European UnionEU Control List of Dual-Use Items
Officially Annex I Category 5 Part 2 (information security) with the Cryptography Note
Also known as Delegated Regulation (EU) 2025/2003.
In force since .
An encryption items rule binding private bodies.
- Obligation class
- Licensing
What it requires
- Classify software that performs or contains encryption against Annex I Category 5 Part 2 (5A002, 5D002, 5E002) before you export it from the Union, and note that sending it or making it available electronically to someone outside the Union is an export (Regulation (EU) 2021/821 Art. 2(2)(d), Art. 3(1)).
- Treat the software as released by the Cryptography Note only if it is generally available to the public by retail sale without restriction, its cryptographic functionality cannot easily be changed by the user, and the user installs it without further substantial supplier support; give the competent authority the details of the product on request (Annex I Category 5 Part 2, Note 3.a).
- Where the Note does not release the software, hold an authorization before exporting it, either individual or global, or use a Union general export authorization whose conditions the export meets (Regulation (EU) 2021/821 Art. 3(1), Art. 12(1)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Each Member State, which takes the measures that ensure proper enforcement and lays down the penalties applicable to infringements (Article 25(1)).
What this law does
Annex I to Regulation (EU) 2021/821 is the Union control list, and Delegated Regulation (EU) 2025/2003 replaced it as a whole.
Its Category 5 Part 2 controls information security equipment (5A002), software (5D002) and technology (5E002); 5D002.c.1 reaches software that has the characteristics of, or performs or simulates the functions of, the cryptographic equipment in 5A002.a. The Cryptography Note (Note 3) releases from control an item generally available to the public by retail sale without restriction, whose cryptographic functionality cannot easily be changed by the user and which the user installs without further substantial supplier support, and Note 2 releases products that accompany their user for personal use.
An exporter of software that performs or contains encryption therefore classifies it against this Category before exporting it, and an item the Note does not release needs an authorization under Article 3(1). Penalties for an infringement are each Member State's own under Article 25(1). The Commission adopted a further Delegated Regulation updating Annex I on .
When LexLint raises it
When your app profile says your app ships encryption.
Back to the example · Lint your app
Page updated .