Complete Guide: Fundamentals of EU Dual-Use Regulation 2021/821 — Annex I 10 Categories, GEAs, and Three Catch-All Articles

Hello, this is Ryuta Hamamoto from TIMEWELL. I keep hearing the same line from export-control teams: “Everyone talks about the 2025 amendment, but I still don’t understand how the basic regulation is built.” Fair. The parent statute, Regulation (EU) 2021/821, really is a three-layer design: the Annex I item list, EU001–EU008 General Export Authorisations, and three catch-all articles. Here I stay with that fundamental structure, not the 2025 list update, so first-time readers can open the text without getting lost.

What you will learn

• Chapter structure of Regulation (EU) 2021/821 and what each of the four Annexes does
• How to read the Annex I 10 categories (0–9) and five-character codes such as “3A001”
• When to use EU001–EU008 General Export Authorisations (GEAs)
• Differences among the three catch-all articles: Art. 4 (WMD), Art. 5 (cyber-surveillance), Art. 8 (technical assistance)
• Criminal-penalty floors under Directive 2024/1226 and the ICP seven elements

Three terms to understand first

Annex I: the controlled-item list

Among the Regulation’s annexes, Annex I matters most. Roughly 2,200 dual-use entries sit in 10 categories (0–9). Exporting listed items to third countries generally needs a member-state license.

GEA: EU-wide General Export Authorisation

A General Export Authorisation is a common EU bulk authorization. When the conditions are met, exporters can use it without filing individual applications. Annex II defines eight types, EU001–EU008: lower-risk destinations such as the U.S. and Japan for most items, temporary exhibition exports, intra-group software and technology transfers, and more.

Catch-all: capturing non-listed items

List control makes Annex I items licenseable. That alone misses non-listed items that can still divert to WMD or cyber-surveillance end uses. Catch-all requires licenses for non-listed items when certain end uses or destinations apply. Regulation 2021/821 provides three: Art. 4 (WMD), Art. 5 (cyber-surveillance), Art. 8 (technical assistance).

Chapter structure of Regulation (EU) 2021/821

Adopted by the European Parliament and Council on May 20, 2021; published June 11; effective September 9, 2021. It recasts Council Regulation (EC) No 428/2009 and integrates dual-use export, brokering, technical assistance, transit, and intra-EU transfers.

Term note: Recast. Rewriting an existing EU regulation or directive into one new instrument rather than piecemeal amendment. The old act is repealed and fully replaced.

A Regulation applies directly in all 27 EU member states without domestic transposition, unlike Directives, which set goals for national implementation.

Chapter	Content	Key articles
Chapter I	Scope and definitions	Arts. 1–2
Chapter II	Export scope (list controls and catch-alls)	Arts. 3–10
Chapter III	Authorization types (individual / global / general)	Arts. 11–14
Chapter IV	Member-state renewal and revocation	Arts. 15–18
Chapter V	Information sharing among member states and the Commission	Arts. 19–23
Chapter VI	Enforcement duties and penalties	Arts. 24–29

Four Annexes follow:

Annex	Content	Role
Annex I	Controlled-item list (~2,200 entries)	License required for third-country export
Annex II	EU GEAs (EU001–EU008)	Conditions for bulk authorization
Annex III	Standard application forms	Procedural harmonization
Annex IV	Most sensitive items	License also required for intra-EU transfers

Annex IV requires licenses even for intra-EU moves. Free movement among member states is the default, but stealth technology and certain strategic materials still need authority approval when they cross internal borders.

Annex I’s 10-category structure

Categories 0–9

No.	Category	Main examples
0	Nuclear materials and equipment	Uranium, reactors, centrifuges
1	Special materials and related equipment	High-performance fibers, composites, chemicals, biological agents
2	Materials processing	Machine tools, robots, vibration test equipment
3	Electronics	Semiconductor manufacturing equipment, special ICs, inspection tools
4	Computers	High-performance computers; crypto-capable systems
5	Telecommunications and information security	Comms gear, crypto, quantum key distribution
6	Sensors and lasers	Night vision, sonar, high-power lasers
7	Navigation and avionics	Inertial navigation, GNSS anti-jam
8	Marine	Submersibles, underwater comms, diving gear
9	Aerospace and propulsion	Aircraft, jet engines, rocket technology

This structure is broadly shared with the U.S. EAR CCL and China’s dual-use list — so “first digit = genre” works across EU, U.S., Japan, and China regimes.

Reading five-character codes

3 A 0 0 1
│ │ │ │ │
│ │ │ └─┴── Sequential number
│ │ └────── Regime origin (0=Wassenaar, 1=MTCR, 2=NSG, 3=AG, 4=CWC)
│ └──────── Product group (A–E)
└────────── Category (0–9)

Product groups (second character):

Letter	Content
A	Systems, equipment, components
B	Test, inspection, production equipment
C	Materials
D	Software
E	Technology / technical information

Regime digit (third character):

Digit	Regime	Focus
0	Wassenaar Arrangement	Conventional arms and dual-use
1	MTCR	Missile technology
2	NSG	Nuclear-related
3	Australia Group	Chemical and biological
4	CWC	Chemical Weapons Convention

Example: 3A001 means category 3 (electronics), equipment, Wassenaar-origin, entry 001 (special integrated circuits). 5D002 means category 5 (telecom/infosec), software, Wassenaar-origin, entry 002 (crypto software).

EU-autonomous items (not from multilateral regimes) use the 500 series (third digit 5). The 2025 amendment parked quantum and semiconductor manufacturing equipment there; I cover that list update in a separate article.

Annex I is amended by delegated regulation at least once a year, reflecting decisions and commitments made in the Wassenaar Arrangement, MTCR, the Australia Group and the NSG. The most recent amendment is Delegated Regulation (EU) 2025/2003, adopted by the Commission on 8 September 2025, published in the Official Journal on 14 November 2025 and in force from 15 November 2025. It added quantum computing components, advanced semiconductor manufacturing equipment, additive manufacturing machines and peptide synthesisers, among others. When you cite the text, work from the consolidated version as of 15 November 2025. Classifying against an older consolidated text means missing the additions.

EU001–EU008: eight General Export Authorisations

Individual applications for every Annex I export burden both exporters and authorities. Annex II therefore provides eight EU-wide GEAs for typical scenarios.

Code	Sub-annex	Main coverage	Typical destinations
EU001	Annex IIA	Most Annex I items (with exclusions)	U.S., Canada, Australia, Japan, NZ, Norway, Switzerland (incl. Liechtenstein)
EU002	Annex IIB	Certain lower-risk items	Limited destinations
EU003	Annex IIC	Re-export after repair/replacement	Original destination
EU004	Annex IID	Temporary exhibition/fair exports	All destinations (with exclusions)
EU005	Annex IIE	Telecom equipment and related technology	Certain lower-risk countries (Argentina, India, South Africa, Korea, Russia, Turkey, Ukraine, etc.)
EU006	Annex IIF	Certain chemicals	Limited destinations
EU007	Annex IIG	Intra-group software and technology transfers	Parents, subsidiaries, sister companies
EU008	Annex IIH	Cryptographic items	Destinations other than excluded ones

EU007 and EU008 were new in 2021/821. That was the EU catching up with how multinationals actually move technology and crypto items.

One caution on EU005: the text still lists Russia among lower-risk destinations, but post-2022 Russia sanctions (including Regulation 833/2014) override it. Dual-use exports to Russia are effectively almost fully banned. Reading GEA text alone as “Russia is allowed” is a mistake I still see in the field.

Another common myth: EU001 does not open unlimited U.S. exports. It covers “most of Annex I,” but crypto, certain nuclear-related, and cyber-surveillance items are explicitly excluded from GEAs and need individual or global licenses.

Three catch-all articles

Article 4: WMD / military end-use catch-all

Even non-listed items require a license when (a) authorities notify the exporter, or (b) the exporter itself knows, that the item may be used for:

1. Development or production of WMD or means of delivery
2. Military end use in arms-embargo destinations
3. Parts of military items exported without authorization from the destination country

Member states may extend the duty to cases where the exporter has grounds for suspecting. Germany and France among others have adopted that extension, raising practical due-diligence standards.

Article 5: cyber-surveillance catch-all (new in 2021/821)

Article 5 makes items designed for covert monitoring of natural persons’ information and communications (cyber-surveillance items) licenseable even if unlisted, when they may be used for internal repression or serious human-rights / IHL violations. Examples in mind:

• Communications interception gear (e.g., IMSI catchers)
• Spyware and mobile infection tools
• Facial-recognition systems operated in certain contexts
• Large-scale communications monitoring systems

The Commission published “Article 5 cyber-surveillance guidelines” in 2024 with concrete due-diligence steps.

Article 8: technical assistance (new in 2021/821)

Article 8 requires licenses for technical assistance related to Annex I items when that assistance would contribute to Article 4 catch-all end uses. “Technical assistance” includes intangible services:

• Provision of technical data
• Maintenance, repair, training
• Consulting and design support

Previously, “no physical movement, no export” was a common oversimplification. Article 8 reaches people and knowledge movements. If your EU-based engineers train third-country customers, you are already inside this reach.

Term note: relation to deemed export — Japan’s FEFTA “deemed export” (treating technology transfers from residents to non-residents as exports) is a close cousin. EU Article 8 covers both assistance accompanying goods and standalone intangible assistance.

Comparing the three articles

Aspect	Art. 4	Art. 5	Art. 8
Item scope	All items (including unlisted)	Cyber-surveillance items (including unlisted)	Technical assistance related to Annex I items
Risk focus	WMD / military end use	Internal repression / human-rights abuses	Contribution to Art. 4 end uses
Main basis	Multilateral regime consensus	EU human-rights-driven autonomous rule	New in 2021/821

Articles 6 (brokering) and 7 (transit) sit in the same Chapter II, extending coverage beyond tangible exports.

Four authorization types

Type	Applicant	Scope	Validity	Geographic reach
Individual Export Licence (IEL)	One exporter	One or more items → one end user	Up to 2 years	Valid EU-wide
Global Export Licence (GEL)	One exporter	Multiple items → multiple named end users / destinations	2 years (renewable)	Member-state conditions apply
EU GEA (UGEA / GEA)	All exporters	Under Annex II conditions	Unlimited while conditions met	EU-wide
National GEA (NGEA)	All exporters	Defined by member state	Varies	Issuing state only

Process outline:

1. Item classification: match products to Annex I; identify five-character codes
2. Destination and use: check Art. 4 / Art. 5 catch-all relevance
3. GEA availability: test EU001–EU008
4. Competent authority: the member state where the exporter is established or resident
5. Filing: Annex III standard forms plus end-use certificates and supporting docs
6. Review: typically ~20 working days; sensitive destinations may involve other member states and take longer

Main authorities:

Country	Primary authority
Germany	BAFA
France	DGE / SBDU
Netherlands	CDIU
Italy	UAMA
Spain	SGCEDU

Penalties: Directive 2024/1226 sets criminal floors

Regulation 2021/821 left penalty levels to member states, producing large gaps (strict German criminal exposure vs. administrative-only regimes elsewhere).

Directive (EU) 2024/1226, adopted April 24, 2024, sets minimum criminal-penalty standards for EU sanctions and export-control violations, with member-state transposition due by May 20, 2025.

Category	Natural persons	Legal persons
Floor	1–5 years imprisonment	—
Serious violations	—	Higher of 5% of worldwide annual turnover or €40M
Circumvention	—	Higher of 1% of worldwide annual turnover or €8M
Ancillary	Fines, disqualification from office	Exclusion from public funds, license revocation, etc.

The “higher of 5% or €40M” design follows the same family as GDPR and the EU AI Act — global scale multiplies absolute exposure.

As of July 2025, Commission tallies showed 18 member states late on transposition, with infringement proceedings opened. Germany is aligning via Foreign Trade Act (AWG) amendments through end-2025. EU subsidiaries of Japanese companies must track national implementing statutes country by country for some time.

ICP seven elements: becoming effectively mandatory

Recitals to Regulation 2021/821 call on EU exporters to adopt Internal Compliance Programmes (ICPs). Text-wise this is recommendation, not hard duty. In practice, global licenses (GEL) and cyber-surveillance exports are increasingly unworkable without an ICP.

Commission Recommendation (EU) 2019/1318 (July 30, 2019) sets seven core ICP elements:

1. Top-management commitment
2. Organization, responsibilities, and resources
3. Training and awareness
4. Transaction screening procedures
5. Performance and record-keeping
6. Physical and information security
7. Audit, reporting, and corrective action

Recommendation (EU) 2021/1700 adds a university/research angle: sensitive research governance, foreign researcher involvement, and publication/data handling.

With Directive 2024/1226 in force, violations without an ICP are more readily treated as serious negligence. If I had to pick one baseline for EU subsidiaries, it would be this: build local ICPs at least as strong as the Japan HQ export-control program.

One-page comparison: EU · U.S. · Japan · China

Aspect	EU 2021/821	U.S. EAR	Japan FEFTA	China dual-use ordinance
Structure	List + 3 catch-alls	List (CCL) + EAR99 + end-user controls	List + catch-all	List + anti-sanctions clauses
Extraterritorial reach	Almost none	Strong (de minimis, FDPR)	Almost none	Limited
Item codes	5-character	5-character (ECCN)	Classification / item numbers	5-character (from Dec 2024)
Multilateral regime weight	Nearly 100%	Partial (broad U.S.-autonomous rules)	Nearly 100%	Limited
Enforcer	Member-state authorities + Commission	BIS	METI	MOFCOM

China’s dual-use export-control ordinance effective December 1, 2024 moved ~700 items into a 10-category five-character system. The four major economies now share broadly similar code shapes, which eases comparison — but each still has unique catch-alls and counter-sanctions clauses. Similar codes ≠ same application logic.

Term notes on U.S. EAR

• ECCN: U.S. EAR classification number with structure similar to EU five-character codes (e.g., 3A001, 5D002)
• De minimis: foreign products can become EAR-subject if U.S.-origin content exceeds a threshold (generally 10%; 25% for certain destinations)
• FDPR: U.S. EAR can reach foreign-made products produced with U.S.-origin technology or software — used heavily for semiconductors and advanced China-bound items

If in-house capacity feels insufficient (mid-article CTA)

Regulation 2021/821 is hard because Annex I holds ~2,200 items that update yearly, and 27 member states still diverge on procedures and penalties. Cross-checking U.S. EAR, Japan FEFTA, and China dual-use rules on top makes pure manual coverage unrealistic.

TRAFEED (formerly ZEROCK ExCHECK) cross-searches EU, U.S., China, and Japan controls and visualizes classification and counterparty checks in about five seconds on a 200M+ knowledge graph of papers, patents, researchers, companies, and lists. AWS Tokyo-region operation for sensitive data.

▶ Explore TRAFEED features　▶ Book a 30-minute consultation

Three impacts on Japanese companies and five practical steps

Three patterns

1. Third-country exports from EU subsidiaries: the subsidiary’s member-state rules apply directly; intra-group tech transfers may use EU007
2. Intermediate goods / parts supply into the EU: EU partners increasingly demand EU-rule compliance letters and end-use certificates
3. Third-country exports via EU OEM / contract manufacturing: EU rules govern the final export; Japanese suppliers feel the impact in substance

Term note: OEM — manufacturing under another company’s brand. Export-control rules of the manufacturing location apply directly.

Five practical steps

1. Match products to Annex I; if unlisted, test Art. 4 / Art. 5 catch-all
2. Confirm destinations and end users; test EU001–EU008
3. Self-check ICP seven elements against Japan HQ CP
4. Track member-state transposition of Directive 2024/1226 by subsidiary location
5. Digitize records so license filings, end-use docs, and approvals keep for 5+ years

FAQ

Q1. How do 2021/821 and 2025/2003 differ?

2021/821 is the basic regulation (chapters, catch-alls, authorization framework). 2025/2003 is a delegated regulation updating Annex I. Skeleton stays 2021/821; for the latest list, use 2025/2003.

Q2. Does EU001 allow any export to the U.S.?

No. It covers “most” of Annex I but excludes the most sensitive crypto, certain nuclear-related, and cyber-surveillance items. Always check Annex II exclusion lists before relying on a GEA.

Q3. Is an ICP mandatory?

Text-wise it is recommended. For global licenses and sensitive deals it is effectively required; post–Directive 2024/1226, violations without an ICP are more easily treated as serious negligence.

Q4. Can we export to Russia under EU005?

Textually Russia appears among EU005 destinations, but post-2022 Russia sanctions override. Dual-use exports to Russia are effectively almost fully banned. Do not decide from GEA text alone.

Q5. Will fines really reach 5% of turnover?

Directive 2024/1226 sets floors; member states may go higher. Actual penalties weigh seriousness, intent, and compliance posture. Larger global turnover means larger absolute exposure — group-wide programs matter.

Latest developments as of July 2026

As of July 2026 the skeleton of EU 2021/821 is unchanged, but dual-use-related economic-security partnerships among countries have tightened. At the 16th Japan–India Annual Summit on July 2, 2026, the two sides issued a joint economic-security declaration covering semiconductors, critical minerals (rare earths), clean energy, ICT (subsea cables), and pharmaceuticals, with roughly ¥2 trillion in investment framed (Japan–India summit joint press conference (Prime Minister’s Office, July 2, 2026)). Semiconductors and critical minerals overlap Annex I category 3 and special materials. For Japanese companies classifying inside the EU, bilateral frameworks can move destination judgments and due-diligence baselines over time. Related: Japan–India summit and economic security.

If you want to improve export-control operations or classification efficiency, review the TRAFEED service catalog (PDF) or contact us.

Key takeaways

• Regulation (EU) 2021/821 (effective September 2021) is the parent dual-use statute: chapters, Annexes, and catch-alls
• Annex I runs 10 categories and roughly 2,200 entries; five-character codes encode category, product group, regime origin, and sequence
• EU001–EU008 GEAs are pre-cleared menus for typical scenarios, not blank checks
• Arts. 4 (WMD), 5 (cyber-surveillance), and 8 (technical assistance) still reach unlisted items and assistance
• Directive 2024/1226 sets criminal floors; ICP seven elements are becoming effectively mandatory

Honestly, the teams that struggle most are not the ones who skip Annex I. They are the ones who stop after the list and never build a habit around GEA exclusions, catch-all, and ICP. Monday morning, re-open your item master against Annex I and write down which GEA, if any, you actually rely on.

Related articles

• Overview of the EU Dual-Use Regulation 2025 amendment (2025/2003)
• EU export regulations landscape and 2026 update
• What are dual-use items? The basics
• China adds 14 EU entities to its export control list (MOFCOM Announcement No. 30)
• How to build an export control programme

Take a one-page overview back to the office

Many readers need materials for managers and legal. TIMEWELL offers a practitioner white paper that packs EU · U.S. · Japan · China export-control essentials into a one-page checklist plus structure comparison — Annex I 10 categories / GEA list / three catch-alls / ICP seven elements / Directive 2024/1226 penalties in a form fit for internal circulation.

A TRAFEED product white paper (features, pricing, case studies) is in the same resource library. Download materials first if you want to align stakeholders before a meeting.

▶ Browse free white papers　▶ Related: overview of EU 2025/2003

For product behavior and fit to your operations, a 30-minute online consultation is also available.

▶ Book a 30-minute online consultation

References

• EUR-Lex: Regulation (EU) 2021/821 (basic regulation)
• EUR-Lex: Regulation (EU) 2021/821 (2024 consolidated text)
• EUR-Lex: Directive (EU) 2024/1226 (penalties directive)
• EUR-Lex: Recommendation (EU) 2019/1318 (ICP guidelines)
• EUR-Lex: Recommendation (EU) 2021/1700 (research ICP)
• European Commission Trade DG: Exporting dual-use items
• European Commission: Article 5 cyber-surveillance guidelines consultation
• Wassenaar Arrangement official site
• BAFA (Germany)
• METI security trade control (reference)