ITAR, export controls and AI data deals: keep controlled work out

Anything tied to ITAR, export-controlled or CUI work stays out of an AI data deal. That means more than the engineering files. It means the email, the shared drives and the job paperwork too.

Showing it is exporting it

You don't have to ship anything overseas to export. Under ITAR and the export rules, letting a foreign person see controlled technical data counts as an export, even if that person is sitting in the US.

An AI data deal puts your files in front of people you'll never meet: the buyer's engineers, the contractors who clean the data, the people paid to label it, and the AI lab at the end. We haven't found a buyer that says publicly who those people are or where they sit.

Encryption doesn't fix it. To train an AI on your data, someone has to open it.

What counts

• ITAR technical data: the drawings, instructions and documentation for anything on the US Munitions List. In practice, that's usually drawings, specs, work instructions and inspection plans.
• Export-controlled technology: technical data for dual-use items that carry an export classification number.
• CUI: if your defense contracts include DFARS 7012, it covers drawings, process sheets and specs, including the ones you made for the job.

What it can cost

Civil penalties under ITAR can reach about $1.27 million per violation, or twice the value of the deal. Criminal penalties go up to $1 million and 20 years in prison. The export rules for dual-use items carry similar criminal penalties.

It has happened over ordinary email. In 2023, 3D Systems paid a $2.78 million penalty to the Commerce Department after it emailed design files to its own office in China to get price quotes.

Your primes already said no

Lockheed Martin, Northrop Grumman and L3Harris all bar suppliers from using their information to train AI. Lockheed's terms go further: even where AI use is allowed, export-controlled information never goes in.

The 2026 pause on third-party CMMC certification doesn't change any of this. The Defense Department says the DFARS 7012 rules still apply.

What to do

1. Wall off controlled work by customer, program, job number, folder and mailbox. If one inbox handles both defense and commercial quotes, that inbox is out.
2. Don't rely on "anonymizing." Removing names and logos doesn't remove a tolerance or a material callout.
3. Don't send a sample until your export compliance person has signed off on the scope in writing.
4. Ask the buyer in writing: who will touch the data, are they all US persons, and where is it stored and processed? If they won't answer, that's your answer.

Questions for your export attorney

• Which of the records they asked for are ITAR or export-controlled?
• Which contracts carry DFARS 7012, and which records does it cover?
• What written promises do we need from the buyer about who sees the data and where?
• Do we need to update our technology control plan first?

This isn't legal advice.