Software
The software industry is one of the fastest growing and globally integrated industries, driven by rapid technological innovation, evolving regulatory landscapes, and increasingly complex international trade dynamics. With advances in cloud computing, artificial intelligence, SaaS (Software as a Service) platforms, and cybersecurity, software products are traded across borders, requiring companies to navigate diverse regulations, intellectual property protections, data privacy standards, and compliance requirements.
Software products and related services are often classified as dual-use items (items with both potential civil and military/intelligence application). As a result, they are subject to export controls under U.S. regulations, including the Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR). The EAR, administered by the Bureau of Industry and Security (BIS), governs the export of dual-use items, including software that may be used for general business purposes or in more sensitive, strategic applications. Software related to encryption, network security, and advanced algorithms often requires an export license to be transferred to certain countries. The ITAR, managed by the Directorate of Defense Trade Controls (DDTC), covers software with direct defense applications and is particularly stringent, with restrictions on the export of source code, algorithms, and software products that could enhance foreign military capabilities.
The software industry’s role will continue to grow in the coming years, driven by technological advancements such as artificial intelligence, cloud computing, and the Internet of Things (IoT). Expanding global digital infrastructure and increased data privacy needs also create new opportunities and challenges for the software industry. As the industry adapts to emerging technology and regulatory environments, the U.S. will continue to play a leading role in developing secure, innovative software solutions for both commercial and governmental applications on a global scale.
In recent years, software, particularly SaaS, has come under additional scrutiny from government regulators. Torres Trade Law has assisted many companies in navigating these regulations. Representative experience includes:
- Advising multiple software companies on the potential application of Committee on Foreign Investment in the U.S. (CFIUS) regulations to investments and acquisition by foreign investors.
- Classifying software and SaaS products pursuant to EAR encryption classification regulations, including obtaining favorable government classifications of SaaS products.
- Representing a SaaS company before the Department of the Treasury Office of Foreign Assets Control (OFAC) related to apparent violations of Cuban and Libyan sanctions programs.
- Assisting software companies determine export classification and licensing requirements for products used in industrial fields.
INSIGHTS
Persistent Errors in the Export Classification of Software Products
By: Olga Torres, Managing Member, Derrick Kyle, Senior Associate
Date: 04/20/2024
Many companies, particularly Software-as-a-Service (“SaaS”) and start-up companies, continue to struggle with the concept of export control classification of items with encryption functionality. This ongoing confusion is understandable for a few reasons. First, many SaaS companies do not export their software in the traditional sense. Software purchasing has moved beyond the days of downloading and installing software onto a computer from, for example, a CD-ROM. (Most newer laptops no longer contain disc drives.) But these companies may still unknowingly be exporting software according to regulatory definitions.
Commerce Finalizes ICTS Supply Chain Rule
By: By Derrick Kyle, Senior Associate
Date: 10/31/2023
On June 16, 2023, the U.S. Department of Commerce (“Commerce”) issued a long-awaited final rule (the “Final Rule”), effective July 17, 2023, related to the Information and Communications Technology Supply Chain.1 Among other clarifications, the Final Rule identifies the Under Secretary of Commerce for Industry and Security as responsible
BIS Releases New Rules Updating Restrictions on Advanced Computing Chips, Manufacturing Equipment, and Supercomputing Items to Countries of Concern
By: Olga Torres, Managing Member Derrick Kyle, Senior Associate
Date: 10/31/2023
On October 17, 2023, the U.S. Department of Commerce Bureau of Industry & Security (“BIS”) released three rules amending the Export Administration Regulations (“EAR”) to strengthen export controls on advanced computing semiconductors and semiconductor manufacturing equipment to arms embargoed countries, including the People’s Republic of China (“China”), and to place certain additional entities in China on BIS’s Entity List.
OFAC and BIS Announce Microsoft Settlement of Sanctions and Export Control Violations
By: Derrick Kyle, Senior Associate, Veronica Ochoa, Paralegal
Date: 04/25/2023
On April 6, 2023, the Department of Treasury Office of Foreign Assets Control (“OFAC”) and the Department of Commerce Bureau of Industry and Security (“BIS”) announced a settlement with Microsoft Corporation (“Microsoft”) and issued a combined $3.3 million in civil penalties to settle potential violations of sanctions and export control laws pertaining to Russia and other sanctioned jurisdictions.
New U.S. Rules on Securing the Information and Communications Technology and Services Supply Chain Mean Increased Scrutiny of ICTS Transactions
By: Olga Torres, Managing Member & Matt Lapin, Of Counsel
Date: 04/08/2021
On January 19, 2021, the Department of Commerce (“Commerce”) published an interim final rule, “Securing the Information and Communications Technology and Services Supply Chain,” (“ICTS Rule”) implementing Executive Order 13873.
President Trump Adds Teeth to CFIUS Bite: Chinese Company Ordered to Divest Acquisition of U.S. Hotel-Software Company
By: Olga Torres, Managing Member & Maria Alonso, Associate
Date: 04/05/2020
The U.S. Department of the Treasury finalized the new Committee on Foreign Investment in the United States (“CFIUS”) regulations, which became effective on February 13, 2020.[1]
Amongst other matters, the new regulations significantly expand CFIUS’s jurisdiction for non-controlling investments, including the review of transactions involving U.S. businesses that manage or collect “sensitive personal data” of U.S. citizens.