Hello, this is Ryuta Hamamoto from TIMEWELL. The EU’s parent dual-use statute, Dual-Use Regulation (Regulation 2021/821), was reshaped by Delegated Regulation (EU) 2025/2003, adopted September 8, 2025. The change I get the most questions about is the new EU-autonomous “500 series” control category: quantum computers, semiconductor manufacturing equipment, advanced computing, 3D printing, and certain biotech items newly require licenses. Below is what manufacturers with EU subsidiaries, and teams that ship into the EU, should lock in first.
What you will learn
- How Dual-Use Regulation 2021/821 relates to Delegated Regulation 2025/2003
- What the “500 series” that took effect November 15, 2025 is — and why the third digit is “5”
- Why quantum, semiconductor manufacturing equipment, and advanced computing were added (Wassenaar Minus One)
- Relationship to the EU AI Act (Regulation 2024/1689) and the place of Article 5 catch-all
- A three-point check for whether your company is affected, plus five practical steps
Three terms to understand first
Annex I: the controlled-item list
Regulation 2021/821 has multiple annexes. Annex I is the control list, listing licensable items across 10 categories. 2025/2003 fully replaces Annex I.
| Annex | Role |
|---|---|
| Annex I | Controlled-item list (core) |
| Annex II | Items and destinations for EU General Export Authorisations (EU GEA) |
| Annex III | Individual and global license application forms |
| Annex IV | Most sensitive items (license also needed for intra-EU transfers) |
Delegated Regulation: EU law the Commission can adopt alone
Among EU legal forms (Regulation, Directive, Decision), Delegated Regulations let the Commission alone adopt measures that supplement or amend non-essential elements of a basic act.
“Implementing Regulations” govern how to apply law without changing substance. Delegated Regulations sit closer to the legal core.
2025/2003 is a delegated regulation. Absent objection by the Parliament and Council, it enters into force and applies directly EU-wide. No national re-enactment is required.
500 series: EU-autonomous control category
Annex I classification numbers look like “4A506”: first digit = category (4 = computers), second = product type (A = equipment), remaining digits = entry number, similar to U.S. EAR ECCNs.
Numbers whose third digit is 5 (the 500 series) are the EU-autonomous category created by 2025/2003.
| Numbering | Origin |
|---|---|
| Ordinary three-digit style (e.g., 4A001, 3A001) | Multilateral-regime consensus (Wassenaar, MTCR, NSG, etc.) |
| 500 series (e.g., 4A506) | EU-autonomous additions (outside multilateral consensus) |
Checking whether the third digit is 5 tells you at a glance whether an entry is EU-autonomous or regime-based.
Dual-Use Regulation 2021/821 in one minute
The Dual-Use Regulation is the EU-wide law governing dual-use exports. Effective September 9, 2021, it fully replaced Regulation 428/2009.
Ten categories
| Category | Content |
|---|---|
| 0 | Nuclear |
| 1 | Special materials and related equipment |
| 2 | Materials processing |
| 3 | Electronics |
| 4 | Computers |
| 5 | Telecommunications and information security |
| 6 | Sensors and lasers |
| 7 | Navigation and avionics |
| 8 | Marine |
| 9 | Aerospace and propulsion |
Within each category: A (equipment), B (test/inspection/production), C (materials), D (software), E (technology). “4A506” reads “computers · equipment · entry 506.”
Why annual updates
Annex I is updated roughly once a year to reflect international export-control regimes (Wassenaar Arrangement, Australia Group, NSG, MTCR, CWC). Article 17 of the basic regulation 2021/821 empowers the Commission to update via delegated regulation.
| Delegated regulation | Main content |
|---|---|
| (EU) 2022/1 | 2021 multilateral consensus |
| (EU) 2023/66 | 2022 multilateral consensus |
| (EU) 2024/996 | 2023 multilateral consensus |
| (EU) 2025/2003 | 2024 multilateral consensus + EU-autonomous 500 series |
Past updates mainly reflected multilateral consensus. 2025/2003 matters because the EU stepped beyond that consensus. That is the break from prior years.
Replace siloed classification work with AI.
METI's FY2024 data shows 52% of foreign exchange law violations stem from classification errors. Download the TRAFEED product catalog covering features and rollout.
What Delegated Regulation 2025/2003 changed
Adopted by the Commission on September 8, 2025; published in the Official Journal (L251/1) on November 14, 2025; effective November 15, 2025.
1. Multilateral-consensus updates
Reflects 2024 amendments agreed in the Australia Group, MTCR, NSG, Wassenaar Arrangement (December 3, 2024 plenary), and CWC. Wassenaar updated intrusion-software and IP network-surveillance controls.
2. New 500 series (the headline change)
Items that could not reach multilateral consensus were added on an EU-autonomous basis.
Quantum technology
- 4A506: quantum computers themselves
- Cryogenic electronics for quantum computers
- Parametric signal amplifiers
- Cryogenic cooling systems
- Cryogenic wafer probers
Semiconductor manufacturing and inspection
- ALD (atomic layer deposition) equipment
- Epitaxial deposition equipment
- Lithography equipment
- EUV pellicles, masks, and reticles
- Scanning electron microscope (SEM) equipment
- Etch equipment
Advanced computing
Expanded controls on high-performance integrated circuits; certain FPLDs / FPGAs expressly covered.
Additive manufacturing (3D printing)
Metal 3D printers, high-entropy alloy powders, refractory metal alloy powders, and more.
Biotech
High-purity peptide synthesis equipment. Useful in pharma, diagnostics, and advanced biology; also treated as a biosecurity concern under the control logic.
Aerospace
High-temperature coatings (aerospace, energy, specialty manufacturing) added; “Spacecraft” definition expanded.
3. Definition clarifications
Electronics, manufacturing equipment, and aerospace definitions were rewritten for clearer inclusion/exclusion lines. Some boundaries sharpened; some items newly pulled into scope.
Why quantum, semiconductor equipment, and advanced computing were added
Economic security and emerging technology
Quantum computers and advanced semiconductor manufacturing equipment are emerging technologies with high dual-use potential and relevance to AI, cryptanalysis, and communications interception. Major advanced economies have been tightening controls.
The U.S. BIS moved first on quantum and advanced semiconductor tools; the UK introduced temporary autonomous controls (PL9013–9015) in 2024; Japan added 23 semiconductor manufacturing equipment items from 2024. Pressure for a common 27-member-state EU control was one driver.
Reducing member-state fragmentation
Some 500-series items had already been controlled on national lists in the Netherlands, France, and elsewhere: ASML’s home Netherlands, and France’s quantum and advanced-manufacturing lists.
The result was messy. The same product could be controlled in one member state and free in another. The 500 series aims to end that fragmentation at EU level.
Wassenaar Minus One — the EU-autonomous turn
Multilateral consensus has become hard
The Wassenaar Arrangement (42 participants including the U.S., UK, EU members, Japan, Korea, Russia, and others) operates by consensus: one objection blocks new controls.
Since 2022, after Russia’s invasion of Ukraine, relations among participants deteriorated and quantum / advanced semiconductor / advanced manufacturing consensus effectively stalled. The shared view among practitioners: unanimity is hard, and emerging-tech response is lagging.
“Wassenaar Minus One”
The U.S., UK, and EU have strengthened informal coordination often labeled “Wassenaar Minus One.” The 500 series sits in that stream.
Important framing: this is less “targeting a particular country” than a response to a broken consensus process, with jurisdictions shifting to autonomous controls. I would not plan as if the next decade looks like old Wassenaar. Japanese companies should assume more jurisdiction-specific rules and build cross-jurisdictional check capacity.
Relationship to the EU AI Act (general application date August 2, 2026, and when high-risk obligations start)
The EU AI Act (Regulation (EU) 2024/1689) entered into force August 1, 2024 on a phased schedule. Its general application date (Article 113) is August 2, 2026, but not every obligation begins on that day. What applies from August 2, 2026 includes the transparency obligations of Article 50 (Chapter IV), the provisions on harmonised standards, conformity assessment, CE marking and registration (Chapter III Section 5 = Articles 40–49), Chapter VI, Chapters VIII–XI, and the European Commission's power to impose fines on providers of general-purpose AI (GPAI) models (Article 101).
The substantive obligations for high-risk AI, by contrast, were pushed back by Regulation (EU) 2026/1744 (the "Digital Omnibus"). That regulation was adopted on July 8, 2026, published in the Official Journal (OJ L 2026/1744) on July 24, 2026, and entered into force on July 27, 2026. The amended timeline:
| Scope | Application date of Chapter III Sections 1, 2 and 3 |
|---|---|
| Annex III high-risk AI (Article 6(2)) | December 2, 2027 |
| Annex I high-risk AI (Article 6(1) — embedded in products) | August 2, 2028 |
The authorised representative (Article 22), value-chain obligations (Article 25), deployer obligations (Article 26), and the fundamental rights impact assessment / FRIA (Article 27) likewise start on December 2, 2027 for Annex III systems. The transitional rule for systems already placed on the market (Article 111(2)) was also changed: it now bites only where significant changes in their designs are made on or after the Chapter III application date, rather than from a single fixed cut-off.
For reference, Chapters I and II — including prohibited AI practices (Article 5) and AI literacy (Article 4) — have applied since February 2, 2025, and Chapter V on GPAI models plus Chapter XII on penalties (Articles 99 and 100) have applied since August 2, 2025. On December 2, 2026, the newly added prohibitions (Article 5(1)(ba) and (bb)) begin, and the new Article 111(4) deadline falls due: providers of synthetic-content-generating AI placed on the market before August 2, 2026 must comply with Article 50(2) by that date.
So when mapping the Dual-Use interaction, start by discarding the common shorthand that the AI Act "fully applies, high-risk included, from August 2, 2026." It does not.
Different purposes and application moments
| Aspect | AI Act | Dual-Use Regulation |
|---|---|---|
| Object | AI systems provided/used on the EU market | Items exported outside the EU |
| Main purpose | Fundamental rights and safety | Security and non-proliferation |
| Penalty ceiling | Article 5 (prohibited practices): 7% of worldwide turnover or €35M; GPAI-related and other breaches: 3% or €15M (whichever is higher) | Up to €40M under Directive 2024/1226 |
Purposes and moments differ, so parallel application is the rule. AI software exported from the EU needs AI Act compliance inside the EU and Dual-Use analysis on outbound export.
Article 5 catch-all
Article 5 is the cyber-surveillance catch-all: unlisted items can still require licenses when human-rights abuse or internal repression is foreseeable. AI surveillance systems can fall under it in practice (operational guidelines published 2024).
Even outside the 500 series, destination and end use can still pull AI systems under Article 5.
Three-point check: are you affected?
Check 1: Do you have an EU subsidiary?
EU legal entities are directly subject to the Dual-Use Regulation. 500-series items require individual export licenses from the competent member-state authority.
Direct regulatory responsibility sits with the EU subsidiary. Japan HQ is not the primary regulated party, but group compliance and reputation create indirect exposure.
Check 2: Do you export to the EU?
The Dual-Use Regulation principally regulates exports from the EU outward, so imports into the EU are not its object.
If an EU subsidiary or distributor re-exports or resells, that is separately controlled. Map where your product goes after it enters the EU.
Japan-origin exports are separately controlled under Japan’s FEFTA / Export Trade Control Order (METI). Check both sides.
Check 3: Do goods flow to third countries via EU OEMs?
When you supply parts to EU OEMs/assemblers that export finished goods to third countries, the Dual-Use Regulation applies at the finished-product export.
Even without your own export, supplying 500-series components can require cooperation on the OEM’s licenses and classifications. Map the full supply chain.
Violation risk
Directive 2024/1226 (adopted April 24, 2024) harmonizes criminal penalties for EU sanctions and export-control violations. Member states were to transpose by May 20, 2025.
Criminal floors
- Dual-Use Annex I / IV sanctions violations: up to 5+ years imprisonment (regardless of amount)
- Corporate fines: member states must set maxima of 1–5% of worldwide turnover, or €8M–€40M, depending on offense type
Member-state variation
- Germany: AWG amendments; even slight negligence can be punishable; corporate max €40M
- France: 1–5% worldwide turnover ceilings to be reflected domestically
- Multi-country operations must check each member state’s penalty levels
“EU penalties are soft” is outdated. Honestly, that line was never a safe planning assumption. Post–Directive 2024/1226, exposure approaches U.S. EAR and Japan FEFTA levels.
Five practical steps
For Japanese companies with EU subsidiaries or EU-bound exports (as of May 20 framing):
Step 1: Reclassify your item master against the new Annex I
Re-run classification against fully replaced Annex I. Prioritize quantum, semiconductor manufacturing equipment, advanced computing, 3D printing, and biotech that may hit the 500 series.
Step 2: Ask competent authorities about existing licenses
Official transition language is limited. If you hold existing licenses, query the member-state authority (Netherlands CDIU, Germany BAFA, France Direction Générale des Entreprises, etc.).
Step 3: Map the EU supply chain
Inventory where 500-series items move among EU subsidiaries, OEMs, and distributors — including re-export paths.
Step 4: Strengthen counterparty screening
Combine EU sanctions lists with Annex I item coverage. Check destination, end user, and end use.
Step 5: Build an annual-update workflow
Annex I updates roughly once a year (usually autumn). Embed item-master reclassification before and after updates. Sources: EUR-Lex, Commission Trade DG, JETRO Brussels reporting, METI “EU export-control developments.”
Common misconceptions / FAQ
Q1. If we only export from Japan to the EU, is Dual-Use irrelevant?
It principally regulates EU outbound exports, so Japan→EU imports are outside scope. Re-export/resale inside the EU is separately controlled. Check where goods go after EU entry.
Q2. How do we cover both U.S. EAR and EU Dual-Use?
Three basics:
- Dual item classification: ECCN (U.S.) and EU classification numbers separately
- Integrated destination/end-user screening: U.S. SDN and EU sanctions lists together
- Understand extraterritorial differences: EAR uses de minimis / FDPR abroad; Dual-Use is basically intra-EU focused
Q3. Do SMEs need this?
Yes. Size does not exempt controlled items. Resource-constrained firms should use member-state helpdesks, consultants, and AI-based export-control tools.
Q4. Can we classify 500-series items just by reading Annex I?
Yes in principle, but thresholds (speed, wavelength, temperature ranges, etc.) are fine-grained — you must map product specs against text. Document technical reasoning for audits and authority queries.
Q5. If both AI Act and Dual-Use apply, which wins?
Neither — parallel application. AI Act for EU-market provision/use; Dual-Use for outbound export. Comply with both.
Latest developments as of July 2026
As of July 2026, EU-autonomous 500-series domains (quantum, semiconductors, critical minerals) increasingly overlap Japan’s economic-security agenda. The 16th Japan–India Summit on July 2, 2026 produced a joint declaration on cooperation across semiconductors, critical minerals (rare earths), clean energy, ICT, and pharmaceuticals, with roughly ¥2 trillion in investment framed (Japan–India post-summit joint press conference (Prime Minister’s Office, July 1, 2026)). EU autonomous tightening and bilateral supply-chain partnerships are different tracks, but both target the same emerging-tech clusters. See also Japan–India Summit 2026 and economic security.
If you want to improve export-control operations or classification efficiency, review the TRAFEED service catalog (PDF) or contact us.
Key takeaways
- Delegated Regulation (EU) 2025/2003, effective November 15, 2025, fully replaced Dual-Use Annex I
- Headline change: the 500 series newly covers quantum, semiconductor manufacturing equipment, advanced computing, 3D printing, and certain biotech on an EU-autonomous basis
- Background: Wassenaar Minus One. Weight is shifting from stalled multilateral regimes to autonomous national and regional controls
- Japanese companies should map impact with three checks: EU subsidiaries, EU-bound exports, EU OEM routes
- Violations: under Directive 2024/1226, frameworks for up to €40M fines and 5+ years imprisonment are being built
If I had to pick one Monday-morning task, it would be this: re-run your item master against the new Annex I, starting with quantum, semiconductor equipment, advanced computing, additive manufacturing, and biotech.
Related articles
- EU export regulations landscape and 2026 update
- Export-control compliance basics: five points Japanese companies should lock in
- Differences between U.S. EAR and EU Dual-Use Regulation
If in-house capacity feels insufficient
Dual-Use difficulty is keeping up with annual Annex I amendments while tracking member-state national lists and penalty harmonization (Directive 2024/1226) at the same time. EU subsidiaries need 500-series response (quantum, semiconductor equipment, advanced computing) plus cross-checks against U.S. EAR and Chinese export controls.
TRAFEED (formerly ZEROCK ExCHECK) cross-searches EU, U.S., China, and Japan controls and visualizes classification and counterparty checks in about five seconds on a 200M+ knowledge graph. AWS Tokyo-region operation for sensitive data.
▶ Explore TRAFEED features ▶ Book a 30-minute consultation
References
- EUR-Lex: Commission Delegated Regulation (EU) 2025/2003
- EUR-Lex: Regulation (EU) 2021/821 (basic regulation)
- European Commission Trade DG: 2025 update of the EU control list of dual-use items
- European Commission dual-use guidance page
- European Parliament research paper (economic-security angle)
- Article 5 cyber-surveillance guidelines
- Baker McKenzie: EU Commission's Updating Annex of Dual-Use Regulation
- Cooley: 2025 update to EU Dual-Use Control List
- Hogan Lovells: EU updates dual-use control list
- Akin: EU updates dual-use export control list
