U.S. CNC Shops: 3 Procurement Checks for ITAR Machining Compliance
Position：
/

U.S. CNC Shops: 3 Procurement Checks for ITAR Machining Compliance

2026-09-20 03:38:25

Engineer reviewing controlled CNC machining data

If your shop cuts, finishes, or stores technical data for defense articles, ITAR almost certainly applies, whether or not you ever ship a part overseas. Register with the Directorate of Defense Trade Controls (DDTC), classify every part against the U.S. Munitions List, and lock down technical-data access to authorized U.S. persons before you take another purchase order. Recordkeeping and a written Technology Control Plan (TCP) aren’t optional add-ons; they’re the paperwork that proves you did the first three things right.

TL;DR:

  • Manufacturing defense articles triggers ITAR registration regardless of whether any parts are shipped abroad, with renewal deadlines strict and failure risking work stoppage.
  • Technical data includes CAD files, process instructions, inspection procedures, emails, and chat messages, with unauthorized foreign access being a frequent enforcement cause.
  • Correctly classifying parts before production prevents costly compliance mistakes, and a formal Commodity Jurisdiction request is essential for ambiguous cases.
  • Implementing shop-floor and data controls, such as project segmentation, U.S.-based hosting, encryption, and visitor screening, is vital to prevent data leaks and violations.
  • Verifying subcontractor compliance involves thorough questionnaires, clear flow-down clauses, and documented proof, as supply-chain violations are now heavily scrutinized.
WJ Prototypes
Move From Design To Production
WJ Prototypes supports precision CNC machining and low-volume manufacturing for product teams developing complex parts and prototypes.

Table of Contents

Who Must Register and When ITAR Machining Compliance Rules Apply

Registration isn’t triggered by exporting. It’s triggered by manufacturing. Under 22 CFR § 122.1, any U.S. person who manufactures, exports, temporarily imports, or brokers defense articles, or who furnishes defense services, must register with DDTC, and that registration renews annually. A shop that machines a bracket for a fighter jet program and never sends a single part outside U.S. borders is still on the hook, because the manufacturing itself is the regulated activity.

A few distinctions matter for procurement teams building out ITAR compliance guidelines internally:

  • Manufacturing registration applies the moment you produce a USML-listed item, regardless of destination.
  • Brokering registration is a separate category for firms that arrange defense trade without manufacturing anything themselves.
  • Registration fees and renewal deadlines are strict; letting registration lapse mid-contract can freeze active work.
  • Registration alone doesn’t authorize exports. You still need a license or an applicable exemption for any transfer to a foreign person or country.

Treat registration as the floor, not the finish line, of ITAR compliance for manufacturers.

What ITAR Controlled Technical Data Actually Covers

Technical data is broader than most shop floors assume, and that gap is where a lot of unintentional violations start. ITAR defines technical data as information required to design, develop, produce, manufacture, assemble, operate, repair, test, maintain, or modify a defense article, and it doesn’t have to be a stamped drawing to count, per the Berkeley Lab export control guidance.

In a machining environment, that includes:

  • CAD/CAM files and toolpaths that encode geometry and process know-how
  • Process sheets, work instructions, and fixture designs
  • QA and inspection procedures written for a specific defense part
  • Repair and rework manuals
  • Emails, chat messages, or screen shares that describe how a part is made

DDTC’s own compliance guidance identifies unauthorized foreign-person access to technical data, alongside misclassification, as one of the most frequent causes of enforcement action, according to its Compliance Program Guidelines.

That’s the “deemed export” rule in action: a foreign national viewing a CAD file over someone’s shoulder in a U.S. facility, or a vendor portal with an offshore administrator, can constitute an unauthorized export even though nothing crossed a border. Mitigate it by marking files at creation, segmenting repositories by project and citizenship status, and requiring U.S.-person-only credentials on anything that touches ITAR-controlled technical data.

Classifying Parts and Requesting a Commodity Jurisdiction Determination

Classification comes before almost everything else, because it determines whether you’re operating under the ITAR-controlled U.S. Munitions List or the Commerce Department’s Export Administration Regulations (EAR). Guessing wrong is one of the costliest mistakes in defense manufacturing compliance.

  1. Build an internal checklist. Document the part’s function, design intent, original end use, and technical specifications for every job that touches a defense program.
  2. Compare against the USML categories. Most CNC shops working defense contracts will find their parts fall under Category VIII (aircraft), XII (fire control), or similar hardware categories, but component-level ambiguity is common.
  3. Escalate genuinely unclear cases. When function or end use isn’t obvious from the drawing package, request a formal Commodity Jurisdiction determination from DDTC rather than assuming EAR treatment, since a CJ is the most defensible way to resolve the question, per practical CJ guidance.
  4. Document every determination, including the reasoning, the date, and who signed off, so the file can withstand an audit years later.

Misclassifying a USML part as EAR-controlled doesn’t just risk a fine. It can unravel an entire contract’s paper trail retroactively.

Practical Technical-Data and Shop-Floor Controls

A TCP only works if it’s specific to how your shop actually moves data, not a template pulled off the internet. Core elements should include project-based segmentation, documented access approvals, consistent data marking, audit logging, and a written incident-response path.

Five technical control program components

On the IT side, require U.S.-based hosting or U.S.-person system administration, encryption that meets NIST-validated standards, multi-factor authentication, and least-privilege access rules, since aligning controls to frameworks like NIST 800-171 gives your program something auditable rather than aspirational, per the same DDTC guidelines. Continuously encrypted data using approved standards can, under certain conditions, avoid triggering export authorization during transit or storage, according to federal guidance on technical-data handling, but that exception depends entirely on getting the encryption architecture right.

On the floor itself: screen visitors before they enter machining bays tied to defense work, escort anyone without clearance, restrict what’s visible on shop-floor monitors, and mark physical travelers and inspection reports the same way you mark digital files.

Pro Tip: Audit your file-sync tools before you audit your policies. Dropbox folders, personal cloud drives, and “convenient” integrations between your ERP and a scheduling app are where technical data leaks out quietly, long after everyone forgot the sync was ever turned on.

Vetting Subcontractors: The Procurement Checklist for ITAR Machining Requirements

Supply-chain exposure is now where regulators are looking hardest. Buyers who assume a subcontractor’s compliance without verifying it are absorbing that subcontractor’s risk directly.

  1. Send a supplier questionnaire before award, covering DDTC registration status, where data is hosted, who has administrative access, whether they use their own subcontractors, and whether any foreign ownership, control, or influence (FOCI) factors apply.
  2. Write explicit flow-down clauses into the purchase order, spelling out technical-data handling requirements, incident-notification timelines, and your right to audit their facility or systems.
  3. Require documented proof for higher-risk work, meaning signed attestations, a real TCP on file, and evidence of employee training, not just a verbal assurance that “we’re ITAR compliant.”

Supply-chain risk is now a primary enforcement focus for DDTC, which means the attestation you skip today is the finding an auditor circles tomorrow, according to Cleared Systems’ analysis of recent supply-chain enforcement trends. Shops sourcing aerospace-grade CNC parts internationally should apply the same diligence to every link in the chain, not just the prime contractor relationship.

Common ITAR Violations and What They Cost You

Most enforcement actions trace back to a small set of repeat offenses, not exotic espionage scenarios.

  • Unauthorized disclosure of technical data to a foreign person, often through cloud storage, email, or a poorly screened visitor
  • Misclassification that treats a USML part as EAR-controlled
  • Operating on an expired or improperly scoped export license
  • Failing to flow ITAR obligations down to subcontractors who then mishandle data

Expired licenses, cloud storage misconfigurations, and unmonitored supplier access are among the specific failure patterns DDTC has flagged as driving recent enforcement activity, per Cleared Systems’ review.

Penalties range from civil fines and consent agreements with ongoing monitoring to, in willful cases, criminal charges. If you discover a violation internally, a voluntary disclosure to DDTC, filed promptly and with counsel involved, is consistently treated as a mitigating factor rather than an admission that closes doors.

Building an ITAR Compliance Program: Governance That Holds Up

An effective program needs a named Empowered Official with the authority to sign export documents, halt shipments, and answer directly to DDTC when questions arise. Around that person, build:

  • Role-based training that walks machinists, quality inspectors, and procurement staff through scenarios specific to their job, not a generic slideshow
  • A documented audit cadence, ideally annual at minimum, with findings tracked to closure
  • Recordkeeping that meets the retention requirements under 22 CFR Part 130, covering manufacture, acquisition, and disposition of both defense articles and technical data
  • A license-tracking system that flags expirations before they lapse mid-contract

Bring in export counsel or an outside auditor whenever classification is genuinely ambiguous or when a self-identified incident might warrant voluntary disclosure.

A Procurement Manager’s Honest Priority List

Skip the glossy binder. Classification, data boundaries, and supplier flow-down protect you more than a hundred pages of unused policy. Spend your first dollar on auditable controls and documented training, and escalate any ambiguous classification to counsel before it becomes a finding, not after.

— Nas

Where to Verify the Rules Yourself

Read the regulations directly rather than relying on secondhand summaries. Start with 22 CFR § 122.1 on registration, the DDTC Compliance Program Guidelines for ICP structure, and the technical-data definition guidance for scope questions.

Where to Verify the Rules Yourself — overview diagram

Manufacturers weighing whether to build out full ITAR-grade internal capability versus sourcing non-restricted prototyping elsewhere can review WJ Prototypes’ CNC machining service for commercial and industrial parts that fall outside USML classification, or explore precision tolerances achievable in aerospace-grade CNC work for non-controlled aerospace components. For engineering-side specification guidance on aerospace parts generally, Anderson Australia’s aerospace CNC machining guide covers what to call out on a drawing package before it ever reaches a shop floor.

Sources

FAQ

Are You a U.S. Person for ITAR Purposes?

A U.S. person under ITAR is a U.S. citizen, lawful permanent resident, or protected individual, along with any corporation, business, or organization incorporated in the United States. If your workforce includes foreign nationals without permanent resident status, they generally count as foreign persons for deemed-export purposes, regardless of where they physically sit.

What Are the Most Common ITAR Violations?

The most frequent violations are unauthorized disclosure of technical data to a foreign person, misclassifying a USML item as EAR-controlled, operating under an expired or improperly scoped license, and failing to flow ITAR requirements down to subcontractors. Cloud storage misconfigurations and unscreened supplier access have become especially common triggers in recent enforcement activity.

Which Actions Are Necessary to Comply With ITAR?

At minimum, register with DDTC if you manufacture a USML-listed item, classify every part correctly or request a formal Commodity Jurisdiction determination when ambiguous, and restrict technical-data access to authorized U.S. persons only. Layer in a written Technology Control Plan and consistent recordkeeping to make those three actions auditable.

Am I Eligible to Register With DDTC?

Eligibility generally requires being a U.S. person, meaning a U.S. citizen or a business entity incorporated and located in the United States, engaged in manufacturing, exporting, temporarily importing, or brokering defense articles or services. Registration doesn’t guarantee a license will be granted for any specific export. It’s a prerequisite for seeking one.