The New EU Dual-Use Regulation Enters into Force: Overview of the Main Changes

Background

September 9, 2021 - The European Union has adopted new rules to increase accountability, competitiveness and transparency in the trade of “dual-use” goods,¹  i.e., goods that can be used for both civilian and military²  purposes. In September 2016, the Commission presented a proposal to revise, update and extend the existing rules contained in Regulation 428/2009, setting forth a regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items.³ 

After four years of negotiations between the Commission, the European Parliament and the Council, a preliminary political agreement on a revised regulation was reached on November 9, 2020. On March 25, 2021,⁴  the Parliament adopted on first reading the legislative resolution recasting Regulation 428/2009, followed by the Council on May 10, 2021.⁵  The new Regulation 2021/821 (hereafter, the “new Regulation”),⁶  which repeals Regulation 428/2009, was published in the Official Journal of the European Union on June 11, 2021 and will become effective on September 9, 2021.

The new Regulation aims to strengthen EU action on the non-proliferation of weapons of mass destruction and their means of delivery, to contribute to regional peace, security and stability, and to help ensure respect for human rights and international humanitarian law by controlling the export of dual-use items from the EU.⁷

While maintaining the core principles governing export controls of dual-use items in the EU, the new Regulation introduces the following main changes:

• Increased control of cyber-surveillance items, with the establishment of a new coordination mechanism between Member States;
• New controls over the provision of technical assistance for dual-use items;
• A new provision on “transferable controls” that allows a Member State to introduce export controls on the basis of legislation established by another Member State under certain conditions;
• The emphasis on the role of private sector actors in applying EU export controls measures, notably through integration of the principle of an “Internal Compliance Program” in the new Regulation;
• The creation of two new Union general export authorizations⁸  for intra-group export of certain software and technology (EU007) and export of certain items incorporating cryptology functions (EU008); and
• The introduction of an individual or global authorization applicable to large projects valid for a maximum period of four years, except in duly justified circumstances based on the duration of the project.⁹ 

This advisory focuses on the first four topics listed above that may have a significant impact on parties located and doing business in the European Union.

1. Increased control over the export of cyber-surveillance items

In order to combat the risk of certain cyber-surveillance items exported from the customs territory of the Union, as defined in the new Regulation¹⁰ , being misused by persons complicit in or responsible for ordering or committing serious human rights violations, the new Regulation provides for a “catch-all” clause in Article 5. 

Article 5 gives Member States the power to subject exports of cyber-surveillance items not listed in Annex I to prior authorization if the competent authority informs the exporter that “the items in question are or may be intended, in their entirety or in part, for use in connection with internal repression and/or the commission of serious violations of human rights and international humanitarian law.”¹¹ 

If the exporter becomes aware of this purpose after undertaking due diligence on the transaction, it must inform the competent authority of its own country, which will then decide whether or not to subject the export to authorization.¹² 

Member States also have the option of unilaterally adopting or maintaining national legislation requiring that the export of certain cyber-surveillance items be subject to authorization, provided that they inform the other Member States and the Commission.¹³  

2. New controls over the provision of technical assistance

One of the main changes is the introduction of controls over the provision of “technical assistance”. 

The concept of “technical assistance” is broadly defined in Article 2.9 of the new Regulation as “any technical support related to repairs, development, manufacture, assembly, testing, maintenance, or any other technical service, and may take forms such as instruction, advice, training, transmission of working knowledge or skills or consulting services, including by electronic means as well as by telephone or any other verbal forms of assistance.”

The concept of “provider of technical assistance” is also broadly defined¹⁴  and includes “(a) any natural or legal person or any partnership that provides technical assistance from the customs territory of the Union into the territory of a third country; (b) any natural or legal person or any partnership resident or established in a Member State that provides technical assistance within the territory of a third country; or (c) any natural or legal person or any partnership resident or established in a Member State that provides technical assistance to a resident of a third country temporarily present in the customs territory of the Union.”

In addition, the provision of technical assistance in respect of dual-use items listed in Annex I is subject to authorization if the competent authority has informed the technical assistance provider that the items in question “are or may be intended, in their entirety or in part, for any of the uses referred to in Article 4(1)” of the new Regulation¹⁵  (i.e., for use in chemical, biological, or nuclear weapons or related missiles, for a military end-use in a country subject to an arms embargo, or for use in military items in the national military list that have been the subject of an export violation).  In addition, if the provider itself is aware that the items in question are intended, in their entirety or in part, for any of the uses referred to in Article 4(1), then the provider of technical assistance shall notify the competent authority in its own country, which will decide whether or not to make the export of the service concerned subject to authorization.¹⁶  

The new Regulation introduces a control over exporters providing technical assistance not outside the customs territory of the Union but within it, where the importer (i) is not an EU resident, and (ii) is temporarily located on the territory of the European Union. This obligation can be compared to the U.S. concept of “deemed export.”¹⁷  However, while U.S. Export Administration Regulations require the actual release or transmission of technology or technical data to qualify as a “deemed export,” the new Regulation’s concept of “technical assistance” is in theory broader, and could include the provision of services without the release or transmission of technology or technical data.

3. Export controls that are transferable between Member States

The new Regulation provides that a Member State may prohibit or subject to authorization the export of dual-use items not listed in Annex I for reasons of public security, including the prevention of acts of terrorism or for human rights considerations.¹⁸  The latter justification requires that the restricting Member State notify other Member States as well as the Commission, which will publish it in the Official Journal of the European Union.¹⁹  

Accordingly, if an exporter has been informed by its national competent authority that the items in question (which are subject to specific unilateral control by a Member State as provided for in Article 9 of the new Regulation), are or may be intended, in whole or in part, for uses which give rise to public security concerns, including preventing terrorism or human rights considerations, prior authorization will be required.²⁰  

This new provision therefore enables EU harmonization of export control measures through a cross-border application of the relevant rules adopted by the Member States.

4. Emphasis on the role of private sector stakeholders

The new Regulation explicitly recognizes the “crucial involvement” of private sector actors, who are primarily concerned in terms of operational implementation of export control measures.²¹  

In this regard, the recitals to the new Regulation state that exporters located in the European Union should adopt an “internal compliance program” (hereinafter, the “ICP”)²²  in order to act in accordance with the provisions of the new Regulation, in particular by assessing the risks related to exports of dual-use items. Exporters, brokers and other providers of technical assistance must take “reasonable care” by implementing “transaction-screening measures.”²³  Similar to the U.S. “risk based” approach to the design of compliance programs, the new Regulation recommends that the size, resources, organizational structure and field of activity of exporters must be taken into account when developing and implementing ICPs. ICP requirements for the use of global export authorizations are defined by the Member States.

In addition, Articles 12 and 15 of the new Regulation provide that the adoption of an ICP by exporters applying for global export authorizations is one of the elements necessary or, in any case, taken into account by the competent authorities in their decision to grant a license.