Dual-Use Export Controls and BAFA Licences
Dual use export controls affect far more German companies than defence suppliers. Machinery, electronics, chemicals and software can be listed in Annex I of Regulation (EU) 2021/821 or caught by catch-all clauses. This guide explains classification, BAFA licences and general authorisations, internal compliance programmes and the penalties for getting it wrong.

Key takeaways
- Annex I items need a BAFA licence for exports outside the EU; the German Export List adds national controls.
- Catch-all clauses capture unlisted items intended for WMD, military end-use in embargoed states or repression.
- Individual and global licences are generally valid for up to two years.
- Global licences require an internal compliance programme unless BAFA considers it unnecessary.
- Unlicensed exports are criminal; reckless breaches with listed items are now punishable too.
Dual use export controls in Germany: the short answer
Dual use export controls in Germany are governed primarily by the EU Dual-Use Regulation (EU) 2021/821, supplemented by the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, AWG) and Ordinance (Außenwirtschaftsverordnung, AWV). Exports of items listed in Annex I to the Regulation require a licence for every destination outside the EU. Unlisted items can also require a licence under the catch-all clauses if they are or may be intended for weapons of mass destruction, military end-use in embargoed countries or internal repression through cyber-surveillance. In Germany, the Federal Office for Economic Affairs and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle, BAFA) grants individual, global and general licences.

Breaches are serious. Exporting listed dual-use items without a licence is a criminal offence under § 18(5) AWG, and since the transposition of the EU Sanctions Directive, reckless breaches involving listed items can also be punished. For German manufacturers, especially in machinery, electronics, chemicals, optics and software, effective dual use export controls are therefore a board-level compliance topic.
The legal framework
The Dual-Use Regulation (EU) 2021/821 applies directly in all Member States. It covers exports, brokering, technical assistance, transit and, for the most sensitive items in Annex IV, transfers within the EU. Annex I contains the EU control list, structured in ten categories from nuclear materials (Category 0) to propulsion (Category 9), and is updated regularly by delegated regulation to reflect decisions of the multilateral export control regimes.
German law adds national elements. Part I Section A of the German Export List (Ausfuhrliste) covers military goods; Section B contains national dual-use controls, which require a licence under § 8 AWV. Section 9 AWV adds national catch-all controls, for example for unlisted goods intended for nuclear facilities in specified countries. The AWG contains the criminal and administrative penalties, and BAFA is the competent licensing authority under § 13 AWG.
Annex I: classifying your products
Classification is the first step in every assessment of dual use export controls. Exporters must compare the technical parameters of their goods, software and technology with the entries in Annex I and the German Export List. Many controls depend on precise performance thresholds, such as accuracy of machine tools, frequency of electronic components, encryption functionality or the purity of chemicals.
- Goods: finished products, components, materials and production equipment.
- Software: including software specially designed for listed goods.
- Technology: technical information for development, production or use, transferred by any means, including email, cloud access or visits by foreign engineers.
BAFA offers a formal enquiry (Auskunft zur Güterliste) where classification is uncertain. A negative result gives comfort for the product as described, but not against catch-all controls, which depend on end-use and end-user.
Catch-all clauses for unlisted items
Unlisted items can require a licence under the catch-all provisions of the Regulation. The table summarises the main triggers.
| Provision | Trigger | Exporter's duty |
|---|---|---|
| Article 4(1)(a) Regulation 2021/821 | Items are or may be intended for chemical, biological or nuclear weapons or missiles | Licence required once informed by BAFA; notify BAFA if aware of such use |
| Article 4(1)(b) | Military end-use in a country subject to an arms embargo | Licence required once informed; notify if aware |
| Article 4(1)(c) | Use as parts of military items exported illegally from a Member State | Licence required once informed |
| Article 5 | Cyber-surveillance items intended for internal repression or serious human rights violations | Licence required once informed; notify if aware from due diligence |
| Article 10 | Items on another Member State's national control list intended for uses of concern | Licence required once informed |
| § 9 AWV | National catch-all, e.g. items for nuclear facilities in listed countries | Licence required once informed by BAFA; notify if aware |
Knowledge is the critical element. If the exporter is aware that unlisted items are intended for a listed use, it must notify BAFA, which then decides whether a licence is required. Exporting before that decision is itself an offence under § 18(5) no. 2 AWG. Red flags include evasive customers, implausible end-uses, unusual shipping routes, cash payments and requests for military specifications.
BAFA licences and general authorisations
Article 12 of the Regulation provides four types of export authorisation. Individual and global licences are valid for up to two years unless BAFA decides otherwise, and large project authorisations for up to four years.
- Individual licence: for one or more items to one end-user. An end-use statement is generally required.
- Global licence: for types or categories of items to one or more end-users or countries. Users must implement an internal compliance programme (ICP) unless BAFA considers this unnecessary.
- National general authorisations: BAFA has issued general authorisations (Allgemeine Genehmigungen) for defined items, destinations and situations, which exporters can use after registration and subject to reporting.
- Union general export authorisations: EU001 to EU008 in Annex II cover, for example, low-risk destinations, certain telecommunications and intra-group technology transfers, subject to conditions and registration.
General authorisations are the fastest route, but their conditions are strict. Check excluded destinations and end-uses, register before first use, keep records and meet reporting deadlines. Using a general authorisation where its conditions are not met is treated as exporting without a licence.
Processing times
BAFA processing times depend on the item, destination and end-user and can range from days for routine cases to months for sensitive applications involving consultations with other ministries. Exporters should file early, provide complete technical documentation and end-use statements and plan customer delivery dates accordingly.
Internal compliance programmes
An ICP is defined in Article 2 of the Regulation as ongoing effective, appropriate and proportionate policies and procedures to facilitate compliance, including due diligence on end-users and end-uses. The Commission's Recommendation (EU) 2019/1318 identifies seven core elements, which BAFA's guidance also reflects:
- top-level management commitment to compliance;
- organisational structure, responsibilities and resources, including an export control officer (Ausfuhrverantwortlicher) at board level for licence applications;
- training and awareness raising;
- transaction screening procedures, covering classification, end-use and end-user checks, sanctions lists and red flags;
- performance review, audits, reporting and corrective actions;
- recordkeeping and documentation;
- physical and information security, including controls on technology transfer by email and cloud.
In Germany, BAFA expects the export control officer to be a member of the management board or managing directors. This person bears responsibility for the reliability of the company in export matters, which BAFA assesses when deciding on licences.
Penalties and voluntary disclosure
Exporting dual-use items without a required licence, or before BAFA has decided on a catch-all notification, is punishable by imprisonment from three months to five years under § 18(5) AWG. Reckless breaches involving items in Annex I or IV can be punished with imprisonment of up to three years or a fine (§ 18(8a) AWG). Negligent breaches are administrative offences under § 19 AWG.
For negligent administrative offences, § 22(4) AWG offers a voluntary disclosure route: no fine is imposed if the breach is detected by internal controls, reported before investigations begin and remedied. Companies that discover errors, such as incorrect classifications or missing registrations, should assess quickly whether this route is open. Repeated or intentional breaches can lead to criminal proceedings, corporate fines under §§ 30 and 130 OWiG and loss of reliability for future licences.
Brokering, technical assistance and transit
Dual use export controls are not limited to physical exports by the manufacturer. The Regulation also regulates:
- Brokering services (Article 6): negotiating or arranging transactions for listed items between third countries, or selling items located in third countries, requires a licence where the broker has been informed or is aware that the items are intended for WMD or military uses of concern.
- Technical assistance (Article 8): repair, development, training or consulting services connected with listed items can require authorisation in similar circumstances.
- Transit (Article 7): the transit of non-Union listed items through the EU can be prohibited if they are intended for WMD-related uses.
- Intra-EU transfers (Article 11): the most sensitive items in Annex IV require a licence even for transfers within the Union.
Trading companies, freight forwarders, engineering service providers and group companies providing support to foreign affiliates should therefore assess whether they are exporters, brokers or providers of technical assistance under the Regulation.
Interaction with sanctions
For some destinations, dual use export controls overlap with sanctions regimes. EU sanctions against Russia and Belarus prohibit, with narrow exceptions, the export of all dual-use items to those countries, and add lists of common high priority items and third-country end-users. Sanctions against Iran, North Korea and other countries contain their own lists and prohibitions. An item that could be licensed under the Dual-Use Regulation may therefore be prohibited outright under a sanctions regulation. Screening procedures must combine both regimes, and BAFA processes licences and enquiries under both.
Increasingly, foreign export control laws also matter. US re-export controls can apply to German products that contain US-origin content above de minimis levels or are made with certain US technology, and China has introduced its own dual-use export control regime. Group-wide classification databases should record the origin of components and technology to manage these extraterritorial rules.
Technology transfer and intangible exports
Dual use export controls also apply to intangible transfers. Sending controlled technical drawings by email, granting a foreign subsidiary access to a server with controlled technology, or providing technical assistance during a factory visit can all be exports. Research institutions and companies with international R&D teams should map where controlled technology is stored and who can access it, and apply access controls by nationality and location where required.
Practical safeguards include classifying technology at document level, labelling controlled files, restricting cloud folders to authorised users and logging access. Visits by foreign engineers and joint development projects with non-EU partners should be checked in advance, because a single presentation or a shared CAD file can amount to a licensable transfer.
Illustration: a hypothetical German manufacturer of high-precision machine tools receives an order from a new customer in a non-EU country. The machine meets an Annex I parameter, so an individual licence is needed. During due diligence, the sales team learns that the customer supplies a defence company in an embargoed country. The company must notify BAFA, suspend the transaction and document its assessment, even if the specific machine variant were unlisted.
How TRW & Co helps with dual use export controls
We advise exporters, research institutions and investors on dual use export controls in Germany and the EU. We support classification projects, prepare licence applications and enquiries to BAFA, assess the use of general authorisations, design and audit internal compliance programmes and train management and staff. When breaches occur, we conduct internal investigations, assess voluntary disclosure under § 22(4) AWG and defend companies and individuals in administrative and criminal proceedings. Our work connects with our export control and sanctions and compliance management practices. Read also about Russia sanctions compliance and China's export controls. To discuss a classification or licence, contact us.
Frequently asked questions
How do I know whether my product is a dual-use item?
Compare its technical parameters with Annex I of Regulation (EU) 2021/821 and Part I Section B of the German Export List. Many entries depend on precise performance thresholds. Where classification is uncertain, BAFA can provide a formal enquiry on the goods list, which gives comfort for the product as described.
Can an unlisted product require a licence?
Yes. Under the catch-all clauses in Articles 4, 5 and 10 of the Regulation and § 9 AWV, a licence is required if BAFA informs the exporter that the items are or may be intended for weapons of mass destruction, military end-use in embargoed countries, internal repression or other listed uses. Exporters aware of such use must notify BAFA.
How long is a BAFA licence valid?
Individual and global export authorisations are valid for up to two years unless BAFA decides otherwise. Large project authorisations can be valid for up to four years. General authorisations remain usable as long as their conditions are met and the exporter is registered.
Do we need an internal compliance programme?
Exporters using global authorisations must implement an ICP under Article 12(4) of the Regulation unless BAFA considers it unnecessary. Even where not mandatory, an ICP is the most effective way to prevent breaches and to show reliability to BAFA and prosecutors.
What happens if we discover an unlicensed export?
Stop further shipments, preserve records and assess whether the breach was intentional, reckless or negligent. Negligent administrative offences can benefit from voluntary disclosure under § 22(4) AWG if detected by internal controls and reported before an investigation. Intentional or reckless breaches require specialist criminal advice.
Sources
General information only, not legal advice. References to statutes, courts and authorities describe published law and practice at the date shown.


