SBDU annual report on dual-use export controls in France. Key statistics: 4,200+ individual license applications processed, 127 denials, 340 conditions attached. Top controlled categories: Category 5 (telecom/crypto) 28%, Category 3 (electronics) 22%, Category 6 (sensors/lasers) 18%. Iran, Russia, and China were the top destinations for denials.
Zitierte ECNs:Keine spezifische ECN
Wichtige Feststellungen (5)
Category 5 (telecommunications and information security) represents the largest share of French dual-use license applications
Iran, Russia, and China account for over 60% of license denials in France
SBDU processes applications within an average of 45 working days - expedited procedure available for EU001 destinations
Post-shipment verification missions increased by 30% following Russia sanctions
Intangible technology transfers (emails, cloud access) now represent 15% of all applications, up from 5% in 2020
SBDU guidance on export control classification of AI/ML models. Key determination: AI models themselves are NOT controlled under the current Dual-Use Regulation unless they incorporate controlled encryption (5D002) or are specifically designed for controlled end-uses (military, nuclear, surveillance). General-purpose AI models (LLMs, image recognition) are not dual-use items per se.
General-purpose AI/ML models are NOT controlled under the current EU Dual-Use Regulation
AI software specifically designed for cryptanalysis could be controlled under 5D002
AI models designed for autonomous weapons systems may trigger catch-all provisions (Article 4)
Training data containing controlled technology (e.g., nuclear design data) does NOT make the trained model a controlled item - but the training data transfer itself may require authorization
EU AI Act and Dual-Use Regulation are separate regimes - AI Act compliance does not address export control obligations
FR-2024-SBDU-ITTSBDU (Frankreich)Frankreich
Intangible technology transfers (guidance)
SBDU clarified that intangible technology transfers - including email transmission of technical data, cloud hosting of controlled software, and verbal disclosure of controlled technology to foreign nationals - require export authorization under the EU Dual-Use Regulation. The guidance specifically addressed deemed exports in research environments and multinational corporate settings.
Emailing a controlled technical document to a colleague in a non-EU country constitutes an export requiring authorization - no physical border crossing needed
Cloud hosting of controlled software (5D/E categories) accessible from non-EU locations creates a continuous export - access controls must match export control requirements
Deemed exports in corporate settings mean hosting a foreign national employee at a facility with controlled technology requires authorization - HR departments must coordinate with compliance
SBDU (Service des Biens a Double Usage) published updated guidance on classification of encryption products under Category 5 Part 2. Key clarification: cloud-based encryption services where the cryptographic processing occurs on infrastructure outside France are subject to export control when the encryption technology or software is transferred (even electronically) to a controlled destination.
Cloud-based encryption services constitute 'technology transfer' under the regulation when cryptographic functions are executed on foreign infrastructure
SaaS encryption products require export authorization if the underlying algorithms exceed 5A002 thresholds and Note 3 does not apply
French manufacturers must file déclaration préalable for Category 5 Part 2 items - even when Note 3 decontrol applies, notification is required
Open-source encryption software benefits from the 'public domain' exemption (General Technology Note) only if all source code is genuinely and permanently public
France adopted Export Controls Order 02-2024, effective 1 March 2024, establishing national controls on quantum computers and advanced semiconductor technologies. Quantum controls tiered by qubit count (34 to 2,000 physical qubits) with specified error rates. France is second EU state (after Spain) to impose national quantum computing controls.
France uses Article 9 of EU Regulation 2021/821 for national controls - same legal basis as Netherlands semiconductor controls
Quantum computer controls are parameter-based: tiered from 34 to 2,000 physical qubits with specified error rates per tier
Both semiconductor manufacturing equipment and quantum technologies in a single decree - reflecting technology convergence
SBDU processes license applications - French exporters apply to SBDU, not Ministry of Defence
Anticipates EU-wide 500-series entries adopted in November 2025
FR-2024-CUSTOMS-CODESBDU (Frankreich)Frankreich
All dual-use items (penalty framework)
Under Article 459 of the French Customs Code, export control violations carry penalties of double the transaction value for natural persons and 10 times the transaction value for legal persons. The SBDU (Service des Biens a Double Usage) processes license applications while investigation is conducted by customs agents and prosecution requires referral by the Minister of Economy.
Zitierte ECNs:Keine spezifische ECN
Wichtige Feststellungen (3)
French penalties scale with transaction value - 10x multiplier for companies creates severe exposure for high-value dual-use exports
Prosecution requires ministerial referral (Minister of Economy) - adding a political filter to enforcement decisions that creates discretion in case selection
Investigation by customs agents followed by police referral creates dual-track enforcement - administrative customs process can escalate to criminal prosecution
French customs investigated unauthorized re-export of submarine sonar components to a non-authorized end-user. The components, classified under 8A001 (underwater detection equipment) and 6A001 (acoustic systems), were originally licensed for a NATO partner but diverted through a third country.
8A001 controls underwater detection systems designed to operate at depths exceeding 35 m with specific accuracy requirements
Re-export of controlled items to unauthorized end-users violates the original license conditions even when the re-exporter is in a friendly country
Submarine sonar systems with specific acoustic performance parameters are among the most sensitive dual-use items
End-user certificates must be verified by the exporter - a false certificate does not exonerate the original exporter from due diligence obligations
FR-2021-AMESYS-NEXANationale GerichteFrankreich
Internet surveillance system (EAGLE/Cerebro)
French Tribunal Judiciaire de Paris indicted Nexa Technologies (formerly Amesys) for complicity in torture in Libya and Egypt. The company sold the EAGLE internet surveillance system to Gaddafi's Libya (2007) and the Cerebro system to al-Sisi's Egypt (2014). Both systems were capable of nationwide internet interception and could identify political dissidents.