Input Paper to the Call for Evidence on the Evaluation of the Dual-Use Regulation

Harmonisation while preserving national competence
The Swedish Security and Defence Industry Association (SOFF) and the Technology Industries of Sweden support further harmonisation of export control dual use lists and interpretations across Member States under the Dual-Use Regulation, and the issuing by the Member States and Commission of clear guidelines. Further harmonisation is essential to ensure a level playing field within the internal market and reduce legal uncertainty. Harmonised interpretations of the regulation are particularly important when it comes to e.g. interpretation of core definitions (such as “export”) as well as adopting to emerging technologies, where inconsistent approaches between Member States risk creating regulatory gaps, undermining the effectiveness of export controls and weakening the EU’s ability to address evolving security challenges.
Increased harmonisation would also reduce compliance costs for companies operating across multiple Member States and provide greater predictability for long-term investments, research and development, and international cooperation. As several third countries increasingly use or draw inspiration from the EU control lists, consistent implementation across the Union is important not only for the functioning of the internal market but also for the credibility and effectiveness of the EU export control regime internationally. Moreover, the success of EU control lists being adopted by a growing number of third countries has significantly reduced the administrative burden for companies. While further harmonisation within the EU remains important, it is also of paramount importance that the EU framework is aligned with allies, including the EU001 countries, particularly the United States. This would reduce compliance costs, facilitate international cooperation and strengthen the effectiveness of export controls.
We do not support transferring export control decision-making authority from Member States to the European Commission. Furthermore, Member States, at least that is true for Sweden, have developed technology expertise, institutional capacity and established procedures e.g. in the types of licenses used suitable for individual companies based on their commercial conditions, and not least the lead times for receiving export licenses. There is also a need for companies to be able to have physical meetings with the competent authorities when discussing sensitive business activities. This would severely decrease, not least for SMEs, if an EU export control authority would be established. It is our firm belief that replicating these capabilities at EU level would be costly, administratively burdensome and risks creating additional layers of bureaucracy without necessarily improving the quality, speed or consistency of decision-making. The focus should therefore be on strengthening coordination, information-sharing and common guidance, while preserving Member States’ responsibility for licensing and enforcement decisions.

Digital controlled information
SOFF and the Technology Industries of Sweden assert that the relationship between export controls and the digital handling of controlled technology and software requires greater legal clarity and harmonisation across the Union. The increasing use of cloud services, digital engineering environments, remote collaboration tools and globally distributed IT infrastructure has created significant uncertainty regarding when controlled technology or software should be considered exported, transferred or made available to a foreign person. Companies operating across borders need clear, technology-neutral and predictable rules that reflect modern methods of storing, processing and sharing information without compromising the objectives of export controls.
Particular attention should be given to the treatment of cloud services and encrypted digital environments. The regulation should provide greater clarity regarding when controlled technology or software is considered to have been made available to a recipient and differentiate between the mere technical storage or transmission of data and actual access to, or use of, controlled information. Inspiration could be drawn from the U.S. approach, where BIS § 734.18 and ITAR § 120.54 provide greater legal clarity regarding the export control treatment of encrypted technical data.
This should include clearer guidance on intangible transfers of technology, remote access, collaborative research and development environments, intra-group sharing and situations where controlled information may be accessed by persons located outside the EU or by non-EU persons within multinational corporate structures.
What is defined as an “export” must not only be harmonised within the EU but must also be in accordance with the way other allied countries, such as the United States, is controlling the usage of cloud services.

General export authorisations
We support the concept of general export authorisations as an important tool for reducing administrative burdens and facilitating exports to trusted states. However, apart from EU001, these are in practice often perceived as unnecessarily complex and difficult to use, not least due to the reporting requirements following the use of an EU general license.
An expansion of EU001 to additional trusted partner countries would reduce the administrative burden on companies. Several countries could be considered. One of them could be South Korea, which is a close strategic partner of the European Union, a member of the relevant export control regimes, and has a mature export control system and significant industrial cooperation with European companies.
Catch-all controls, end-use concerns and diversion risks
The review should also address the practical challenges arising from catch-all controls and end-use based restrictions. For companies, these assessments are often more difficult than classification of listed items, as they require case-by-case judgments based on the customer, end user, destination, intended use, diversion risks and available red flags. Clearer and more harmonised guidance is needed on when companies are expected to identify and escalate concerns relating to military end-use, weapons of mass destruction programmes, cyber-surveillance, human rights concerns, internal repression or other sensitive end uses.
In particular, companies need practical support in identifying and managing diversion risks, including indirect exports through intermediaries, re-export risks, unusual purchasing patterns, opaque ownership structures and other indicators of possible circumvention. Greater alignment between Member States on the interpretation of relevant red flags and escalation expectations would strengthen compliance, reduce uncertainty and support more effective implementation of the Regulation.

Practical guidance and industry consultation
The effectiveness of the EU export control framework depends not only on the wording of the Regulation but also on its practical implementation. As stated above, we therefore encourage the Commission and Member States to develop more regular, accessible and practical guidance, including examples, common interpretative notes and coordinated approaches to new technologies and emerging risk areas. Such guidance should be designed to be usable not only by large companies with specialised export control teams, but also by small and medium-sized enterprises.

It would also be helpful to ensure that guidance under the Dual-Use Regulation is aligned with related EU measures, including sanctions, due diligence requirements and other instruments affecting supply chains and international trade, so that companies are not subject to overlapping or inconsistent expectations.

The review should also take into account the importance of European competitiveness and security of supply. Export controls must remain effective in protecting foreign and security policy concerns, while also being sufficiently clear, proportionate and predictable to support innovation, research and development, defence-industrial cooperation and resilient European supply chains. A well-functioning framework should enable legitimate trade and cooperation with trusted partners, while ensuring that controls are targeted at clearly defined risks.
Industry should also be consulted at an early stage when new guidance, control approaches or implementing measures are developed. Early dialogue with affected sectors can help ensure that regulatory objectives are met while avoiding unintended barriers to legitimate trade, research, innovation and international industrial cooperation, as well as an increase of unnecessary administrative burden on companies.
Limit the duration of the revision process
We encourage the European Commission to conduct the review of the Dual-Use Regulation within a clearly defined and limited timeframe. At a time of geopolitical uncertainty and raid technological development, European companies need stability, predictability and legal certainty, and prolonged revision processes risk delaying investments, innovation and international cooperation.