On 11 June 2021, the new EU Dual-Use Regulation 2021/821 was published in the EU Official Journal, set to replace current Regulation 428/2009 of 5 May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual use-items. Often referred to as the Recast, it will enter into force on 9 September 2021. While it introduces additional controls, the Recast is much less ambitious in scope than the European Commission had originally envisaged, particularly in terms of addressing the human rights aspects of export controls and the lack of a level playing field due to differences in interpretation, application and enforcement among the Member States. Even so, it expands the range of general export authorisations available, reducing the administrative burden for exporters of relevant items. Companies involved with dual-use items are recommended to take note of the changes and to assess any implications and benefits that these may have on their business.

Background

The Recast was considered necessary to adapt to changing technological, economic and political circumstances. To that end, in 2011, the Commission set out to revise the current Dual-Use Regulation. After public consultation, the Commission submitted its Proposal in 2016 (the "Commission Proposal"). In the review and negotiation process that followed, the EU Parliament largely sided with the Commission's goals addressing human rights concerns and further harmonising controls. The Commission Proposal, however, faced resistance from the Council. Ultimately, this has resulted in a limited revision of the Dual-Use Regulation.

Scope

Even though the Recast updates the definition of "dual-use items", the term itself has not undergone any substantive change. Dual-use items are defined as "items, including software and technology, which can be used for both civil and military purposes". The current definition already clarifies that this includes certain items related to nuclear weapons. The updated definition clarifies that dual-use items also include those related to chemical and biological weapons.

The Recast amends the definition of "exporter" to include natural persons carrying dual-use items in their personal baggage. It also covers the legal or natural person or partnership that decides to make dual-use software or technology available in an electronic form outside the customs territory of the Union other than by transmitting it through electronic means, such as email (which was already covered).

The Recast does not add any new categories of dual-use items to Annex I of the Dual-Use Regulation, which lists the items that are considered dual-use and that are, in any event, subject to export controls.

Cyber-surveillance items

Article 5 of the Recast adds a catch-all authorisation requirement for the export of non-listed cyber-surveillance items. The Commission Proposal originally sought to more comprehensively regulate the export of cyber-surveillance technology, expanding the definition of "dual-use items" to include cyber-surveillance technology which "can be used for the commission of serious violations of human rights or international humanitarian law or can pose a threat to international security or the essential security interests of the Union and its Member States." It also proposed introducing a new category 10 "Other items of 'cyber-surveillance technology'" to Annex I. Both proposals were dismissed. The Recast does include a definition of "cyber-surveillance items", but it is much more limited than the definition of "cyber-surveillance technology" as included in the Commission Proposal. The new "cyber-surveillance items" definition covers "dual-use items specially designed to enable covert surveillance of natural persons by monitoring, extracting, collecting or analysing data from information and telecommunication systems".

The catch-all authorisation requirement for the export of non-listed cyber-surveillance items applies "if the exporter has been informed by the competent authority that the items in question […] are or may be intended for use in connection with internal repression and/or the commission of serious violations of international human rights and international humanitarian law".

Similar to the existing general catch-all for the export of non-listed dual-use items in article 4, the exporter is bound by a notification obligation. If an exporter "is aware according to its due diligence findings" that the non-listed cyber-surveillance items are intended for any of the outlined uses, it must notify the competent authority. The competent authority must then decide whether to subject the export to authorisation. Member States can choose to expand this notification obligation to situations in which the exporter merely has grounds for suspecting that the relevant items are or may be intended for such use.

The catch-all provision for cyber-surveillance items makes explicit reference to the exporter's "due diligence findings", whereas the general catch-all provision does not. The Commission Proposal suggested including this phrase in the general catch-all provision. While its omission could suggest that there is a difference in the exporter's due diligence obligations relating to non-listed cyber-surveillance items and other non-listed dual-use items, we don't believe this to be the case.

Article 5 also provides for a new coordination mechanism between the Member States. If a Member State imposes an authorisation requirement on the export of a non-listed cyber-surveillance item, it must provide relevant information to the other Member States and the Commission. If all Member States notify the other Member States and the Commission that an authorisation requirement for essentially identical transactions should be imposed, the Commission must publish the relevant item information and, where appropriate, the destinations subject to authorisation. The Recast thus provides for a mechanism for the Member States to align with an authorisation requirement imposed by another Member State. How this will play out in practice remains to be seen. This coordination mechanism, however, is unlikely to prevent the occurrence of substantial differences amongst the Member States in authorising the export of dual-use cyber-surveillance items, distorting the level playing field.

Non-listed dual-use items

The general catch-all provision of article 4 (providing an authorisation requirement for the export of other non-listed dual-use items), has not changed substantively. it applies if the competent authority has informed the exporter that the relevant items are or may be intended for:

• use in connection with weapons of mass-destruction and missiles capable of delivering such weapons ("WMD");
• military end-use if the purchasing country or country of destination is subject to an arms embargo; or
• use as parts of components of military items which were exported in violation of a national export authorisation requirement.

Exporters who are aware that the items they plan to export are intended for such use must inform the competent authority. It is then up to the competent authority to decide whether to impose an authorisation requirement. Member States may expand the notification obligation to situations in which the exporter merely has grounds for suspecting such use.

The Commission Proposal suggested expanding this authorisation requirement and the corresponding notification obligation to non-listed dual-use items for use: (i) by persons complicit in or responsible for violations of human rights or international humanitarian law in situations of armed conflict or internal repression in the country of final destination, or (ii) in connection with acts of terrorism. This proposal did not make it to the Recast. The Recast thus does not impose a mandatory authorisation regime for the export of non-listed dual-use items raising human rights concerns.

Public security and human rights considerations

The Recast does provide an optional authorisation regime for the export of non-listed dual-use items raising human rights concerns. Like the current Dual-Use Regulation, it allows Member States to impose an authorisation requirement on the export of non-listed dual-use items for public security reasons or human rights considerations. Furthermore, article 9 of the Recast now provides that Member States may establish a national control list to that end. The Commission is responsible for publishing a compilation of any such national control lists.

In addition, pursuant to article 10 of the Recast, an authorisation is required for the export of non-listed dual-use items if:

• another Member State requires an authorisation for the export of these items, based on its national control list, adopted pursuant to article 9; and

• the exporter has been informed by the competent authority that the items in question are or may be intended for uses of concern with respect to public security, including the prevention of acts of terrorism, or to human rights considerations.

In this way, export authorisation requirements imposed by one Member State for public security reasons or human rights considerations may have an impact outside the relevant Member State.

Still, the optional authorisation regime for the export of non-listed dual-use items leaves ample room for a diverging approach of such exports amongst the Member States.

Brokering

Article 6 of the Recast requires authorisation for the brokering of listed dual-use items if the competent authority has informed the relevant party that the items in question are or may be intended for uses as referred to in article 4, as discussed above. It also provides for a notification obligation, similar to the export catch-all provisions discussed above. Member States can choose to expand this notification obligation to situations in which the exporter merely has grounds for suspecting that the relevant items are or may be intended for such use. The Commission Proposal suggested making the authorisation requirement and the notification obligation applicable to both listed and non-listed dual-use items. However, according to the Recast, both apply only to the brokering of dual-use items listed in Annex I. The Member States can choose to expand the authorisation requirement but not the notification obligation to include the brokering of non-listed dual-use items.

What has changed, is the definition of a "broker". Pursuant to the new definition, a broker no longer needs to be resident or established in the EU. As a result, brokers who are resident or established outside of the EU, are now also bound by the relevant restrictions when carrying out brokering services from the customs territory of the Union into a third country. The new definition is still limited to brokering services for transactions where the relevant dual-use items move from one third country to another. It does not cover the brokering of dual-use items moving from the EU to outside of the EU. However, brokers resident or established in, or carrying out their services from, the Netherlands should keep in mind that pursuant to the Dutch Strategic Services Act (Wet Strategische Diensten) such brokering services are subject to an authorisation requirement.

Article 13 of the Recast provides that authorisations are to be granted by the competent authority of the Member State where the broker is resident or established. If the broker is not resident or established in the customs territory of the Union, an authorisation is to be granted by the competent authority of the Member State from where the brokering services will be provided.

Transit

Article 7 of the Recast provides that the competent authority of the country where the items are situated may prohibit the transit of non-Union dual-use items at any time, if the relevant items are or may be intended for uses as referred to in article 4. If the items transit through multiple Member States, the competent authority of each affected Member State may prohibit transit through its territory. Before deciding whether to prohibit transit, the competent authority may in individual cases impose an authorisation requirement for the specific transit.

As with brokering services, the Commission Proposal suggested making this provision applicable to both listed and non-listed dual-use items. However, according to the Recast, it still only applies to dual-use items listed in Annex I. It remains for the Member States to decide on whether to expand this authorisation requirement to the transit of non-listed dual-use items.

Article 7 also clarifies that a transit authorisation requirement may be imposed on the natural or legal person or partnership that holds the contract with the consignee in the third country and has the power for determining the sending of the item passing through the customs territory of the Union. If that person or partnership is not resident or established in the customs territory of the Union, the authorisation requirement may be imposed on the declarant, the carrier or the natural person carrying the items in transit in his or her personal baggage. Companies acting as carrier or declarant for non-EU parties should be aware of this.

Technical assistance

Article 8 introduces an authorisation requirement for the provision of technical assistance related to listed dual-use items that are or may be intended for uses as referred to in article 4. The current Dual-Use Regulation already requires an authorisation for the provision of certain technical assistance. It provides that dual-use items include 'technology', which is defined in Annex I as "specific information necessary for the ‘development’, ‘production’ or ‘use’ of goods". Such 'technology' may take the form of ‘technical assistance’, which in turn "may take forms such as instructions, skills, training, working knowledge and consulting services". As a result, providing technical assistance in relation to certain dual-use items, as set out in paragraph E (Technology) of the various categories of Annex I, already requires an authorisation. Additionally, article 8 of the Recast requires an authorisation for the provision of technical assistance related to all items included in Annex I if the provider has been informed by the competent authority that the items in question are or may be intended for uses as referred to in article 4. Technical assistance providers must notify the competent authority if they are aware that the dual-use items for which they propose to provide technical assistance are intended for such use. Member States can again choose to expand this notification obligation to situations in which the exporter merely has grounds for suspecting that the relevant items are or may be intended for such use. Member States may also extend the authorisation requirement to non-listed dual-use items, but not the notification obligation.

Both the authorisation requirement and the notification obligation do not apply in a number of situations, including when the technical assistance:

(a) is provided:

• within or into the territory; or
• towards a resident;

of a country listed in Annex II, section A, part 2 (Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland, Liechtenstein, the UK and the US);

(b) takes the form of transferring information that is in the public domain or basic scientific research within the meaning of the General Technology Note or the Nuclear Technology Note of Annex I; or

[…]

(f) is the minimum necessary for the installation, operation, maintenance (checking) or repair of those items for which an export authorization has been issued.

Pursuant to the definition of a "provider of technical assistance", such provider can be natural or legal persons or partnerships resident or established in the customs territory of the Union or providing technical assistance from the customs territory of the Union.

Pursuant to article 13 of the Recast, authorisations are granted by the competent authority of the Member State where the provider of technical assistance is resident or established. If the provider is not resident or established in the customs territory of the Union, an authorisation is to be granted by the competent authority of the Member State from where the technical assistance will be provided.

Authorisations

Just like the current Dual-Use Regulation, the Recast provides for individual and global export authorisations, and national and Union General Export Authorisations (UGEAs). All such authorisations are valid throughout the customs territory of the Union.

The Recast clarifies that individual and global export authorisations are granted by the competent authority of the member state where the exporter is resident or established. Where the exporter is not resident or established in the customs territory of the Union, individual export authorisations are to be granted by the competent authority of the Member State where the relevant dual-use items are located.

The current Dual-Use Regulation provides that authorisations may be subject to an end-use statement, if appropriate. The Recast, however, provides that individual export authorisations shall be subject to an end-use statement, unless exempted by the competent authority. Global export authorisations may be subject to an end-use statement, if appropriate. Exporters using a global export authorisation must implement an internal compliance programme (ICP), unless this is considered unnecessary by the competent authority based on information provided by the exporter in the authorisation application.

The Recast also introduces two new types of UGEAs: one for intra-group export of software and technology (EU007, see Annex IIG), and another for encryption items (EU008, see Annex IIH).

The intra-group export UGEA (EU007) is available for the majority of dual-use items listed in Annex I, but not for those included in Section I of Annex II nor for a few other items as referenced in Annex IIG. The authorisation is valid for exports to a number of designated third countries. For exports to some countries not covered by EU007 use can possibly be made of UGEA EU001, or (for many fewer items) to EU002. The intra-group export authorisation can be used for exports by legal persons established in a Member State, of which both the direct parent company and ultimate controlling entity are established in a Member State, Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland, Liechtenstein, the UK or the US. It can be used for exports to a company wholly owned and controlled by the exporter (referred to as its "subsidiary") or a company directly and wholly owned and controlled by the same parent company as the exporter (referred to as its "sister company"). In addition, conditions apply as to the use and control of the relevant software and technology, which must be returned to the exporter and deleted by the subsidiary or sister company at the completion of the development activity or if the subsidiary or sister company is acquired by another entity. In addition, exporters intending to use this specific UGEA must put in place an ICP.

The encryption authorisation (EU008) covers the export of a range of encryption items to all destinations except those mentioned in part 2 of the Annex IIH. The authorisation is subject to restrictions relating to the use of the encryption items and cannot be used if the encryption items are formally approved by a Member State to transmit, process or store certain classified information or have a certain national security classification marking.

The Recast also introduces the large project authorisation, a new subtype of authorisation. According to the definition, it may consist of an individual or a global authorisation granted to one exporter for a type or category of dual-use items, valid for exports to one or more specified end-users in one or more third countries for a specified large-scale project. What exactly qualifies as such a project is not defined. This type of authorisation is valid for a duration determined by the competent authority, but no longer than four years, except in duly justified circumstances based on the duration of the project.

Due diligence obligations and Internal Compliance Programmes

The Preamble of the Recast explicitly refers to the crucial importance of the contribution by exporters, brokers and providers of technical assistance and other relevant stakeholders, to the overall aim of trade controls and the need for "transactions screening measures, also referred to as the due diligence principle, as part of Internal Compliance Programmes (ICP)" for them to act in conformity with the Regulation. However, the Recast does not provide a general obligation to implement an ICP, although in principle it is required for users of global export authorisations. Member States are to define the reporting and ICP requirements relating to the use of global export authorisations. The Netherlands published Guidelines for compiling an ICP in 2019, available in both Dutch and English here. The general EU Guidelines on ICPs are available here. In view of the relevant provisions in the Recast, we note that the Dutch ICP Guidelines include a paragraph on cyber-surveillance and human rights, with additional points to be covered in an ICP in relation to human rights.

No circumvention prohibition included

The Commission Proposal suggested introducing a prohibition on knowingly and intentionally participating in activities with the object or effect of circumventing any applicable export, brokering, transit and technical assistance controls, for example, by exporting the relevant items from another Member States that applies less strict controls. The Recast, however, does not include such a prohibition, leaving room for forum shopping.

Retention period

Per the current Dual-Use Regulation, exporters and brokers must keep detailed registers of their exports or records their brokering services. Article 27 of the Recast extends this obligation to technical assistance providers. It also extends the retention period for these registers and records from three to five years. The retention period for documents and records of intra-Community transfers remains three years.

Exchange and publication of enforcement information

Article 23(2) provides a legal basis for the exchange of more information between the Member States, including data on the enforcement of controls and penalties imposed (sub (d)), while article 25(2) provides for the setting up of an Enforcement Coordination Mechanism to support the exchange of information and the direct cooperation between the competent authorities and enforcement agencies of the Member States. In addition, article 26(2) requires the Commission to submit an annual report to the European Parliament and the Council, which must include information data on the enforcement of controls, particularly the number of infringements and penalties.

Transitional law

The Recast enters into force on 9 September. However, relevant provisions of the current Dual-Use Regulation will continue to apply for export authorisation applications made before then.

General assessment

When the Commission Proposal was submitted, it faced resistance from international businesses that feared more controls and additional due diligence and notification obligations, especially on human rights. This resistance seems to have paid off: the Recast does not impose a general authorisation requirement and notification obligation on the export of non-listed dual-use items that are or may be intended for uses of concern in relation to human rights or internal suppression. The Recast also does not extend the authorisation requirements for brokering services and transit to non-listed dual-use items, as was envisaged in the 2016 Commission Proposal.

The failure to more comprehensively address human rights concerns related to the export of dual-use items has drawn fierce criticism from various NGOs. International business is likely to welcome the restrained approach of the Recast with its limited expansion of controls and due diligence obligations. But this limited approach may have a downside for international business as well, as the Recast leaves room for diverging approaches among the Member States. Individual Member States may choose to unilaterally address human rights concerns related to exports of dual-use items, be it through a national control list pursuant to article 9 or through their licensing policy. In addition, they may choose to expand brokering, transit and technical assistance authorisation requirements to non-listed dual-use items.

A unilateral approach by the Member States would complicate compliance efforts for companies active across the EU and could distort the level playing field. The introduction of various mechanisms to foster greater coordination and alignment between the Member States in terms of both authorisations and enforcement is unlikely to remedy this shortcoming.

Recommendations

We recommend that companies involved with dual-use items in any way, take note of the changes introduced by the Recast, and:

1. assess whether:

• any of their products qualify as non-listed cyber-surveillance items;

• the services they provide qualify as technical assistance in the sense of the Recast;

and, if so, take note of the relevant notification obligations;

2. assess whether they can avail themselves of the newly introduced Union General Export Authorisations or large project authorisation;

3. monitor potential amendments to relevant national laws and regulations on the topics that allow for additional national legislation, such as:

• the introduction of national export control lists for items raising concerns from a human rights perspective; and

• the expansion of brokering, transit and technical assistance authorisation requirements to non-listed dual-use items