ITAR in the age of automation and why export control is a governance challenge

The biggest risk with ITAR isn’t a missing licence. It’s losing control of information.

Some defence organisations still treat ITAR as a licensing exercise when, increasingly, regulators treat it as a governance issue. As businesses digitise operations, automate workflows, adopt AI-enabled systems, and manage growing volumes of technical data, export control increasingly sits inside the architecture of the organisation itself.

The challenge is governing how information moves through systems, teams, suppliers, and international programmes.

“The future of ITAR compliance will be determined less by who files the licence, and more by how organisations govern the data, systems, and information flows behind it.”

The consequences of failure have changed

Civil penalties can exceed $1m per violation, organisations can lose export privileges, suffer reputational damage, or find themselves excluded from critical defence programmes.

In extreme cases, individuals can face personal liability and criminal prosecution.

“Export control failures don’t become business problems overnight. They creep in through weak governance, poor visibility, and unchallenged assumptions.”

Ian Hunt, export controls specialist at clearBorder, states that it wouldn’t be unusual to work with a company undergoing regulatory review where the issue wasn’t a lack of expertise, or intent, but visibility.

The information can exist, but if it’s fragmented across spreadsheets, folders, and disconnected systems – when regulators ask questions – the organisation will struggle to demonstrate control.

ITAR has become a systems challenge

Major defence organisations have spent years embedding compliance directly into their operational infrastructure; from document controls and access permissions to transfer approvals, metadata tagging, and information management systems.

The objective? To make compliance part of the workflow, rather than a final-stage intervention.

A decade ago, export control relied largely on manual processes, spreadsheets, and individual expertise; a model that has become difficult to sustain. Ian Hunt has seen this evolution first-hand.

“Historically, organisations treated export control as something that happened at the point of shipment. Today, the strongest organisations build compliance directly into how information is created, stored, accessed, transferred, and managed.”

For smaller organisations, the challenge is particularly acute. While large defence primes have invested aggressively in embedding and automating governance environments, many SMEs and fast-growth businesses still rely on spreadsheets, fragmented processes, and individual expertise.

Regulators expect both to demonstrate the same level of control.

Automation raises the bar for governance

It’s tempting to view automation as a compliance solution in its own right. That is a mistake. Properly deployed, automation strengthens traceability, creates auditability, enforces controls, and makes governance more scalable.

It cannot compensate for weak data, poor governance, or unclear ownership.

“The data out is only as good as the data in.”

That is the crux of the modern compliance challenge.

Every automated control system ultimately depends on the quality of the information feeding it. Incorrect classifications, incomplete supplier information, weak record-keeping, or poorly maintained data structures will simply produce automated versions of the same problems.

AI may help classify products, prepare applications, flag anomalies, and support screening activity. But responsibility remains human. Automation can accelerate decision-making. It cannot own it.

“You can automate compliance tasks.

You cannot automate accountability.”

In the eyes of regulators, “that’s what the system says” is not a defence. Organisations remain responsible for:

1. How systems are configured
2. How decisions are made
3. Whether governance controls are operating effectively

Compliance sits closer to engineering and operations

“The biggest mistake organisations make is treating compliance as something to address later. By then, most of the important decisions have already been made.”

As software, technical data, digital twins, cloud environments, and globally distributed engineering teams become more common, compliance decisions need to be made at the beginning of activity.

“Compliance cannot be an end-stage activity. It has to be present from the outset.”

Historically, compliance usually appeared near the end of a process. Products were designed; supply chains were established; programmes were launched; compliance teams were then asked to validate what had already been built.

In the modern era, export control sits much closer to:

• Engineering design
• Product development
• Technology architecture
• Supply chain planning
• Data governance
• Programme management

Record-keeping as a strategic capability

Regulatory investigations repeatedly expose the same weakness: poor record-keeping.

If approvals cannot be found, decisions cannot be traced, or data cannot be verified, regulators are unlikely to accept assurances that processes were followed correctly.

“If you don’t have a record of it, it didn’t happen.”

Automation plays a role here because it creates traceability. Time-stamped records, auditable workflows, approval histories, and system-generated evidence can all strengthen an organisation’s ability to demonstrate control.

The bigger picture

Much of the conversation around sovereign capability focuses on industrial capacity, shipyards, manufacturing facilities, and weapons production. ITAR itself was originally designed to control the movement of physical defence articles.

Now, its challenge is controlling the movement of information. As defence capability becomes increasingly digital, ideas of sovereignty must expand to include information itself; information such as:

• Technical drawings
• Engineering models
• Source code and encrypted software
• Controlled datasets
• Digital twins
• Sensitive programme information

These assets now sit at the heart of military capability.

“As defence becomes more digital, information is capability. Controlling information matters as much as controlling hardware.”

The question is not whether organisations adopt automation. They will. The question is whether corporate governance matures at the same pace. Because – while automation will make good governance stronger – it will only make weak governance more dangerous.

The biggest risk with ITAR isn’t a missing licence. It’s losing control of information.

Some defence organisations still treat ITAR as a licensing exercise when, increasingly, regulators treat it as a governance issue. As businesses digitise operations, automate workflows, adopt AI-enabled systems, and manage growing volumes of technical data, export control increasingly sits inside the architecture of the organisation itself. 

The challenge is governing how information moves through systems, teams, suppliers, and international programmes.

“The future of ITAR compliance will be determined less by who files the licence, and more by how organisations govern the data, systems, and information flows behind it.”

The consequences of failure have changed

Civil penalties can exceed $1m per violation, organisations can lose export privileges, suffer reputational damage, or find themselves excluded from critical defence programmes. 

In extreme cases, individuals can face personal liability and criminal prosecution.

“Export control failures don’t become business problems overnight. They creep in through weak governance, poor visibility, and unchallenged assumptions.”

Ian Hunt, export controls specialist at clearBorder, states that it wouldn’t be unusual to work with a company undergoing regulatory review where the issue wasn’t a lack of expertise, or intent, but visibility. 

The information can exist, but if it’s fragmented across spreadsheets, folders, and disconnected systems – when regulators ask questions – the organisation will struggle to demonstrate control.

ITAR has become a systems challenge

Major defence organisations have spent years embedding compliance directly into their operational infrastructure; from document controls and access permissions to transfer approvals, metadata tagging, and information management systems.

The objective? To make compliance part of the workflow, rather than a final-stage intervention.

A decade ago, export control relied largely on manual processes, spreadsheets, and individual expertise; a model that has become difficult to sustain. Ian Hunt has seen this evolution first-hand.

“Historically, organisations treated export control as something that happened at the point of shipment. Today, the strongest organisations build compliance directly into how information is created, stored, accessed, transferred, and managed.”

For smaller organisations, the challenge is particularly acute. While large defence primes have invested aggressively in embedding and automating governance environments, many SMEs and fast-growth businesses still rely on spreadsheets, fragmented processes, and individual expertise. 

Regulators expect both to demonstrate the same level of control.

Automation raises the bar for governance

It’s tempting to view automation as a compliance solution in its own right. That is a mistake. Properly deployed, automation strengthens traceability, creates auditability, enforces controls, and makes governance more scalable.

It cannot compensate for weak data, poor governance, or unclear ownership.

“The data out is only as good as the data in.”

That is the crux of the modern compliance challenge.

Every automated control system ultimately depends on the quality of the information feeding it. Incorrect classifications, incomplete supplier information, weak record-keeping, or poorly maintained data structures will simply produce automated versions of the same problems.

AI may help classify products, prepare applications, flag anomalies, and support screening activity. But responsibility remains human. Automation can accelerate decision-making. It cannot own it.

“You can automate compliance tasks. 

You cannot automate accountability.”

In the eyes of regulators, “that’s what the system says” is not a defence. Organisations remain responsible for: 

1. How systems are configured
2. How decisions are made
3. Whether governance controls are operating effectively

Compliance sits closer to engineering and operations

“The biggest mistake organisations make is treating compliance as something to address later. By then, most of the important decisions have already been made.”

As software, technical data, digital twins, cloud environments, and globally distributed engineering teams become more common, compliance decisions need to be made at the beginning of activity.

“Compliance cannot be an end-stage activity. It has to be present from the outset.”

Historically, compliance usually appeared near the end of a process. Products were designed; supply chains were established; programmes were launched; compliance teams were then asked to validate what had already been built.

In the modern era, export control sits much closer to:

• Engineering design
• Product development
• Technology architecture
• Supply chain planning
• Data governance
• Programme management

Record-keeping as a strategic capability

Regulatory investigations repeatedly expose the same weakness: poor record-keeping.

If approvals cannot be found, decisions cannot be traced, or data cannot be verified, regulators are unlikely to accept assurances that processes were followed correctly.

“If you don’t have a record of it, it didn’t happen.”

Automation plays a role here because it creates traceability. Time-stamped records, auditable workflows, approval histories, and system-generated evidence can all strengthen an organisation’s ability to demonstrate control.

The bigger picture

Much of the conversation around sovereign capability focuses on industrial capacity, shipyards, manufacturing facilities, and weapons production. ITAR itself was originally designed to control the movement of physical defence articles. 

Now, its challenge is controlling the movement of information. As defence capability becomes increasingly digital, ideas of sovereignty must expand to include information itself; information such as:

• Technical drawings
• Engineering models
• Source code and encrypted software
• Controlled datasets
• Digital twins
• Sensitive programme information

These assets now sit at the heart of military capability.

“As defence becomes more digital, information is capability. Controlling information matters as much as controlling hardware.”

The question is not whether organisations adopt automation. They will. The question is whether corporate governance matures at the same pace. Because – while automation will make good governance stronger – it will only make weak governance more dangerous.