The recast of the Dual-Use Regulation is expected to be published in the Official Journal of the EU at the beginning of June 2021. Given the various changes this recast version brings for the economic operators, they will have to prepare themselves in good time before it will enter into force 90 days after its publication.

Amendment

After formal adoption of the recast version of the Dual-Use Regulation by the European Parliament on 25 March 2021 and by the Council on 10 May 2021, the Regulation is expected to be published in the Official Journal of the EU at the beginning of June 2021. After a transition period of 90 days, it will enter into force at the end of August or at the beginning of September, thus replacing the Dual-Use Regulation (EC) No 428/2009 currently in force.Although the basic system of control of dual-use items will remain unchanged, the recast version will nonetheless bring about various substantive law changes:

Surveillance technology

In the course of the legislative process, particularly more stringent controls on the export of cyber-surveillance technology were discussed. The amendment now includes a catch-all clause for export of non-listed cyber-surveillance and intrusion technology. Exports of such items will require prior authorisation if the exporter has been informed by the competent authority that the items in question are or may be intended, in their entirety or in part, for use in connection with internal repression and/or commission of serious violations of human rights and international humanitarian law. If an exporter “according to its due diligence findings” is aware that non-listed cyber-surveillance items are intended for any of the aforementioned uses, the exporter has an obligation to notify the competent authority. But it is neither clarified when a serious violation of human rights exists nor what due diligence obligation the economic operators are required to observe. Risk analysis is instead to be defined by internal compliance programmes to be established depending on the size, structure and scope of the respective company’s business operations.

Further changes

• In future, the Dual-Use Regulation will cover technical assistance. That means an authorisation will be required for providing technical assistance in connection with listed dual-use items if there are indications of a sensitive end-use or the competent authority has informed the exporter of such sensitive end-use.
• If an EU Member State lists dual-use items on a national control list and this list has been published in the Official Journal, this may also result in an authorisation requirement in other EU Member States if the competent authority has informed the exporter that the export of the items is of concern for reasons of public security or with respect to human rights.
• Two new general authorisations are created: firstly, there will be a general authorisation for intra-group export of software and technology to subsidiaries or sister companies with regard to certain items to certain destinations (EU007). However, for export to a subsidiary the pre-requisite is that it is wholly owned and controlled by the exporter, and for export to a sister company that it is directly and wholly owned by the same parent company. Secondly, a general authorisation is created at the EU level for encryption items (EU008). At the same time, in Germany, it will still be possible to use the German national General Authorisation 16 (telecommunications and information security).
• An authorisation for large projects is introduced subject, as a general rule, to a maximum validity period of four years (with a longer validity period being possible in sufficiently justified cases arising from the term of the project).
• The exchange of information between national authorities and the Commission, but also between the licensing and customs authorities of the EU Member States, will be strengthened.
• Moreover, some definitions, including that of “exporter”, have been revised.

Marian Niestedt, M.E.S., Lawyer, Hamburg