The short version. ITAR does not spell out a training mandate, but DDTC expects one: its Compliance Program Guidelines make training one of eight program elements and recommend tiers by job function. Good export control training gives everyone awareness, gives people who handle technical data role-specific scenarios, and keeps records for five years.
Everyone at a defense contractor needs some ITAR training because an export does not need a shipping dock. Under the regulation’s own definitions, an engineer emailing a drawing to a foreign person, a foreign visitor inspecting a test stand, or a shared folder a foreign national contractor can open can each be a release of technical data. None of those moments involve the export compliance team, which is why training has to reach the people who are in them.
This article describes what the regulations say and what is common practice. It is not legal advice. Your empowered official and export counsel decide what your program requires. Regulatory citations were checked against the eCFR text of 22 CFR in October 2026.
Does ITAR require training?
Not in so many words. The International Traffic in Arms Regulations, 22 CFR parts 120 to 130, define what is controlled, who must register and how exports are authorized. They do not contain a general clause that says every employee must complete a course. What they do contain is the reason every defense contractor trains anyway.
Three definitions do most of the work. Technical data under 22 CFR 120.33 includes the information needed to design, build, operate, maintain or repair a defense article, in drawings, instructions or documentation. Under 22 CFR 120.56, that data is released by visual or other inspection by a foreign person, and by oral or written exchanges with foreign persons in the United States or abroad. And under 22 CFR 120.50(b), releasing it to a foreign person inside the United States is a deemed export to every country where that person holds or has held citizenship or permanent residency. A U.S. person, per 22 CFR 120.62, includes U.S. citizens, lawful permanent residents and protected individuals; everyone else is a foreign person for this purpose.
Put those together and an export can happen in a meeting room, a screen share or a site tour. The company is liable for it. 22 CFR 127.10 sets the maximum civil penalty for a violation of section 38 of the Arms Export Control Act at $1,271,078, or twice the value of the transaction behind the violation, whichever is greater. That is the figure after the State Department’s January 2025 inflation adjustment. A rule that any employee can break by talking is a rule every employee has to understand.
The expectation is written down elsewhere. DDTC’s ITAR Compliance Program Guidelines, issued in December 2022, list eight elements of an effective program, and ITAR training is Element 5. On the dual-use side, the Bureau of Industry and Security’s eight elements of an effective export compliance program say to “require training for all employees, including support staff whose responsibilities relate to exports.” Neither is a regulation. Both describe what the agency will look for when something goes wrong, which is when the quality of your training stops being a paperwork question.
| Question | What the regulation says | What agencies expect or common practice adds |
|---|---|---|
| Is training mandatory? | No general training clause in 22 CFR 120 to 130 | Training is one of eight program elements in both the DDTC and BIS guidelines |
| Who must be trained? | Not specified | Everyone at awareness level, with tiers by function (DDTC); all employees including relevant support staff (BIS) |
| How often? | Not specified | Reviewed periodically and updated as needed (DDTC); annual refreshers are common practice |
| What records? | ITAR records kept five years (22 CFR 122.5); EAR records under 15 CFR part 762 | Training records kept alongside: person, course version, date, result |
What ITAR training do employees at a defense contractor need?
Tiered training, by what each person can release. DDTC’s guidelines say organizations “should adopt a tiered ITAR training program based on the responsibilities of each employee,” tailored to the organization’s risk profile, and give four tiers as an example: all personnel, senior management, positions with export functions, and the export compliance team. They also recommend including ITAR training as a requirement in performance plans. Smaller organizations, the guidelines add, may instead give comprehensive ITAR training to everyone.
The reason one course rarely fits a larger contractor is practical. A machinist, a program manager and an IT administrator each meet export control in a different form. The machinist meets it as a visitor at the cell. The program manager meets it as a supplier asking for a drawing package. The IT administrator meets it as an access request from a contractor whose citizenship nobody checked. A single slide deck about the Munitions List prepares none of them for the moment that matters.
Most defense contractors also handle items controlled under the Export Administration Regulations, 15 CFR parts 730 to 774. The EAR has its own deemed export rule in 15 CFR 734.13: a release of technology or source code to a foreign person in the United States is a deemed export to that person’s most recent country of citizenship or permanent residency. Note the difference from the ITAR rule, which reaches every country of citizenship or residency. That is exactly the kind of detail the compliance team needs and the shop floor does not, which is the argument for tiers in one sentence.
What each tier should cover
A working outline, built on DDTC’s four tiers. Your own program manual, registrations and licenses decide the specifics.
- All personnel. What a defense article and technical data are, what a release is (seeing, hearing, receiving), who counts as a foreign person, how controlled material is marked, and who to ask. The test is whether someone stops before forwarding the email, not whether they can recite the definition.
- Senior management. Corporate liability, penalties, voluntary disclosure, what the empowered official needs from them, and why the program has to be resourced. DDTC treats management commitment as its own element; this tier is how it shows.
- Positions with export functions. Role by role: engineers on technical data and defense services, program managers on technical assistance agreements and supplier flow-down, shipping and logistics on licenses and exemptions, IT on access control and cloud storage, HR on hiring and deemed exports, sales and business development on what can be said at a trade show. This tier is where scenarios matter most.
- Export compliance team. Jurisdiction and classification under both the USML and the CCL, licensing, recordkeeping under 22 CFR 122.5 (five years from license expiration, or from the transaction for exemptions), voluntary disclosures and audits.
A sample all-personnel scenario
Here is the kind of item that tests judgment rather than recall. It is an illustration, not a case from any company.
A program office asks you to add a new contract engineer to the shared folder that holds a subsystem’s drawings, marked as ITAR-controlled. The engineer starts Monday and holds a work visa. The folder request came from the program manager. What do you do?
Answer. Hold the access request and ask export compliance before granting it. A work visa holder is not a U.S. person under 22 CFR 120.62, so giving a foreign person access to technical data in the United States is a deemed export. It may need a license. A request from the program manager does not change that; the decision belongs to the people who own the licenses. The point of the item is the pause, not the citation.
Do we need a separate training system for ITAR and export control training?
Usually not, and running one creates its own risk. A separate system means a second set of training records, a second roster to keep in step with HR, and a second place an auditor has to look. ITAR training is training: it needs assignment by role, completion and assessment records kept for the retention period, and versioning so you can show which revision someone saw. Before relying on your LMS, check two things: that it keeps completion and assessment records for at least five years after the related license or transaction, and that each record shows the course version the person completed.
What does need separate handling is the content, not the system. Two things to settle with IT and your empowered official. First, whether the course itself contains technical data. Awareness training should not; it can teach the rules with generic or sanitized examples. Role-specific training for engineers sometimes does, and then the course falls under the same access controls as the data, which may mean restricting enrollment to U.S. persons or hosting it in a controlled environment. Second, where the training platform and any tool used to build the course store and process the files. That is a hosting question, and it is the same one you already answer for engineering systems.
So the practical answer is: keep the LMS you already run, keep awareness content free of technical data, and put the role-specific modules that need it behind the access controls your data already has. Courses built as SCORM or xAPI packages move between systems without re-authoring if that boundary ever changes.
How do AI course builders handle export-controlled or ITAR content?
The same way any other system does: the rules attach to the data, not to the tool. If you put technical data into a course builder, that is a possible release to whoever operates it and whoever can reach it. The encryption carve-out in 22 CFR 120.54 covers sending, taking and storing unclassified technical data that is secured with end-to-end encryption. The text does not mention processing, and processing generally means working on decrypted data, so it is safest to assume the carve-out does not reach it. Confirm that reading with your export counsel. Our accuracy guide covers the questions to ask an AI vendor about where your data is processed.
Two cases are worth separating. Building awareness and most role-specific training does not require technical data at all. The source is your export compliance manual, your procedures, your marking and visitor rules, and the scenarios your compliance team has seen. That material is policy, not technical data, and it is the natural input for a course builder. Building engineer-level training that walks through controlled drawings is the second case, and it needs the same hosting answers as any engineering system.
For either case, ask any vendor four things in writing: where the files are stored and processed, who can access them, whether your data is retained or used to train models, and what changes between their standard and any government or restricted deployment. AmpUp has a SOC 2 Type II report and does not use customer data to train models. For anything involving controlled data, get the answer in writing from that conversation, not from a blog post, ours included.
Where a course builder earns its place is in the tiers. One export compliance manual has to become four sets of training pitched at four audiences, and then a dozen role-specific variants. Built by hand, the all-personnel module gets made and the rest wait. The AmpUp for Aerospace & Defense course builder drafts those courses from your own manual and procedures, with scenarios and assessments for each role, for your compliance lead to review and sign off before anyone trains on it. When the manual changes, the affected sections get another pass rather than a rebuild.
What to check after the annual module
A completion record shows who finished the course. It does not show whether the engineer will pause before attaching a drawing to an email next spring. That is the knowing-doing gap, and export control is where it is most expensive, because the liability sits with the company and the decision sits with one person at one moment.
Scenario practice gives you something more useful to look at. If program managers consistently hesitate on the supplier flow-down scenario, that section of the course needs another pass, or the procedure behind it needs to be clearer. If new hires in one site miss the visitor question, that is where to spend the next briefing. Short scenarios repeated through the year show what is being retained, which is the thing your empowered official actually needs to know. Start with the role that handles the most technical data, build its tier first, and use what it shows to shape the rest.
Frequently asked questions
The ITAR text in 22 CFR parts 120 to 130 does not contain a general rule that every employee must complete ITAR training. What it does is make the company responsible for every export, including a deemed export to a foreign person in the United States, with civil penalties under 22 CFR 127.10 of up to $1,271,078 per AECA section 38 violation, or twice the value of the transaction if greater (the State Department's January 2025 inflation adjustment, published in the Federal Register on January 10, 2025). DDTC's Compliance Program Guidelines list training as one of eight elements of an effective program. In practice, training is expected. This is not legal advice; your export counsel decides what your program needs.
Anyone who can touch, see, send or talk about technical data or defense articles, plus the people who decide who gets access. DDTC's guidelines suggest tiers by function: awareness for all personnel, a tier for senior management, role-specific training for positions with export functions (for example engineering, program management, shipping, contracts, IT, HR, sales), and the deepest tier for the export compliance team. Support staff are included because a deemed export can happen in a hallway conversation or a shared drive permission.
The regulation sets no frequency. Annual refresher training is common practice, with role-specific training at onboarding and whenever a role changes, a new program or license arrives, or the rules change. DDTC's guidelines ask that training be reviewed periodically and updated as needed, which is a reason to tie the course to your compliance manual so a manual revision triggers a training revision.
ITAR (22 CFR 120 to 130, administered by the State Department's DDTC) controls defense articles, defense services and related technical data on the US Munitions List. The EAR (15 CFR 730 to 774, administered by Commerce's BIS) controls dual-use and less sensitive military items on the Commerce Control List. Both treat release of controlled technology to a foreign person in the United States as an export. Most defense contractors handle items under both, so most programs train on both and teach jurisdiction and classification as the first question.
22 CFR 122.5 requires ITAR records to be kept for five years from the expiration of the license or other approval, or from the date of the transaction for exports made under an exemption. Keep training records on the same footing: who was trained, on which version, when, and how they did on the assessment.