What Is an ECCN? How to Read One, Find It on the CCL, and Use EAR99 and de minimis (2026)

Hello, this is Ryuta Hamamoto from TIMEWELL.

This is a working guide to what an ECCN is, how to read the five characters, how to look one up on the Commerce Control List (CCL), and how EAR99 and de minimis fit real reexport work. If you only need lookup tables — categories, reasons for control, frequent numbers — start with the companion ECCN number list and cheat sheet.

I keep hearing the same question from trading companies and manufacturing QA teams: "Where exactly do I look to get an ECCN?" The Export Administration Regulations (EAR) sit at the center of US dual-use controls, yet many teams still treat the five-character code as a black box. Building TRAFEED, our export-control AI agent, has put me through thousands of classification cases. What follows is the 2026 field version of that process.

Bottom line up front: staring at a five-character code tells you almost nothing. The number only works when you pair it with the technical parameters in the entry and the conditions that apply when the item leaves a non-US country. Start with who decides, for what purpose, in which text — then the code. Full EAR operations: EAR compliance hub. Quick program check: free export-control readiness check.

What is an ECCN?

ECCN means Export Control Classification Number. It is the five-character alphanumeric code for controlled items, software, and technology on the Commerce Control List (CCL) under the EAR. The Bureau of Industry and Security (BIS) at the US Department of Commerce writes each entry around technical parameters.

An ECCN does not describe what a product is. It describes which regulatory box the product falls into. Two units with the same marketing name can take different ECCNs if one crosses a performance threshold. Different numbers mean different license analysis. Part numbers never settle the question; you always return to the specification that actually ships.

Structure in three parts:

1. First digit (0–9): category (0 nuclear-related … 3 electronics, 4 computers, 5 telecom and information security … 9 aerospace and propulsion)
2. Second character (A–E): product group (A systems and equipment, B test/production equipment, C materials, D software, E technology)
3. Last three digits: the specific entry, often with .a / .b subparagraphs for thresholds

Items that match no ECCN on the CCL, but are still subject to the EAR, fall into EAR99. That is not "unregulated." It is "subject to the EAR, not separately listed." That misread is the most common EAR trap I see. Companion deep dive sits inside our EAR compliance hub.

ECCNs are a US construct. Japan runs FEFTA and Appended Table 1 of the Export Trade Control Order; the two lists do not map one-to-one. When a shipment from Japan contains US-origin parts or technology, you run both Japanese classification (gaihi hantei) and ECCN work. See gaihi hantei process and Appended Table 1.

How to read an ECCN — and the EAR99 trap

People sometimes confuse ECCNs with ten-digit Schedule B or HTS codes used for customs. Different systems. Example: 9A001 reads as aerospace (9), equipment (A), entry 001 — civil gas turbine engines. Subparagraphs hold the performance lines.

EAR99 is the bucket for items subject to the EAR but not on the CCL as a numbered ECCN. Most ordinary commercial goods land here and often ship under No License Required (NLR). That comfort disappears when General Prohibitions 4 through 10 bite: embargoed destinations, restricted parties, or WMD end-uses can require a license even for EAR99. Does your team still treat EAR99 as "no license needed, ever"? If yes, fix that habit before the next red-flag shipment.

Catch-all style end-use and end-user rules also matter. If you know, or have reason to know, a concerning end-use, you have affirmative duties regardless of the ECCN string. Confirming the number is mid-process, not the finish. Export control is context, not code hunting.

Keep the reasoning, not only the number: We publish a fill-in sheet that follows "subject to the EAR? → ECCN on the CCL? → EAR99?" then covers embargoed destinations, end-use/end-user, de minimis and FDP, party screening, and a two-track check against Japan's FEFTA / Appended Table 1 classification. → Download the EAR Classification Flow and EAR99 Checklist (Free. Company name and work email required.)

Classification in the field

BIS publishes classify-your-item guidance¹. First gate: is the item subject to the EAR at all? US-made, shipped from the US, containing US-origin content, or produced with certain US technology can pull an item in. If you can honestly conclude "not subject to the EAR," you do not hunt for an ECCN.

Hard calls cluster in Categories 3 (electronics), 4 (computers), and 5 (telecom / information security). They usually turn on frequency, compute performance, or cryptographic strength. Newer entries such as 4A906 (quantum computers) force checks on qubit count and gate error rate. The most common field failure I see: catalog values vs shipped configuration. The brochure sits at the regulatory ceiling; the factory unit is limited below the line — and the outcome depends on who certifies which document.

Eight steps on eCFR

1. Gather technical data: model, spec sheet, catalog, and the numeric values that matter for thresholds.
2. Confirm the item is subject to the EAR. If none of the usual hooks apply, stop.
3. Open 15 CFR Part 774 on eCFR — Supplement No. 1 is the CCL². Prefer live eCFR over a stale PDF.
4. Narrow by category (0–9) and product group (A–E). A chip often points to Category 3 Group A; its production tool to Group B; design software to Group D. Field map: ECCN cheat sheet.
5. Read candidate entries in Order of Review sequence (Supplement No. 4 to Part 774)². Do not stop at the first keyword hit; more specific entries take precedence.
6. Match entry parameters to the shipped specification, not the marketing ceiling.
7. With the ECCN fixed, read License Requirements and reasons for control; compare the destination on the Commerce Country Chart (Supplement No. 1 to Part 738).
8. No match → EAR99. Still run party screening and end-use checks.

If the eight steps leave you stuck, ask the manufacturer or file a CCATS (Commodity Classification Automated Tracking System) request with BIS. Official rulings often take on the order of four to six weeks. Japanese and other non-US makers do hold CCATS letters; suppliers sometimes answer "for this model, CCATS is Gxxx." I treat CCATS as insurance for low-frequency edge cases. On the Japan side, classification results also feed customs documents — pair with non-applicability certificates.

Three scenarios non-US teams hit constantly

1) US content inside a third-country product (de minimis)

You incorporate US components or software, then reexport from Japan, Europe, or elsewhere. De minimis asks what share of the item is controlled US-origin content by value. For many destinations the practical threshold is 25%. For certain embargoed destinations the bar drops (historically 10% for some country groups), and special cases can go to 0%. Recalculate by destination. The hard part is almost always component-level country of origin, not the arithmetic³.

2) "Domestic" buys that later reexport

You buy a tool through a local distributor, later learn it was produced with US technology, then move it to an overseas plant and trip reexport rules. Entity List updates can also reclassify a counterparty overnight. In December 2024, BIS added a large batch of entities across multiple countries in one semiconductor and advanced-computing action⁴. Annual party screening is too slow.

3) Dual-use context and "should have known"

R&D materials, test gear, and analytics software can be civilian by design and still support military end-uses. Liability standards often look at the total picture: counterparty profile, stated end-use, prior history. "We did not notice that far" is a weak after-the-fact story. Policy context from adjacent Japan economic-security moves — National Security Information Council, Makino Milling block — helps set how seriously boards treat screening maturity.

List placement is a regulatory designation, not a moral label on a company. Screen for control status; do not brief counterparties as "bad actors" in customer-facing docs.

Making classification scalable (and where TRAFEED fits)

ECCN work is patient reading: documents, standards, a human call at the right moment. At hundreds or thousands of line items a month, pure manual capacity fails.

TRAFEED is our export-control AI agent for that bottleneck. It cross-checks multiple denial and restriction lists (Entity List, Denied Persons List, SDN, and others) and supports classification candidates against both METI frameworks and the US CCL. Japanese Patent No. 7862062 covers classification logic we use; more than 20 organizations run the product. Field teams hand over fuzzy questions — "this PN is probably EAR99, gut-check please" — and get a candidate plus the clauses and parameters used. Multilingual intake matters when overseas subsidiaries send English packs only.

Design rule we will not break: a human always owns the final call. Export control sits at executive accountability. The UI is built so reviewers see statutes, parameters, and similar cases next to the recommendation. Speed of review is business agility, not just compliance hygiene.

2026 watch list: Affiliates Rule and frontier tech ECCNs

You cannot plan 2026 without the Affiliates Rule (often called the BIS 50% rule). Published by BIS on 30 September 2025, it pulls majority-owned affiliates of certain listed entities into the same control scope⁵. Enforcement was later suspended for one year; return is scheduled for 10 November 2026 unless further action changes the calendar. From late 2026, ownership maps — parents, subsidiaries, siblings at or above 50% — become operationally mandatory. JETRO and others have flagged continuous ownership tracking as the pain point⁶. Companies that start UBO work early will separate from those that scramble in Q4.

The other wave is semiconductors, AI hardware, and quantum. Between late 2024 and 2025, new ECCNs landed for high-bandwidth memory, AI hardware, and quantum computing (including 4A906 thresholds on qubits and gate error). Semiconductor manufacturing equipment transitional measures and IC designer certification windows continue to move on short clocks. Assume continuous update, not annual refresh.

Three steps you can start this week

1. Inventory country of origin and ECCNs for your top 100 items. Most suppliers will provide a statement or ECCN summary if you ask cleanly. Items that never come together are a supplier-relationship warning, not just a data gap.

2. Raise party-screening cadence. Monthly list updates beat annual refresh. Transaction-time screening is better. If tools like TRAFEED are not yet in budget, at least bookmark BIS list pages and build a handover so the practice survives staff changes.

3. Build ownership maps before the Affiliates Rule returns. Map parents, subsidiaries, and sibling entities for main counterparties. The data is messier than spreadsheets suggest. Earlier starts mean quieter late-2026 operations.

Export control feels like a swamp on day one. Once the system exists, day-to-day work gets lighter. If you want a partner for that first climb, book a consultation with the TRAFEED team.

For features and rollout, download the TRAFEED product catalog (PDF). To discuss workflow, contact us.

References

Footnotes

1. Bureau of Industry and Security, "Classify Your Item / Licensing." https://www.bis.gov/licensing/classify-your-item ↩

2. eCFR, 15 CFR Part 774 — The Commerce Control List (Supplement No. 1 CCL; Supplement No. 4 Order of Review). https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-774 ↩ ↩²

3. Center for Information on Security Trade Control (CISTEC), "Introduction to US Reexport Controls." https://www.cistec.or.jp/service/beikoku_saiyusyutukisei/index.html ↩

4. WilmerHale, "BIS Issues Sweeping Additional Restrictions on Semiconductors and Advanced Computing, Entity List Designations" (December 2024). https://www.wilmerhale.com/en/insights/client-alerts/20241206-bis-issues-sweeping-additional-restrictions-on-semiconductors-and-advanced-computing-entity-list-designations ↩

5. Federal Register, "Expansion of End-User Controls To Cover Affiliates of Certain Listed Entities" (2025-09-30). https://www.federalregister.gov/documents/2025/09/30/2025-19001/expansion-of-end-user-controls-to-cover-affiliates-of-certain-listed-entities ↩

6. JETRO, analysis of Affiliates Rule ownership tracking burden (2025-09). https://www.jetro.go.jp/biznews/2025/09/c92c704c4b353243.html ↩