Export-controlled information moves through engineering workflows, supplier relationships, multinational operations, and digital collaboration environments. Governing those movements starts with two questions: What constitutes Export Controlled Information, and how do we consistently identify it?
At TC Engine, we use Export Controlled Information (ECI) as a country- and jurisdiction-agnostic descriptor for information subject to applicable export regulations. It provides a common language across regulatory environments while preserving the distinctions that determine how information must be handled and when it may be released.
To make that language operational, organizations need two complementary standards: an ECI Definition Standard and an ECI Identification Standard.
A common definition across jurisdictions
Export regulations use different terms for regulated information. In the United States, these include technical data under the International Traffic in Arms Regulations (ITAR) and technology under the Export Administration Regulations (EAR). Each has a specific definition, scope, and exclusions. ECI provides a canonical descriptor under which those concepts—and their counterparts in other regulatory environments—can be represented together.
This shared descriptor supports a global operating model. An organization can recognize information as ECI without requiring every employee or application to use a different umbrella term for each jurisdiction. The underlying regulatory definitions remain authoritative.
ECI also extends beyond defense contexts. The descriptor follows the information’s regulatory status across military, commercial, and dual-use activities.
Recognizing ECI in context
Engineering drawings, design models, manufacturing instructions, test records, maintenance documentation, and software may contain ECI. Their status depends on their content and the applicable regulations.
The ITAR definition of technical data includes specified information required for activities involving defense articles, while excluding certain general principles, public-domain information, basic marketing information, and general system descriptions. Under the EAR, technology controls depend on the regulatory definition, applicable control entry, and associated requirements.
Consequently, a file extension, title, proprietary marking, or reference to a controlled product is insufficient by itself to establish ECI status. Such attributes can provide evidence or indicators that warrant assessment.
A document discussing export regulations may contain no controlled technical content. An unmarked drawing may contain substantial controlled information. The determination must address what the information conveys.
The ECI Definition Standard
An ECI Definition Standard establishes the organization’s operational meaning of ECI, grounded in applicable regulations. It gives employees, export professionals, data governance teams, and automated systems a consistent basis for determining whether information contains ECI.
The standard should establish:
- The regulatory concepts, scope, and exclusions used to determine ECI status.
- The evidence needed to support a determination.
- The distinction between an ECI indicator and a confirmed determination.
- How incomplete evidence, uncertainty, and conflicting assessments are handled.
- Who may approve determinations and resolve ambiguous cases.
- The handling and review requirements that follow identification.
This is foundational work for automation. A scanning system needs an agreed decision target. An AI model needs instructions and examples that reflect that target. Reviewers need a common basis for accepting, correcting, or escalating results.
The definition must therefore be governed, tested against representative information, and maintained as regulations and organizational understanding evolve. An adjudication process allows difficult cases to become documented precedents.
A determination that information contains ECI can precede its precise export classification. The standard should support that sequence while preserving the distinction between confirmed ECI, suspected ECI, and information whose status remains undetermined.
The ECI Identification Standard
The ECI Identification Standard establishes how an ECI determination and its regulatory context are represented, associated with information, and exchanged.
The Definition Standard answers, “What constitutes ECI?” The Identification Standard answers, “How do people and systems recognize and interpret the determination consistently?”
Its core attributes include:
| Attribute | Question it answers |
|---|---|
| ECI status | Does the information contain ECI, contain no ECI within the assessed scope, or remain undetermined? |
| Authority | Which country or governing authority’s export requirements apply? |
| Regime or jurisdiction | Which regulatory framework under that authority governs the information? |
| Export classification | Which control entry or designation applies under that framework? |
“Authority” identifies the source of the applicable export requirements. The information’s storage location and proprietary owner are separate attributes.
An illustrative classification identifier is ECI:US:EAR:6E001. It communicates a regulatory identity: U.S. authority, EAR jurisdiction, and classification under ECCN 6E001. Multiple information objects may share that identity.
The identifier should remain compact. Supporting detail belongs in an associated determination record or decision context profile, including assessment scope, evidence, regulatory references, approval, effective dates, review status, and revision history.
Coarse-grained identity for safeguarding
Organizations may establish that information contains ECI before resolving every classification detail.
A coarse-grained identity can record ECI status and applicable authority, with jurisdiction added when known. These attributes allow the organization to recognize information requiring export-control handling and apply its defined interim safeguards while further assessment proceeds.
For example, an organization may determine that a file contains U.S. ECI while its precise classification remains under review. That is materially different from either an unassessed file or a supported determination that the file contains no ECI.
Coarse-grained identity supports safeguarding decisions. Its usefulness depends on the organization’s policies and the information available; it does not establish permission to release the information.
Fine-grained identity for release decisions
A proposed release requires sufficient regulatory detail to evaluate the applicable requirements. Jurisdiction and export classification connect the information to the rules relevant to that transaction.
Even a precise classification is only one input. Export Authorization (ExAuth) evaluation must also consider the proposed recipient, relevant identity attributes, location, purpose, activity, and applicable authorization conditions.
The standards preserve a clear relationship:
ECI identification describes the information’s regulatory status. Export authorization determines whether a proposed activity may proceed.
A classification label alone cannot communicate all the conditions governing a recipient’s access, use, transfer, or retransfer.
Information objects and regulatory identity
The standard must distinguish the identity of the information object from the regulatory identity assigned to it.
For a file, a cryptographic hash can bind a determination to a specific content version. The associated record can hold its ECI status, classification profiles, evidence, and approval history. Identical content may occur in multiple locations, so ownership, custody, and transaction context must also be retained where relevant.
This approach supports external metadata records as well as embedded markings. Many file types do not support useful metadata embedding, and embedded values require maintenance when determinations change.
A file’s content may remain unchanged while its classification is corrected or revised. The identification standard should support updating the determination, retaining the prior decision, and making the current approved result available to consuming systems.
Human-readable markings remain useful. Machine-readable records make those determinations available to applications and policy services.
Interoperability across authorities and organizations
The same information may be subject to requirements from more than one authority. The identification model should retain each applicable authority, regime, and classification as an associated profile, together with its assessment status and supporting evidence.
That capability matters within a multinational company and across its customers, suppliers, and partners. Consistent representation allows a receiving system to interpret the regulatory context supplied by another system or organization.
Interoperability requires more than exchanging a label. Participants need shared definitions, attribute meanings, determination states, provenance, and rules for interpreting updates.
The ECI Definition Standard establishes shared meaning. The ECI Identification Standard carries that meaning into operations. Together, they provide the foundation for repeatable identification, appropriate safeguarding, classification-informed authorization, and compliant collaboration.