Dual-use items are goods, software, and technology that can be used for both civilian and military purposes, or that could contribute to the proliferation of weapons of mass destruction. That is the working definition behind two separate, overlapping legal regimes a research organisation with international collaborators, sponsors, or equipment suppliers has to navigate: the EU’s Regulation (EU) 2021/821 and the US Export Administration Regulations (EAR). Both regulate items that have no single, dedicated military-only classification but still carry proliferation or strategic risk — which is exactly what makes them harder to spot than obviously militarised equipment.
This guide defines dual-use items in both regimes, explains how an item actually gets classified as one, and draws an explicit line between dual-use items (an export-control classification) and Dual-Use Research of Concern (a life-sciences biosecurity oversight category) — two terms that sound alike and are routinely confused, but that trigger completely different institutional review processes.
The short definition
A dual-use item is any good, piece of software, or technology that:
- has a legitimate civilian, commercial, or research application, and
- also has a plausible military application, or could contribute to the design, development, production, or use of chemical, biological, radiological, or nuclear (CBRN) weapons or their delivery systems.
Because both conditions can be true of the same physical item at once, dual-use status is not a property of what an item is in isolation — it is a property of what the item can do, assessed against a specific control list. A high-performance computing cluster, a particular grade of carbon-fibre composite, an encryption library, a mass spectrometer, or a cryogenic freeze-dryer can all be entirely legitimate research equipment and simultaneously appear on a national or multilateral dual-use control list.
Dual-use items under EU law: Regulation (EU) 2021/821
The European Union’s dual-use export control regime is Regulation (EU) 2021/821 of 20 May 2021 (a recast of the earlier Regulation (EC) 428/2009). It defines dual-use items as goods, software, and technology that can be used for both civilian and military purposes, including anything that could contribute to the proliferation of weapons of mass destruction, and it sets up an EU-wide licensing system covering export, brokering, technical assistance, transit, and transfer of those items.
Two features of the EU regime matter specifically for a university or research organisation:
- Annex I is the control list. Regulation 2021/821 controls the specific categories, sub-categories, and technical parameters listed in its Annex I (which largely mirrors the multilateral Wassenaar Arrangement dual-use list, described below). An item not listed in Annex I is not automatically exempt, though — the regulation’s catch-all clauses can still require authorisation for an unlisted item, based on end-use or end-user, not just the item’s classification.
- “Technology” transfer is controlled independent of the medium. The Regulation’s definitions reach technology and software transferred electronically, by fax, or by phone, and technical assistance delivered orally — not only physical shipments. That reach is what makes a lab presentation, a training session, or a shared code repository a potential export-control event, not just a customs event.
The EU also issued Commission Recommendation (EU) 2021/1700 specifically to help research organisations build an internal compliance programme proportionate to their dual-use exposure. For the full mechanics of the EU regime — licensing categories, catch-all controls, the 2021 cyber-surveillance additions, and what an internal compliance programme actually needs to contain — see CASRAI’s dedicated guide: EU Dual-Use Export Control Regulation 2021/821 and Internal Compliance Programmes.
Dual-use items under US law: EAR, the CCL, and ECCNs
In the United States, dual-use items sit under the Export Administration Regulations (EAR) (15 CFR Parts 730–774), administered by the Department of Commerce’s Bureau of Industry and Security (BIS) — deliberately separate from the International Traffic in Arms Regulations (ITAR) (22 CFR Parts 120–130), which cover items designed or adapted specifically for military use and are administered by the State Department’s Directorate of Defense Trade Controls (DDTC). The dividing line matters operationally: an item that is inherently military-specific belongs on the ITAR US Munitions List, not the EAR’s dual-use list, and the two regimes have different licensing authorities, different exceptions, and different research carve-outs.
Within the EAR, dual-use items are organised on the Commerce Control List (CCL), and each controlled item is assigned an Export Control Classification Number (ECCN) — a five-character code:
- the first digit (0–9) identifies the product category (e.g. 3 = electronics, 5 = telecommunications and information security, 9 = aerospace and propulsion);
- the following letter (A–E) identifies the product group (A = equipment/assemblies/components, B = test/inspection/production equipment, C = materials, D = software, E = technology);
- the final three digits point to the specific CCL entry and reason for control.
An item subject to the EAR that does not match any CCL entry is classified EAR99 — a residual catch-all that is generally license-free to most destinations and end-users, though restricted parties, prohibited end-uses, and embargoed destinations can still require a license even for an EAR99 item. A researcher or export-control office determines an item’s classification either by self-classifying against the CCL’s Order of Review (15 CFR Part 774, Supplement No. 4), or by filing a formal Commodity Classification request with BIS, which returns a CCATS determination. See CASRAI’s dictionary entry on the ECCN determination process for the full mechanics of both paths.
The common thread: the Wassenaar Arrangement
Neither the EU nor the US built its dual-use control list from scratch. Both draw heavily on the Wassenaar Arrangement, a multilateral export-control regime established in 1996 as the successor to the Cold War-era COCOM (Coordinating Committee for Multilateral Export Controls). Wassenaar’s participating states maintain two agreed control lists — a Munitions List and a Dual-Use List — and each member incorporates those lists into its own national or regional export-control law. That is why the EU’s Annex I and the US CCL cover substantially overlapping technical categories despite being separate legal instruments: both are national/regional implementations of the same underlying multilateral list, then layered with each jurisdiction’s own additions (the EU’s cyber-surveillance human-rights controls, for example, or US-specific national-security additions to the CCL). Other narrower multilateral regimes — the Nuclear Suppliers Group, the Missile Technology Control Regime, and the Australia Group (chemical/biological) — feed into the same lists for their specific proliferation categories.
Dual-use items vs. Dual-Use Research of Concern (DURC): not the same thing
“Dual-use” gets applied to two genuinely different oversight frameworks that research administrators routinely have to distinguish for different offices and different reviewers:
| Dual-use items (export control) | Dual-Use Research of Concern (DURC) | |
|---|---|---|
| What it governs | Physical goods, software, and technology transfers across borders | Life-sciences research design and publication, regardless of borders |
| Legal basis | EU Regulation 2021/821 / US EAR & ITAR | US Government DURC/PEPP policy (life-sciences funders and institutions) |
| Trigger | Item matches a control list entry (EU Annex I / US CCL/ECCN) or a catch-all end-use/end-user concern | Research involves one of a defined set of select agents/toxins AND is reasonably anticipated to produce one of a defined set of concerning experimental outcomes |
| Reviewing body | Export-control office / empowered official; licensing authority (BIS, DDTC, EU Member State authority) | Institutional Review Entity (IRE), often the Institutional Biosafety Committee (IBC) acting in that capacity |
| What triggers review | Shipping, transmitting, or disclosing a controlled item, including to a foreign national in a domestic lab (a “deemed export”) | Designing or conducting the research itself, and later publishing or communicating the results |
An item or a research project can, in principle, touch both frameworks at once — a controlled piece of laboratory equipment used in DURC-eligible life-sciences research, for example — but clearing an export-control review does not clear a DURC review, and vice versa. They are administered by different offices under different legal authorities, and treating one as a substitute for the other is a real institutional gap, not a paperwork shortcut. See CASRAI’s dictionary entry on Dual-Use Research of Concern (DURC) for the two-part DURC test and its institutional oversight requirements.
Worked examples
| Item category | Civilian/research use | Why it can be dual-use |
|---|---|---|
| High-performance computing hardware above certain processing-power thresholds | Climate modelling, genomics, AI research | Same processing capability supports nuclear-weapons simulation and advanced missile design |
| Certain encryption software and hardware | Secure research data transfer, cybersecurity research | Same cryptographic strength protects military communications and can frustrate lawful interception |
| High-precision machine tools and certain metrology equipment | Precision manufacturing, materials science | Same tolerances required for centrifuge components used in uranium enrichment |
| Certain freeze-dryers (lyophilizers) and fermenters above listed capacity thresholds | Vaccine and pharmaceutical production, food science | Same equipment can produce or stabilise biological agents at scale |
| Specific chemical precursors | Pharmaceutical synthesis, industrial chemistry | Same precursors are inputs to chemical-weapons synthesis |
| Certain drones/UAV components and related software | Environmental monitoring, agricultural research | Same platforms and guidance software adapt to military reconnaissance or weapons delivery |
This table is illustrative of the categories that recur across national dual-use control lists, not an exhaustive or authoritative classification tool — the actual, current classification of any specific item always depends on its precise technical parameters checked against the current EU Annex I or US CCL/ECCN text, not on the general category it resembles.
Frequently asked questions
What is the definition of dual-use goods?
Dual-use goods are items with a legitimate civilian or commercial application that also have a plausible military application or could contribute to weapons-of-mass-destruction proliferation. Both the EU (Regulation 2021/821) and the US (EAR) use materially the same underlying definition, though each implements it through its own control list — the EU’s Annex I and the US Commerce Control List.
What are dual-use goods best described as?
Dual-use goods are best described as items controlled not because of what they inherently are, but because of what they are capable of doing in a different context — the same laboratory freeze-dryer, encryption library, or precision machine tool that is unremarkable in a civilian research setting can carry export-control obligations because an identical unit could serve a military or proliferation purpose.
What is dual-use classification?
Dual-use classification is the process of determining whether a specific item matches an entry on the applicable control list — in the US, assigning an Export Control Classification Number (ECCN) from the Commerce Control List, or confirming an item is EAR99 (uncontrolled by specific entry); in the EU, checking the item against the technical parameters in Regulation 2021/821’s Annex I. Classification is item-specific and parameter-specific, not a general judgment about a product category.
Are dual-use items always physical goods?
No. Both the EU and US regimes explicitly control software and technology (technical data and technical assistance) as well as physical goods. Under EAR, software and technology have their own CCL product groups (D and E). Under Regulation 2021/821, technology transferred electronically, by fax, or by phone, and technical assistance delivered orally, are all within scope — not only physical shipments.
Is dual-use research of concern the same as a dual-use item?
No. A dual-use item is an export-control classification for goods, software, or technology. Dual-Use Research of Concern (DURC) is a separate life-sciences biosecurity oversight category, governed by US Government DURC/PEPP policy and reviewed by an institution’s Institutional Review Entity, typically the Institutional Biosafety Committee. See the comparison table above.
Related CASRAI resources
- EU Dual-Use Export Control Regulation 2021/821 and Internal Compliance Programmes
- Export Control (EAR/ITAR) in International Research Collaboration
- The Four Pillars of Export Control Compliance
- Empowered Official: The ITAR-Required Export-Control Compliance Role
- Embargoed Countries and Export Control
- ECCN Determination Process
- Technology Control Plan (TCP)
- Dual-Use Research of Concern (DURC)
- Export-Controlled Research
- Software Export Controls
