iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, U.S. export controls can apply to an India-based sourcing or outsourcing arrangement—even when no shipment goes directly from the United States. The analysis turns on the item or information, its origin and classification, how it is transferred or accessed, the destination, the end use and end user, and any license, exception or special authorization that actually fits. India is not a blanket license-free destination, and an Indian supplier is not automatically approved merely because India is eligible for certain U.S. authorization programs.
What the rules cover
This article addresses the Export Administration Regulations (EAR), administered by the U.S. Bureau of Industry and Security (BIS). The EAR can regulate physical products, software, source code, technical data and some services or assistance connected with controlled items. It can also reach transactions that never look like a traditional export shipment.
![International Trade Law: Problems, Cases, and Materials [Connected Ebook] (Aspen Casebook)](https://m.media-amazon.com/images/I/418wzUp2AZL._SL160_.jpg)
Under the EAR, a U.S.-origin item may remain subject to the regulations after it is reexported from another country. A foreign-made product can also become subject to the EAR under a de minimis rule or a foreign-produced direct product rule (FDP rule), but only when the detailed conditions of the applicable rule are met. Separately, giving a foreign person access to controlled technology or source code can be an export event even if the person is physically in the United States.
BIS’s online EAR text reviewed October 13, 2026, is the appropriate starting point for current requirements. Regulations, classifications, country controls and policies can change, so a transaction should be checked against the operative text and its actual facts before work begins.
#1 Best Overall
Does sourcing software development from India trigger U.S. controls?
Not automatically. Buying ordinary services from an Indian company is not, by itself, a license requirement. The risk appears when the engagement gives the supplier controlled software, source code, technology, technical assistance, credentials or remote access, or when the supplier is developing a foreign-made product that falls within an EAR scope rule.
For example, a contractor may receive an ordinary business application that is EAR99, while a different project may involve controlled source code needed to develop, produce or operate a listed item. The commercial label “software development” does not determine the result; the content and classification do.
Document the deliverables rather than describing the project only as a service. Include hardware, executable software, source code, design files, test data, technical drawings, manuals, application-programming interfaces, credentials, cloud access and oral or visual briefings. Electronic transmission and remote access can be relevant even where no tangible media crosses a border.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to determine whether an India arrangement is covered
1. Inventory every item and information flow
Create a list for each workstream. Identify what the Indian supplier will receive, create, modify, host, test or support. Include information needed to develop, produce, operate, install, maintain or repair an item. Record where the material is stored and where each person who can access it is located.
- Physical equipment, components and prototypes
- Object code, source code and encryption-related software
- Design files, specifications, process instructions and test procedures
- Technical assistance, demonstrations, training and oral briefings
- Credentials, remote desktop sessions, repositories and cloud environments
- Subcontractor access and onward transfers to other countries
2. Establish origin
Determine whether each item is U.S.-origin, already subject to the EAR, or foreign-made. A product assembled in India is not automatically outside U.S. jurisdiction. Conversely, the mere use of a U.S. laptop, design tool or commercial application does not by itself prove that the resulting foreign-made product is subject to the EAR.
Rank #2
3. Classify the item
For an item subject to the EAR, identify its Export Control Classification Number (ECCN) on the Commerce Control List, or determine that it is EAR99. EAR99 means the item is subject to the EAR but is not described by an ECCN; it can still be restricted by end-use, end-user, destination or other provisions. “Commercial,” “off-the-shelf” or “used by a private company” are not classification conclusions.
Keep the technical basis for the classification: product specifications, performance thresholds, relevant software functions, encryption characteristics, manufacturer information and the date of the determination. If a supplier supplies a classification, validate that it matches the actual version and configuration being transferred.
4. Test foreign-made products under the exact scope rule
Two rules are especially important for foreign-made products:
- De minimis rules: a foreign-made item may be covered when it contains more than the permitted amount of controlled U.S.-origin content, subject to the applicable content calculation, control reason, destination and other conditions.
- Foreign-produced direct product rules: a foreign-made item may be covered when it is a direct product of specified U.S. technology or software, or of a complete plant or major component that is itself a direct product, and the destination and other rule conditions are satisfied.
These provisions are not a universal “any U.S. content” rule. The applicable product, technology or software, plant or major-component relationship, destination and other requirements must be tested as written. A supplier’s use of U.S. tools or software alone does not establish that its product is controlled.
5. Map every transfer and access point
Identify U.S. shipments, reexports from a third country, in-country transfers in India, and releases of technology or source code. In a staffing arrangement, record the location and relevant nationality or permanent-residency information of everyone who can access controlled material. A release to a foreign person in the United States can be a deemed export; certain releases in a foreign country to a third-country national can be deemed reexports.
Rank #3
Nationality is not the complete test. First establish that the technology or software is controlled, then apply the operative deemed-export or deemed-reexport rule and its exceptions. BIS describes the core concept in EAR Part 730: “The release of technology to a foreign national in the United States through such means as demonstration or oral briefing is deemed an export.” The definitions and exceptions are in Part 734.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow India affects the licensing analysis
Country groups and the Commerce Country Chart
BIS places India in Country Groups A:1, A:2, A:3 and A:5. Those groupings can affect whether a license exception is available, but they do not answer every licensing question. For an ECCN, match the listed reasons for control against the current Commerce Country Chart and then review the rest of the EAR for additional controls.
The chart is only one part of the analysis. End-use and end-user restrictions, restricted-party screening, antiboycott provisions and other Part 744 controls can apply independently of a country-chart result. An item that does not require a license for one reason may still require authorization because of who will receive it or how it will be used.
India’s general license-review policy
BIS states a general policy of approval for specified license applications to India, including certain 600-series items for specified civil or military end uses, with exclusions that include certain weapons activities. This is a policy for reviewing applications. It is not a general license, an automatic authorization or a substitute for filing when the EAR requires a license.
Validated End User (VEU)
India is eligible for the General VEU authorization, but eligibility of the country does not make every Indian customer or facility a VEU. The transaction must involve an approved validated end user, eligible items and facilities, and compliance with the authorization’s conditions, including certification and recordkeeping requirements. India VEU items may be used for civil or military end uses, but not for activities described in EAR Part 744.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #4
Before relying on VEU, verify the specific end user’s listing, the approved facilities, the item scope and every condition in the authorization. If any of those elements falls outside the approval, use the ordinary license and exception analysis instead.
Direct shipment, Indian supplier, remote access or staffing: compare the routes
Different operating models do not create a hierarchy of “safe” and “unsafe” choices. Compare each model against the same control questions.
| Operating model | Questions to answer | Typical authorization paths |
|---|---|---|
| Direct shipment from the United States to India | What is the ECCN or EAR99 status? What reasons for control and chart entries apply? Who is the end user and what is the end use? | License, eligible license exception, or another applicable authorization |
| Foreign-made product from an Indian supplier | Is it U.S.-origin, does a de minimis rule apply, or does an FDP rule apply? What content, technology, destination and product conditions are met? | Determination under the relevant scope rule, followed by license or exception analysis if subject to the EAR |
| Remote access to a U.S. repository or cloud system | What controlled technology or source code is exposed? Where are users located? Are there onward transfers or subcontractors? | Deemed-export or reexport analysis plus any license, exception or access controls |
| Indian staffing or engineering support | What technical information is released, to whom, and for what project? Are foreign-person access and end use documented? | Classification and deemed-release analysis, then applicable authorization |
| VEU-based supply | Is the customer an approved VEU? Are the item, facility, end use and certification within the authorization? | General VEU only within its stated scope and conditions |
A practical compliance workflow
- Define the transaction. Write the parties, locations, subcontractors, deliverables, systems, shipment legs, access dates and intended end use. Do not rely on a purchase-order description alone.
- Classify each item. Assign an ECCN or document an EAR99 determination. Separate hardware, software, source code, technology and technical assistance rather than giving the entire project one label.
- Confirm jurisdiction and origin. Identify U.S.-origin items and any prior EAR jurisdiction. For foreign-made products, test the applicable de minimis and FDP provisions with the required technical and destination facts.
- Analyze access. List every person and facility with access, their locations, relevant nationality or permanent-residency information, and the exact material they can see or download. Apply deemed-export and deemed-reexport rules where relevant.
- Check destination controls. Use the ECCN’s reasons for control and the current Commerce Country Chart. Then review license exceptions and their eligibility conditions.
- Screen end users and end uses. Check the parties, intermediaries, ultimate users and intended applications against applicable restricted-party lists and Part 744 end-use and end-user controls.
- Evaluate India-specific paths. Determine whether the transaction fits BIS’s India review policy or a particular VEU authorization. Treat both as limited pathways, not blanket permission.
- Control the environment. Use repository permissions, network segmentation, encryption where appropriate, download restrictions, visitor controls and subcontractor flow-down terms. These measures do not replace a license, but they help keep the actual transfer within the approved scope.
- Document the decision. Retain classifications, calculations, screening results, authorization conditions, access lists, contracts and approvals. Reassess when the product, software version, user, facility, destination or end use changes.
Examples of how the result can change
Uncontrolled business application
A company gives an Indian developer access to an ordinary internal scheduling application that has been classified EAR99, with no controlled technical data and no restricted party or prohibited end use. The service relationship alone does not create an automatic license requirement. The company still needs to verify the actual software and users rather than assuming all commercial applications are EAR99.
Controlled source code in a U.S. repository
A U.S. employer allows an Indian national working in its U.S. office to view controlled source code. The physical location of the employee does not remove the issue: the release may be a deemed export. The employer must classify the source code and apply the relevant deemed-export rule and authorization before granting access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Foreign-made equipment with U.S. content
An Indian manufacturer incorporates U.S.-origin components into a finished product. That fact starts a de minimis analysis; it does not finish one. The company must calculate the relevant controlled content and check the control reason, destination and other conditions. If the result does not satisfy the rule, the product may be outside that particular EAR scope provision, subject to any other applicable basis.
Best Value
Indian customer described as “VEU eligible”
A supplier cannot rely on a customer’s assertion that India is VEU-eligible. The supplier must verify that the customer is an approved validated end user, that the facility and item are covered, and that the use complies with the authorization. Otherwise, the normal licensing analysis applies.
Common mistakes and how to correct them
- “Every product with U.S. content is controlled.” Correct this by applying the exact de minimis or FDP rule, including its thresholds and conditions.
- “India’s country group means no license is needed.” Use the country group only as one input; check the ECCN, chart, end use, end user and exceptions.
- “The India approval policy is a license.” Treat it as a policy for specified applications and file or obtain another authorization when required.
- “Any Indian buyer qualifies for VEU.” Verify the named end user, facility, item scope and conditions.
- “Nationality alone decides deemed export.” Establish that the information is controlled and then apply the operative release rule and exceptions.
- “The EAR covers every controlled U.S. item.” Some items may fall under another U.S. agency’s exclusive jurisdiction. Confirm jurisdiction before applying an EAR conclusion.
- “A service contract solves the export issue.” Contract language should allocate compliance duties and prevent unauthorized access, but it cannot turn a controlled transfer into an uncontrolled one.
What to put in the contract and operating procedures
A sourcing agreement should identify the authorized work, locations, approved personnel and subcontractors, permitted systems, retention and deletion rules, incident notification, record access and change-control process. Require the supplier to disclose onward transfers and changes in ownership, facility, personnel or end use that could affect screening.
Operationally, maintain an access matrix tying each person to specific repositories, documents and environments. Use least-privilege permissions and review them when a project changes. Freeze access while a classification, screening or authorization question is unresolved; do not assume that a later license will retroactively cure an unauthorized release.
For a significant arrangement, have export counsel or a qualified trade-compliance professional validate the classification, scope-rule calculations and authorization path. Keep the analysis tied to the actual product version and transaction facts, because a change in code, performance, destination, user or facility can change the result.
Bottom line for an India sourcing decision
India sourcing is neither automatically prohibited nor automatically exempt. Start with the item and information, establish origin and classification, test any foreign-made-product rule, map shipments and access, screen end users and end uses, and then select a license, exception or VEU authorization only if every condition fits. If the facts are incomplete, the responsible answer is to pause the transfer and resolve the classification and authorization questions—not to infer that an Indian supplier’s location makes the transaction free of U.S. controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
