Export Compliance for Technology & IT Companies — UK

UK export controls regulate several technology categories critical to IT companies: encryption software and cryptographic products, cybersecurity tools with advanced intrusion detection capabilities, software source code with military or sensitive applications, artificial intelligence and machine learning systems with dual-use potential, quantum computing technologies, and semiconductors meeting specified performance thresholds. The Export Control Order 2008 and subsequent amendments classify these under 'dual-use' items, meaning they have both civilian and military applications. Technology companies must assess whether their products trigger controls, obtain appropriate licenses from the Export Control Joint Unit, and implement procedures ensuring customers aren't restricted end-users (certain governments, terrorists, or sanctioned entities). Non-compliance—such as exporting encryption software to Iran without license—can result in criminal prosecution and fines exceeding £500,000.

Export compliance responsibility ultimately rests with individuals controlling companies. The PSC (Person with Significant Control) register, containing 457,852 records in UK Technology & IT companies with an average complexity score of 14.5, reveals beneficial ownership chains. When ownership is concentrated, single individuals bear full responsibility for ensuring compliance—they cannot delegate accountability despite complexity. Complex structures with multiple PSC layers create ambiguity: which tier bears compliance responsibility? Multiple PSCs without assigned duties may each assume others are monitoring compliance. HMRC enforcement targets individuals shown to have knowledge of export violations. Companies with layered offshore ownership face additional scrutiny, as structures may be designed to obscure beneficial ownership to evade sanctions. Therefore, ownership transparency and documented compliance role assignments are essential to establish clear accountability lines.

Export control violations constitute serious criminal offences under the Export Control Act 2002. Individuals (including company directors) can face prosecution for knowingly or recklessly breaching export restrictions. Convictions result in unlimited fines and up to 10 years imprisonment for intentional violations. Companies face unlimited fines with no cap—fines have exceeded £500,000 in prosecuted cases. Beyond criminal penalties, convictions result in: revocation of export licenses permanently or for extended periods, director disqualification under the Company Directors Disqualification Act 1986, reputational damage affecting customer relationships and market access, and operational shutdown if licenses are essential to business. Regulatory agencies pursue directors individually, not just companies, meaning executives cannot shelter behind corporate structures. Real-world prosecutions have involved Technology company founders receiving custodial sentences for exporting encryption software without license.

The 255,517 Technology & IT companies formed since 2020 face accelerated compliance obligations. New companies must immediately assess whether their products/services trigger export controls—this assessment should occur during business planning, not after customer negotiations. Established procedures must include: product classification reviews (with external technical experts if uncertain), customer due diligence screening against sanctions lists before sales are finalized, written end-use declarations for all international transactions, staff training mandatory for anyone handling international business, annual compliance audits, and board-level oversight. New companies should document that directors understand export obligations through board minutes confirming compliance discussions. Many recent founders lack experience with export regulations; hiring compliance specialists or engaging external advisors is prudent. Companies should also establish export compliance procedures before reaching customers in restricted jurisdictions—reactive compliance after violations are detected results in criminal exposure.

The ch_officers register contains 481,436 records across active Technology & IT companies, documenting individuals in decision-making roles. Export compliance due diligence requires screening all officers against sanctions lists and reviewing previous employment in restricted sectors. Directors with prior involvement in export violations, even at different companies, suggest elevated compliance risk. Officer appointment dates and changes are significant: if directors changed recently without compliance transition documentation, knowledge gaps may exist regarding export obligations. The register reveals whether multiple directors have export control experience or whether one junior officer incorrectly bears sole compliance responsibility. Companies with high director turnover (ch_officers average complexity score 1.5) may indicate inadequate compliance training transition. Investors and business partners use director screening to assess whether company leadership understands export obligations—poorly qualified directors suggest insufficient compliance oversight. This data helps identify whether companies have appropriate expertise in place before engaging in international business.