Cryptography, Cloud & Export Controls: What IT Teams Must Know
Export controls apply not only to physical goods, but also to software, encryption technology, and data stored or transmitted digitally. Organisations that fail to manage controlled data across cloud platforms, employee devices, and third, party suppliers face serious legal exposure. This post breaks down the key compliance obligations and practical steps to manage them.
Global trade compliance has long been associated with freight manifests, commodity codes, and customs declarations. But the rules governing what can cross a border now extend into an area most legal and compliance teams do not expect: your IT infrastructure.
Encryption software, technical data stored on laptops, files uploaded to cloud platforms and even help desk employees remotely accessing a colleague's computer, all of which may trigger export control obligations. As technology develops faster than regulation, the gap between what organisations do and what the law requires is widening.
This post draws on key themes from a recent workshop, CTRL + ALT + COMPLY: IT, Encryption, Cloud and AI, hosted by Andrew Skinner, export controls solicitor, Lauren Nazer Trade Control Manager of Babcock Corporate Services Ltd and to help compliance, legal, and IT professionals understand where the risks lie and how to address them. This workshop formed part of a wider conference organised by ADS Group Ltd, and in particular Brinley Salzmann, Director, Overseas & Exports at ADS Group Ltd.
What export controls apply to cryptography and information security?
Most people are familiar with export controls on physical goods, including military and dual-use list-controlled goods. Fewer realise that the same frameworks extend to software and technology, including encryption.
Under the Wassenaar Arrangement, which underpins dual-use export control regimes in the UK, EU, and many allied nations, Category 5 Part 2 (Information Security) specifically controls cryptographic items. This covers encryption software, systems designed to protect data, and the technical knowledge used to develop or deploy them.
In the United States, the Export Administration Regulations (EAR) distinguish between "Restricted" and "Unrestricted" encryption. The classification relies on factors such as key length, algorithm type, and intended end-use. Organisations exporting US, origin encryption technology, even embedded within commercial software, must understand which category applies.
One important relief mechanism is the Note 3 (Mass Market) decontrol, which can remove items from control if they satisfy specific criteria, including general availability to the public and limited ability to modify cryptographic functionality. However, relying on this exemption without proper analysis is a compliance risk
Beyond encryption software, controls also apply to IT servers, printers, and other equipment that may retain controlled technology or software in their onboard memory, even after a factory reset. This is an area where many organisations may unknowingly fall short.
Are there new export controls covering quantum technology and semiconductors?
Yes, and they are expanding rapidly. Quantum tech and advanced semiconductors have become central for geopolitical competition, triggering regulatory measures from both the US and UK governments.
The US Bureau of Industry and Security (BIS) has introduced increasingly stringent controls on advanced chips and semiconductor manufacturing equipment, restricting their export to certain countries and entities. Controls on quantum computing hardware, software, and related technology have followed a similar trajectory.
For organisations working in these sectors, or those whose supply chains intersect with them, keeping up with regulatory updates is not optional. The rules are moving quickly, and the consequences for non-compliance are considerable.
What are the export control risks for travelling employees?
This is one of the most overlooked areas of trade compliance and one of the most practically significant. When a sales engineer boards a flight with a laptop containing controlled technical data, or downloads a controlled document whilst working from a hotel in a foreign country, an unlicenced export may have just occurred.
Under most export control regimes, the transmission of controlled technical data across borders constitutes an export, regardless of whether any physical goods are involved. This applies to:
- Laptops and devices carrying controlled software or technical data
- Remote access to controlled files from abroad
- Downloading an email with controlled data onto a device whilst travelling overseas
The individual traveller may not even be aware that the data is controlled. That is precisely why governance frameworks must reach beyond the trade compliance team and into HR onboarding, travel policies, and IT device management.
How should organisations manage the lifecycle of export-controlled data?
Managing controlled data is not a one-time exercise, it requires ongoing governance across the entire data lifecycle. Lauren Nazer, Trade Control Manager at Babcock Corporate Services Ltd, who co-presented the CTRL + ALT + COMPLY workshop, put it plainly:
"Our workshop explored some of the difficulties of export controls in today's quickly evolving technology landscape. We discussed the challenges surrounding IT, encryption, cloud computing and AI, and how organisations are able to navigate this increasingly complicated regulatory environment. It was fantastic to see so much engagement and discussion around these important topics."
That complexity manifests across multiple practical areas:
Data and lifecycle controls management
Controlled data must be clearly identified and marked from the point it enters the organisation. Standards for securely erasing controlled data from equipment prior to disposal, redeployment, or return to a supplier must be documented and consistently followed. Strong controls are also needed for employees who join, move across roles, or leave the company, each of which creates a data access risk.
IT environments change constantly. Policies and processes need to be held in a single, accessible location so that updates are reflected across the organisation without delay.
Governance and visibility
Export control checkpoints should be embedded into IT policies and processes, not bolted on as an afterthought. This means knowing which data is controlled, who can access it, and under what conditions it can be shared or transferred.
Under 22 CFR § 120.54(a) of the ITAR (International Traffic in Arms Regulations), specific rules govern the sending, storage, and transfer of controlled technical data. ITAR applies to defence/military goods, related technologies and entails harsh penalties for violations, including criminal prosecution.
Understanding your data flow
One of the most important and most frequently neglected steps is end-to-end data mapping. Working alongside IT colleagues, compliance teams need to trace at which controlled data is stored, who can access it, and how it moves through the organisation's systems.
This includes understanding for example the export control implications of SaaS platforms, SharePoint environments, and AI tools, all of which may store, process, or transmit data in ways that create compliance exposure. The question of whether controlled data is protected by genuine end-to-end encryption.. Working alongside IT colleagues, compliance teams need to trace and map export-controlled technology and software, and ensure that any access is properly authorised.
What are the supplier and third-party access risks in cloud environments?
Cloud infrastructure creates a category of risk that sits at the intersection of IT security and export controls: third-party access.
Bring Your Own Key (BYOK) encryption arrangements, where organisations manage their own encryption keys, grant greater control over who can access data. But even with BYOK in place, cloud providers, managed service providers, and help desk personnel may retain administrative access that could, in certain circumstances, constitute an unlicenced export.
Suppose a scenario where a help desk employee based in a restricted country remotely accesses the computer of a UK-based engineer who works with military or dual-use -controlled data. That access, however routine it may appear operationally could represent a serious compliance breach.
Organisations must perform thorough due diligence on supplier agreements, understand who holds administrative access to cloud environments, and ensure that contractual protections correspond to their export control obligations.
Who within the organisation should own export control compliance?
Export controls cannot be managed by a single team operating in isolation. Effective compliance requires shared ownership across the business—trade compliance, IT, HR, legal, and senior leadership all have a role to play.
In practice, this means:
- Trade compliance teams define the obligations and identify controlled data.
- IT departments implement the technical controls, data mapping, and access restrictions.
- HR teams manage the employee lifecycle controls—particularly joiners, movers, and leavers.
- Senior leadership guarantees adequate resources, visibility, and accountability.
Without that alignment, policies remain on paper while the actual data flows, through cloud platforms, employee devices, supplier systems, and AI tools, remain unexamined and uncontrolled.
Taking the Next Step in IT Trade Controls Compliance
The regulatory setting governing cryptography, cloud storage, and data transfers is not static. New controls on quantum technology and advanced semiconductors show that governments are paying close attention to the technology sector. Enforcement actions are following.
The organisations best positioned to manage this environment are those that have already done the foundation: mapping their data flows, embedding controls into IT governance, and constructing genuine cross-functional ownership of compliance. Taking the next step means treating export controls as an ongoing part of IT, legal, and compliance operations, not a one-off exercise.
If your organisation is working through these issues, whether for the first time or in response to a specific concern, specialist legal advice is a sound starting point. Andrew Skinner at AM Skinner Solicitors offers a free initial 15-minute consultation for organisations seeking practical guidance on export controls and trade compliance.
Frequently Asked Questions
Does exporting software or data require an export licence?
It can. Software containing encryption functionality, or technical data controlled under frameworks such as the UK’s Export Control Act 2002, Export Control Order 2008, and assimilated Council Regulation (EC) No 428/2009, as well as the US EAR or ITAR, may require a licence before it is transmitted, shared, or taken across a border. The specific requirements depend on the classification of the item, the destination country, and the end-user/end-use.
What is the Note 3 Mass Market decontrol and when does it apply?
Note 3 (Mass Market) is an exemption under Information Security export controls that can remove certain widely available commercial encryption products from licencing requirements. It applies when specific criteria are met, including general public availability and restrictions on cryptographic customisation. It should not be assumed to apply without a formal assessment.
Can an employee travelling abroad trigger export control obligations?
Yes. Carrying a laptop loaded with controlled technical data, or remotely accessing controlled files from a foreign country, may constitute an unlicenced export under UK, US, or EU regulations. Travel policies and device management practices should reflect these obligations.
What is BYOK and why does it matter for export controls?
Bring Your Own Key (BYOK) is an encryption key management approach where the organisation, rather than the cloud provider, controls the encryption keys. It can reduce third-party access risks, but it does not eliminate them. Administrative access by cloud providers or managed service personnel may still create compliance exposure if that access touches export-controlled data.
What are the risks of using AI tools and SaaS platforms with controlled data?
AI tools and SaaS platforms may store, process, or transfer data in jurisdictions or through infrastructure that creates export control exposure. Organisations should map how controlled data interacts with these systems and assess whether adequate encryption and access controls exist in place before use.
Who should I contact for specialist advice on IT export controls?
Andrew Skinner at AM Skinner Solicitors is a solicitor and Chartered Engineer specialising in export controls, sanctions, and trade compliance. He offers a free initial 15-minute consultation and can be reached at +44 (0) 1423 734019 or contact him here.