A deemed export doesn’t happen at a border crossing. It happens the first time a new lab member reads a controlled drawing, logs into a restricted instrument, or is talked through a piece of source code — and under US export control law, that moment can occur the day someone starts, not the day they’re formally badged in. This guide is a practical, PI-facing checklist for that specific moment: what a principal investigator (or the lab manager acting on their behalf) needs to check before granting an incoming international student, postdoc, or visiting scholar access to a lab that holds any export-controlled technology, software, or technical data.
CASRAI’s deemed export entry covers the operational definition of the rule itself; Export Control (EAR/ITAR) and International Research Collaboration covers the fundamental research exclusion and how a collaboration stays inside it; The Four Pillars of Export Control Compliance covers how a compliance office structures a deemed-export program overall. None of those walks through the actual onboarding sequence a PI or lab manager runs through for one incoming person. This page does — treat it as the checklist that sits between “someone has accepted an offer to join the lab” and “that person has been given a badge, a login, or hands-on access to equipment.”
This is not legal advice. Export control determinations are fact-specific, and the consequences of getting one wrong include civil penalties, debarment from federal funding, and — in willful cases — criminal liability for both the institution and the individual who authorized the release. Every step below assumes the PI is working with, not instead of, the institution’s designated Empowered Official or export control officer. The goal of this checklist is to make sure a PI knows what to ask and when to escalate, not to make the classification call independently.
Why onboarding is the trigger point, not the visa application
Most institutional export-control failures don’t happen because nobody knew the rule existed. They happen because the review that was supposed to occur before access was granted actually occurred after — or not at all — because onboarding is decentralized, fast-moving, and owned by several offices (the PI, the department, international student services, HR) none of which is solely responsible for the export-control check. A visa approval, an I-20, or a start date on an offer letter tells an institution that a person is authorized to be in the country and to work or study. It tells the institution nothing about whether that person can be given access to a specific piece of controlled technology — those are two entirely separate legal questions, decided under two entirely separate bodies of law (immigration law and export control law), and conflating them is one of the most common sources of deemed-export exposure in university labs.
Step 1 — Confirm whether there’s anything controlled in the lab at all
Before screening the person, confirm what, if anything, in the lab actually requires screening. Most university research is not export-controlled, because of the fundamental research exclusion: under EAR (15 CFR 734.8) and ITAR, technology or software that arises during, and is intended for publication from, fundamental research generally falls outside the regulations’ scope. See CASRAI’s fundamental research exemption entry for the operational boundaries of that exclusion — it has real limits (proprietary or government-restricted inputs, certain pre-existing technology, and specific controlled equipment are not automatically covered just because the surrounding project is otherwise open).
A PI onboarding a new lab member needs a straight answer to one question first: does this lab hold, or will this person be exposed to, any specific item with an Export Control Classification Number (ECCN) under the EAR, or an item on the US Munitions List (USML) under ITAR — see CASRAI’s ITAR US Munitions List (USML) guide — independent of whether the surrounding project is fundamental research? If the honest answer is no, the deemed-export screening steps below are largely moot for that lab, though restricted-party screening (Step 3) is still worth running as standard institutional practice. If the answer is yes, or “not sure,” that determination itself needs to be made or confirmed by the export control office, not assumed by the PI — this is the single most consequential step in the whole checklist, because everything downstream depends on it.
Step 2 — Determine the person’s export-control status, not their visa category
This is the step PIs most often get wrong, because it’s intuitive to treat “visa status” and “export-control status” as the same question. They aren’t. Under the EAR, a “foreign person” is any individual who is not a US citizen, not a lawful permanent resident (green card holder), and not a “protected individual” under 8 U.S.C. §1324b(a)(3) — a category that includes certain asylees and refugees. ITAR’s foreign-person definition (22 CFR 120.63) works the same way: US citizenship or lawful permanent residency takes a person outside the “foreign person” category regardless of what visa, if any, they hold or previously held.
The practical consequence: a green card holder or an asylee working in the lab is not a “foreign person” for deemed-export purposes, even though they are a non-citizen and even though HR or international-services paperwork may still flag them as “international” for other administrative reasons. Conversely, someone on a valid, fully authorized work visa is very much a foreign person under export control law — visa validity establishes the right to be present and to work; it says nothing about export-control status. A PI’s onboarding checklist needs to ask the citizenship/permanent-residency/protected-individual question directly, in addition to and separately from confirming the person’s immigration status is in order.
For a deemed export specifically, the relevant “destination” is the foreign person’s most recent country of citizenship or permanent residency — not their country of current physical presence, and not necessarily their country of birth.
Step 3 — Know what the visa category does and doesn’t tell you
International students, postdocs, and visiting scholars typically arrive under one of a small number of visa categories, each tied to a specific document a PI or department can and should look at during onboarding — but the visa category answers an immigration-status question, not the export-control-status question from Step 2. Use the table below as a reference for what to check, not as a substitute for the citizenship/permanent-residency determination.
| Common role | Typical visa category | Key document | What it establishes |
|---|---|---|---|
| International degree student | F-1 (student) | Form I-20 | Authorization to study; does not establish citizenship or permanent-residency status |
| Visiting scholar / exchange researcher / many postdocs | J-1 (exchange visitor) | Form DS-2019 | Sponsorship under a designated exchange-visitor program; some J-1 categories carry a two-year home-residency requirement relevant to other compliance questions, not to deemed-export status itself |
| Postdoc or visiting scholar in an employee role | H-1B (specialty occupation) | Form I-797 approval notice | Authorization for US employment in the sponsoring role; does not establish citizenship or permanent-residency status |
| Any of the above who has since obtained a green card | N/A — lawful permanent resident | Permanent Resident Card (Form I-551) | Removes the person from EAR/ITAR “foreign person” status regardless of prior visa history |
A practical onboarding note: institutions routinely reuse the same intake form for international-programs tracking, HR/payroll setup, and export-control screening, which can create the false impression that one office’s “yes, cleared” covers all three purposes. Confirm the export-control determination is actually being made — by the export control office, using the citizenship/permanent-residency test — rather than assuming it happened as a side effect of visa processing or HR onboarding.
Step 4 — Run restricted party screening on the individual
Independent of the deemed-export analysis above, most institutions run every incoming lab member — not only those who will touch controlled technology — through a restricted-party screening check against the Commerce Department’s Consolidated Screening List (which itself aggregates BIS’s Denied Persons, Entity, Unverified, and Military End-User Lists), the State Department’s debarment and nonproliferation lists, and Treasury/OFAC’s Specially Designated Nationals list. This checks whether the person, not just their country of citizenship, appears on a list that would prohibit or restrict engaging with them at all. CASRAI’s Restricted Party Screening guide covers how institutions structure this as a standing program; the point for a PI’s onboarding checklist is simply to confirm this screening step actually ran and was documented for this specific individual before lab access began, not just assumed to be part of “the paperwork HR already did.”
Step 5 — If the technology is controlled and the person is a foreign person, don’t assume a license is required
Confirming that a controlled item exists (Step 1) and that the new lab member is a foreign person (Step 2) does not automatically mean an export license is required before access can be granted. The EAR provides license exceptions that can apply depending on the specific ECCN, the person’s country of citizenship, and the nature of what’s being shared — for example, License Exception TSR (Technology and Software under Restriction, 15 CFR 740.6) can, subject to its own conditions and country-group restrictions, permit release of certain restricted technology and software without a separate license. ITAR’s structure is generally less permissive here: absent a specific, applicable exemption, a foreign person typically needs coverage under a license or a Technical Assistance Agreement/Manufacturing License Agreement before receiving ITAR-controlled technical data, regardless of how minor the access seems.
This is the step where PI-level judgment should stop and export-control-officer-level analysis should start. The role of the PI’s checklist at this point is not to determine which exception applies — that determination requires classification expertise most labs don’t have in-house — but to make sure the question gets asked and answered before the new lab member’s first day, not after an access request has already been informally granted because “we needed them working.”
Step 6 — Put access controls in place before, not after, access begins
If the review above concludes that this specific new lab member requires restricted or conditioned access, the standard institutional control is a Technology Control Plan (TCP) — see CASRAI’s Technology Control Plan (TCP) entry. A TCP documents the specific controlled item, the specific individuals authorized to access it, and the physical, IT, and procedural restrictions in place: badge-controlled room access, segregated network shares or VLANs, supervised-only access to a specific instrument, and a named point of accountability. The operational rule for onboarding specifically: the TCP needs to be signed, communicated to the new lab member, and its controls actually implemented (badge access provisioned, network segmentation in place) before the person’s first day with access to the controlled item — not drafted retroactively once an access review flags a gap.
Step 7 — Document the determination, even when the answer is “not controlled”
A defensible onboarding process produces a written record for every incoming international lab member, including the ones who turn out not to trigger any restriction — “reviewed, no export-controlled technology or technical data present in this role” is itself a record worth keeping, not an outcome that needs no documentation. At minimum, the record should show: what was reviewed (the specific equipment, software, or technical data the role involves), who made the classification and foreign-person determinations, when the review occurred relative to the person’s start date, and what access controls, if any, resulted. This is the record an institution needs to produce if BIS or DDTC ever asks how a specific access decision was made — and it’s also what protects a PI who followed the process correctly if a downstream reviewer later disagrees with an earlier classification call.
Common PI mistakes at onboarding
- Treating “not a US citizen” as equivalent to “foreign person.” Green card holders and certain protected individuals are not foreign persons under EAR or ITAR, regardless of visa history.
- Treating visa approval as export-control clearance. A valid visa authorizes presence and work/study; it says nothing about export-control status or license requirements.
- Assuming fundamental research status covers everything in the lab. The fundamental research exclusion applies to the research output, not automatically to every discrete piece of equipment or proprietary input used to produce it.
- Granting informal access “just for the first week” before the review completes. A deemed export can occur through a single verbal explanation, a shared screen, or a walkthrough of an instrument — there is no de minimis exposure exception based on how briefly access was granted.
- Assuming HR or international-services intake already handled the export-control check. Those offices confirm immigration and employment eligibility; the export-control determination is a separate review that has to be independently confirmed as complete.
Who owns which part of this checklist
Deemed-export screening at onboarding works only when the division of responsibility is explicit, because no single office has full visibility into all the facts. A typical split:
- PI / lab manager: knows what equipment, software, and technical data the role will actually involve, and initiates the review before extending an informal “come start now” invitation.
- Export control office / Empowered Official: makes or confirms the ECCN/USML classification, the foreign-person determination in edge cases, license-exception analysis, and approves or drafts the TCP.
- International student and scholar services (or equivalent office): confirms visa status and processes the underlying immigration paperwork — a necessary but separate track from export-control clearance.
- HR / department administration: runs restricted-party screening as part of standard onboarding intake and provisions badge/network access only after the export-control review is confirmed complete.
Institutions vary in exactly how these roles are named and split, but the underlying principle is the same across CASRAI’s export-control content: a deemed-export screening step that’s owned by everyone in general and no one specifically tends not to happen reliably.
Frequently asked questions
Does a green card holder or asylee count as a “foreign person” for deemed export purposes?
No. Under both EAR and ITAR, lawful permanent residents and certain protected individuals (including specific categories of asylees and refugees, per 8 U.S.C. §1324b(a)(3)) are excluded from the “foreign person” definition regardless of their country of birth or original citizenship.
If a project qualifies for the fundamental research exclusion, do I still need to screen new lab members?
Restricted party screening (Step 4) is still standard practice regardless of fundamental research status. Deemed-export screening specifically becomes largely moot for that project’s fundamental research output, but any discrete controlled equipment, proprietary third-party input, or government-restricted data used in the lab can still fall outside the exclusion even when the surrounding research is otherwise unrestricted — confirm with the export control office rather than assuming blanket coverage.
Can I let a new postdoc start working while the export-control review is still in progress?
Only in areas of the lab and with materials that don’t require a review in the first place. If any part of the role involves a controlled item, access to that specific item should wait until the review is complete — a deemed export can occur through informal, brief exposure, and there’s no exception for access granted “temporarily” while paperwork catches up.
Who makes the final call on whether an export license is needed?
The institution’s designated Empowered Official or export control officer, not the PI. The PI’s role in this checklist is to surface the facts (what’s controlled, who the person is) early enough for that office to make a timely determination before access begins.
For the underlying regulatory definitions this checklist assumes, see CASRAI’s deemed export, export-controlled research, and fundamental research exemption dictionary entries, and the ITAR vs. EAR comparison for how the two regimes differ on licensing structure.
