Export Controls API: BIS Advisory Opinions and DDTC Commodity Jurisdiction Determinations

Short answer: the export control corpus you can query as JSON has three pieces, all under corpusType=AGENCY_GUIDANCE. 5,903 DDTC Commodity Jurisdiction determinations (ddtc_commodity_jurisdiction, 2010 to present, taken from the list DDTC publishes itself), 39 BIS Advisory Opinions (bis_advisory_opinion, 2003 to 2023), and 9 DDTC guidance documents (ddtc_guidance). Those sit next to the regulations themselves, 15 C.F.R. for the EAR and 22 C.F.R. for the ITAR, in the same search index. The CJ set is the interesting one: it is more than a decade of the US government answering, item by item, the single question every hardware exporter has to answer first.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice.

TL;DR

• The first question is jurisdiction, not licensing. Commerce (BIS) under the EAR, or State (DDTC) under the ITAR. The answer changes the license regime, the penalty statute, and which employees may touch the technical data.
• Commodity Jurisdiction is the formal way to ask. 22 C.F.R. § 120.4 says the CJ procedure is used "if doubt exists" about whether an article or service is covered by the US Munitions List. § 120.12 sets the request procedure.
• 5,903 CJ determinations, 2010 to present, is a decade-plus of published answers to that exact question, taken from the list DDTC publishes itself.
• BIS Advisory Opinions are a small, honest archive, not a live feed. 39 documents covering 2003 to 2023. BIS's own advisory opinions page runs from May 2003 to September 2023 (checked 12 October 2026). Do not build a monitor on it.
• A citation resolves to the text in force now, and asOf=YYYY-MM-DD reaches earlier text. On a current CFR section, asOf is a reconstruction from changes we observed, and isBounded flags an answer that rests on when capture began. GPO's printed annual editions are separate CFR_ANNUAL records, where an asOf date resolves to the edition as printed. Around it sit amendment history, a yearFrom/yearTo currency filter, and change events per refresh.
• Results carry the publisher's own source URL where the publisher exposes one. The sourcing rule is the government publisher, never a commercial aggregator.

The trade-controls entry in our federal agency guidance series.

For related coverage, see Federal Agency Guidance API: 53 Sub-Regulatory Sources in One Endpoint, DOJ Justice Manual API: Over 1,500 Sections of Federal Prosecution Policy for how these cases get charged, and The Long-Tail Regulators: CFTC, FCC, FERC, DOE, and CPSC Guidance in One API.

The question that decides everything

A trade compliance team doesn't start with "which license do I need." It starts with which agency owns my item.

If the item is on the US Munitions List, it is ITAR controlled and DDTC at the State Department owns it. If it isn't, it is almost certainly subject to the EAR and BIS at Commerce owns it. Two different rulebooks, two different penalty statutes, two different answers to whether a green card holder on your team may read the design file.

Get that wrong at the start and every downstream control is wrong too. You will have built an export compliance program around the wrong regulation.

All C.F.R. citations above were checked against eCFR text current through 8 October 2026.

A short history of the two rulebooks

Both regimes have a statute behind them, and one of those statutes had a surprisingly rocky history. The ITAR rests on the Arms Export Control Act, 22 U.S.C. 2778, which is how the State Department ends up in charge of the Munitions List. The EAR was built on the Export Administration Act of 1979, and that law wasn't permanent. Commerce's own regulation says so: "The EAA is not permanent legislation, and when it has lapsed, Presidential executive orders under IEEPA have directed and authorized the continuation in force of the EAR" (15 C.F.R. § 730.2).

The fix came in 2018. A BIS rule published on August 30, 2018 explains that on August 13, 2018, the President signed the National Defense Authorization Act for fiscal year 2019, which included the Export Control Reform Act of 2018 (Title XVII, Subtitle B of Pub. L. 115-232). That Act, the notice says, "provides the legal basis for BIS's principal authorities." The same notice describes the older arrangement: earlier rules and licenses had been kept alive under the EAA of 1979 "as continued in effect pursuant to" the International Emergency Economic Powers Act and Executive Order 13222 of August 17, 2001.

The line between the two lists has also moved. On November 15, 1996, President Clinton signed Executive Order 13026, which addressed encryption products that would otherwise be defense articles in Category XIII of the Munitions List but were being placed on the Commerce Control List instead (text in the Federal Register). The order set conditions for encryption products that would move from the Munitions List to the Commerce Control List, the dual-use list. That's why the first question in this post is "who owns my item," and why the answer can depend on the date.

Commodity Jurisdiction is the mechanism, and it is written down

The ITAR doesn't leave the jurisdiction question to vibes. It gives you a procedure.

22 C.F.R. § 120.4(a) says the commodity jurisdiction procedure is used with the US Government if doubt exists as to whether an article or service is covered by the USML, and that it may also be used to ask for redesignation of something already on the list. § 120.4(b) points to § 120.12 for how to file. § 120.11 sets the order of review, the sequence you are supposed to walk before you conclude anything.

The EAR has a parallel move on its side. 15 C.F.R. § 748.3 lets you ask BIS for a classification (an ECCN down to the paragraph) or, for a broader interpretive question, an advisory opinion under § 748.3(c). The regulation is blunt about the boundary: people requesting classifications and advisory opinions "should have determined that the items at issue are not subject to the exclusive export control jurisdiction of one of the other U.S. Government agencies."

Translation: BIS won't settle an ITAR question for you. DDTC will. That is what CJ is for.

Why 5,903 CJ determinations is an unusual dataset

Most agency guidance corpora are thin because agencies publish sparingly. The CJ set is the opposite.

DDTC publishes its determinations as a spreadsheet export, and the corpus holds 5,903 of them covering 2010 to the present. Each one is a real company asking about a real item and the government writing down which side of the line it fell on.

That gives you something no treatise gives you: a base rate. Not "here is how the order of review works" but "here is what happened the last several hundred times somebody asked about a component of this kind."

Three ways compliance teams actually use it:

• Precedent search before you file. Before spending months on a CJ request, search the set for items described the way yours is. If forty similar determinations came back one way, you have a strong prior and a much better drafted request.
• Sanity check on an outside opinion. Counsel says the bracket is EAR99. The published determinations on similar brackets are a cheap second read.
• Watching the ITAR to EAR migration. The 600 series ECCNs exist because items moved off the USML. 15 C.F.R. § 738.2 assigns the 600 to 699 range to Wassenaar Munitions List or former USML items controlled for national security and other reasons. CJ determinations are where that migration shows up item by item.

In their words

Compliance documents tell you what the rule says. Hacker News comments tell you how it feels to live with it, so here are three, each with its link.

In August 2021, a commenter named raphlinus, in a thread about the 1990s fight over encryption in software, shared the commodity jurisdiction request that was filed for an "RSA in Perl" T-shirt and added: "My recollection is that this was filed, but not long afterwards, the 40 bit restrictions were lifted, rendering the question moot." (Hacker News, August 2021). It's a good reminder that the CJ process is open to anyone with a doubt, even about a shirt, and that a determination's life can end when the rule underneath it changes.

On the product side, a commenter named mrtnmcc described the two-track approach this post keeps coming back to: "We also proactively submitted a detailed report to the State Department earlier this year showing we don't exceed any of the USML criteria for ITAR controls. Separately we have an ECCN determination under EAR." (Hacker News, July 2026). That's one company's account of its own filings, and it fits the order of questions above: State first, Commerce second.

And on the people side, a 2012 commenter named Aleppo_Redditor wrote: "I'm from an embargoed country and I recently lost job offer in a big semiconductor company because of the deemed export requirement." (Hacker News, June 2012). That's one person's account of one hiring decision. In the same thread, another commenter, r00fus, repeated an excerpt saying "This deemed export rule does not apply to persons lawfully admitted for permanent residence in the United States" (r00fus, Hacker News, June 2012). The ITAR points the same way: its definition of a foreign person in 22 C.F.R. § 120.63 leaves out lawful permanent residents. The takeaway for a hiring team is to learn the exceptions before screening anyone out.

BIS Advisory Opinions: small, real, and closed at 2023

The corpus holds 39 BIS advisory opinions covering 2003 to 2023. That is small, and the smallness is the point worth understanding.

BIS doesn't publish every advisory opinion it issues. Its own page says it has "selected certain advisory opinions that may be of general interest to the public," and that some are redacted to avoid releasing identifying information protected under Section 1761(h) of the Export Control Reform Act of 2018. What is published runs from May 2003 to September 2023 (BIS advisory opinions page, checked 12 October 2026). The page listed 40 rows that day, two of them dated 03/21/08. The corpus holds 39 records and one for that date, so check the publisher's list if you need every row.

Citation form is the first thing developers get wrong here. BIS advisory opinions have no serial number. They are identified by issue date and subject line, and that is how they appear in the corpus.

Two real entries from the published list, as an illustration of shape:

• 09/25/23, export guidance and BIS interpretation of "gene" related to ECCN 1C353.
• 06/09/23, additional deemed export authorization not required for release of licensed technology and software to permanent and regular employees, as defined in 15 C.F.R. § 734.20(d)(2), in the United States.

That second one is exactly the "who can I hire" question in its EAR form. Under 15 C.F.R. § 734.15, releasing controlled technology to a foreign person is a release, and § 734.13 makes that release an export. On the ITAR side the parallel definitions are 22 C.F.R. § 120.63 (foreign person) and § 120.64 (regular employee). Same hiring decision, two different rulebooks, and which one applies is decided by the jurisdiction question.

DDTC Guidance: 9 documents, high value per document

ddtc_guidance is 9 documents. Small count, but these are the operational documents, including the Guidelines for Preparing Agreements, the Compliance Program Guidelines and the ITAR Risk Matrix. Some appear as two dated versions, for example the Guidelines for Preparing Agreements (May 26 and September 14, 2026).

The Guidelines matter to anyone drafting a Technical Assistance Agreement or Manufacturing License Agreement, because DDTC tells you what it expects in the clauses before you submit. The Risk Matrix matters to compliance programs that need a defensible way to grade exposure.

Nine documents isn't a corpus you search. It is a corpus you retrieve whole and keep in context. Fetch them by actId and cache them.

The three source codes, and how to query them

All three live under corpusType=AGENCY_GUIDANCE, filterable with source=. The corpus types reference lists every token.

A precedent search against the CJ set. Search costs 4 credits per call, and you can run it in the API playground first.

curl -X POST https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "inertial measurement unit accelerometer bias stability",
    "corpusType": "AGENCY_GUIDANCE",
    "source": "ddtc_commodity_jurisdiction",
    "limit": 25
  }'

Widen it to both agencies in one call by passing a list:

{
  "query": "specially designed part for a commercial derivative aircraft",
  "corpusType": "AGENCY_GUIDANCE",
  "source": ["ddtc_commodity_jurisdiction", "bis_advisory_opinion"],
  "matchType": "any",
  "limit": 50
}

Three API behaviors that matter when you are automating this:

• actId is stable and not guessable. Take it from the search response and use it for retrieval. Hand built ids mostly 404.
• Unknown filter values return 422, not an empty result set. A typo in a source code fails loudly.
• Paging is cut from one ranking. Results don't repeat or vanish between pages, and every page costs the same. The deepest reachable result is offset plus limit, with offset capped at 70.

A worked ECCN to guidance chain

Take a real chain end to end, using only citations you can check.

Step 1. Learn what an ECCN encodes. 15 C.F.R. § 738.2 defines the structure. The CCL has 10 categories, 0 through 9. Category 3 is Electronics, 5 is Telecommunications and Information Security, 9 is Aerospace and Propulsion. Within each category, five groups: A equipment, B test and production equipment, C materials, D software, E technology.

So in 3A001, the 3 is Electronics and the A is equipment. The last three digits carry the reason for control. Per § 738.2(d)(1), 000 to 099 is National Security, 100 to 199 is Missile Technology, and 600 to 699 is Wassenaar Munitions List or former USML items.

Step 2. Pull the regulation text. The structural rules and the entries themselves are in the CFR corpus, which refreshes daily.

{
  "query": "Commerce Control List structure categories groups ECCN",
  "corpusType": "CFR",
  "titleNumber": "15",
  "part": "738",
  "limit": 5
}

Step 3. Ask whether anyone else already asked. Search bis_advisory_opinion for the ECCN. The published set includes opinions on the scope of ECCN 1C353, ECCN 5E001.b.3, and ECCN 2B350, among others, so an ECCN string is a genuinely useful query term here.

Step 4. If doubt exists about the USML, that is a CJ question, not a BIS question. Search ddtc_commodity_jurisdiction for the article description, then read 22 C.F.R. § 120.4 and § 120.12 from the CFR corpus in the same session.

Step 5. Cross the line into hiring. If the answer is EAR, the release rules are 15 C.F.R. §§ 734.13 and 734.15. If it is ITAR, they are the 22 C.F.R. Part 120 definitions. Pull both by citation and put them in front of whoever writes the access policy.

Where the answer lives outside this corpus

Say the limits plainly, because a compliance team that discovers them after integration has a real problem.

• Point in time depends on the corpus. Ask for a citation and you get its live text. Add asOf=YYYY-MM-DD to the body request and the response says which engine answered. On a current CFR section such as 22 C.F.R. § 120.4 or 15 C.F.R. § 734.13, we tested this on 12 October 2026 and it returned engine: observed_change, source: live and isBounded: true, which means a reconstruction bounded by when change capture began and not a printed edition, so do not cite it as the text on that date. Where you need the book as GPO printed it, the annual editions are held as separate CFR_ANNUAL records from 1996 on, and there an asOf date resolves to the edition in force and a date in a gap comes back unavailable with no text, as the CFR annual editions guide explains. Alongside it sit amendment history with lastAmendedYear, a yearFrom/yearTo currency filter, change events per refresh, and per section diffs on watched boards, explained in full here. To prove what 22 C.F.R. § 121.1 said on a date three years ago, use the CFR_ANNUAL record for the edition and cite it.
• The CJ set is a published list, not a case tracker. It reflects what DDTC publishes. It won't tell you about a pending request.
• BIS advisory opinions stop at 2023 and are a selected, partly redacted subset by BIS's own description, which also says BIS will add future opinions to its list as appropriate.
• Nothing here is legal advice or a determination about your item. It is the government's published record, retrievable by citation with the publisher's own source URL attached.

Who this is wrong for

If you need a docket tracker for pending CJ requests, this is the wrong tool. If you need a legal-grade archive of every historical USML revision, read the asOf block on each answer and confirm against the printed edition before you rely on it. If your whole need is "read today's 22 C.F.R. Part 121," the eCFR website is free and you should just use it.

It earns its place when you need the regulations, the determinations, and the guidance in one query surface with stable ids, so an internal tool or an agent can move between them without a human copying citations across four websites. Defense suppliers usually want the FAR and DFARS clause corpus sitting beside it.

The collection layer behind it is published at open-us-law, so the sourcing is readable rather than asserted.

FAQ

What is the difference between EAR and ITAR jurisdiction?

The ITAR (22 C.F.R. Parts 120 to 130) covers defense articles and services on the US Munitions List and is administered by DDTC at the State Department. The EAR (15 C.F.R. Parts 730 to 774) covers dual use and other items and is administered by BIS at Commerce. The two regimes have different license rules, different penalty provisions, and different rules on releasing technical data to foreign persons.

What is a Commodity Jurisdiction determination?

It is DDTC's formal answer to whether a specific article or service is covered by the US Munitions List. 22 C.F.R. § 120.4 says the procedure is used when doubt exists about USML coverage, and § 120.12 sets out how to submit the request. It can also be used to ask for redesignation of something already on the list.

How many CJ determinations can I query?

The published coverage table lists 5,903 determinations covering 2010 to the present (measured 2026-09-07), taken from the list DDTC publishes and filterable with source=ddtc_commodity_jurisdiction under corpusType=AGENCY_GUIDANCE.

Are BIS advisory opinions binding?

No. A BIS advisory opinion is BIS's written view on how the EAR applies to a described fact pattern. 15 C.F.R. § 748.3(a) is explicit that responses about whether a license is required or likely to be granted don't bind BIS to issuing a license later. Treat them as strong interpretive guidance, not as authorizations.

Why does the BIS advisory opinion set stop at 2023?

Because that is where BIS's own published selection currently ends. BIS publishes selected opinions of general public interest, some redacted under Section 1761(h) of the Export Control Reform Act of 2018, and the published list runs from May 2003 to September 2023 as of 12 October 2026. The corpus reflects the publisher rather than filling the gap from somewhere else.

How do I cite a BIS advisory opinion?

By issue date and subject, because BIS doesn't assign serial numbers to them. For example, the 09/25/23 opinion on export guidance and BIS interpretation of "gene" related to ECCN 1C353. In the API, retrieve by the actId returned in a search response rather than by constructing an identifier.

Can I query historical versions of the USML or the CCL?

Yes, with limits. A citation carries the text in force now by default, and the section body endpoint takes asOf=YYYY-MM-DD. On a current 15 C.F.R. or 22 C.F.R. section that is a reconstruction from changes we observed, and isBounded marks an answer that rests on when capture began. For the text as GPO printed it, use the annual editions held as CFR_ANNUAL records, where a date resolves to the edition governing it and a date that falls between editions we hold comes back unavailable with no text. Also available is amendment history per section, a yearFrom/yearTo currency filter that keys on the last amendment year the publisher credits, change events captured on each refresh, and per section diffs on watched boards.

What does an ECCN like 3A001 actually mean?

Under 15 C.F.R. § 738.2, the first digit is the CCL category (3 is Electronics), the letter is the product group (A is equipment, assemblies and components), and the last three digits identify the reason for control. The 600 to 699 range marks Wassenaar Munitions List or former USML items, which is where ITAR to EAR transitions land.

Where does the export control data come from?

The list DDTC publishes for the CJ determinations, BIS's own advisory opinions page for the EAR opinions, DDTC's published guidance documents, and eCFR for 15 C.F.R. and 22 C.F.R. Every result carries the publisher's source URL, and no commercial aggregator is used as a source or a fallback.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.