Export Control Is the First Architecture Decision

Founders in aerospace tend to meet export control late — usually when a promising international customer appears, or when a strong engineering candidate turns out not to be a US person.

By then the decision has already been made for you by choices nobody framed as export-control choices: where the repository lives, who has commit access, which cloud region, which investor.

Two regimes, and which one you are under

ITAR governs defense articles and services on the United States Munitions List. It is administered by the State Department and it is strict — a "deemed export" occurs when controlled technical data is disclosed to a foreign person inside the United States. Showing a drawing to a colleague on a visa can be an export.

EAR governs dual-use items through the Commerce Department, on a graduated basis. Many commercial space and aviation items moved from ITAR to EAR through reform over the past decade, which is why the question "which list am I on" is genuinely worth asking rather than assuming the worst.

The classification of your specific hardware, software and technical data determines almost everything downstream. Getting a proper determination early is cheap. Discovering it during diligence is not.

Where it actually bites

Hiring. Under ITAR, access to controlled technical data by a foreign person requires authorization. In a field where the talent pool is global, this narrows recruiting sharply — and it applies to employees, contractors and sometimes visitors.

Your repository and your cloud. Technical data stored where a foreign national administrator could access it can constitute an export. This is why controlled workloads sit in specific cloud regions with screened personnel, and why the architecture decision is also a compliance decision.

International revenue. Selling abroad requires licenses, and licensing timelines are measured in months. A founder who has modeled international sales without modeling licensing has modeled revenue that will arrive later than planned.

Your cap table. Foreign investment in a company handling controlled technology draws scrutiny, including potential CFIUS review. An investor who is attractive on terms can be expensive on timeline.

The compliance program is the asset

The practical answer is not to avoid controlled work. It is to build the program deliberately:

- A written classification determination for your products and technical data - An access-control model that maps to it — who can see what, enforced technically not by policy - Screened personnel and documented authorizations - A record that survives an audit

Companies that do this have something real. Primes and program offices treat export-control maturity as a proxy for seriousness, and a supplier who can demonstrate it clears diligence in weeks rather than quarters.

For investors

Three questions worth asking early:

Has anyone made a formal classification determination, or are you assuming?

Who has access to controlled technical data today, and can you prove it?

Does the revenue model depend on international sales, and what licenses does that require?

A company that cannot answer the first question has an unpriced liability. A company that answers all three crisply has done work its competitors mostly have not.

The read

Export control is usually framed as friction. For a venture it functions more like a certification: costly, slow, and therefore a barrier that protects the companies on the right side of it.

The mistake is treating it as a legal problem to solve later. It is an architecture problem, and architecture decisions get expensive in proportion to how long you wait.