.

A useful place to start is with four questions:

What are you providing? Where is it going? Who is receiving it? What will it be used for?

Those questions won't give you every answer, but they can quickly show whether your product or international expansion plans need a closer look.

Do These Rules Still Apply If Customers Access Your Software Online?

Potentially.

Delivering software through the cloud does not automatically take it outside US export controls. Depending on the software involved and how access is provided, electronic transmission or access can still fall within the EAR.

So, the fact that your customers simply log in through a browser does not answer the export-control question by itself.

You still need to look at the technology being provided and where, to whom and for what purpose it is being made available.

What Does Your Product Actually Do?

The next step is understanding how US export rules categorise your product.

Some software and technology is specifically listed on the Commerce Control List (CCL) and assigned an Export Control Classification Number (ECCN).

Other products may be subject to the EAR but not specifically listed on the CCL. These are commonly referred to as EAR99.

Neither label gives you the whole answer.

A product with an ECCN does not automatically require an export license every time it is provided overseas. Equally, a product classified as EAR99 is not automatically free from restrictions. The destination, customer and intended use can still matter.

For founders, the practical question is whether there is anything about what your technology does that warrants a closer review.

That can become particularly relevant for businesses working with areas such as cybersecurity, advanced computing, semiconductors, aerospace, defence-related technology or certain advanced AI applications.

A standard scheduling platform and software designed for sensitive military communications, for example, are likely to require very different export-control reviews.

Does Your Software Use Encryption?

Most modern SaaS products use encryption somewhere.

Your platform may use it to protect passwords, customer information, communications or data while it is being stored or transferred.

Encryption being present does not, by itself, mean the business needs an export license. However, US export rules contain specific provisions for certain encryption software, technology and products.

Some encryption products can also qualify for particular treatment under the EAR, including rules covering certain mass-market products. Depending on the software, classification, review or reporting requirements may need to be considered.

The important distinction is often between a SaaS platform that uses encryption as part of its everyday security and a business whose product itself provides sophisticated cryptographic, cybersecurity or information-security capabilities.

If encryption is an important part of what your technology actually does, it can be worth checking how the product is classified before making it widely available overseas.

Where Are You Making The Product Available?

For a SaaS business, international expansion can sometimes happen without a deliberate international launch.

You might build a platform for US customers and discover months later that people are signing up from several different countries.

That ease of access is part of what makes SaaS scalable, but it also means founders should understand where their technology is actually being made available.

Some destinations are subject to tighter US export restrictions than others, and the requirements can also depend on the technology involved.

If customers can register from almost anywhere, it can therefore be worth checking whether you've actually considered the countries your business is serving.

Depending on the product and its risk profile, that could mean considering additional customer checks, account restrictions or location controls for particular markets.

The issue may not end with the first customer either. If controlled technology is later passed on to another country, reseller or user, US export rules can continue to matter.

If your business licenses software to customers or commercial partners, your Software License Agreement can also be important in setting out who can use the software, whether access can be transferred and how the product may be used.

Who Are You Dealing With?

Where the customer is located is only one part of the review.

A person or business may be subject to US restrictions even if they are based somewhere your company would normally be able to sell.

BIS and other US agencies maintain lists of people, organisations and addresses that are subject to different trade restrictions. The consequences vary depending on the list and the transaction, so this isn't simply one universal list of businesses you cannot deal with.

This is where restricted-party screening may become relevant.

In simple terms, screening means checking the people or organisations involved in a transaction against relevant government lists and considering whether any restrictions apply.

It is also important not to treat a clean search result as the end of the process where something else looks unusual. BIS guidance identifies a range of red flags that can require businesses to ask further questions about a customer or transaction.

For example, a request for highly specialised technology from a company that won't clearly explain what it does may deserve more attention than an ordinary commercial signup.

What Will The Technology Be Used For?

The next question is what the customer actually plans to do with the technology.

The EAR contains restrictions relating to certain end uses, including some military, weapons-related and other sensitive activities.

These rules matter because an otherwise ordinary classification or destination does not always end the analysis. End-use restrictions can apply even to EAR99 items in some circumstances.

For example, providing specialised imaging software for an ordinary commercial purpose can raise very different issues from supplying the same technology for a restricted military application.

For many SaaS companies, this won't be something that comes up during everyday customer signups.

However, if your business works in a sensitive industry, receives an unusual request or is asked to customise technology for a specific purpose, it can be important to understand what the customer actually plans to do with it.

What About Overseas Developers, Contractors And Team Members?

Customers aren't the only people who may get access to your technology.

Startups frequently work across borders. You may have developers in another country, use an overseas engineering agency or give international contractors access to source code and technical documentation.

The relevant question is what those people can actually access.

If the underlying technology or source code is controlled, making it available to someone overseas can raise export-control issues even where there is no customer transaction involved.

This is also a good reason to make sure your arrangements with external developers clearly deal with things such as access to source code, confidentiality, intellectual property and how sensitive technical information will be handled. A properly drafted Software Development Agreement can help set those expectations from the beginning.

There is another rule that can surprise startups too.

In some circumstances, releasing controlled technology or source code to a foreign person while they are in the US can be treated as an export under the EAR. This is commonly referred to as a deemed export.

Whether a license is required depends on the technology involved and the particular person and circumstances, so employing or working with a foreign person does not by itself answer the question.

For founders, the practical starting point remains the same: understand what technology the person will actually be able to access.

Export Controls And Sanctions: What's The Difference?

Export controls and sanctions often come up together, but they're not the same thing.

Export controls generally deal with whether particular products, software or technology can be exported, reexported or transferred, including restrictions based on destination, end user and end use.

US sanctions, administered primarily by the Office of Foreign Assets Control (OFAC), can restrict dealings with particular countries, regions, organisations and individuals more broadly.

There isn't one simple list of countries that US businesses can or cannot deal with. Some sanctions programs are geographically focused, while others target particular people, businesses or activities.

This means a SaaS business selling internationally may need to consider both systems. Working out how your software is classified does not necessarily answer whether you can deal with a particular customer.

What If A Customer Or Investor Asks About Export Compliance?

Sometimes a startup first encounters export controls because somebody else raises them.

An enterprise customer may send you an agreement containing export-control clauses. A government contractor may ask how your technology is classified. An investor or potential buyer carrying out due diligence may ask how the business manages export and sanctions compliance.

These requests matter because contracts can ask the company to make quite broad promises.

For example, you may be asked to warrant that your technology won't be provided to restricted users, exported to prohibited destinations or used for certain restricted purposes.

Before agreeing, it is worth considering whether those promises reflect what your business can actually control.

If your product is licensed to customers, your Software License Agreement may also need to deal with restrictions on access, transfers or permitted use. More broadly, having an important commercial contract reviewed can help identify export-control warranties or compliance obligations before they become contractual promises your business is expected to meet.

What Happens If You Get It Wrong?

Export-control issues can be easier to deal with before technology has been made widely available.

If a business later discovers that controlled technology may have been provided to a restricted customer, destination or end use, simply switching off an account may not resolve everything that has already happened.

Depending on the circumstances, the business may need to investigate the transaction, stop further access and work out whether additional remedial steps are appropriate.

That doesn't mean startups should approach every international customer as a major compliance risk. It does mean that identifying higher-risk products, customers and markets earlier can be much easier than trying to unwind the issue later.

What Should You Check Before Expanding Overseas?

Export-control law can become technical quickly, but a founder's first review does not need to start with hundreds of pages of regulations.

Start with the business itself.

What does the product do? How is it classified? Where will it be available? Who will receive it? What will they use it for? And who else will have access to the underlying technology?

Those questions can help you identify whether international expansion looks relatively straightforward or whether something deserves a closer review.

A US company selling standard workflow software to commercial customers in Canada and the UK, for example, may face a very different set of questions from a cybersecurity startup providing advanced technology to government contractors and technical teams across several countries.

The point isn't that one can sell internationally and the other cannot. It's that their export-control risks and the checks they need to make may be very different.

When Should A Startup Get Legal Advice?

You don't necessarily need an export-control review every time somebody overseas signs up to your platform.

However, additional advice can be useful if your product involves sensitive or highly technical functionality, you're unsure how the technology is classified, significant encryption functionality is involved, customers are in higher-risk markets or overseas personnel need access to controlled technology.

The same applies if you're moving into government or defence supply chains, or export compliance starts appearing in an important customer, investment or acquisition process.

Export-control classification itself can become highly specialised, so in some cases specialist trade or export-control advice may be appropriate.

There may also be more familiar commercial issues sitting alongside it. If you're entering into a Software License Agreement, engaging an overseas development team under a Software Development Agreement, or being asked to give broad export-compliance warranties in a customer contract, getting the agreement reviewed can help make sure the legal promises you make reflect how the business actually operates.

Key Takeaways

Selling software overseas doesn't automatically mean your business needs an export license. But "we only sell software" isn't enough to assume export controls don't apply.

Before making US technology available internationally, understand what you're providing, how it is classified, where it is going, who can access it and what it will be used for.

If the product, customer, destination or intended use raises more complicated questions, looking into them before the technology is widely available can make international expansion much easier to manage. If you would like help with this, you can reach us at (888) 449-8437 or team@sprintlaw.com for a free, no-obligations chat.