Examples
Worked examples
- Is an instance
A university engineering lab imports a high-performance oscilloscope whose bandwidth exceeds a specific performance threshold written into a CCL entry. The export control office compares the instrument's technical parameters against Category 3 (Electronics) of the CCL and self-classifies it under the matching ECCN rather than as EAR99, because it meets the control parameters described in that entry.
- Is an instance
A campus research group develops an encryption library as part of a funded project and plans to make the code publicly available. Because encryption functionality is addressed specifically under CCL Category 5, Part 2 (Information Security), the export control office reviews the software against that category's entries and applicable license exceptions before publication or foreign-national access, rather than assuming general-purpose software is automatically uncontrolled.
Counter-examples
Looks similar, but isn't
- Not an instance
A component designed and built specifically for a military rocket motor is not on the Commerce Control List at all. Items specifically designed, developed, configured, adapted, or modified for a military application are generally controlled under the US Munitions List (USML) administered by the State Department's Directorate of Defense Trade Controls (DDTC) under the International Traffic in Arms Regulations (ITAR), 22 CFR Parts 120-130 -- a separate regulatory list and a separate administering agency from the CCL/EAR/BIS regime, even though both are commonly discussed together as 'export control.'
Editorial commentary
The Commerce Control List (CCL) is the master list of items subject to the Export Administration Regulations (EAR) — so-called dual-use goods, software, and technology that have both civilian and military, terrorism, or weapons-of-mass-destruction-related applications. It is administered by the Department of Commerce’s Bureau of Industry and Security (BIS) and published as Supplement No. 1 to 15 CFR Part 774.
Anything the CCL doesn’t specifically list, but that is still subject to the EAR, falls into a residual classification called EAR99.
For a research institution, the CCL matters less as an abstract regulatory document and more as the reference an export control office actually works against every time it has to answer a concrete question: is this instrument, this software package, this technical dataset controlled, and if so, under what conditions can it be exported, shared with a foreign national on campus, or taken abroad?
How the CCL is organized: ten categories, five product groups
The CCL groups every controlled item into one of ten numbered categories (0 through 9), based on the item’s technology area:
| Category | Covers |
|---|---|
| 0 | Nuclear materials, facilities, and equipment (and miscellaneous items) |
| 1 | Special materials and related equipment, chemicals, microorganisms, and toxins |
| 2 | Materials processing |
| 3 | Electronics |
| 4 | Computers |
| 5 (Part 1) | Telecommunications |
| 5 (Part 2) | Information security |
| 6 | Sensors and lasers |
| 7 | Navigation and avionics |
| 8 | Marine |
| 9 | Aerospace and propulsion |
Within each category, entries are further split into five lettered product groups: (A) equipment, assemblies, and components; (B) test, inspection, and production equipment; (C) materials; (D) software; and (E) technology. A category number plus a product group letter plus three digits identifying the specific control reasons (national security, missile technology, nuclear nonproliferation, and so on) together make up the five-character Export Control Classification Number (ECCN) assigned to a matching item — see ECCN Determination Process for the step-by-step workflow an export control office runs to reach that classification, including self-classification against the CCL’s ‘Order of Review’ (15 CFR Part 774, Supplement No. 4) and the option to request a formal, binding classification from BIS.
EAR99: the residual category
Most items handled in day-to-day university research and commerce are not listed anywhere on the CCL. If an item is subject to the EAR but doesn’t match any CCL entry, it’s designated EAR99 — a catch-all that generally does not require a license for most destinations, end uses, and end users. EAR99 is not, however, a blanket exemption: shipping an EAR99 item to an embargoed country, a restricted party, or a prohibited end use (for example, certain weapons-of-mass-destruction-related end uses) can still trigger a license requirement.
How the CCL applies to university research and dual-use technology
Universities encounter the CCL primarily through equipment, software, and technical data that enter a research project — not, in most cases, through the research results themselves. Under National Security Decision Directive 189 (NSDD-189, 1985) and its implementing EAR provision (15 CFR 734.8), technology or software that arises during, or results from, fundamental research intended for open publication generally falls outside the EAR’s scope entirely. That exclusion, however, is scoped to a project’s published results — it does not retroactively declassify a controlled instrument, code library, or dataset that was brought into the project to begin with. This is why an export control office typically runs an ECCN classification on the inputs to a project (equipment purchased, software used, technical data received from a sponsor) as a separate exercise from evaluating whether the eventual publication qualifies for the fundamental research exclusion. See Export Control (EAR/ITAR) and International Research Collaboration for how these two analyses fit together in practice, and deemed export for the related question of when giving a foreign national access to CCL-controlled technology or source code itself counts as a regulated export.
Once an item is confirmed to sit on the CCL under a specific ECCN, institutions typically implement a Technology Control Plan (TCP) to document and enforce the access, storage, and handling restrictions that follow from that classification — for example, restricting physical or remote access to personnel who are US persons or otherwise cleared for the technology. Software specifically is its own recurring issue in a research setting; see software export controls for how source code, object code, and technology ‘released’ through publication or open repositories are treated under the CCL’s software (D) and technology (E) product groups.
Commerce Control List vs. US Munitions List
The CCL is not the only US export control list, and confusing the two is a common source of misclassification. Items specifically designed or modified for military use are generally controlled under the US Munitions List (USML), administered by the State Department’s Directorate of Defense Trade Controls (DDTC) under the International Traffic in Arms Regulations (ITAR), 22 CFR Parts 120-130 — a separate list, separate regulation, and separate administering agency from the CCL/EAR/BIS regime, even though both fall under the umbrella term ‘export control’ and are often discussed together in a research-compliance context.
Frequently asked questions
How many categories does the Commerce Control List have?
Ten, numbered 0 through 9, each covering a distinct technology area from nuclear materials (Category 0) to aerospace and propulsion (Category 9). Category 5 is split into two parts — telecommunications and information security.
What’s the difference between an ECCN and the Commerce Control List?
The CCL is the list itself; an ECCN is the five-character code assigned to a specific item once it has been matched against a CCL entry. Not every EAR-subject item has an ECCN — items that match no CCL entry are EAR99 instead.
Who administers the Commerce Control List?
The Department of Commerce’s Bureau of Industry and Security (BIS) administers the CCL as part of the Export Administration Regulations. BIS also operates the self-classification tools and the formal Commodity Classification (CCATS) process described in ECCN Determination Process.
Does the Commerce Control List apply to university research?
It can. The fundamental research exclusion can remove a project’s published results from EAR control, but equipment, software, and technical data used in the project are classified against the CCL independently of that exclusion — so dual-use instruments, code, and sponsor-furnished technical data brought into an otherwise fully publishable project can still carry export control obligations.
References
- Export Administration Regulations, 15 CFR Parts 730-774, and the Commerce Control List, Supplement No. 1 to 15 CFR Part 774 (including the ‘Order of Review,’ Supplement No. 4), administered by the Bureau of Industry and Security, US Department of Commerce.
- BIS, ‘Commerce Control List Overview and the Country Chart,’ bis.gov/regulations/ear/738, and BIS’s Interactive Commerce Control List, bis.gov.
- National Security Decision Directive 189 (1985), National Policy on the Transfer of Scientific, Technical and Engineering Information; 15 CFR 734.8 (EAR fundamental research provision).
- International Traffic in Arms Regulations, 22 CFR Parts 120-130, and the US Munitions List, administered by the Department of State’s Directorate of Defense Trade Controls.
Machine-readable encodings
Use in your systems
<role vocab="credit"
vocab-identifier="https://casrai.org/dictionary/"
vocab-term="Commerce Control List (CCL)"
vocab-term-identifier="https://casrai.org/dictionary/term/commerce-control-list-ccl" />{
"@context": "https://schema.org",
"@type": "DefinedTerm",
"@id": "https://casrai.org/dictionary/term/commerce-control-list-ccl",
"name": "Commerce Control List (CCL)",
"identifier": "https://casrai.org/dictionary/term/commerce-control-list-ccl",
"description": "The Commerce Control List (CCL) is the master list of 'dual-use' items -- goods, software, and technology with both civilian and military, terrorism, or weapons-of-mass-destruction-related applications -- that are subject to the Export Administration Regulations (EAR, 15 CFR Parts 730-774) and administered by the Department of Commerce's Bureau of Industry and Security (BIS). The CCL is organized into ten numbered categories (0-9) and, within each category, five lettered product groups (A-E); an item that matches a specific CCL entry is assigned an Export Control Classification Number (ECCN), while an item that is subject to the EAR but matches no CCL entry falls into the residual EAR99 classification.",
"inDefinedTermSet": "https://casrai.org/dictionary/domain/research-security#set",
"url": "https://casrai.org/dictionary/term/commerce-control-list-ccl",
"sameAs": [],
"license": "https://creativecommons.org/licenses/by/4.0/",
"publisher": {
"@id": "https://casrai.org/#organization"
},
"dateModified": "2026-07-30T05:49:13",
"inLanguage": "en"
}
