European UnionDual-Use Regulation
Officially Authorisation requirement for listed dual-use items (Article 3)
Also known as Regulation (EU) 2021/821.
Regulation (EU) 2021/821, Art. 3
In force since .
An encryption items rule binding private bodies.
- Obligation class
- Licensing
As of .
What it requires
- Hold an authorization before you export software or technology listed in Annex I, which includes software that performs or contains encryption and is not released by the Cryptography Note (Regulation (EU) 2021/821 Art. 3(1)).
- Treat sending software to someone outside the Union by email or other electronic means, or making it available for download to people outside the Union, as an export (Art. 2(2)(d)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Each Member State, which takes the measures that ensure proper enforcement and lays down the penalties applicable to infringements (Article 25(1)).
What this law does
Article 3(1) requires an authorization to export a dual-use item listed in Annex I, and Article 2(1) counts software and technology as dual-use items. Export includes transmitting software by electronic means, or making it available in electronic form, to a person outside the customs territory of the Union, so a download or email counts.
An exporter of software that performs or contains encryption and falls within Annex I Category 5 Part 2 therefore needs an individual, global, national general or Union general export authorization before it goes. Each Member State lays down the penalties for infringement under Article 25(1).
When LexLint raises it
When your app profile says your app ships encryption.