The much-awaited Recast of the EU Dual-Use Regulation entered into force on 9 September 2021. This article explores how the amended Regulation came into being, what it sets out to achieve, what it adds and what the major takeaways for businesses are.
The Commission, the European Parliament and the Council have long-since recognized the need to upgrade the export control system of the European Union (“EU’’) in response to the fast-changing geopolitical, scientific, technological and economic developments and the surfacing of new threats to security and stability.[1]
Five years after the European Commission published its proposal in September 2016, Regulation (EU) 2021/821 (‘’Recast’’) of 20 May 2021 was finally adopted by the European Parliament and the Council of the EU.[2]
The Recast heightens controls on emerging technologies and empowers the private sector in addressing risks to global security and human rights by introducing due diligence obligations. It also improves transparency and coordination among Member States, between the latter and the Commission, and between the EU and third countries to enhance effective enforcement of controls.[3]
But first, why regulate dual-use items?
Dual-use items are goods, including software and technologies, which can be used for both civil and military purposes.[4] Because of the risk of their illegitimate application – e.g. the development of weapons of mass destruction, terrorist acts and human rights violations – the EU adopted the Dual-Use Regulation to oversee the export, transfer, brokering and transit of these goods.
The Dual-Use Regulation sets out common lists of dual-use items, assessment criteria and types of authorisations (individual, global and general).[5] It provides for the free circulation of dual-use items within the EU, and its Annexes – which are updated regularly to reflect evolving security threats, international commitments and agreements[6] – list the dual-use items of which the circulation is subject to conditions:
- Annex I lists the dual-use items that require an export authorisation to leave the EU. The Dual-Use Regulation also includes several ‘’catch-all clauses’’,[7] under which dual-use items that are not listed in Annex I require an export authorisation nevertheless.
- Annex II provides the EU’s general export authorisations that allow for the export of dual-use items to specific destinations, under specific conditions.
- Annex III provides the models for individual and global export authorisation forms and brokering services authorisation forms.
- Annex IV lists the particularly sensitive dual-use items that require an export authorisation for intra-Community transfers.
Why did this Recast become necessary?
The update of the Dual-Use Regulation became necessary on account of geopolitical and technological developments including cyber-surveillance, creating an increasing risk for global security and human rights. Further, businesses and relevant national authorities were faced with the administrative burden of interpreting, with very little guidance, a complex and technical Regulation, of which the diverging interpretations and enforcement among Member States were running the risk of distorting competition within the EU.
As a result, the Recast aims to update the EU’s export control toolbox to respond effectively to disruptive technologies, but also to enhance transparency by reinforcing information exchange and to level the playing field of export controls among Member States, and in fine, with third countries and the private sector. It intends to provide increased clarity, effectiveness, efficiency of control,[8] through strengthened regulation and further guidance on responsible practices – while striving not to impede business competitiveness and legitimate trade. An ambitious mandate in short.
What are the major implications of the Recast, in law and in practice?
Controlled exports of cyber-surveillance technology
- Definition: theRecast introduces a definition of cyber-surveillance items – i.e. dual-use items specially designed to enable the covert surveillance of natural persons by monitoring, extracting, collecting or analysing data, including biometrics data, from information and telecommunication systems.[9]
- Catch-all provision: additionally to listed cyber-surveillance items, the Recast provides that an export authorization will be required for non-listed cyber-surveillance items, should the competent Member States’ authorities consider that the items are or may be used in whole or in part in connection with internal repression and human rights and international humanitarian law violations.[10]
- National authorisation requirements: the Recast provides that Member States may adopt or maintain national legislation imposing an authorisation requirement.[11]
- Information and cooperation: the Recast provides that Member States must notify their relevant national authorities, other Member States and the Commission of authorisation requirements,[12] allowing the Commission to publish information regarding items and destinations subject to authorisation requirements.[13] The Commission and Dual-Use Coordination Group will submit an annual and public report on the Recast’s implementation that will include information on authorisations requirements for cyber-surveillance items (e.g. number of applications by item, the issuing Member States, the destinations and the decisions).[14] Member States and the Commission must also contribute to the activities of multilateral export control regimes for newly identified risks for cyber-surveillance items.[15]
- Implication for businesses: cyber-surveillance items designed to enable intrusion or deep packet inspection into information and telecommunication systems to conduct covert surveillance of natural persons are considered “associated risks’’ with internal repression and human rights violations. Exporting of these items thereby requires prior authorisation. Cyber-surveillance items used for purely commercial applications, e.g. billing, marketing, quality services, user satisfaction or network security, should not.[16]
- Implication for businesses: cyber-surveillance exporters have a duty to inform the competent authorities, if it appears from their due diligence findings that non-listed cyber-surveillance items are or may be used in connection with internal repression or serious human rights violations. The competent authority will then decide whether the export concerned will be subject to any restrictions.[17]
- Implication for businesses: the additional, amended or renewed authorisation requirements will be published in the Official Journal of the EU, Information and Notices, allowing businesses to determine what types of cyber-surveillance items will fall under the scope of the Recast.[18]
Protection of human rights and prevention of terrorism
- Reasserted commitment: the Recast stresses the importance of an effective common system of export controls to ensure inter alia the respect for regional peace, human rights and international humanitarian law.[19]
- Catch-all provisions: the Recast includes internal repression and human rights and international humanitarian law violations in its Article 5 catch-all criteria for non-listed cyber-surveillance items.[20] It maintains human rights considerations and public security in its Article 9 catch-all for non-listed dual-use items[21] – adding the prevention of acts of terrorism. The Recast also adds a catch-all in its Article 10, whereby authorisations shall be required for the export of non-listed dual-use items, if another Member State imposes an authorisation requirement on the basis of a national control list of items pursuant to Article 9, and if the competent authority considers that the items are or may be intended for uses of concern with respect to public security, e.g. acts of terrorism, and human rights considerations.[22]
- Implication for businesses: the catch-all provisions are broadened to include non-listed dual-use items based on another Member State’s assessment that an authorisation requirement is necessary.[23] These ‘transmissible controls’ allow one Member State to introduce export controls based on another Member State’s legislation – amounting to a cross-border effect of export controls. Accordingly, these provisions introduce new prerogatives to national export licencing authorities.
- Implication for businesses: the authorisation requirements based on national control lists will be published by the Commission, making it easier for businesses to monitor the types of dual-use items that will fall within the scope of the Recast.[24]
Tailored Internal Compliance Programmes and best practices
- Definition: the Recast introduces a definition of the Internal Compliance Programme (‘’ICP’’) – i.e. ongoing effective, appropriate and proportionate policies and procedures adopted by exporters to facilitate compliance with the Regulation and implemented authorisations, including due diligence measures assessing risks related to the export of the items, to end-users and end-uses.[25]
- Criteria to grant a global export authorisation: the Recast introduces the ICP implemented by the exporter in the criteria for Member States to assess applications for global export authorisations.[26]
- Implication for businesses: businesses are asked to contribute to trade control, namely by assessing risks related to transactions concerned by this Regulation, through transaction-screening measures.[27]
- Implication for businesses: exporters using global export authorisations should implement an ICP, unless relevant authorities consider this unnecessary due to other circumstances. Reporting and ICP requirements shall be defined by Member States.[28]
- Implication for businesses: the EU Guidelines for Internal Compliance Programs date back to 2019 and are to be updated in the near future to provide renewed recommendations on identifying and managing risks associated with dual-use exports and ensuring compliance with the Recast. These Guidelines are to consider the size and resources (e.g. Small Medium Enterprises, ‘’SMEs”), organizational structure and field of activity (e.g. exporting, brokering, technical assistance) of businesses to avoid a ‘one-size-fits all’ approach.[29] The Commission, in consultation with Member States, is also to develop guidelines and/or recommendations for best practices to support practical application of controls, also taking into account the needs of SMEs.[30]
Improved and flexible controls
- Definition: the Recast offers a wider and detailed definition of dual-use items – i.e. items, including software and technology, which can be used for both civil and military purposes, and includes items which can be used for the design, development, production or use of nuclear, chemical or biological weapons or their means of delivery, including all items which can be used for both non-explosive uses and assisting in any way in the manufacture of nuclear weapons or other nuclear explosive devices.[31]
- Additional general EU export authorisations: the Recast makes way for two new general export authorisations – i.e., the general authorisation of exports of certain encryption items, such as certain transfers of dual-use software and technology[32] and the general authorisation for intra-group transmission of software and technology, under specific conditions.[33]
- National general export authorisations: the Recast provides that Member States will be able to introduce national general export authorisations for low-risk exports.[34]
- Validity period of licences: the Recast harmonised the validity period of individual export authorisations and global export authorisations to maximum two years, unless the competent authority is to decides otherwise. Large project authorisations shall be valid for a duration to be determined by the competent authority, but no longer than four years, except in duly justified circumstances based on the duration of the project.
- Implication for businesses: the administrative burdens for exporters and relevant stakeholders will be reduced for low-risk exports that occur frequently, but the newly implemented export system and dual-use items definition appears to require heightened awareness in relation to the implemented controls.
Extended controls on brokering and technical assistance
- Definitions: the Recast:
- broadens the definition of broker – i.e. to include legal persons and partnerships not resident or established in a Member State and that provide brokering services from the customs territory of the Union into the territory of a third country.[35]
- includes a definition of technical assistance – i.e. technical support related to repairs, development, manufacture, assembly, testing, maintenance, or technical service, e.g. instruction, advice, training, transmission of working knowledge or consulting services from the customs territory of the Union into the territory of a third country[36].
- Controls: the Recast intends to harmonize controls relating to technical assistance[37] and mirrors authorisations on those granted to brokering services.[38] Specifically, authorisations will be required for technical assistance related to listed dual-use items, if they are related in any way to chemical, biological or nuclear weapons or other nuclear explosive devices, if they are for military end use in an arms embargoed country, or if they are for use as parts of military items listed in the national military list and have been exported without authorisation. Exceptions apply – e.g. if the technical assistance is provided within or into the territory of specifically listed countries[39] or if it takes the form of transferring information in the public domain or basic scientific research.[40]
- Deemed exports: “deemed export” is a term that is commonly used in the US and refers to the notion that the release of controlled technology to foreign persons on US territory is “deemed” to be an export to that person’s country of nationality and therefore subject to licensing requirements. The Recast has introduced a very specific type of deemed export control as the scope of the control on technical assistance extends to providing assistance to ‘a resident of a third country temporarily present in the customs territory of the [European] Union’.
- Implication for businesses: it is important that businesses determine whether the modified definitions cover their operations. E.g. brokers that are not residents or established in a Member State but provide brokering services from the EU, now fall under the scope of the Recast. Businesses must thereby be all the more attentive to apply for the appropriate authorisations.
- Implication for businesses: businesses that offer technical assistance from the EU, whether residing or being established in a Member State or not, now also fall under the scope of the Recast. Academia, research institutions, and businesses R&D departments must show heightened awareness.[41]
Enhanced coordination and transparency
- Powers to national authorities: the Recast provides that Member States are committed to cooperate and provide competent authorities with appropriate powers to allow for coordination of responses upon identification of new threats, additional national control lists and export authorisations.[42]
- EU-level coordination mechanism: the Recast provides for the set-up of an Enforcement Coordination Mechanism which allows for information exchange among the Member States and the Commission on decisions to refuse export authorisations, violations of the Recast, penalties taken as a result and enforcement of best practices.[43] It also provides for possible future guidance to support interagency cooperation between licensing and customs authorities.[44]
- Publications and reporting: the Commission will publish and regularly update Annex I and national control lists in all official EU languages.[45] The Union annual report on the implementation of controls should include information on licensing and enforcement of controls under this Regulation, while ensuring the protection of the confidentiality of certain data, especially in relation to national security concerns, risks of jeopardising commercial confidentiality or of allowing non-Union suppliers to undercut restrictive licensing decisions.[46]
- Implication for businesses: businesses and civil society are to be consulted, where appropriate, by the Dual-Use Coordination Group and other technical expert groups.[47]
- Implication for businesses: businesses will gain a better understanding of licensing decisions made by authorities and are better informed when applying for export authorisations.
How is the Recast likely to be received?
The Recast has already been the target of some criticism, namely in relation to the extension of a catch-all provision to include items that may cause human rights and international humanitarian law violations, as this could complexify the foreseeability of export authorisations. Businesses fear the additional controls and reporting obligations introduced by the Recast, as well as the administrative burden of implementing an ICP under threat of seeing their export applications refused. Moreover, what constitutes the appropriate ‘’due diligences’’ to be carried out by businesses is not further defined in the Recast than ‘’transaction screening measures” [48] – businesses having to rely on the discretionary authority of Member States, which runs against the intention of the Recast to harmonize export controls.
Several human rights organizations,[49] in turn, have noted positive elements within the Recast, but have criticised the lack of safeguards for human rights and security across the EU. Emphasizing that original stronger provisions of the Commission’s proposal have been watered down – e.g. including cyber-surveillance technology in the definition of dual-use items in its Article 2 – they revendicate the Recast as a minimum baseline for the export control of dual-use items.[50]
Either way, it is evident that striking a balance between ensuring global security, respect for human rights, the appropriate degree of transparency and robustness of the export control system on the one hand, and permitting a level playing field and legitimate trade on the other, is no mean feat. While the results that the Recast yields in terms of clear, effective and efficient export control remain to be seen, its enforcement will require the full awareness and cooperation of all Member States and relevant stakeholders.
Get in touch
The EU and US trade law specialists of BenninkAmar Advocaten are following the developments and legal implications of the EU Dual-Use Regulation Recast closely. Should you require advice or wish to further discuss, please feel free to reach out to us. You can reach us by telephone at +31 20 308 5918 and by e-mail at info@batradelaw.com.
[1] Report from the Commission to the Council and the European Parliament on the implementation of Regulation (EC) No 428/2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items, 16 October 2013; Legislative Resolution of the European Parliament of 3 April 2014 on the Council position at first reading with a view to the adoption of a regulation of the European Parliament and of the Council amending Regulation (EC) No 428/2009.
[2] Regulation (EU) 2021/… of the European Parliament and of the Council setting up a Union regime for the controls of exports, brokering, technical assistance, transit and transfer of dual-use items (recast). The Parliament approved the text of the Recast in plenary on 25 March 2021. The Council adopted the text of the Recast on 10 May 2021. The number of the Regulation will be attributed upon publication in the EU Official Journal.
[3] Council of the EU Press release, Trade of dual-use items: new EU rules adopted,10 May 2021.
[4] Article 2 (1) Council Regulation (EC) No 428/2009 of 5 May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items.
[5] Dual-use trade controls, Ec.europa.eu.
[6] E.g. United Nations Security Council Resolution (UNSR) 1540 (2004), the Australia Group, the Missile Technology Control Regime, the Nuclear Suppliers Group, the Wassenaar Arrangement and the Chemical Weapons Convention.
[7] Article 4 and Article 8 Council Regulation (EC) No 428/2009 of 5 May 2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual-use items.
[8] Para. 1, Preamble, Recast.
[9] Article 2 (21), Recast.
[10] Article 5 (1), Recast.
[11] Article 5 (3), Recast.
[12] Article 5 (4), Recast.
[13] Article 5 (6), Recast.
[14] Article 26 (2), Recast.
[15] Para. 39, Preamble, Recast.
[16] Para. 8, Preamble, Recast.
[17] Article 5 (2), Recast.
[18] Article 5 (6), Recast.
[19] Para. 5, Preamble, Recast.
[20] Article 5 (1), Recast.
[21] Article 9 (1), Recast.
[22] Article 10 (1), Recast.
[23] Article 10 (1), Recast.
[24] Article 10 (3), Recast.
[25] Article 2 (21), Recast.
[26] Article 15 (2), Recast.
[27] Para. 7, Preamble, Recast.
[28] Article 12 (4), Recast.
[29] Para. 18, Preamble, Recast.
[30] Para. 20, Preamble, Recast.
[31] Article 2 (1), Recast.
[32] Paras. 7 and 11, Preamble, Recast.
[33] Section G, Annex II, Recast.
[34] Para. 19, Preamble, Recast.
[35] Para. 30, Preamble, Recast; Article 2 (8), Recast.
[36] Article 2 (9), Recast.
[37] Paras. 13 and 15, Preamble, Recast.
[38] Article 12, Recast.
[39] See Part 2, Section A, Annex II, namely Australia, Canada, Iceland, Japan, New Zealand, Norway, Switzerland, Liechtenstein, United Kingdom or United States.
[40] Article 8 (1) and (3), Recast.
[41] Para. 13, Preamble, Recast; Article 2 (10), Recast.
[42] Paras. 26 and 36 Preamble, Recast.
[43] Paras. 30 and 37 Preamble, Recast; Article 25(2), Recast.
[44] Article 21 (5), Recast.
[45] Para. 24, Preamble, Recast.
[46] Para. 35, Preamble, Recast.
[47] Para. 30, Preamble, Recast.
[48] Para. 7, Preamble, Recast.
[49] E.g. Access Now, Amnesty International, Committee to Protect Journalists, International Federation for Human Rights, Human Rights Watch, Privacy International, and Reporters Without Borders.
[50] Access Now, New EU dual use export control rules finally adopted, but leave a lot of room for improvement, 25 March 2020. A coalition of NGOs has published a set of recommendations to bolster export controls and the protection of human rights, i.e., Human Rights Organisations’ Response to the Adoption of the New EU Dual Use Export Control Rules, March 2021.