ITAR Machining Explained: What It Means and When You Need It

Reviewed by the Rapidcision Engineering Team | Last updated: June 2026

ITAR machining is the manufacture of defense-related parts, or parts made from controlled technical data, by a shop that is registered with the US government and restricts access to that data to US persons. If your component appears on the United States Munitions List, or if the drawing and CAD file behind it are export-controlled, the machining has to happen inside an ITAR framework. That means an ITAR-registered, US-based supplier, secure handling of your technical data, and strict control over who can see it.

For a defense or aerospace buyer, getting this wrong is not a quality problem, it is a legal one. This guide explains what ITAR is, what makes machining fall under it, how it differs from EAR, what an ITAR-compliant shop actually has to do, and how to choose a partner. We build for defense and aerospace programs through our Servicios de mecanizado CNC, and the points below are the ones that matter most before you send a controlled drawing to anyone.

What ITAR Actually Is

ITAR stands for the International Traffic in Arms Regulations. It is a set of US government regulations that control the export and import of defense articles, defense services, and related technical data. The regulations are authorized by the Arms Export Control Act and administered by the Directorate of Defense Trade Controls, known as the DDTC, which sits inside the US Department of State.

The items ITAR controls are listed on the United States Munitions List, or USML, which is organized into 21 broad categories. Those categories cover far more than finished weapons. They include components, subassemblies, spare parts, and the technical data needed to make them. A bracket, housing, or fitting that goes into a defense system can fall under ITAR even though it looks like ordinary hardware on its own.

What Makes Machining “ITAR Machining”

Two things can pull a machined part under ITAR control, and you need to watch both.

The first is the part itself. If the component is described on the USML, or is a part or subassembly of a USML-listed defense article, the work is ITAR-controlled.

The second is the technical data. ITAR controls the blueprints, drawings, CAD files, specifications, and production files required to manufacture a controlled article. The moment you share that data with a supplier, you are dealing with export-controlled information, even if no physical part has crossed a border yet. This is the part buyers most often miss. Sending a controlled CAD file to a foreign person, or to a shop that lets foreign nationals access it, can count as an export on its own.

ITAR vs EAR: Knowing Which Applies

Not every defense-adjacent part is ITAR-controlled. Some fall under the Export Administration Regulations, or EAR, instead. The distinction matters because the rules and the registration requirements are different.

If you are unsure which applies to your part, the manufacturer or prime can request a commodity jurisdiction determination from the DDTC to clarify. When in doubt, treat the data as controlled until you know otherwise.

What an ITAR-Compliant Machine Shop Must Do

Saying a shop is “ITAR compliant” is shorthand for a specific set of obligations. A supplier doing ITAR machining must:

•             Register with the DDTC. Manufacturers of USML-listed articles are required to register with the State Department, even if they never export the part themselves. Registration is the mandatory first step, though it does not by itself grant export permission.
•             Restrict technical data to US persons. Access to your controlled drawings, models, and specifications must be limited to US citizens, lawful permanent residents, and protected individuals. Letting a foreign national view that data, even an employee inside a US facility, is a deemed export and requires separate authorization.
•             Control and secure the data. The shop has to know exactly what data is controlled, where it lives, and who can reach it, with documented access controls protecting prints, models, and production records throughout the job.
•             Flow requirements down the supply chain. Any sub-tier processor that touches the controlled part or data carries the same obligations.
• That last point is the one that catches smaller operations. A Tier 2 or Tier 3 shop machining a USML-described part needs its own DDTC registration and authorizations. The prime contractor’s license does not cover a subcontractor’s operations.

Why It Matters: The Stakes of Getting It Wrong

ITAR is enforced seriously. Violations can bring civil penalties exceeding a million dollars per violation, along with criminal fines, prison time, loss of export privileges, and debarment from defense contracts. For a supplier, a single mistake can end its ability to work in the defense sector. For a buyer, it can compromise a program and expose the company to liability.

It is also worth knowing that the regulations are not static. The USML is revised periodically, most recently in 2025, so a part’s jurisdiction should be confirmed rather than assumed from an old determination.

ITAR, AS9100, and NADCAP Are Not the Same Thing

Buyers often blur these together, but they answer different questions about a supplier.

•             ITAR is export-control law. It governs who may handle defense articles and controlled technical data.
•             AS9100 is a quality management certification. It tells you the shop runs an aerospace-grade quality system. We cover this in detail in our guide to AS9100 vs ISO 9001.
•             NADCAP is an accreditation for special processes such as heat treating, plating, and non-destructive testing.

A serious defense program often requires more than one of these at once. A part might need an AS9100-certified, ITAR-registered shop, with NADCAP-accredited sub-processors for the special processes. They stack, they do not substitute for each other.

How to Choose an ITAR Machining Partner

When you qualify a supplier for ITAR work, confirm the essentials directly rather than trusting a logo:

1.         DDTC registration. Ask for confirmation that the supplier, and any sub-tier shop touching the data, is registered.
2.         US-based operations and US-persons data control. Verify where the work happens and who can access your files.
3.         Secure data handling. Look for documented access controls and a clear process for protecting prints and models.
4.         Quality credentials. AS9100 certification is the practical baseline for aerospace and defense parts.
5.         A workflow that protects controlled data end to end, including how a quote request and CAD upload are handled before a contract even exists.

That final point deserves attention with any online or network-based manufacturer. The instant a controlled file is uploaded, it is controlled data, so the platform handling it has to operate within the same ITAR framework as the shop that cuts the metal.

Rapidcision is built in the United States with an AS9100D-certified, security-conscious digital workflow for defense and aerospace programs. For controlled work, we keep technical data inside a US-persons framework and route it only to qualified US suppliers. If your part is ITAR-controlled, talk to us first about how the data will be handled, and we will confirm the right path before anything moves. You can start a secure quote here.

Preguntas frecuentes

What is ITAR machining? ITAR machining is the manufacture of defense parts, or parts made from export-controlled technical data, by an ITAR-registered, US-based supplier that limits access to that data to US persons. It applies when a component is on the US Munitions List or is built from controlled drawings and specifications.

Does a machine shop need to be ITAR registered? If the shop manufactures parts described on the USML, it generally must register with the DDTC, even if it does not export the parts itself. Sub-tier suppliers that handle controlled parts or data need their own registration, since the prime’s license does not cover them.

What is the difference between ITAR and EAR? ITAR covers military-specific defense articles on the US Munitions List and is administered by the State Department’s DDTC. EAR covers commercial and dual-use items on the Commerce Control List and is administered by the Commerce Department’s BIS. The item’s classification, not the company’s general business, decides which applies.

Is sending a CAD file an export under ITAR? It can be. ITAR controls technical data, so sharing a controlled drawing or CAD file with a foreign person, even within the United States, can count as a deemed export that requires authorization.

Is ITAR the same as AS9100? No. ITAR is export-control law about who may handle defense data and articles. AS9100 is a quality management certification. A defense part often requires both an ITAR-registered and an AS9100-certified supplier.

What are the penalties for ITAR violations? Penalties can include civil fines exceeding one million dollars per violation, criminal charges, imprisonment, loss of export privileges, and debarment from defense contracts.

Getting ITAR Machining Right

ITAR machining comes down to controlling the part and the data behind it, through a registered, US-based supplier that restricts access to US persons and flows those obligations down to every shop that touches the work. Confirm registration, confirm where your data lives, and confirm who can see it, before you send a single file.

If you have a defense or aerospace part and need to know whether it is ITAR-controlled and how it should be handled, send us your project details. Our US-based team will help you confirm the right path and keep your technical data protected from the first upload.