Catch-All Assessment - Articles 4 and 5

The catch-all clause is the safety net of the EU export control regime. It imposes a licensing obligation even for products not listed in Annex I of Regulation (EU) 2021/821, when certain risk conditions are met.

The principle is straightforward: Annex I cannot list every potentially sensitive product. Technologies evolve faster than control lists. The catch-all clause fills this gap by imposing on the exporter a duty of vigilance regarding the end-use of their products.

Articles 4 and 5 of the Regulation define three main scenarios: proliferation of weapons of mass destruction (WMD), military end-use in certain contexts, and since Regulation 2021/821, cyber-surveillance in connection with human rights violations.

Article 4 covers two scenarios:

WMD proliferation (Article 4, paragraph 1): a licence is required if the exporter has been informed by the competent authority, or is aware, that the items are or may be intended, in their entirety or in part, for use in connection with the development, production, handling, operation, maintenance, storage, detection, identification or dissemination of chemical, biological or nuclear weapons, or missiles capable of delivering such weapons.

Military end-use (Article 4, paragraph 1, points c and d): a licence is required if the items are intended for military end-use and the purchasing or destination country is subject to an arms embargo. The definition of military end-use is broad: it includes incorporation into military items, use of production or testing equipment for the development of military products.

Key point: for WMD, there is no geographical condition - control applies regardless of destination. For military end-use, only countries under embargo are concerned.

Article 5, introduced by Regulation 2021/821, is a major innovation. It imposes control on cyber-surveillance items not listed in Annex I when they are intended, in their entirety or in part, for use in connection with internal repression or the commission of serious violations of international human rights and humanitarian law.

Cyber-surveillance items include: - Communications interception software (wiretapping) - Network traffic surveillance equipment (DPI) - Digital surveillance software (spyware) - Computer intrusion tools - Geolocation and tracking equipment

Unlike Article 4, Article 5 uses the concept of due diligence. The exporter must actively assess risk, not merely react to information received. This is a paradigm shift: the exporter has a proactive obligation.

The question of the exporter's knowledge is central to catch-all. The Regulation distinguishes two situations:

Notification by the competent authority: the authority (in France, the SBDU) informs the exporter that the items are or may be intended for a use covered by Articles 4 or 5. This notification creates an obligation to apply for a licence. It may concern a specific transaction or a specific end-user.

The exporter's own knowledge: the exporter knows that the items are intended for a prohibited use. But what does 'know' mean? Case law and Commission guidelines clarify:

• •Objective indicators matter: destination to an embargoed country, request for unusual specifications, refusal to provide an end-use statement
• •Wilful blindness is no protection: deliberately ignoring warning signs is treated as knowledge
• •Due diligence is expected: the exporter must implement verification procedures proportionate to their business

In practice: systematically document your assessment. If you identify any doubt, contact your competent authority before exporting.

Here is the recommended procedure to assess whether an export of a non-listed product is subject to catch-all:

1. 1.Transaction screening: check sanctions lists (EU, UN, OFAC) for the end-user, consignee, and intermediaries.
2. 2.Destination country analysis: is the country subject to an arms embargo? Is it identified as at risk for WMD proliferation?
3. 3.End-use assessment: does the product have potential military applications? Could it contribute to a WMD programme? Could it be used for cyber-surveillance?
4. 4.Red flags: does the customer refuse to specify the end-use? Are the requested specifications inconsistent with the declared use? Does the customer have links to military entities?
5. 5.Documented decision: record your analysis, sources consulted, and conclusion. If doubt remains, consult the competent authority.

This assessment must be proportionate: an SME exporting standard electronic components does not have the same due diligence obligations as a manufacturer of surveillance technologies.

Export control authorities have identified warning signs that should trigger enhanced vigilance:

Customer-related red flags: - The customer is a military, defence or internal security entity in a sensitive country - The customer refuses to provide an end-use certificate (EUC) - The customer was recently established with no verifiable commercial history - The delivery address is a PO box or does not match the customer's profile

Transaction-related red flags: - The product is oversized relative to the declared use - The customer requests unusual specifications (shielding, radiation resistance) - Payment comes from a third party with no apparent link to the transaction - The customer declines after-sales service or training, unusual for the product type

Destination-related red flags: - Country under EU embargo (check the current CFSP Regulation) - Country identified on FATF watchlists - Transit through a third country with no logistical justification

Non-compliance with the catch-all clause exposes the exporter to severe criminal and administrative penalties:

Criminal penalties (vary by Member State): - France: up to 5 years imprisonment and EUR 75,000 fine (Customs Code, Art. 459). For legal entities, fines are multiplied by five. - Germany: up to 5 years imprisonment (AWG, Section 18). For serious cases (WMD), up to 15 years. - At EU level: Member States must provide for effective, proportionate and dissuasive penalties (Art. 25).

Administrative consequences: - Withdrawal or suspension of general export authorisations - Placement on watchlists - Refusal of future licences - Publication of the sanctioned company's name

The trend is towards enforcement: the 2021 revision extended catch-all to cyber-surveillance, and authorities now have strengthened control powers. Proactive compliance is no longer optional.