On 9th September 2021, after long negotiations, a new dual-use regulation of the EU will come into force. The determination of the resulting changes can be achieved – as usual in the case of legal changes – simply and superficially by comparing the old regulation, which has been in force since 2009 (regulation EC No. 428/2009; hereinafter old DU-reg.) with the version of the new regulation (regulation EU 2021/821; OJ L 206/1 as of June 11th, 2021; hereinafter new DU-reg.). There are already many specialist articles that shed light on the legal differences in detail and their (presumed) effects on practice. The following diagram briefly shows the main changes in the form of the new and extended approval facts under the new EU DU-reg. marked in yellow and red compared to the old DU-reg. in grey.
Through the latest press releases about the spy software “Pegasus” and its possible applications, the background and the importance for the control of goods of digital surveillance and the newly created Art. 5 are impressively visualized. This also underlines the importance of bringing so-called “emerging technologies” into the focus of international export control regimes much earlier than before and in a more EU-wide coordinated approach.
Besides these above shown obvious changes by the new DU-reg. arises the question if this was in fact all the change? Therefore, is what is immediately recognized really all of the change for the future that companies in the EU must deal with or is there perhaps still more to consider behind all the legal details and obvious changes? What may be written “between the lines” and what should companies, especially small and medium-sized enterprises (SMEs), prepare for in the EU with the entry into force of the new EU DU-reg.?
The answer is as banal as it is significant. The requirements for the respective internal control system (hereinafter Internal Compliance Programme, ICP) of companies as defined under the new EU DU-reg. will continue to rise. These results, among other things, from the following considerations.
- The intended achievement and maintenance of a level playing field in the EU to prevent distortions of competition means from a German point of view to aim in all EU countries at least for the same high level of control as in Germany as the largest export nation in the EU, where 50% of all export control permit cases are located in the EU. The requirements for exporters and their ICPs will presumably increase in all EU countries where necessary in the future and thus at the same time the possibilities to violate against those increased requirements.
- The new DU-reg. demands a stronger cooperation between the EU Member States, their export control and customs authorities and the EU Commission with the aim of more transparency, improved controls, harmonization of processes and a level playing field. This intended “readjustment” of the authorities in export control therefore also requires appropriate reactions on the part of exporters regarding their respective ICP. Without the self-dependent and cooperative assistance of the exporters in export control, the EU authorities will not be able to achieve their existing and newly underlined goals with the new DU-reg.
- The interests of small and medium-sized enterprises (SMEs) are mentioned at various points in the recitals of the new DU-reg. for the purpose of their supposedly special consideration, which is positive. However, this should not lead them to believe that compliance violations by SMEs would be treated differently from those of large or multinational companies. In the event of infringements, there is no general pardon for SMEs and their responsible natural persons. Before a criminal or administrative offence law in the EU, all persons are equal in this respect, even if each single case must always be considered individually.
- In the negotiations on the new DU-reg. a proposal was rejected that expressly required an ICP for all approval procedures and not only – as before – for applications for global permits. The discussion about this demand will certainly continue in the coming years.
In addition to the above reasons for a stronger focus of the new DU-reg. on the ICP of exporters, the new DU-reg. defines for the first time the term „ICP” as such at all in Article 2 (21) and refers (in)directly to ICP in further articles by using the terms “due diligence”, “aware” or “awareness”. For the purposes of the new regulation, the term ICP (emphasis added) means:
„Internal compliance programme’ or ‘ICP’ means ongoing effective, appropriate and proportionate policies and procedures adopted by exporters to facilitate compliance with the provisions and objectives of this Regulation and with the terms and conditions of the authorisations implemented under this Regulation, including, inter alia, due diligence measures assessing risks related to the export of the items to end-users and end-uses”
Beyond this definition, however, there is unfortunately no clear statement in the other articles of the new DU-reg. to companies about who, when and how an ICP has to hold. According to recital 18, this is to be done in separate (legally non-binding) EU guidelines, which are not intended to pursue a “one fits all” model approach for an ICP.
Such ICP guidelines for dual-use goods already exist since 2019 as a non-binding recommendation/guideline of the EU Commission of July 30th, 2019 (EU 2019/1318; OJ L 205/15, 5.8.2019). In so far is the demand for such guidelines from the recital 18 for the new DU-reg. obsolete after the almost ten-year long negotiations.
Also, the new DU-reg continues to require an ICP only regarding approval procedures for global export authorizations. There was also a demand to explicitly require an ICP for all approval procedures in the previous discussions about the new DU-reg. However, this proposal did not find a majority. Therefore, and from now on, this demand is found “between the lines” of the new DU-reg.
Surprisingly, for the EU General Authorisation EU007 for the intra-group export of software and technology, which was newly created under the new DU-reg., there is also an explicit requirement for an ICP of the exporter in a General Authorisation of the EU for the first time.
The fact that explicitly the new DU-reg. thus only continues to require an ICP explicitly only for global permits and newly for the new EU007 may give the false impression that only in these cases an ICP is of benefit and special importance for exporters. But this is by no means the case. An ICP is the necessary protective shield for companies not only in these two cases, but in all cases of the daily practice of export control. ICPs primarily protect exporters preventively against infringements and their prosecution/punishment, but on the other hand even if infringements have already occurred under an ICP.
Somewhat awkwardly formulated from the legislators, the central importance of maintaining an appropriate ICP for all parties involved can be retrieved from recital 7 (emphasis added):
„The contribution of exporters, brokers, providers of technical assistance or other relevant stakeholders to the overall aim of trade controls is crucial.
In order for them to be able to act in conformity with this Regulation, the assessment of risks related to transactions concerned by this Regulation is to be carried out through transaction-screening measures, also known as the due diligence principle, as a part of an Internal Compliance Programme (ICP).
In that regard, in particular the size and organisational structure of exporters have to be taken into account when developing and implementing ICPs. “
Overall, high-ranking German export control authority officials read the following from all of this:
“The growing importance of internal (export) control measures (ICPs) is clearly recognizable in addition to the above-called international and national developments in the amendment “
G.Pietsch, APräs in BAFA (Federal Office for Economic Affairs and Export Control) in AW Prax 04/2021 p. 211
and
“Everyone must/should have an ICP. Doing nothing is not enough”
G.Pietsch, APräs in BAFA on DIHK/BAFA virtual conference for information June 16th, 2021
Summary:
The upcoming and foreground changes in the new DU-reg. should not lead exporters to believe that nothing new developments can be expected beyond that. In fact, the topic of ICP is not new, but in my opinion, it will come stronger into focus and be further developed even more strongly than before via the new DU-reg. Companies based in Germany should, for example, share and mutually exchange their accumulated expertise in export control with their affiliated companies in other EU countries even more. In a supply chain, the weakest link often determines success or failure. Maintaining an appropriate ICP for export control strengthens international supply chains and is a key to (global) success for exporting small, medium and large companies in Germany and the EU.