You didn't ship anything. You didn't fill out a customs form. You sent a STEP file to a contract machinist in Shenzhen so they could quote a small run of brackets.
Under U.S. law, that email was an export.
Welcome back to The Loop. This week we're unpacking the single biggest blind spot in small-shop manufacturing — and one of the easiest to walk into without knowing you did.
The rule, in one sentence
The Export Administration Regulations (15 CFR 734.2(b)) define "export" to include the release of controlled technology or source code to a foreign person — including by email, screen-share, cloud upload, or a verbal walkthrough on a Zoom call. When that release happens to someone outside the U.S., it's an export. When it happens to a foreign national insidethe U.S. — your contract engineer on an H-1B, a foreign intern on the shop floor — it's what BIS calls a "deemed export."
The shipment isn't the trigger. The transfer of the information is.
Why SMB shops walk right into it
The fact patterns repeat themselves, and almost none of them feel like "exporting":
Emailing CAD, PDM, or STEP files to a foreign vendor for a quote.
Giving an offshore contract engineer access to your Fusion 360 or SolidWorks workspace.
Sharing a controlled drawing in a Dropbox or Google Drive folder with a foreign subsidiary.
Walking a Chinese supplier through a tolerance spec on a video call.
Letting a foreign-national employee read tech data on their work laptop.
None of that involves a freight forwarder. All of it can be an export.
"But we have an NDA"
An NDA protects you commercially. It does nothing for you under export control. BIS doesn't care that the recipient promised confidentiality — they care whether the information itself was controlled and whether the recipient was a foreign person.
The same goes for "but it's just a quote," "but they're our long-time partner," and "but the part is simple." None of those are defenses. The defenses live in the regulation:
Is the technology actually on the Commerce Control List (CCL)? A lot of commercial tech is EAR99 — controlled, but generally license-free to most destinations. A lot isn't.
Is the destination a problem? China, Russia, and a long list of others trigger license requirements that the same transfer to Germany wouldn't.
Does a License Exception apply? TSU (technology and software unrestricted), GBS, ENC, fundamental research — these are real, but each has its own footnotes.
Is the recipient on a denied-party list? Entity List, SDN, Unverified, Military End User — if yes, the conversation ends there.
The 5-minute self-check before you hit send
Next time you're about to share a drawing, spec, or source file with anyone outside the U.S. — or with a foreign national inside the U.S. — walk these five questions:
What is it? Production tech for a controlled item? Software? Just a cosmetic exterior drawing? Get specific about what you're actually releasing.
Who's the recipient, and what's their nationality? Company and the individual.
Where are they? Country matters. The same file to Canada vs. China is not the same transaction.
Is the underlying item on the CCL — and at what ECCN? This is the question 90% of shops can't answer in the moment. It's also the one that decides whether you need a license.
Is there a license exception that covers you? Don't guess. Cite it.
If you can't answer 4 and 5 with confidence, don't send the file yet.
The pattern in BIS enforcement
You don't have to imagine the consequences. Year after year, BIS settlements include the same fact pattern: an engineer emailed drawings, a contractor uploaded files to a shared folder, a foreign-national employee was given access to a controlled design system. The shipments never happened. The penalties did — sometimes in the seven figures, sometimes with a denial of export privileges that quietly ends a company's overseas business.
The shops getting hit aren't the ones who knew the rule and ignored it. They're the ones who never knew the rule applied to email.
What to do this week
Pick one foreign supplier or contractor relationship and answer the five questions above for the next file you plan to send them. If you get stuck on question 4, that's exactly the moment ExChek was built for.
Run a deemed-export check: exchek.us — Get the plugin for your AI, free, no card.
Read the rule yourself: 15 CFR 734.2(b)
Want a walkthrough? Book a call
Next week: we go back to the enforcement tracker — a real settlement, what they did, what it cost, and which of the five questions they would have caught it on.
Ship the file. Just don't ship it blind.
— The ExChek Team
———————————————————————————
ExChek is software, not legal advice. Every determination is reviewed and approved by you. American-owned, built to help American SMBs navigate export compliance.