ITAR Compliance for Aerospace Precision Manufacturers

Last updated: August 26, 2026

Key Compliance Takeaways for Precision Manufacturers

• ITAR compliance applies to any U.S. manufacturer that produces defense articles on the USML, even when no exports occur.
• Every aerospace component requires a documented USML classification before production, with penalties that can exceed $1 million per violation.
• DDTC registration, Empowered Official designation and an active Technology Control Plan must be in place before controlled data or hardware moves.
• Supply-chain flow-down obligations reach every sub-tier supplier, including CMMC 2.0 self-assessments and annual SPRS affirmations for FCI or CUI.
• Precision Advanced Manufacturing operates as a single-source, ITAR-registered, AS9100D-certified partner that removes multiple compliance handoffs and integrates controlled processes from program kickoff.

USML Classification Steps for Aerospace Components

Every aerospace machined component needs a defensible classification before production begins. The USML (22 CFR 121.1) is reviewed first, and the Commerce Control List (CCL) is reviewed only when the item is not described there.

The seven-step classification path is:

1. Identify the item’s technical specifications, design intent and end-use application.
2. Search all 21 USML categories for an enumerated match, with close attention to catch-all paragraphs (x) that capture parts specially designed for a listed defense article.
3. Apply the 22 CFR 120.41 “specially designed” analysis and determine whether the item has properties responsible for controlled military performance.
4. Check whether a release provision removes the item from USML coverage after an initial match.
5. If no USML match exists, review the CCL for a 600-series ECCN such as 9A610 for military aircraft and components, and confirm that USML residual jurisdiction is clear before assigning an ECCN.
6. Assign EAR99 only when the item matches no USML paragraph and no specific CCL entry.
7. Document item identity, applicable USML category and paragraph, specially designed reasoning, conclusion, date and reviewer, and review classifications against updated USML category text.

These seven steps create the framework for consistent decisions, and real production examples reveal where errors occur. A machined bracket or wiring harness that is specially designed for a USML-listed system becomes a defense article subject to ITAR, even when it resembles commercial hardware. CAD files and manufacturing packets for such parts are technical data controlled under ITAR, and emailing a controlled drawing to a foreign person counts as an export even when no hardware ships. Precision Advanced Manufacturing manages this risk through encrypted CAD-file transfer protocols and a formal Technology Control Plan that limits access to ITAR-controlled data to U.S. persons.

When self-classification cannot resolve USML versus EAR jurisdiction, a Commodity Jurisdiction (CJ) determination under 22 CFR 120.4 submitted to DDTC on Form DS-4076 provides a legally binding result.

Mandatory DDTC Registration Workflow for Manufacturers

Under 22 CFR 122.1, any U.S. entity that manufactures, exports or brokers defense articles must register with DDTC before that activity begins, including subcontractors that manufacture USML items but never export directly.

The registration workflow proceeds as follows:

1. Confirm USML applicability across all product lines.
2. Designate at least one Empowered Official under 22 CFR 120.67, a U.S. person directly employed by the company with authority to sign export license applications and personal legal responsibility for DDTC submissions.
3. Create a DECCS portal account and prepare Form DS-2032, including ownership structure, foreign ownership, control or influence disclosures and applicable USML categories.
4. Assemble required documentation such as articles of incorporation, an Empowered Official designation letter signed by the CEO, an officer and director citizenship list, an organizational chart showing compliance reporting lines and any prior violation disclosures.
5. Submit DS-2032 and pay the registration fee. Fees effective Jan. 9, 2025 are $3,000 per year for Tier 1 registrants, with some small businesses qualifying for a reduced rate.
6. Await DDTC review. Processing typically takes 30 to 60 days for a complete application, and FOCI disclosures can extend the timeline.
7. Receive the registration code and include it on all export documents and license applications.
8. Renew annually through DECCS, submitting no earlier than 60 days and no later than 30 days before expiration, and file amendments for material changes within five business days under 22 CFR 122.4.

Companies with foreign investors, foreign parent entities or foreign board members disclose FOCI relationships on DS-2032, which can trigger additional DDTC review or mitigation steps.

Working with an ITAR-registered partner reduces registration risk at the sub-tier level. Connect with the Precision Advanced Manufacturing compliance team to map how ITAR-registered, AS9100D-certified processes fit into existing program structures without adding sub-tier registration gaps.

Common ITAR Violations and Targeted Prevention Actions

The U.S. Department of State has assessed about $821 million in ITAR civil penalties since 2000. Recent enforcement actions highlight patterns that affect precision manufacturers.

In April 2026, GE Aerospace agreed to a $36 million civil penalty to settle 116 ITAR violations spanning April 2018 through November 2024. Of those, 103 charges involved mismanagement of DDTC authorizations, including unauthorized retransfers and proviso violations. Three violations involved unauthorized exports of technical data to China, including an employee hand-carrying a laptop that contained F-35 and F414 engine design data. GE Aerospace identified outdated authorization management SOPs as a root cause.

The scale of enforcement can grow when violations are systemic and involve failure to disclose. The 2024 RTX Corporation settlement, the largest ITAR enforcement outcome in history at $200 million, involved unauthorized exports of defense articles and technical data, failure to disclose known violations and broad compliance program deficiencies.

Across more than 200 client engagements, the most common root cause of ITAR violations is misclassification. Many organizations assume a part is commercial when it qualifies as a defense article under the USML. Other recurring patterns include deemed exports to foreign-national employees, manufacturing without DDTC registration, recordkeeping failures, unauthorized retransfers and proviso breaches.

A prevention checklist for precision manufacturers addresses these patterns directly. To prevent misclassification, maintain a written USML classification record for every part number, updated after any design change or post-September 2025 USML category revision. To avoid registration lapses, verify that DDTC registration is active and current before accepting any new defense contract or purchase order. To prevent deemed exports, restrict access to ITAR-controlled CAD files, drawings and manufacturing packets to U.S. persons and document all access in the Technology Control Plan.

• Train machinists, programmers and shipping staff on deemed export rules before foreign nationals access controlled technical data.
• Update authorization management SOPs at least annually and after organizational changes.
• Notify DDTC within five business days of material changes to company name, ownership or control structure.
• Retain export documents, licenses and shipping records for at least five years.
• Submit voluntary self-disclosures promptly when potential violations surface, since DDTC credits cooperation in penalty decisions.

ITAR and EAR Boundaries for Commercial Aerospace Work

The jurisdictional boundary between ITAR and EAR is the most consequential classification decision for a precision manufacturer. ITAR, administered by the State Department’s DDTC, controls defense articles, technical data and defense services, while EAR, administered by the Commerce Department’s Bureau of Industry and Security, controls dual-use items and less sensitive technology.

Design intent and military performance significance drive the decision, not appearance. A machined bracket that is specially designed for an F-35 panel is ITAR-controlled under the USML Category VIII catch-all paragraph (x), while a geometrically identical bracket for a commercial aircraft is EAR-controlled or EAR99. Spare parts take on the classification of the system they support, so the same bearing sold for commercial use is EAR-controlled, and the same bearing sold as a spare for a military system on the USML is ITAR-controlled.

The 600-series ECCNs on the CCL, such as 9A610 for military aircraft and components, represent items that migrated from the USML under Export Control Reform. Before assigning a 600-series ECCN, manufacturers confirm through USML residual jurisdiction analysis that the item does not fall within a retained USML catch-all provision. Parts and components have independent classification status, and the end item’s ECCN does not automatically determine the component’s classification.

A machine shop that produces standard fasteners and brackets not specifically designed for defense articles classifies those items as EAR99. When a defense contractor shares technical data about integrating those components into a classified system and foreign engineers need access to that data, ITAR compliance obligations arise even when no USML-listed hardware is in production.

When jurisdiction cannot be resolved through self-classification, a CJ determination from DDTC or a classification request to BIS provides a binding result.

Supply-Chain Flow-Down and Sub-Tier Vetting

ITAR compliance obligations extend beyond the prime contractor. Every sub-tier supplier that manufactures, handles or receives technical data related to a defense article inherits the same obligations. Separately, under 32 CFR Part 170 and DFARS 252.204-7021, effective Nov. 10, 2025, prime contractors must flow CMMC requirements down to every subcontractor at any tier whose systems process, store or transmit FCI or CUI, excluding COTS-only subcontracts.

The CMMC 2.0 final program rule at 32 CFR Part 170 took effect Dec. 16, 2024, with DFARS clauses 252.204-7021 and 252.204-7025 enabling insertion of CMMC requirements into solicitations starting Nov. 10, 2025. Phase 1 beginning Nov. 10, 2025 primarily requires Level 1 and Level 2 self-assessments. On July 13, 2026, DoD suspended third-party C3PAO audit requirements for Phase 2 and launched a 60-day review, and Phase 1 self-assessment requirements remain fully in effect during the review period. Suppliers confirm current requirements directly with prime contractors, and primes such as Boeing, Lockheed Martin and Raytheon have enforced independent supply-chain deadlines separate from the DoD rollout.

A practical sub-tier vetting template follows a clear sequence. First, establish regulatory compliance by confirming DDTC registration status and registration code before sharing any ITAR-controlled technical data or hardware, then verifying CMMC status in SPRS at the required level, Level 1 for FCI and Level 2 for CUI, before awarding any purchase order or subcontract. Second, validate quality systems by confirming AS9100D or equivalent quality management certification and requesting current certificate copies.

• Include DFARS 252.204-7012 flow-down language in all subcontracts where CUI will be shared and require 72-hour cyber incident reporting.
• Require annual SPRS affirmations of continuous CMMC compliance from all sub-tier suppliers that handle CUI.
• Restrict CUI sharing to suppliers with verified CMMC status at the required level, since primes cannot pass FCI or CUI to subcontractors that lack the required CMMC level.
• For suppliers that handle export-controlled CUI, verify that cloud services meet FedRAMP Moderate equivalency or use U.S.-sovereign cloud environments such as Microsoft 365 GCC High or AWS GovCloud.

Scaling Prototype-to-Production Under ITAR Controls

Movement from a prototype build to full-rate production under ITAR introduces compliance risk that grows with each new supplier. Every new sub-tier relationship requires DDTC registration verification, USML classification confirmation and CMMC flow-down before controlled data or hardware transfers.

Precision Advanced Manufacturing reduces those handoff risks by consolidating advanced multi-axis CNC machining, precision sheet-metal fabrication, specialty welding with thermal distortion control, kitting and secondary finishing, including anodizing, passivation and plating, under one AS9100D, ISO 9001 and ITAR-registered roof in California and Texas. A single DDTC-registered supplier relationship replaces multiple sub-tier vetting exercises, and classification records, Technology Control Plans and quality documentation remain with the part through every production stage inside a controlled environment.

The same quality checkpoints validated during prototype runs govern full-rate production. Multi-shift capacity supports program ramp without supplier changes and preserves the traceability chain that procurement, program and supplier quality teams depend on for audits and milestone reviews.

Precision Advanced Manufacturing’s in-house CNC programming and engineering support teams apply manufacturability analysis at the start of each program, which reduces design iterations that can trigger reclassification reviews during production. Parts arrive fully finished and ready to integrate, which removes secondary work that would otherwise require additional ITAR-registered vendor relationships.

Defense and aerospace programs with tight timelines benefit from a single source of record for compliance documentation. Start a prototype-to-production conversation with the Precision Advanced Manufacturing engineering team to explore how consolidated capabilities reduce compliance handoffs during program ramp.

How Precision Advanced Manufacturing Supports Compliance Stakeholders

Procurement and sourcing managers face program delays when suppliers lack current DDTC registration or cannot show CMMC compliance before purchase order award. Precision Advanced Manufacturing maintains active ITAR registration and AS9100D certification with full documentation available for supplier qualification packages, which reduces the audit burden on procurement teams and closes the registration gap that component makers deep in the supply chain often miss.

Program managers face schedule risk when out-of-spec parts arrive that require rework or when integration is delayed because finishing operations were sourced separately. Precision Advanced Manufacturing delivers fully finished, ready-to-integrate components with complete inspection and material certification documentation, which protects milestone dates and reduces cost exposure from rework and expedited orders.

Supplier quality engineers face increased inspection workload when supplier quality systems do not align with AS9100D requirements or when traceability records are incomplete. Precision Advanced Manufacturing’s certified quality management system includes defined inspection checkpoints, in-process and final inspection records and material certifications for every production run. Complete documentation packages reduce the verification burden on customer quality teams and support first-article and source inspection requirements without extra coordination.

Next Steps for Program and Compliance Teams

Precision Advanced Manufacturing operates as a single-source, ITAR-registered, AS9100D-certified partner for aerospace and defense programs that require precision machined and fabricated metal components. Procurement, program and supplier quality teams can engage directly to discuss USML classification support, compliance documentation requirements, prototype builds and full-rate production capacity. Request a quote to begin a tailored compliance and manufacturability review for the next program.

Frequently Asked Questions

Does a machine shop that never exports ITAR-controlled parts still need to register with DDTC?

Yes. Under 22 CFR 122.1, any U.S. entity that manufactures defense articles on the USML must register with DDTC before that activity begins, regardless of export activity. A single occasion of manufacturing a USML-listed item triggers the registration requirement. Failure to register counts as an ITAR violation with civil penalties per occurrence, potential criminal penalties and possible debarment from defense trade activities. Precision Advanced Manufacturing maintains active DDTC registration, so customers that source from Precision avoid a registration gap at the sub-tier level.

What is the difference between ITAR-controlled technical data and EAR-controlled technical data for aerospace machined components?

ITAR-controlled technical data includes information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of a defense article on the USML. EAR-controlled technical data relates to dual-use items on the Commerce Control List. Design intent creates the key distinction. A CAD file or manufacturing packet for a component specially designed for a USML-listed military system is ITAR-controlled, while the same type of file for a commercially developed component with no military-specific design features can be EAR-controlled or EAR99. Sharing ITAR-controlled technical data with a foreign person, including a foreign national employee, constitutes a deemed export that requires authorization even when no hardware ships. Precision Advanced Manufacturing’s Technology Control Plan limits access to ITAR-controlled data to U.S. persons.

How does CMMC 2.0 affect aerospace parts manufacturers that are sub-tier suppliers to defense primes?

Sub-tier aerospace suppliers that process, store or transmit Federal Contract Information or Controlled Unclassified Information on unclassified contractor systems fall under CMMC requirements flowed down from the prime contractor under DFARS 252.204-7021 and 32 CFR 170.23. During Phase 1, from Nov. 10, 2025 through Nov. 9, 2026, Level 1 and Level 2 self-assessments form the primary requirement, with scores posted in SPRS and annual affirmations of continuous compliance. The DoD suspended third-party C3PAO audit requirements for Phase 2 in July 2026 pending a program review, and Phase 1 obligations remain in effect. Major primes including Boeing, Lockheed Martin and Raytheon have enforced independent supply-chain deadlines separate from the DoD rollout, so sub-tier suppliers confirm current requirements directly with the prime. Engineering drawings, models, specifications and process sheets often qualify as CUI once marked or contractually identified under DFARS 252.204-7012, which makes Level 2 the practical baseline for most aerospace machining work on defense contracts.

What documentation should procurement teams request from an ITAR-registered precision machining supplier?

Procurement teams that source ITAR-controlled components request the supplier’s current DDTC registration code and registration expiration date, AS9100D and ISO 9001 certification numbers with scope and expiration, a current SPRS self-assessment score and affirmation date for CMMC compliance, a summary of the Technology Control Plan that confirms U.S.-person-only access to controlled technical data, material certifications and traceability records for the specific alloys and processes involved, and first-article inspection reports or capability data relevant to the part family. Precision Advanced Manufacturing provides complete documentation packages with every production run, including inspection reports and material certifications aligned to AS9100D requirements, which reduces the verification workload for procurement and supplier quality teams.

Can a single supplier handle ITAR-controlled CNC machining, welding, sheet-metal fabrication and finishing without creating additional compliance handoffs?

Yes, when the supplier is ITAR-registered and maintains all capabilities under one quality management system. Each time a defense article or its associated technical data moves to a new supplier for a secondary operation such as welding, finishing or plating, that transfer requires verification of the receiving supplier’s DDTC registration and CMMC status, which creates additional compliance touchpoints and traceability gaps. Consolidating machining, fabrication, specialty welding, kitting and secondary finishing under one ITAR-registered, AS9100D-certified facility removes those inter-supplier transfers. Precision Advanced Manufacturing integrates these capabilities at its California and Texas facilities and maintains a single chain of custody for controlled hardware and technical data from raw material through finished, ready-to-integrate components.