Insights · Export controls
Dual-Use Regulation (EU) 2021/821: licensing requirements, catch-all and internal compliance programmes
What this is about
Regulation (EU) 2021/821 governs the control of dual-use items. These are items, including software and technology, which can be used for both civil and military purposes. It covers exports, brokering, technical assistance, transit and transfers within the Union. The Regulation applies directly in all Member States. The penalties for infringements are laid down by the Member States (Article 25).
Listed items: Annex I
An authorisation is required for the export of the dual-use items listed in Annex I (Article 3). Annex I implements the control lists of the international export control regimes: the Australia Group, the Missile Technology Control Regime, the Nuclear Suppliers Group, the Wassenaar Arrangement and the Chemical Weapons Convention. The Commission updates it regularly by delegated regulations.
Most recently, Commission Delegated Regulation (EU) 2025/2003 of 8 September 2025 replaced Annex I in its entirety. According to its recitals, the Member States informed the Commission on 23 May 2025 that they had accepted further control commitments. New entries with the "5xx" numbering were added, among them:
- quantum computers and related electronic assemblies (4A506),
- equipment for the manufacturing of semiconductor devices (3B501),
- certain electronic items (3A501),
- additive manufacturing equipment for metal components (2B510),
- certain metal and alloy powders (1C513).
The Delegated Regulation was published in the Official Journal on 14 November 2025 and entered into force on the following day.
Unlisted items: catch-all
Unlisted items may also require an authorisation. Under Article 4(1), this applies where the competent authority has informed the exporter that the items are or may be intended, in their entirety or in part, for one of the following uses:
- in connection with chemical, biological or nuclear weapons or missiles capable of delivering such weapons,
- for a military end-use in a country subject to an arms embargo,
- as parts or components of military items that have been exported without authorisation.
Where the exporter is aware of such a use, it must notify the competent authority. The authority then decides whether an authorisation is required (Article 4(2)). Member States may extend the obligation to cases in which the exporter has grounds for suspecting such a use (Article 4(3)). They may also subject unlisted items to national controls for reasons of public security or human rights considerations (Article 9).
Cyber-surveillance items
Article 5 contains a separate catch-all rule for cyber-surveillance items. These are items specially designed to enable the covert surveillance of natural persons by monitoring, extracting, collecting or analysing data from information and telecommunication systems (Article 2, point 20).
An authorisation is required where the competent authority has informed the exporter that the items may be intended for use in connection with internal repression or the commission of serious violations of human rights and international humanitarian law. Where the exporter becomes aware of this on the basis of its own due diligence findings, it must notify the competent authority (Article 5(2)). The other Member States review such an authorisation requirement within 30 working days. Guidance is provided by Commission Recommendation (EU) 2024/2659 of 11 October 2024.
Internal compliance programme
The Regulation defines the internal compliance programme (ICP) as ongoing effective, appropriate and proportionate policies and procedures to facilitate compliance with the Regulation (Article 2, point 21). Exporters using global export authorisations must implement an ICP, unless the competent authority considers it unnecessary in the individual case (Article 12(4)). Commission Recommendation (EU) 2019/1318 offers orientation. It was adopted under the predecessor Regulation (EC) No 428/2009.
In Germany, the Federal Office for Economic Affairs and Export Control (BAFA) requires the appointment of a person responsible for exports (Ausfuhrverantwortlicher). According to the BAFA guidance leaflet, this person must be a member of the company's management; a general commercial power of attorney (Prokura) is not sufficient.
Exporters must also keep detailed registers or records of their exports. These must be kept for at least five years from the end of the calendar year in which the export took place (Article 27).
Criminal liability under the AWG
In Germany, exporting without an authorisation under Article 3(1), 4(1), 5(1) or 10(1) is a criminal offence under section 18(5) of the Foreign Trade and Payments Act (AWG). The same applies to exports without a decision of the competent authority in the cases of Articles 4(2) and 5(2). The penalty is imprisonment from three months to five years. Section 18(5) AWG refers to Regulation (EU) 2021/821 as amended on 5 September 2024.
Evaluation of the Regulation
Under Article 26(4), the Commission evaluates the Regulation between 10 September 2026 and 10 September 2028 and reports on the main findings.
What companies typically examine
- Classification: Are goods, software or technology listed in Annex I, including after its replacement by Delegated Regulation (EU) 2025/2003?
- End-use: Are there indications of a use relevant under the catch-all clauses or of cyber-surveillance?
- Organisation: Are an ICP and a person responsible for exports in place?
- Records: Are records kept and retained in full?
This post provides a general overview of the legal position and does not replace legal advice on individual cases.