ITAR Registration for Aerospace Composite Manufacturers

Last updated: July 24, 2026

Key Takeaways for ITAR-Registered Composite Programs

• Any U.S. manufacturer that produces or handles USML-controlled defense articles must register with DDTC under 22 CFR Part 122, even without exporting.

• ITAR compliance rests on three core actions: DDTC registration, controlled access to technical data, and auditable recordkeeping for at least five years.

• Composite manufacturers must correctly classify structures under USML Category VIII or XII to avoid misclassification penalties up to $500,000 per violation.

• ITAR obligations attach during lay-up, curing and machining stages, and extend to metal hardware suppliers and raw-material vendors in the supply chain.

• Precision Advanced Manufacturing provides a single-source, ITAR-registered solution for composite OEMs that need compliant metal hardware and tooling, helping consolidate the supply chain under one certified partner.

Three Core Actions for ITAR Compliance

ITAR compliance rests on three foundational actions: register with DDTC, control access to USML-controlled technical data and hardware, and maintain auditable records. Each action maps to a specific regulatory obligation under 22 CFR Parts 120-130. The seven-step registration sequence below operationalizes the first action.

1. Confirm USML scope. Conduct a documented item-level analysis for every product and service against 22 CFR 121.1 to determine which USML categories apply.

2. Designate an Empowered Official. Appoint a U.S. person in a management or policy-level position with independent authority to halt noncompliant transactions. DDTC requires at least one Empowered Official per registrant, and that individual must be reachable and accountable.

3. Set up a DECCS account. Create a DECCS organizational account using the company’s exact legal name, physical address, EIN and SAM.gov UEI as they appear in corporate documents.

4. Submit Form DS-2032. Select “New Registration” in the DDTC Registration module and complete DS-2032. Capture applicable USML categories, Empowered Officials and any foreign ownership, control or influence disclosures for persons owning 10% or more.

5. Pay the registration fee. Process payment through DECCS at submission. See the 2026 fee table in the section below.

6. DDTC review. DDTC processes new registrations after submission and payment confirmation.

7. Receive registration letter and M-code. The approved Registration Code must appear on all export license applications. Retain the registration letter as a compliance record.

Annual renewal functions as the eighth recurring obligation. The renewal window opens 90 days before expiration, and submissions are permitted no earlier than 60 days before expiration. Lapses carry no grace period.

USML Category VIII vs XII Decision Path for Composite Structures

Misclassification between USML Category VIII and Category XII ranks among the most common compliance errors for composite manufacturers. The classification analysis starts with the relevant category text, applies the “specially designed” definition at 22 CFR 120.41 including its release provisions, and considers design intent and performance criteria rather than commercial sourcing or appearance.

USML Category VIII covers aircraft and associated equipment, while Category XII covers fire control, range finder, optical and guidance and control equipment, per 22 CFR 121.1. The functional analysis follows this sequence:

1. Determine whether the composite article is explicitly enumerated on the USML. If yes, the item is ITAR-controlled under the enumerated category.

2. If not explicitly enumerated, assess whether it is “specially designed” for a USML-listed defense article under 22 CFR 121(b) and 22 CFR 121(d).

3. If the article is a primary structural component for a military aircraft, helicopter or military UAV, classify it under Category VIII as defined in 22 CFR 121.1 Category VIII.

4. If the article is specially designed for optical, targeting, imaging, guidance or inertial navigation subsystems, classify it under Category XII per the functional analysis required by 22 CFR 121.1 and 22 CFR 120.41.

5. If jurisdiction remains unclear after this analysis, submit a commodity jurisdiction request to DDTC before production begins.

A composite airframe skin panel for a military rotorcraft falls under Category VIII. A carbon-fiber housing for a missile guidance unit with integrated inertial sensors falls under Category XII. Both require DDTC registration and full ITAR controls. ITAR-controlled items take precedence over EAR controls, and only items not enumerated or specially designed under the USML are reviewed against the Commerce Control List.

2026 DDTC Registration Fees and DECCS Workflow

Effective Jan. 9, 2025, DDTC registration fees are tiered based on application activity in the prior registration period. The table below reflects 2026 fee guidance from tglobeconsultants.com and legalclarity.org.

Payment is submitted through DECCS at the time of DS-2032 submission. Annual renewal does not operate as automatic continuation, and DDTC uses the renewal review to flag misaligned commodity categories or unnotified changes in the designated Empowered Official. Composite manufacturers benefit from auditing the USML category list before each renewal cycle.

Composite Manufacturing Stages That Trigger ITAR Controls

ITAR obligations attach at the point where a manufacturing process produces or modifies a USML-controlled article or generates controlled technical data. For composite manufacturers, three process stages carry the highest trigger risk.

Lay-up operations that position carbon-fiber plies according to controlled ply-orientation schedules constitute the production of a defense article when the resulting structure is USML-enumerated, and the ply schedule itself becomes ITAR-controlled technical data at that point. The compliance obligation continues through curing operations, where specific temperature, pressure and time profiles needed to achieve militarily significant structural properties generate additional controlled process specifications. Machining and trimming of cured composite structures to final tolerances complete the production sequence, and when these operations rely on controlled drawings, they remain within ITAR scope throughout.

Metal hardware that interfaces with composite airframe structures, including brackets, fittings, fastener inserts, tooling fixtures and secondary structural members, falls under the same USML controls when specially designed for the controlled composite article. Precision Advanced Manufacturing operates multi-axis CNC machining, precision sheet-metal fabrication, specialty welding and secondary finishing capabilities under ITAR-registered, AS9100D-certified quality systems. Composite OEMs can consolidate metal-hardware and tooling procurement under one compliant source rather than fragmenting the supply chain across multiple vendors. Evaluating Precision Advanced Manufacturing’s integrated capabilities helps align program requirements with a single ITAR-registered partner.

Beyond controlling the production environment and supply chain, composite manufacturers must also manage who accesses controlled technical data. The next section addresses foreign-national handling and TAA requirements.

Foreign-National Access and TAA Planning

Under 22 CFR 120.62, lawful permanent residents qualify as U.S. persons for ITAR purposes and may access ITAR-controlled technical data without a separate export license.

Foreign nationals holding temporary visas such as H-1B, L-1, O-1, TN or F-1 remain non-U.S. persons under ITAR regardless of years lived in the United States and require a DDTC authorization, typically a Technical Assistance Agreement or Manufacturing License Agreement, before accessing ITAR-controlled technical data.

Under 22 CFR 120.17, the release of technical data to a foreign national inside the United States constitutes a deemed export that triggers the same licensing analysis as a physical shipment overseas. A composite engineer sharing a controlled ply schedule in a team meeting, a CAD file on a shared server or a verbal briefing on cure parameters creates an export event if a non-U.S. person is present without authorization.

TAA example: A composite OEM employs an H-1B structural analyst who needs access to Category VIII airframe drawings. The company must obtain a TAA from DDTC authorizing that access before the analyst reviews any controlled file. The TAA approval process requires significant lead time. Careful planning helps avoid program delays.

Noncompliance with ITAR employee access rules can carry civil fines up to $500,000 per violation, criminal fines up to $1 million and up to 10 years of imprisonment per violation.

Vetting Carbon-Fiber and Resin Suppliers for ITAR Compliance

ITAR obligations extend to raw-material and subcomponent suppliers when those vendors handle controlled technical data or produce articles that become part of a USML-listed defense article. Composite OEMs remain responsible for the compliance posture of their supply chain. The following vetting steps apply to carbon-fiber, resin, prepreg and tooling material vendors.

• Confirm whether the supplier’s products are USML-controlled or EAR-controlled before onboarding.

• Verify that the supplier holds a current DDTC registration if it manufactures or exports USML-controlled materials or articles.

• Obtain and retain copies of the supplier’s DDTC registration letter, AS9100D or equivalent quality certification and material certifications for each lot.

• Assess the supplier’s foreign ownership, control or influence status and confirm disclosure in the supplier’s DDTC registration.

• Confirm that the supplier maintains a Technology Control Plan governing access to any controlled technical data shared during the procurement relationship.

• Establish flow-down clauses in purchase orders that require the supplier to notify the OEM of any change in DDTC registration status, ownership or Empowered Official within 30 days.

• Conduct annual supplier compliance reviews and retain documentation for the six-year recordkeeping period described below.

Six-Year Recordkeeping Checklist and Renewal Milestones

Under 22 CFR 122.5, ITAR registrants must maintain records of all controlled transactions for at least five years from the expiration of the relevant license or approval, or from the transaction date when an exemption was used. A defensible DDTC registration posture in 2026 requires records management practices sufficient to support a five-year lookback in the event of a DDTC audit. Industry best practice extends retention to six years to accommodate audit timing variability.

Six-year recordkeeping checklist for ITAR-registered composite manufacturers:

• Export licenses, TAAs, MLAs and all DDTC authorizations with approval and expiration dates

• DS-2032 submissions and DDTC registration letters for each registration year

• USML commodity-category assessment documentation, including CJ requests and determinations

• Controlled technical data inventory, including drawings, CAD files, process specifications, manufacturing instructions and ply schedules

• Foreign-national access logs, including citizenship, visa type, authorization basis, dates of access and data accessed

• Visitor logs for ITAR-controlled manufacturing areas, including arrival time, departure time, escort identity, citizenship status and purpose

• Employee ITAR training records, including new-hire orientation completion dates and annual refresher attestations

• Supplier compliance records, including registration letters, certifications and flow-down acknowledgments

• Technology Control Plan review records and annual risk assessment reports

• Shipping and export transaction records, including EEI filings and carrier documentation

Annual renewal calendar: Follow the 90-day and 60-day renewal timing described in the fees section above. Allow 30 days for DDTC processing, and update the USML category list and Empowered Official designation before submission.

Precision Advanced Manufacturing’s Role in ITAR Programs

Precision Advanced Manufacturing operates two specialized facilities in California and Texas under AS9100D, ISO 9001:2015 and ITAR-registered quality systems. Every production step, from multi-axis CNC milling and turning to precision sheet-metal fabrication, TIG and MIG welding, kitting, hardware installation and secondary finishing, takes place within a single ITAR-compliant environment.

Composite OEMs that source metal brackets, structural fittings, tooling fixtures and secondary assemblies from multiple vendors introduce compliance risk at every handoff. Precision Advanced Manufacturing consolidates those capabilities under one roof, which reduces supplier fragmentation and lowers the number of ITAR-compliance relationships a program manager must audit and maintain.

Full material traceability, complete inspection documentation and certified quality processes apply to every order. Programs transition from prototype to full-rate production without a supplier change, which preserves validated processes and quality records. For procurement managers evaluating ITAR registration requirements for aerospace composite manufacturers, Precision Advanced Manufacturing provides a single-source metal-hardware and tooling solution that satisfies ITAR controls without adding complexity. Connecting with Precision Advanced Manufacturing’s aerospace specialists helps define program requirements and produce a tailored production plan.

Frequently Asked Questions

Who must register with ITAR

Any U.S. person or entity that manufactures, exports, temporarily imports, brokers or furnishes defense services related to a defense article listed on the USML must register with DDTC under 22 CFR Part 122. This group includes composite airframe manufacturers, missile-structure fabricators, metal-hardware suppliers whose products are specially designed for USML-listed articles and companies that generate or transfer ITAR-controlled technical data such as ply schedules, cure process specifications or controlled drawings. Registration remains required even when a company never exports. Foreign ownership, control or influence must be disclosed in the registration.

Which three actions are necessary to comply with ITAR

The three foundational actions described earlier in this article, DDTC registration, access control through a Technology Control Plan and auditable recordkeeping, form the compliance baseline. Each action maps to specific regulatory obligations under 22 CFR Parts 120-130 and must be maintained continuously, not only at registration.

Does ITAR apply to composite lay-up and curing operations even if no export occurs

ITAR applies to the production of any USML-listed defense article and to the technical data required to produce it, regardless of whether an export takes place. Lay-up operations that follow controlled ply-orientation schedules, curing operations governed by controlled process specifications and machining of cured composite structures to controlled drawings all constitute production of a defense article or use of controlled technical data. A deemed export, the release of controlled technical data to a foreign national inside a U.S. facility, triggers the same licensing analysis as a physical shipment overseas. DDTC registration and full shop-floor controls apply from the first production step.

What is the difference between a TAA and a DSP-5 license for composite programs

A DSP-5 license authorizes the permanent export of unclassified USML-listed hardware and, where applicable, related unclassified technical data to a foreign recipient. A Technical Assistance Agreement authorizes the transfer of defense services, manufacturing know-how, integration guidance or controlled technical data access, including deemed exports to foreign nationals inside the United States. Composite programs that employ foreign nationals who need access to controlled drawings, ply schedules or cure specifications require a TAA, not a DSP-5. Many programs require both, a DSP-5 for hardware shipments and a TAA for the technical data and engineering support that accompany them. DDTC registration is a prerequisite for filing either application through DECCS.

Conclusion

ITAR registration requirements for aerospace composite manufacturers encompass DDTC registration, USML classification, shop-floor access controls, foreign-national authorization, supply-chain vetting and six-year recordkeeping. Each element remains mandatory and auditable. Composite OEMs that also need ITAR-registered metal-hardware and tooling fabrication can reduce supply-chain compliance risk by partnering with a single certified source. Precision Advanced Manufacturing’s ITAR-registered, AS9100D-certified facilities in California and Texas deliver the precision, traceability and regulatory alignment that mission-critical programs require. Starting a conversation with Precision Advanced Manufacturing’s team helps align composite manufacturing needs with a compliant metal-hardware and tooling strategy.