Does a machine shop have to register for ITAR if it never exports?

Updated September 30, 2026

A new customer's purchase order says "ITAR controlled" and asks for your DDTC registration number. You've never shipped a part past the county line. If you machine even one part that is a defense article, you have to register, whether or not you ever export. The regulation says it in one sentence: "A manufacturer who does not engage in exporting must nevertheless register" (22 CFR 122.1(a)).

Some translation. ITAR is the International Traffic in Arms Regulations, the State Department's rules for military items and the technical data behind them. DDTC is the Directorate of Defense Trade Controls, the office that runs ITAR and keeps the registration list. A defense article is anything on the U.S. Munitions List (USML), the list of controlled military items, and that includes parts and components made for those items.

The decision path

Walk these in order. Stop at the first answer.

1. Does any drawing, model, or PO you've accepted say ITAR, name a USML category (for example "Category XI" or "Cat VIII(h)"), or carry an export warning citing the Arms Export Control Act? If no, go to step 2. If yes, go to step 3.
2. Ask the customer in writing: "Is part number X controlled under the ITAR, the EAR, or neither?" The design owner decides this, not you. If they say EAR (a Commerce Department control, often shown as an ECCN such as 9A610 or 3A001), DDTC registration doesn't apply, because only USML items are defense articles (22 CFR 120.11). If they say ITAR, go to step 3. If nobody can tell you, DDTC's formal answer is a commodity jurisdiction request (22 CFR 120.4).
3. Will you make, or have you made, the part? One job counts. The rule says engaging in the business "requires only one occasion of manufacturing." If yes, go to step 4.
4. Does one of the four exemptions below fit? If none does, register. Do it before the first chip, because the obligation starts with the first part.

The four exemptions, and why they rarely fit a job shop

22 CFR 122.1(b) exempts:

• U.S. Government officers and employees acting officially.
• Businesses whose only relevant activity is producing unclassified technical data. A design firm that only makes drawings fits. A shop that makes the part doesn't.
• Businesses whose manufacturing and exports are all licensed under the Atomic Energy Act.
• Fabrication "solely for experimental or scientific purposes, including research and development."

That last one tempts prototype shops. Read it narrowly: once R&D work turns into a production PO, you're manufacturing, and the exemption is gone.

What it costs

The fee is set in 22 CFR 122.3:

A build-to-print shop that never files an export license stays in Tier 1 at $3,000 a year. One shop owner put it bluntly on a forum: "feels like a money grab." Price it into overhead and move on. The alternative is a civil penalty of up to $1,271,078 per violation, or twice the value of the transaction (22 CFR 127.10). Registering also carries one duty people miss: you have to keep records of the defense articles and technical data you make and handle for five years (22 CFR 122.5).

How to file, and how long it takes

The form is the DS-2032, Statement of Registration, filed online in DECCS, DDTC's filing system at pmddtc.state.gov. Three things trip up small shops (22 CFR 122.2):

• A U.S.-person senior officer signs it. The owner, president, or a partner. Not the office manager, and not a consultant.
• Proof you're a U.S. business. Your articles of incorporation or organization, or state registration.
• A certification about your officers and owners. Whether any has been charged with or convicted of an export crime, whether any is barred from federal contracting, and whether the company is foreign owned or controlled. Know the answers before you start.

DDTC reviews the filing, then DECCS shows the fee due. You pay in DECCS and download your registration letter. DDTC says average processing dropped from about 45 days to 30 (Federal Register, April 24, 2024); shops on forums report two to three weeks. Plan on a month, and don't accept the PO's delivery date until you have the letter.

Renewal is annual. File it at least 30 days and no more than 60 days before expiration. If you let it lapse and keep machining, you owe the fees for the gap anyway.

"ITAR certified" doesn't exist

Half the machine shop websites out there say "ITAR certified." There is no such thing. DDTC doesn't inspect you, audit you, or certify you. Registration, in the regulation's own words, "is primarily a means to provide the U.S. Government with necessary information on who is involved" and "does not confer any export rights or privileges" (22 CFR 122.1(c)).

Registration tells the government you exist. Everything after that is on you, and nobody checks it until something goes wrong. Say "registered with DDTC" on your website and quote forms. It's accurate, and it's what buyers ask for.

Changes you have to report

Within five days, a senior officer sends DDTC a signed notice if any of these change (22 CFR 122.4):

• company name or address
• legal structure (say, an LLC converts to a corporation)
• ownership or control
• a subsidiary or affiliate that makes or exports defense articles is created, bought, or sold
• the board, senior officers, partners, or owners
• anyone listed on the registration is charged with or convicted of an export crime, or is barred from contracting

A sale or transfer of ownership or control to a foreign person needs 60 days' advance notice by registered mail. If you're selling the shop, tell your broker on day one. Everything else waits for the annual renewal.

The five-day rule catches retirements: the founder steps back, his daughter becomes president, and nobody tells DDTC. Put "notify DDTC" on the same checklist as the bank signature card.

The foreign-national machinist

Almost nobody in a small shop talks about this part. Under ITAR, showing ITAR technical data to a foreign person inside the United States is an export. The rule calls it a deemed export (22 CFR 120.50(a)(2)), and it counts as an export to every country where that person holds citizenship or permanent residency.

Who counts: a U.S. person is a citizen, a green card holder, or a protected individual such as someone granted asylum. Everyone else is a foreign person (22 CFR 120.62 and 120.63). That includes a machinist here on an H-1B, a Canadian engineer on a TN visa, and the visiting technician from the machine builder in Germany or Japan.

What counts as showing it: "visual or other inspection" of a part that reveals technical data, talking through the drawing, or handing someone the password to a folder that holds it (22 CFR 120.56). A print on a traveler at the machine next to a foreign-national operator is a release.

What we'd do:

• Sort by role, before access. For every job that touches ITAR prints, programs, or parts, confirm the person is a U.S. person, and record it. Asking about citizenship at hiring has its own employment-law rules, so have your employment attorney give you the exact wording once. Then use it every time.
• License the ones you need. If a foreign-national employee must work ITAR jobs, the answer is a DSP-5 export license for that person's access to the technical data (22 CFR 123.1). You must be registered before you apply. Until the license issues, they run commercial work.
• Lock the files to the list. The ITAR folder, the CAM project, and the DNC directory open only for people on the U.S.-person list.
• Handle visitors on purpose. Escort them, cover ITAR parts and travelers along the tour route and the shipping dock, and keep them out of the programming office. For a foreign machine builder's technician, schedule the visit when no ITAR job is on that machine, or get the license first.
• Watch remote support. A builder's technician dialing in from overseas to a controller with an ITAR program loaded is an export in the plain sense. Load a non-ITAR program before the session starts.

ITAR and CMMC: the same drawing, two rulebooks

A drawing from a defense prime is often both. It's ITAR technical data, and it's also CUI (controlled unclassified information, the sensitive data the government requires contractors to protect). The National Archives' CUI list names ITAR data under its Export Controlled category (NARA CUI Registry). So one PDF carries two obligations.

They ask different questions. ITAR asks who may see it: U.S. persons only, unless licensed. CMMC asks how the systems holding it are protected: the 110 security requirements for Level 2, such as multi-factor login and encrypted laptops. Registering with DDTC does nothing for your CMMC score. A perfect CMMC score doesn't make a foreign-national operator's access legal.

They meet in three places:

• Access lists. Your U.S.-person list becomes the access rule in your CMMC security plan (the requirement to limit system access to authorized users, 3.1.1). One list, two jobs.
• Encryption. Sending or storing ITAR data that is end-to-end encrypted with FIPS 140-2 validated modules isn't an export, provided it isn't stored in or sent to a proscribed country (22 CFR 120.54(a)(5)). CMMC asks for the same validated encryption to protect CUI (3.13.11). Buy it once.
• Contracts. DoD contracts carry DFARS 252.225-7048, which requires you to follow export law "including... the requirement for contractors to register with the Department of State" and to pass that clause to every subcontractor (DFARS 252.225-7048). If you send the drawing to a plater, the flowdown goes with it. Outside processors and CUI →

If you're working out whether a drawing is CUI in the first place, start with is this drawing CUI? and then follow it through your shop.

The first-year checklist

Before you file

• Get the customer's written jurisdiction answer (ITAR, EAR, or neither) for each controlled part number.
• Pull your articles of incorporation and your officer and owner list.
• Answer the officer certification questions, and the foreign ownership question.
• Pick the U.S.-person senior officer who will sign.

Filing (plan a month)

• Create the DECCS account and file the DS-2032.
• Pay the $3,000 Tier 1 fee when DECCS asks for it.
• Save the registration letter where quoting and quality can find it.

First 90 days after the letter

• List every role that touches ITAR prints, programs, or parts, and record each person's U.S.-person status.
• Restrict the ITAR folders, CAM projects, and DNC directories to that list.
• Write a one-page visitor rule: escort, covered parts, no programming office.
• Tell the machine builders their remote sessions happen only with a non-ITAR program loaded.
• Set up the five-year record file for ITAR jobs.

Standing

• Report officer, owner, name, address, or structure changes within 5 days.
• File the renewal between 60 and 30 days before expiration.
• Update the U.S.-person list at every hire.

Common questions

Do we have to register before we quote an ITAR job? Quoting isn't manufacturing, so the rule doesn't require it. But reading the drawing to quote still counts as access, so the deemed-export rules apply to your estimator. And many primes won't send the package without your registration number, so register as soon as you intend to take the work.

Can a green card holder work on ITAR parts? Yes. Lawful permanent residents are U.S. persons under ITAR.