ECCN Number Cheat Sheet by Category: Reading Categories 0-9, Product Groups A-E, and Reasons for Control (NS/MT/AT) [2026 Edition]

Hello, this is Hamamoto from TIMEWELL. The first thing that trips people up in day-to-day export control work is reading those cryptic ECCNs like "5A002" or "3A090." An ECCN (Export Control Classification Number) is like a jersey number that identifies an item in the U.S. export control system, and packed into just five characters is a compressed statement of what field the item belongs to and why it is controlled.

Turn that around, and once you have internalized how to take these five characters apart, you can look at an ECCN you have never seen before and get a rough read on the kind of item it is. This article organizes Categories 0-9, Product Groups A-E, and the reasons-for-control codes into a single cheat sheet you can keep at hand. Every number and every point of regulatory content here is drawn from primary sources such as 15 CFR 738.2, but this is a field where amendments keep coming, so when you use it in practice always confirm against the latest eCFR text. If you want to learn the structure of these numbers systematically, reading it alongside our companion piece, the ECCN classification fundamentals guide, should make the picture come together faster.

How to read the five characters of an ECCN

An ECCN is made up of five alphanumeric characters. The order carries meaning, and the basic way to read one is to break it down from the front. The first digit is a number from 0 to 9 that represents the category on the CCL (Commerce Control List), the single character right after it is a letter from A to E that represents the product group, the second and third positions indicate the type of control reason tied to that entry, and the final digit is a sequential number within the same group[^1]. Take "3A001," which the official guidance itself uses as an example: the 3 is the category (Electronics) and the A is the product group (equipment, assemblies, and components), so at a glance you can tell it is equipment in the electronics field.

The CCL itself sits within the EAR (Export Administration Regulations) at Supplement No. 1 to 15 CFR Part 774. The EAR is the set of rules running from Part 730 through Part 774 of 15 CFR, and the general technology and software notes that apply across the individual CCL entries are placed in Supplement No. 2 to that same Part 774[^13]. In other words, an ECCN is like an address assigned to an individual item within this thick rulebook, and it clicks into place if you picture each digit of the address as corresponding to a district or a block number.

The point to hold on to here is that identifying an ECCN alone does not settle whether you can export. Once you have classified an item into a particular ECCN, the next step is to line up that ECCN's "License Requirements" section against the Commerce Country Chart (Supplement No. 1 to Part 738), which shows whether a license is required for each destination, and then decide whether a license is needed for that specific destination[^14]. Landing on the number is the starting line, not the finish. We lay out this downstream decision flow in detail in our list controls and catch-all controls guide.

Cheat sheet: Categories 0-9 by Product Groups A-E

The vertical axis, so to speak, is the category. The CCL divides the whole into ten categories. 0 is nuclear materials, facilities, and equipment plus miscellaneous items; 1 is materials, chemicals, microorganisms, and toxins; 2 is materials processing; 3 is electronics; 4 is computers; 5 is telecommunications and information security; 6 is lasers and sensors; 7 is navigation and avionics; 8 is marine; and 9 is aerospace and propulsion[^2]. Categories 3 and 4, whose names come up in discussions of semiconductors and AI chips, along with 5 for cryptographic products and 9 for aircraft engines, all surface regularly in the news, so they are worth committing to memory.

Category	Field (summary of English wording)
0	Nuclear materials, facilities, equipment, and miscellaneous
1	Materials, chemicals, microorganisms, and toxins
2	Materials processing
3	Electronics
4	Computers
5	Telecommunications and information security
6	Lasers and sensors
7	Navigation and avionics
8	Marine
9	Aerospace and propulsion

Next is the product group, the horizontal axis. Every category subdivides internally into five product groups. A is equipment, assemblies, and components; B is test, inspection, and production equipment; C is materials; D is software; and E is technology[^3]. This is where it starts to matter in practice, because within the single field of semiconductors, a finished chip itself lands in Group A, the equipment that manufactures it lands in Group B, and the know-how for designing or making it scatters into Group E. Whether the thing you are trying to export is an object, a piece of equipment, software, or technical information changes which second character of the ECCN you should be aiming at.

Group	Scope (summary of English wording)
A	Equipment, assemblies, and components
B	Test, inspection, and production equipment
C	Materials
D	Software
E	Technology

Category 5 alone has a slightly special internal structure. It is split into two parts: Part 1 is telecommunications and Part 2 is information security. For example, 5A001 covers telecommunications systems, equipment, and components, while 5A002 covers information security, that is, cryptographic systems and equipment[^8]. It is a good illustration of how, even when the category and product group are identical, a difference in the trailing number can change the items covered entirely. Once you layer the reasons-for-control codes explained below onto this vertical-and-horizontal matrix, a single ECCN finally takes shape.

How to read the reasons-for-control codes (NS, MT, AT, and more)

As I noted above, the second and third positions of an ECCN indicate the type of control reason. What captures this "why is it controlled" is the Reasons for Control. There are fourteen official codes enumerated in 15 CFR 738.2(d). AT is Anti-Terrorism, CB is Chemical and Biological Weapons, CC is Crime Control, CW is Chemical Weapons Convention, EI is Encryption Items, FC is Firearms Convention, MT is Missile Technology, NS is National Security, NP is Nuclear Nonproliferation, RS is Regional Stability, SS is Short Supply, UN is United Nations Embargo, SI is Significant Items, and SL is Surreptitious Listening[^4]. Summaries floating around online sometimes leave one of these out, and UN (United Nations Embargo) in particular tends to drop off, so it is worth building the habit of confirming against the fourteen in the original text.

Code	Reason for control
AT	Anti-Terrorism
CB	Chemical and Biological Weapons
CC	Crime Control
CW	Chemical Weapons Convention
EI	Encryption Items
FC	Firearms Convention
MT	Missile Technology
NS	National Security
NP	Nuclear Nonproliferation
RS	Regional Stability
SS	Short Supply
UN	United Nations Embargo
SI	Significant Items
SL	Surreptitious Listening

It is this code that, when matched against the destination, actually leads to whether a license is required. The column headings on the Commerce Country Chart carry a column name and number for each reason for control, written like "CB Column 1"[^5]. Once the License Requirements section of an ECCN tells you "this item is controlled for NS and MT," you read across the NS column and the MT column of the Country Chart and check whether there is a mark in the row for your destination. If there is a mark, the reading is that a license is required on the basis of that control reason. The licensing policy behind each individual reason for control is set out in detail in Part 742 of the EAR.

It is not unusual for a single ECCN to carry several reasons for control. For an item controlled for both National Security and Missile Technology, a license is required if a mark appears for the destination under either one. Conversely, depending on the combination of control reason and destination, no license may be needed at all, so it is important not to skim past the codes and jump to the conclusion that "it is controlled, so everything is off limits." How strict the controls are is determined not by the item alone but by the three-part set of which reason, to where, and what.

This is also why the same code can feel light in one context and heavy in another. AT (Anti-Terrorism), for instance, is attached to a very wide range of items, but for most destinations it does not by itself trigger a license, whereas for a small set of countries it does. NS (National Security), by contrast, tends to bite across a far broader list of destinations. Reading the code without reading the corresponding column of the Country Chart tells you only half the story. The habit worth building is to always treat the pair of code and column as a single unit, and to resist the temptation to memorize any code as either "always fine" or "always blocked." The matrix decides, not the mnemonic.

There is one more subtlety that catches people out. The two and three positions of an ECCN signal the type of control reason, but the definitive list of reasons for a given entry lives in that entry's own License Requirements section, not in the digits alone. The digits are a strong hint, and the entry text is the authority. When the two seem to diverge, or when an amendment has moved things around, the entry text and the current Country Chart win. Treating the five characters as a lookup key rather than a self-contained answer is the mindset that keeps you out of trouble.

ECCN examples that recur in AI and semiconductors

From here I will look concretely at ECCNs that have appeared frequently in recent news. First, in the electronics field of Category 3, 3A001 is the equipment and components entry the official guidance uses as an example, and it is often cited as an entry point for learning how to read an ECCN[^1]. And the number at the center of today's export control debate is 3A090. 3A090 covers integrated circuits for advanced computing, spanning a broad range that includes GPUs, tensor processing units (TPUs), neural processors, in-memory processors, image and text processors, coprocessors and accelerators, adaptive processors, FPLDs, and ASICs. Within it, 3A090.a applies to integrated circuits whose "total processing performance" (TPP) is 4800 or greater[^10]. This threshold of 4800 is the figure indicated as of January 2025, and the performance-metric thresholds and the structure of the sub-paragraphs are an area where amendments keep coming. When you use the numbers in practice, confirm against the latest text with its effective date.

A computer with a 3A090 chip built into it moves over to Category 4 for computers and is captured as 4A090[^10]. In other words, the chip on its own is Category 3, while the machine carrying it is Category 4, so even for the same AI chip the number moves across categories when the physical form of the item changes. Part of why export control for AI chips tends to get complicated shows up right here.

The equipment on the side that makes the semiconductors is controlled too. Manufacturing equipment gathers into Product Group B, with numbers such as 3B001, 3B002, 3B090, 3B611, 3B991, and 3B992 lined up there. The BIS rule of October 2022 introduced a framework requiring a license for the export, reexport, or transfer of items used to develop or produce, in China, the parts, components, and equipment described in these ECCNs, regardless of the end use or end user[^11]. That the framework applies regardless of end use is a major departure from the previous way of thinking, and this idea was carried forward into the later advanced-semiconductor controls. If you want an overview of the timeline of U.S. and Chinese controls, you can follow the flow in our U.S.-China AI semiconductor regulatory calendar.

On advanced computing, it is worth touching on how quickly the framework moved within a short span. In January 2025 the so-called "AI Diffusion" framework was introduced, but ahead of its stated compliance date of May 15, 2025, BIS announced on May 12-13 of the same year that it was rescinding the rule. For the time being it is being replaced with policy guidance that includes red flags, and BIS has said a replacement rule will be issued in the future. Meanwhile, the earlier advanced-computing controls such as 3A090 and 4A090 remained in place as they were[^12]. What was rescinded was the diffusion framework, not the controls on the chips themselves, and that distinction matters in practice. We dig into how to read the post-rescission BIS guidance in BIS advanced computing and the D5 guidance.

The cryptographic products in Category 5 Part 2 are another leading example of something that is easy to get wrong. 5A002 covers items whose primary function is information security, and simply "using encryption" does not automatically make something a 5A002. Items that fall under Note 3 to Category 5 Part 2, the so-called mass-market note, are routed not to 5A002 but to 5A992 or 5D992[^9]. Many cryptographic products sold widely to the general public, like commercial smartphones and apps, fall to the 5A992 side at this branch. Finally, on a different field from encryption or semiconductors, 9A001 in Category 9 covers aviation gas turbine engines[^15], a clean example of how the leading number and letter map an item to its field and group in one stroke.

Looking up the number and running the classification in practice

So which ECCN is your own product? BIS describes three ways to find out. One is to ask the manufacturer or developer. When you have built in components made by another company, this check is often the fastest. The second is self-classification, where you classify the item yourself following the CCL Order of Review. The third is to submit a formal classification request to BIS through the SNAP-R system, a procedure based on EAR Section 748.3[^7]. Shipping while still unsure and only later discovering a misclassification is costly, so when the judgment is genuinely uncertain, I think settling it black and white with a formal request is ultimately the safer path.

And the thing you must not forget is EAR99. An item that is subject to the EAR but does not match the description of any ECCN on the CCL falls into the EAR99 bucket. EAR99 items require no license in most situations, but a license may be needed if the item is destined for an end user, end use, or destination of concern[^6]. From where I sit, the most dangerous assumption is "our product is EAR99, so export control has nothing to do with us." A number not being on the list and being free to ship anywhere are two entirely different things.

Between these three methods, the self-classification route deserves a word of caution, because it is the one most people default to and the one where mistakes hide. The CCL Order of Review exists precisely so that you do not stop at the first entry that looks close. It asks you to work through the categories and product groups in a defined sequence, so that an item is not misfiled into a broad, generic entry when a more specific one applies. In practice, the discipline of following that order, rather than searching for a keyword and settling on the first plausible match, is what separates a defensible classification from a lucky guess. When components from several suppliers are combined into one product, the safest reading is often to confirm each supplier's classification first and only then decide how the finished item should be classified.

Classifications like these stop scaling by hand as the number of items you handle grows. You break down the five characters of an ECCN, match the reasons-for-control codes against the Country Chart, and if the item is EAR99, then check the end user and the end use. Repeating this sequence for every product and every transaction is steady, error-prone work. TRAFEED, the export control AI agent we provide, was built precisely to support this repetition with AI. It complies with the standards of Japan's Ministry of Economy, Trade and Industry while handling the classification of cargo and technology, the assessment of list controls and catch-all controls, and the screening of counterparties and end users all in one flow. That you can advance the assessment while organizing the correspondence between U.S. ECCNs and Japan's export control ordinance schedules is something that should prove welcome in practice.

The same holds for advanced computing, where the numbers move quickly and the thresholds are revised. A team that has wired the classification of cargo and technology, the list and catch-all assessment, and end-user screening into a single repeatable workflow can absorb an amendment far more calmly than one reclassifying by hand each time. When the definition of a controlled chip shifts, you want to change the rule in one place and have the downstream checks follow, rather than chase the change across scattered spreadsheets.

One last thing. An ECCN is less something to memorize than something to look up correctly. Once you have the structure of the number in your head, you can get a read on the field and the reason for control even for an ECCN you are seeing for the first time, and you know where in the original text to look. Rely on rote memorization, and you get left behind by the amendments. Take this chance to run a one-time inventory of which category and group your flagship products belong to and what reasons for control they carry. If you want to run item-by-item classification as a system, reach out through a consultation and I will show you concretely how it works with TRAFEED.

References

[^1]: 15 CFR 738.2 - Commerce Control List (CCL) structure (an ECCN is five characters; the leading digit is the category, the following character is the product group; example 3A001) - Cornell Legal Information Institute / eCFR - 2025 [^2]: 15 CFR 738.2 - the ten CCL categories (0 nuclear materials to 9 aerospace and propulsion) - Cornell Legal Information Institute / eCFR - 2025 [^3]: 15 CFR 738.2 - the five product groups (A equipment and components to E technology) - Cornell Legal Information Institute / eCFR - 2025 [^4]: 15 CFR 738.2(d) - Reasons for Control (the fourteen: AT/CB/CC/CW/EI/FC/MT/NS/NP/RS/SS/UN/SI/SL) - Cornell Legal Information Institute / eCFR - 2025 [^5]: Supplement No. 1 to Part 738 - Commerce Country Chart (each column carries a column name and number per reason for control, e.g., CB Column 1; policy is in Part 742) - Cornell Legal Information Institute / eCFR - 2025 [^6]: Classify Your Item (definition of EAR99 and whether a license is required) - Bureau of Industry and Security (BIS), U.S. Department of Commerce - 2025 [^7]: Classify Your Item (the three methods to identify an ECCN; SNAP-R and Section 748.3) - Bureau of Industry and Security (BIS), U.S. Department of Commerce - 2025 [^8]: Category 5 Part 1 - Telecommunications (Category 5 is Part 1 telecommunications and Part 2 information security; 5A001 and 5A002) - Bureau of Industry and Security (BIS) - 2024 [^9]: 5A002 a.1-a.5 / Encryption controls (5A002.a covers items whose primary function is information security; Note 3 items go to 5A992/5D992) - Bureau of Industry and Security (BIS) - 2025 [^10]: Implementation of Additional Due Diligence Measures for Advanced Computing Integrated Circuits (the scope of 3A090 and the TPP 4800 of 3A090.a; 4A090) - BIS / Federal Register - January 16, 2025 [^11]: Implementation of Additional Export Controls: Certain Advanced Computing and Semiconductor Manufacturing Items (license requirement for using manufacturing equipment such as 3B001 in China) - BIS / Federal Register - October 13, 2022 [^12]: Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule (the AI Diffusion rule was rescinded on May 12-13, 2025; the 3A090/4A090 controls remained) - Bureau of Industry and Security (BIS) - May 13, 2025 [^13]: 15 CFR Part 774 - The Commerce Control List (the CCL is Supplement No. 1; the general technology and software notes are Supplement No. 2; the EAR is Part 730-774) - eCFR / BIS - 2025 [^14]: Commerce Control List Overview and the Country Chart (matching an ECCN's License Requirements section against the Country Chart) - Bureau of Industry and Security (BIS) - 2025 [^15]: Commerce Control List Category 9 - Aerospace and Propulsion (9A001 is aviation gas turbine engines) - Bureau of Industry and Security (BIS) - 2024