New EU Dual-Use Regulation increases focus on Internal Compliance Programmes

The new EU Dual-Use Regulation 2021/821 will enter into force on 9 September 2021 and replace the previous EU Dual-Use Regulation 428/2009. The new EU Dual-Use Regulation introduces a number of significant changes to EU export controls. In addition to new regulations for surveillance technology in connection with human rights violations as well as future technologies, export control as a whole will become more transparent and effective. The probability of detecting a violation will additionally increase due to closer cooperation between the licensing authorities of the EU Member States. For the first time, an Internal Compliance Programme – "ICP") will be explicitly required as a prerequisite for the use of the new general licence EU007 for the intra-group export of software and technology. It is therefore more important than ever to implement a functioning ICP in the company in order to be able to exclude violations of EU export controls.

Catch-All Clauses

The EU Dual-Use Regulation retains the existing catch-all controls in the event of possible use for weapons of mass destruction and military purposes (Art. 4 EU Dual-Use Regulation). The comprehensive catch-all clause for possible misuse for terrorist purposes, which was initially envisaged, was not implemented by the legislator due to existing terrorist/sanctions lists.

New, however, is the catch-all clause for non-listed goods for digital surveillance (Art. 5 EU Dual-Use Regulation). These are subject to authorisation if the competent authority informs the exporter that the goods in question are or may be intended, in their entirety or in part, for use in connection with internal repression or the commission of serious violations of human rights and international humanitarian law. If the exporter itself becomes aware of such an end-use based on the normal risk analysis carried out in the exercise of its due diligence, it shall inform the authority thereof. The company's risk analysis must be carried out based on the implemented ICP. This catch-all regulation extends the objective of the reformed EU Dual-Use Regulation to the monitoring of human rights violations. By limiting the scope of goods to digital surveillance goods, the scope of the regulation is concretized and more legal certainty is created in the implementation.

New general authorisations

There are two relevant innovations with the introduction of additional general authorisations in order to ease trade while still ensuring sufficient controls on the part of the competent authorities. In future, the majority of the software and technology listed in Annex I can be exported within the group to both subsidiaries and sister companies for product development in a number of uncritical countries via general authorisation EU007 (Annex II). These include Argentina, Brazil, Chile, India, Israel and South Africa. In addition to other requirements, the exporter must always be able to demonstrate a functioning ICP and fulfil registration and reporting obligations vis-à-vis the competent authority. With the crea-tion of the general authorisation EU007 for the intra-group export of software and technology, there is a general authorisation of the EU for the first time in which the requirement for an ICP of the exporter is explicitly stipulated.

For encryption technologies (cryptography), the EU introduces a general authorisation with regard to the eased export of certain goods listed in Annex I EU008 (Annex II). Until now, in the EU, only Germany and the Netherlands had national licences pertaining to encryption technology. This export licence is in principle valid for all countries, with the exception of negative-listed countries of destination and arms embargo countries. In addition, the export is subject to conditions and reporting obligations of the exporter. However, the new EU Dual-Use Regulation does not create a general obligation to implement an ICP for general licences, as was initially planned.

Uniform procedures and exchanges between authorities

In future, a uniform EU-wide authorisation period of up to two years will apply for individual and global export licences. Licences for large-scale, multi-year projects will be valid for up to four years. Improved possibilities for exchanging information between the licensing and customs authorities of the Member States and the Commission on licensing decisions contribute to further harmonisation of practical application. Overall, the Regulation introduces a new mechanism for coordinating the enforcement of controls for dual-use items, which are aimed at improving cooperation between enforcement authorities and the exchange of best practices.

Increased requirements for ICP

The requirements for an ICP from companies will continue to increase as a result of the amendments. The new EU Dual-Use Regulation pushes for greater cooperation between the EU Member States, their export control and customs authorities and the EU Commission with the aim of achieving greater transparency, improved controls, harmonisation of processes and the creation of a level playing field within the Member States. Detection of export control violations will increase because of cooperation at EU level. This requires analogous reactions on the part of exporters with regard to their ICP.

The EU Dual-Use Regulation itself defines the term "ICP" for the first time and refers to it on various occasions. For the purposes of the new Regulation, the term ICP (Recital 21 of the EU Dual-Use Regulation) means:

“‘internal compliance programme’ or ‘ICP’ means ongoing effective, appropriate and pro-portionate policies and procedures adopted by exporters to facilitate compliance with the provisions and objectives of this Regulation and with the terms and conditions of the au-thorisations implemented under this Regulation, including, inter alia, due diligence measures assessing risks related to the export of the items to end-users and end-uses"

Against the background of this legal definition, existing ICPs should be reviewed and adapted as necessary. In the day-to-day practice of export control, an ICP represents a crucial "protective shield" for companies. The granting of export licences has often depended on the company's proven reliability. With an ICP, the exporter can substantiate this reliability. Moreover, violations of export control law are not only punishable under criminal law or lead to negative administrative consequences (including fine proceedings) - export violations are also picked up by the media and can result in an enormous loss of image for the companies concerned. A functioning ICP can help to eliminate or reduce these risks completely at best. With the introduction of the new EU Dual-Use Regulation, exporters should review whether their ICP complies with the applicable requirements.