You didn't ship anything. You didn't fill out a customs form. You sent a STEP file to a contract machinist in Shenzhen so they could quote a small run of brackets.
Under U.S. law, that email was an export.
This week we are unpacking the single biggest blind spot in small-shop manufacturing, and one of the easiest to walk into without knowing you did.
The rule, in one sentence
The Export Administration Regulations define "Export" at 15 CFR 734.13. Paragraph (a)(2) includes "Releasing or otherwise transferring 'technology' or source code (but not object code) to a foreign person in the United States (a 'deemed export')." Paragraph (b) adds that any such release inside the U.S. is treated as an export "to the foreign person's most recent country of citizenship or permanent residency."
In plain English: when controlled tech moves to a foreign person, it is an export. Email, screen-share, cloud upload, a verbal walkthrough on a video call. The medium does not matter. The transfer of the information is the trigger, not the shipment.
Why SMB shops walk right into it
The fact patterns repeat themselves, and almost none of them feel like exporting.
Emailing CAD, PDM, or STEP files to a foreign vendor for a quote. Giving an offshore contract engineer access to your Fusion 360 or SolidWorks workspace. Sharing a controlled drawing in a Dropbox or Google Drive folder with a foreign subsidiary. Walking a Chinese supplier through a tolerance spec on a Zoom call. Letting a foreign-national employee read tech data on their work laptop inside your facility.
None of that involves a freight forwarder. All of it can be an export.
"But we have an NDA"
An NDA protects you commercially. It does nothing for you under export control. BIS does not care that the recipient promised confidentiality. BIS cares whether the information itself was controlled and whether the recipient was a foreign person.
The same goes for "but it is just a quote," "but they are our long-time partner," and "but the part is simple." None of those are defenses. The defenses live in the regulation.
Is the technology actually on the Commerce Control List? A lot of commercial tech is EAR99, which is subject to the EAR but generally license-free to most destinations. A lot of commercial tech is not.
Is the destination a problem? China, Russia, and a long list of others trigger license requirements that the same transfer to Germany would not.
Does a License Exception apply? TSU at 15 CFR 740.13, ENC at 15 CFR 740.17, the published-information carve-out at 15 CFR 734.7, and the fundamental research carve-out at 15 CFR 734.8 are real, but each has its own footnotes. Do not assume. Cite the one you are using.
Is the recipient on a denied-party list? Entity List, SDN, Unverified, Military End User. If yes, the conversation ends there.
The five-minute self-check before you hit send
Next time you are about to share a drawing, spec, or source file with anyone outside the U.S., or with a foreign national inside the U.S., walk these five questions.
What is it? Production tech for a controlled item? Software? A cosmetic exterior drawing? Get specific about what you are actually releasing.
Who is the recipient, and what is their nationality? Company and the individual.
Where are they? Country matters. The same file to Canada vs. China is not the same transaction.
Is the underlying item on the CCL, and at what ECCN? This is the question most shops cannot answer in the moment. It is also the one that decides whether you need a license.
Is there a License Exception that covers you? Do not guess. Cite it.
If you cannot answer the last two with confidence, do not send the file yet.
The pattern in BIS enforcement
You do not have to imagine the consequences. Year after year, BIS settlements include the same fact pattern. An engineer emailed drawings. A contractor uploaded files to a shared folder. A foreign-national employee was given access to a controlled design system. The shipments never happened. The penalties did, sometimes in the seven figures, sometimes with a denial of export privileges that quietly ends a company's overseas business.
The shops getting hit are not the ones who knew the rule and ignored it. They are the ones who never knew the rule applied to email.
What to do this week
Pick one foreign supplier or contractor relationship and answer the five questions above for the next file you plan to send them. If you get stuck on the CCL question, that is exactly the moment ExChek was built for.
Run a deemed-export check at exchek.us. Free, no card.
Read the rule yourself at 15 CFR 734.13.
Want a walkthrough? Book a call.
Ship the file. Just don't ship it blind.
The ExChek Team
ExChek is software, not legal advice. Every determination is reviewed and approved by you. American-owned, built to help American SMBs navigate export compliance.