# OCR Export Controlled Documents: ITAR and EAR Limits

- Author: Schema Law (https://www.schemalaw.com/)
- Published: 2026-10-03T17:08:04Z
- Updated: 2026-10-11T19:22:20Z
- Category: Confidentiality
- Canonical: https://www.schemalaw.com/blog/ocr-export-controlled-documents

> Before you OCR export controlled documents online, read how the ITAR and the EAR define export, release and the end-to-end encryption carve-out.

Do not OCR export controlled documents in an online service until someone qualified has confirmed the upload is not an export. Under the ITAR and the EAR, sending controlled technical data abroad, or letting a foreign person see it in the United States, can be an export, and the encryption carve-out in both rules has conditions an upload must meet.

This post reads the regulations as they stood on the eCFR in October 2026 and explains how to handle the paper. It is not legal advice and it does not classify anything. Classification and licensing decisions belong to the client's export compliance officer or export counsel.

## What makes a scanned document export controlled?

A scanned document is export controlled when the information on its pages falls inside a regulatory definition: "technical data" under the International Traffic in Arms Regulations, or "technology" under the Export Administration Regulations. The control attaches to the information. Scanning a drawing, photographing it or converting it to text changes the format and leaves the status where it was.

### Technical data under the ITAR

The ITAR definition is at [22 CFR 120.33](https://www.ecfr.gov/current/title-22/section-120.33). Paragraph (a)(1) covers:

> Information, other than software as defined in § 120.40(g), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation;

Paragraph (b) of the same section takes some material back out. The definition "does not include information concerning general scientific, mathematical, or engineering principles commonly taught in schools, colleges, and universities, or information in the public domain", and it "also does not include basic marketing information on function or purpose or general system descriptions of defense articles."

### Technology under the EAR

The EAR definition sits in the definitions section, [15 CFR 772.1](https://www.ecfr.gov/current/title-15/section-772.1). "Technology" means:

> Information necessary for the “development,” “production,” “use,” operation, installation, maintenance, repair, overhaul, or refurbishing (or other terms specified in ECCNs on the CCL that control “technology”) of an item.

Note 1 to that definition says technology "may be in any tangible or intangible form, such as written or oral communications, blueprints, drawings, photographs, plans, diagrams, models, formulae, tables, engineering designs and specifications, computer-aided design files, manuals or documentation, electronic media or information revealed through visual inspection".

### What that means for a box of scans

Both definitions name drawings, plans and documentation, which is what an engineering file is made of. Neither definition turns on the file type. A TIFF of a blueprint, a searchable PDF of the same sheet and a Word export of its notes block all carry the same information.

You do not decide which pages meet either definition. That is a classification question, and the client's compliance staff own the answer. Your job is to know that the question exists before a page leaves your office.

Export controls follow the drawing into a text file, a photo, and a searchable PDF. Before a hosted tool sees the page, send the client's compliance contact your information security questions: where the file would sit, and who could view it in readable form. Vendor security answers belong in that same email so classification and handling stay together.

## Is uploading export controlled technical data to a cloud service an export?

Uploading export controlled technical data to a cloud service can be an export in two ways: the data is transmitted out of the United States, or it is released to a foreign person in the United States. Both regulations define export that way and list excluded activities. An upload has to fit an exclusion or be authorized.

The ITAR definition is at [22 CFR 120.50](https://www.ecfr.gov/current/title-22/section-120.50). Export means, among other things:

- "An actual shipment or transmission out of the United States, including the sending or taking of a defense article out of the United States in any manner" (paragraph (a)(1)).
- "Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)" (paragraph (a)(2)).

The EAR definition at [15 CFR 734.13](https://www.ecfr.gov/current/title-15/section-734.13) follows the same pattern: "An actual shipment or transmission out of the United States" in paragraph (a)(1), and "Releasing or otherwise transferring “technology” or source code (but not object code) to a foreign person in the United States (a “deemed export”)" in paragraph (a)(2).

"Release" has its own definition in each rule. Under [22 CFR 120.56](https://www.ecfr.gov/current/title-22/section-120.56), technical data is released through "Visual or other inspection by foreign persons of a defense article that reveals technical data to a foreign person" and through "The use of access information to cause or enable a foreign person, including yourself, to access, view, or possess unencrypted technical data". The EAR counterpart, [15 CFR 734.15](https://www.ecfr.gov/current/title-15/section-734.15), lists "Visual or other inspection by a foreign person of items that reveals “technology” or source code subject to the EAR to a foreign person".

Three questions follow for any online converter:

1. **Where do the pages go?** A server outside the United States means a transmission out of the United States. The post on [OCR data residency](https://www.schemalaw.com/blog/ocr-data-residency) covers how to find out which country a vendor processes and stores files in.
2. **Who can open them?** A person who can view the unencrypted page is a person to whom the data may have been released.
3. **Does an exclusion apply?** Both rules exclude a transfer between U.S. persons inside the United States. [22 CFR 120.54(a)(2)](https://www.ecfr.gov/current/title-22/section-120.54) excludes "Transmitting or otherwise transferring technical data to a U.S. person in the United States from a person in the United States". The other exclusion that matters for hosted software is the encryption one.

Whether a particular upload fits is a legal conclusion on facts you may not have. Treat the three questions as what you bring to the client's compliance officer, with the vendor's written answers attached.

## The end-to-end encryption carve-out in the ITAR and the EAR

The end-to-end encryption carve-out says that sending, taking or storing unclassified controlled data is not an export when the data is encrypted end to end to a stated standard and kept out of listed countries. It appears at 22 CFR 120.54(a)(5) and [15 CFR 734.18(a)(5)](https://www.ecfr.gov/current/title-15/section-734.18). Both define end-to-end encryption narrowly.

### The conditions side by side

| Condition | ITAR, 22 CFR 120.54(a)(5) | EAR, 15 CFR 734.18(a)(5) |
| --- | --- | --- |
| Classification | "Unclassified" | "Unclassified" |
| Encryption | "Secured using end-to-end encryption" | "Secured using 'end-to-end encryption;'" |
| Strength | Cryptographic modules compliant with FIPS 140-2 or its successors, with the supplementing controls the paragraph describes, "or by other cryptographic means that provide security strength that is at least comparable to the minimum 128 bits of security strength achieved by the Advanced Encryption Standard (AES-128)" | Cryptographic modules compliant with FIPS 140-2 or its successors, with the supplementing controls the paragraph describes, "or other equally or more effective cryptographic means" |
| Countries | "Not intentionally sent to a person in or stored in a country proscribed in § 126.1 of this subchapter", and "Not sent from a country proscribed in § 126.1" | "Not intentionally stored in a country listed in Country Group D:5" |

### How each rule defines end-to-end encryption

The ITAR definition, at 120.54(b)(1), has two parts:

> (i) The provision of cryptographic protection of data, such that the data is not in an unencrypted form, between an originator (or the originator's in-country security boundary) and an intended recipient (or the recipient's in-country security boundary); and
> (ii) The means of decryption are not provided to any third party.

Paragraph (b)(2) adds that the intended recipient "must be the originator, a U.S. person in the United States, or a person otherwise authorized to receive the technical data". The EAR definition at 734.18(b) uses nearly the same two parts and ends: "the means of decryption are not provided to any third party. The originator and the recipient may be the same person."

### Why an OCR upload is a hard fit

OCR software has to read the page. A service that returns text from your scan worked on the page in unencrypted form at some point, on a machine the vendor runs. That is common to hosted conversion of any kind, and it is the fact to hold against the quoted definition: data "not in an unencrypted form" between originator and recipient, with the means of decryption "not provided to any third party".

A cloud drive that stores a file you encrypted yourself, with a key only you hold, is the arrangement those words describe. A converter that opens the file is a different arrangement. Whether a given vendor is an authorized "intended recipient", or a third party holding the means of decryption, is a question for export counsel with the vendor's architecture in hand.

Two cautions when you read a vendor's security page:

- **"Encrypted in transit and at rest" is a different statement.** It says the connection and the stored copy are encrypted. It does not say who holds the keys or whether the service works on readable pages. The post on [what encryption in transit and at rest protects](https://www.schemalaw.com/blog/encrypted-ocr) explains those two terms. Schema Law's own plan list uses that phrase, and it should be read the same way: as written, and not as a statement about either export rule.
- **Access after decryption is a release question.** Both rules say that "The ability to access" data "in encrypted form that satisfies the criteria set forth in paragraph (a)(5) of this section does not constitute the release or export" of it. The protection is for encrypted access. Once someone can view the unencrypted page, the release definitions apply.

The eCFR page for 22 CFR 120.54 carried a notice in October 2026 linking to an amendment published in the Federal Register in August 2026 and a correction published in September 2026. Read the current text before you rely on any quotation from it.

## Why does a foreign national on an OCR vendor's staff matter?

A foreign national on an OCR vendor's staff matters because showing controlled data to a foreign person inside the United States is itself an export under both rules. No file has to cross a border. The regulations call this a deemed export, and it makes the vendor's staffing as relevant as its server location.

The ITAR says at 120.50(b): "Any release in the United States of technical data to a foreign person is deemed to be an export to all countries in which the foreign person has held or holds citizenship or holds permanent residency." The EAR says at 734.13(b) that such a release "is a deemed export to the foreign person's most recent country of citizenship or permanent residency."

Who counts as a foreign person is defined. Under [22 CFR 120.63](https://www.ecfr.gov/current/title-22/section-120.63), it "means any natural person who is not a lawful permanent resident as defined by 8 U.S.C. 1101(a)(20) or who is not a protected individual as defined by 8 U.S.C. 1324b(a)(3)", along with foreign entities and governments. The EAR definition in 15 CFR 772.1 is similar and names U.S. citizens expressly.

For a hosted converter, the people who might see a page include support staff who open a document to diagnose a failed job, engineers with access to storage, and the staff of any company the vendor passes pages to. Ask the vendor in writing:

- Can any employee or contractor view customer documents in readable form, and under what conditions?
- Are all of those people U.S. persons as the ITAR defines the term, and are they located in the United States?
- Does the same hold for every subprocessor that receives document content?

A general account of [which people at a vendor can open an uploaded document](https://www.schemalaw.com/blog/can-ocr-vendor-employees-see-my-documents) is in its own post. The same deemed export rule applies inside your firm: a contract reviewer or paralegal who is a foreign person under these definitions is covered by it too, so raise staffing on your own side with the client's compliance officer.

## Screening a client's engineering file for controlled drawings before conversion

Screening an engineering file means sorting pages that carry an export marking, or that look like technical data, away from the conversion queue before anything is uploaded. You are looking for legends, classification codes and contract references. A marking is a strong signal. A missing marking settles nothing, because the definitions control and a stamp does not.

### Markings and legends to look for

| What appears on the page | What it suggests | What to do |
| --- | --- | --- |
| A legend mentioning ITAR, 22 CFR 120 to 130, the Arms Export Control Act or the U.S. Munitions List | The author treated the page as ITAR technical data | Hold the page and ask the client |
| An Export Control Classification Number (ECCN), such as the 3A090 named in 15 CFR 758.6, or the words "Export Administration Regulations" | The author classified it under the EAR | Hold and ask whether a license requirement applies to your handling |
| "EAR99" | A designation under the EAR that the client assigned | Ask the client what handling it expects |
| A destination control statement beginning "These items are controlled by the U.S. Government and authorized for export only to the country of ultimate destination" | The page is, or travelled with, shipping paperwork for controlled items | Hold the related drawings and specifications |
| A distribution statement or dissemination limit in a title block | A government customer restricted circulation | Hold and ask |
| A government contract number, a defense program name or a military part number | The work may involve defense articles | Ask before converting |

The destination control statement wording comes from the regulations: [22 CFR 123.9(b)](https://www.ecfr.gov/current/title-22/section-123.9) and [15 CFR 758.6](https://www.ecfr.gov/current/title-15/section-758.6) each require it on the commercial invoice for covered tangible shipments. Finding one in a file tells you controlled items are in play. It does not tell you which drawings are controlled.

### A screening routine

1. Ask the client at intake whether any part of the file is export controlled and who its compliance contact is. Write the answer in the matter file.
2. Before scanning or converting, page through title blocks, footers and cover sheets for the markings in the table.
3. Separate three piles: marked, unmarked but technical (drawings, specifications, test procedures, manufacturing instructions), and plainly non-technical (correspondence, invoices without technical content, contracts).
4. Send the first two piles to the client's compliance contact with a page count and a description. Ask which pages may go to an online service, if any.
5. Convert only what has been cleared, and keep the clearance with the matter.

### A worked example

A firm represents a fictional parts maker, Alder Ridge Machining, in a contract dispute with a prime contractor. The client delivers four boxes: purchase orders, emails, inspection reports and about 300 drawing sheets. A paralegal finds a legend citing 22 CFR on 40 sheets and nothing on the rest. She does not assume the other 260 are clear. She sends the compliance manager at Alder Ridge a list of drawing numbers. The answer comes back that all 300 sheets and the inspection reports are controlled and the purchase orders and emails are not. The firm converts the purchase orders and emails online and treats the rest separately.

## Converting export controlled documents when no online service qualifies

When no online service qualifies, convert export controlled documents on equipment where no transmission abroad and no release to a foreign person can occur, or leave conversion to the client. The decision belongs to the client's export compliance function, so the first step is a question to that person. The second is choosing a method they approve.

### Whom to ask at the client

Ask for the person responsible for export compliance. If the title draws a blank, describe the function: the person who classifies products and technical data and signs license applications. In-house counsel can point you to them. Put three things in the request: what you hold, what you want to do with it, and who would have access.

### Options to put in front of them

- **Installed software on a firm computer, with no online recognition feature switched on.** Pages stay on a machine you control. Your own staffing still has to satisfy the deemed export rule. The three approaches are compared under [three ways to keep OCR private](https://www.schemalaw.com/blog/private-ocr#three-ways-to-keep-ocr-private).
- **The client runs the conversion.** The client's engineering group may already hold native files or searchable copies. Ask before you scan anything.
- **A service the client has already approved.** Ask whether the client has an approved environment for controlled data. If it names one, use it on the terms it states.
- **No conversion.** For a small set of drawings that will be reviewed by eye, an image-only copy on controlled storage may be enough.

Whichever route is chosen, the converted text is controlled to the same extent as the scan. A Word or plain text export of a specification is easier to forward than a 40 megabyte image file, so store exports with the same restrictions as the originals.

The same drawings may also be the client's confidential know-how, which raises a separate question about [keeping trade secret documents secret during OCR](https://www.schemalaw.com/blog/ocr-trade-secret-documents). For the uncontrolled remainder of the file, the general checks in the post on [whether it is safe to upload client documents to an OCR tool](https://www.schemalaw.com/blog/is-it-safe-to-upload-client-documents-to-an-ocr-tool) apply, and Schema Law's own statements about uploads are in the [security section of the homepage](https://www.schemalaw.com/#security).

## Try it on a real document

Upload a scanned PDF and export it as Word, a searchable PDF or plain text on the free plan. Your documents are never used to train an AI model. [Start free](https://www.schemalaw.com/api/auth/google)