Your agent needs an export control check (seriously)

Your AI agent just scraped a technical paper from arxiv.org, summarized it, and sent the key insights to your Slack channel. Normal Tuesday, right?

Except that paper contained dual-use encryption algorithms. Your agent just became an unlicensed arms dealer.

This isn't theoretical. Export controls cover software, technical data, and "technology" — which includes know-how your agent might be processing, storing, or transmitting. The regulations are written for humans, but your agent doesn't get a pass.

The ITAR and EAR problem

Two regulations matter: ITAR (International Traffic in Arms Regulations) covers defense articles, and EAR (Export Administration Regulations) covers dual-use items. Both define "export" broadly — it includes transmitting technical data to foreign nationals, even if they're in the US.

Your agent probably violates both daily:

• Processes technical drawings and sends summaries to cloud storage (potential ITAR violation)
• Scrapes research papers on cryptography and shares insights (potential EAR violation)
• Analyzes satellite imagery and stores results (potential dual-use export)
• Accesses your codebase containing encryption libraries (controlled technology)

The penalties start at $300,000 per violation. Criminal penalties go up to $1 million and 20 years in prison.

The audit that saves you

Run this check on every agent task:

EXPORT_CONTROL_CHECK = {
    "technical_data": [
        "Does this involve defense articles?",
        "Are there technical drawings or specifications?",
        "Does this include controlled software source code?"
    ],
    "dual_use": [
        "Encryption algorithms or implementations?",
        "Surveillance technology or methods?",
        "Navigation or guidance systems?"
    ],
    "foreign_access": [
        "Will foreign nationals access this data?",
        "Is data stored on foreign-owned cloud services?",
        "Are team members located outside the US?"
    ]
}

If any answer is "yes," you need export control review before your agent touches it.

The safe harbor pattern

Build export control awareness into your agent's operating procedures:

# Export Control Safety Check
Before processing any technical document or code:
1. Flag potential controlled items (encryption, defense, dual-use)
2. Verify all data recipients are US persons
3. Confirm cloud storage is US-controlled
4. Log all technical data transfers
5. Escalate flagged items to human review

Critical: "Publicly available" doesn't mean "export-free." Even public research papers can be export-controlled if they contain certain technical details.

The practical implementation

Add this to your agent's system prompt:

Before processing technical documents, code, or research materials:
- Check if content involves defense, encryption, or dual-use technology
- Verify all recipients are authorized US persons
- Flag any controlled items for human review
- Do not transmit flagged content without explicit approval

Your agent needs to understand that some knowledge requires careful handling. Export controls aren't just compliance theater — they're national security law with criminal penalties.

The good news? Most business tasks are fine. The bad news? The ones that aren't fine can destroy your company.