Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (recast)

Overview

Regulation (EU) 2021/821, adopted by the European Parliament and the Council on 20 May 2021, establishes a comprehensive Union regime for the control of exports, brokering, technical assistance, transit, and transfer of dual-use items. This regulation, which entered into force on 9 September 2021, recasts and replaces the previous Council Regulation (EC) No 428/2009, aiming to enhance clarity, effectiveness, and efficiency in the EU's export control system. Its primary objective is to prevent the proliferation of weapons of mass destruction (WMDs) and their delivery systems, while also addressing concerns related to regional peace, security, stability, and respect for human rights and international humanitarian law. The scope of dual-use items is broad, encompassing goods, software, and technology that can be used for both civilian and military purposes.

A significant aspect of Regulation (EU) 2021/821 is its heightened focus on emerging technologies, including those related to artificial intelligence (AI), which are increasingly recognized for their potential dual-use applications. The regulation explicitly extends controls to cyber-surveillance technologies, defining them as goods designed for covert surveillance of natural persons through data control, extraction, collection, or analysis from information and telecommunications systems. This expansion reflects the evolving geopolitical landscape and the rapid advancements in critical and emerging technologies such as quantum computing, advanced semiconductors, additive manufacturing, biotechnology, and materials science. The regulation underscores the EU's commitment to maintaining robust legal requirements for dual-use items, strengthening information exchange, and increasing transparency, particularly concerning the risk of such items being misused for internal repression or serious human rights violations.

Definitions

Central to Regulation (EU) 2021/821 are its definitions, which delineate the scope of items and activities subject to control. A 'dual-use item' is defined as goods, software, or technology that can be used for both civilian and military purposes, including items that can contribute to the development, production, handling, operation, maintenance, storage, detection, identification, or dissemination of chemical, biological, or nuclear weapons or other nuclear explosive devices, or to the development, production, maintenance, or storage of missiles capable of delivering such weapons. This broad definition ensures comprehensive coverage of technologies with potential military or illicit applications.

The regulation introduces a specific definition for 'cyber-surveillance technology', categorizing it as goods "designed to enable the covert surveillance of natural persons through the control, extraction, collection or analysis of data from information and telecommunications systems." This explicit inclusion highlights the EU's concern over the misuse of such technologies for human rights violations. Furthermore, the definition of 'exporter' is extended to include natural persons and operators re-exporting European products, making them directly responsible for the transmission or provision of goods. The communication of goods/technologies in electronic or oral format is also brought within the regulation's scope, clarifying obligations for technical assistance, transit, and brokering related to dual-use goods.

Governance and Institutional Framework

The governance and institutional framework for Regulation (EU) 2021/821 involves a multi-layered approach, with responsibilities shared between the European Union institutions and the Member States. The European Parliament and the Council are the legislative bodies that adopted the regulation, while the European Commission plays a crucial role in proposing amendments and overseeing its implementation. Member States are responsible for the practical application of the regulation, including the issuance of export authorisations and the enforcement of control measures.

To foster greater cooperation and consistency across the Union, the regulation establishes an EU-level coordination mechanism. This mechanism facilitates information exchange among Member States, particularly concerning the export of cyber-surveillance items, and allows for the examination and discussion of issues arising from the regulation's application. Competent authorities in each Member State, such as the Ministry for Foreign Affairs in Finland, are tasked with issuing export authorisations, providing guidance to companies, and ensuring compliance. This collaborative framework aims to create a uniform export control system across the EU, enhancing the effectiveness of controls and reducing administrative burdens where appropriate.

Key Focus Areas

Regulation (EU) 2021/821 significantly strengthens controls over critical and emerging technologies, particularly those with implications for artificial intelligence and advanced computing. A major focus is on 'cyber-surveillance technology', for which stricter export controls are imposed to prevent its use in human rights violations in third countries and to protect European security. This includes goods designed for covert surveillance of natural persons through data control, extraction, collection, or analysis from information and telecommunications systems. The regulation mandates that competent authorities consider the risk of such items being used in connection with internal repression or serious violations of human rights and international humanitarian law when assessing export applications.

Beyond cyber-surveillance, the regulation expands controls over a range of advanced technologies critical to AI development and deployment. Recent updates to Annex I, such as those in Commission Delegated Regulation (EU) 2025/2003, have broadened controls in domains including quantum computing, semiconductor manufacturing, biosecurity, advanced materials, and additive manufacturing. Specific new entries cover items like quantum computers, cryogenic Complementary Metal-Oxide-Semiconductor (CMOS) integrated circuits, advanced integrated circuits, EUV lithography equipment, peptide synthesizers, and high-entropy alloys. These controls reflect a recognition of the strategic dimension of these technologies and their potential for dual-use applications, from military simulation to space-related processing and advanced defense components.

Implementation Framework

The implementation framework of Regulation (EU) 2021/821 is built upon a system of export authorisations and control measures designed to regulate the movement of dual-use items. Exporters are generally required to obtain an authorisation for the export of listed goods in Annex I. The regulation provides for different types of authorisations, including individual export authorisations, global export authorisations, and new Union general export authorisations. The latter aim to reduce administrative burdens for companies, particularly SMEs, for low-risk exports, while maintaining an appropriate level of control.

A critical component of the implementation framework is the 'catch-all' clause, which allows for controls on non-listed dual-use items under certain circumstances. This clause applies if an exporter is informed by a competent authority, or is aware, that items they propose to export may be intended for use in connection with WMDs, military end-uses in countries subject to an arms embargo, or for cyber-surveillance items intended for internal repression or human rights violations. Furthermore, the regulation emphasizes the importance of internal compliance programs (ICPs) for exporters, particularly for users of global export authorisations, to ensure adherence to export control requirements and maintain detailed records of their exports.

Monitoring and Evaluation

Monitoring and evaluation under Regulation (EU) 2021/821 are crucial for ensuring the effectiveness and adaptability of the Union's dual-use export control regime. The regulation introduces new reporting rules aimed at increasing transparency for the trade in dual-use items. This enhanced transparency is supported by increased cooperation between Member States and between licensing and customs authorities of the EU, facilitating a more coordinated approach to export controls.

The European Commission is mandated to present an annual report on the implementation of the regulation, contributing to greater oversight and accountability. Moreover, the dynamic nature of technology, particularly in AI and emerging fields, necessitates regular updates to the list of dual-use items in Annex I. These updates incorporate decisions from multilateral export control regimes and address evolving technological and proliferation risks. The ongoing review and amendment process, such as the Commission Delegated Regulations updating Annex I, demonstrate the commitment to continuously adapt the regulatory framework to new challenges and ensure its relevance in a rapidly changing technological landscape.

Penalties, Liability, and Appeals

While Regulation (EU) 2021/821 establishes the Union regime for dual-use items, it generally leaves the specific provisions for penalties, liability, and appeals to the discretion of individual Member States. The regulation requires Member States to lay down rules on penalties applicable to infringements of its provisions and to take all measures necessary to ensure that they are implemented. These penalties must be effective, proportionate, and dissuasive.

National legislation, such as the Act on the Export Control of Dual-Use Items in Finland, complements the EU regulation by including provisions on authorities' responsibilities, control and enforcement measures, and the imposition of sanctions. For instance, the Finnish Criminal Code lays down provisions on punishments for non-compliance with the national act, which in turn enforces the EU regulation. This decentralized approach to penalties acknowledges the varying legal traditions and enforcement mechanisms across the EU, while ensuring that a robust system of deterrents is in place to uphold the integrity of the export control regime.

Relationship to Other Instruments

Regulation (EU) 2021/821 operates within a complex web of international and national legal instruments, demonstrating its foundational role in the broader export control landscape. It is designed to ensure that the Union and its Member States fully take into account international obligations and commitments, particularly regarding non-proliferation, regional peace, security, and stability, and respect for human rights and international humanitarian law. This includes obligations under relevant sanctions and commitments agreed upon in multilateral export control regimes such as the Wassenaar Arrangement (WA), the Missile Technology Control Regime (MTCR), the Australia Group (AG), and the Nuclear Suppliers Group (NSG).

The regulation also aligns with the EU Strategy against proliferation of Weapons of Mass Destruction (WMD Strategy) and considers national foreign and security policy, including human rights considerations outlined in the Council Common Position 2008/944/CFSP. At the national level, Member States enact specific legislation to implement and enforce the EU regulation, addressing areas such as the organisation of authorities' responsibilities, control and enforcement measures, and national authorisation requirements. This interplay between international commitments, EU law, and national implementing acts creates a comprehensive and layered framework for controlling dual-use items.

International Alignment

International alignment is a core principle underpinning Regulation (EU) 2021/821, as it seeks to harmonize the EU's export controls with global standards and commitments. The regulation explicitly aims to reflect decisions taken within multilateral export control regimes, such as the Wassenaar Arrangement, MTCR, Australia Group, and NSG. Regular updates to Annex I of the regulation are specifically designed to incorporate the latest multilateral control-list updates, ensuring that the EU's controls remain consistent with international efforts to prevent proliferation and misuse of sensitive technologies.

Furthermore, the regulation strives to align the EU's position with that of other major international partners, such as the United States, which has also implemented many of these developments in export control. This alignment is crucial for maintaining a level playing field for EU exporters and for fostering international cooperation in addressing common security challenges related to dual-use items. The EU's commitment to strong national and internationally coordinated export controls, as emphasized in the EU WMD Strategy, is reinforced through this regulation, demonstrating a proactive approach to global security and non-proliferation efforts.

Implementation Timeline

Compliance Checklist

Sources and References