Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 27 OCTOBER 2026

BIS Enforcement Action Highlights Export Control Risks For Software Updates And Entity List Transactions

Bass, Berry & Sims PLC
Explore more from Bass, Berry & Sims PLC

A U.S. software company's $2 million settlement with BIS reveals critical compliance gaps in export controls for software transactions. The case demonstrates how automatic software updates, maintenance services, and sales through distributors can create ongoing export violations when customers are added to restricted-party lists, even for commercially available EAR99 software.

GlobalInternational Law
Faith Dibble
Faith Dibble
Thaddeus R. McBride
Thaddeus R. McBride

Key Takeaways

  • EAR99 does not mean uncontrolled. Companies cannot assume that commercially available or EAR99 software can be provided to any customer without a license.
  • Restricted-party screening should continue throughout the customer relationship. Violations arose when software updates continued to be made available to an existing customer after the customer was added to the Entity List.
  • Sales through a distributor do not protect against violations. Violations involved transactions conducted through distributors in Japan and China where transaction documents identified the ultimate customer.
  • Informal attempts to understand export restrictions are not a substitute for an export compliance program. Penalties were aggravated based on the company’s lack of written export compliance procedures, trained personnel, designated compliance responsibility, and timely legal guidance.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

See more popular content from

Article

The Lindsey Graham Sanctions Act: What Businesses Need To Know About The New Tariffs

President Trump signed the Lindsey O. Graham Sanctioning Russia and Iran Act into law on September 18, 2026, establishing mandatory tariffs of up to 500% on Russian goods and up to 100% on goods from countries that continue to buy Russian energy. The Act targets major importers like China, India, and Turkey, with limited relief mechanisms including natural gas exceptions, presidential waivers, and a 270-day winddown period for entities divesting from Russian operations.
GlobalInternational Law
Crowell & Moring LLP
Crowell & Moring LLP
Article

Updates On Export Controls Impacting AI & Advanced Computing

The U.S. Department of Commerce's Bureau of Industry and Security issued guidance on May 31, 2026, clarifying licensing requirements for advanced computing items and AI technologies. The guidance maintains export restrictions for entities in certain countries while providing limited relief for data center operators, though questions remain about future regulatory direction. Companies must now strengthen their compliance programs and supply-chain due diligence as BIS continues to prioritize national security
GlobalInternational Law
Finnegan, Henderson, Farabow, Garrett & Dunner LLP
Finnegan, Henderson, Farabow, Garrett & Dunner LLP
Article

New Tariffs And Import Bans: An Update On The U.S.-Canada “Trade War”

The U.S.-Canada trading relationship has reached a critical juncture as both nations implement escalating trade measures, with Canada's counter-tariffs taking effect and the United States responding with unprecedented import bans on Canadian alcoholic beverages, dairy products, and motorcycles. These actions mark a significant expansion of the Trump Administration's use of Section 338 of the Tariff Act of 1930, moving beyond additional tariffs to outright import restrictions. What does this escalation mean
GlobalInternational Law
Cassidy Levy Kent LLP
Cassidy Levy Kent LLP
Article

Update On CAPE Phase 3 Duty Refunds From U.S. Customs And Border Protection

U.S. Customs and Border Protection has announced that importers with court orders for IEEPA duty refunds on finally liquidated entries can begin filing for those refunds starting October 6, 2026, through the CAPE Phase 3 system. This development follows the Supreme Court's February 2026 decision striking down IEEPA tariffs and represents a critical step for importers seeking refunds on entries liquidated for more than 80 days.
United StatesInternational Law
Buchanan Ingersoll & Rooney
Buchanan Ingersoll & Rooney
Article

Congress Passes New Russian Sanctions Bill Providing Additional Tariff Authority To Address Countries That Purchase Russian Energy, Facilitate Evasion Of Russian Sanctions

The U.S. House of Representatives has passed H.R. 5334, the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, which directs the President to impose tariffs of up to 500 percent on Russian imports and up to 100 percent on imports from countries that are significant purchasers of Russian energy. The bill includes provisions for Presidential waiver authority and a five-year sunset clause...
GlobalInternational Law
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

Newly Enacted Law Targeting Russia Creates Novel Tariff Authority Over Third-Country Imports, While Reinforcing Existing U.S. Sanctions Framework

President Trump signed the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, introducing unprecedented tariff authority that could impose duties up to 100% on goods from countries purchasing Russian energy or facilitating sanctions evasion. The legislation creates a novel framework where tariffs stack on top of existing duties while codifying Russia sanctions into statute...
GlobalInternational Law
Akin
Akin
Article

FCC Replaces TCPA “Revoke All” Rule: New Category-Specific Opt-Out Rules For Robocalls And Robotexts

The Federal Communications Commission has fundamentally altered how businesses must handle consumer opt-out requests under the Telephone Consumer Protection Act, replacing the broad "revoke all" mandate with a more nuanced, category-specific approach for informational messages. This regulatory shift allows companies to maintain separate consent tracks for different types of non-marketing communications while preserving stricter opt-out requirements for telemarketing messages. The Updated Order introduces ne
United StatesConsumer Protection
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Healthcare Trends & Transactions Q2 2026

Healthcare M&A activity maintained steady momentum through Q2 2026, driven by physician practice consolidation, AI-enabled technology acquisitions, and strategic outpatient expansion. Private equity investment persisted despite intensifying regulatory scrutiny of MSO arrangements, while digital health buyers paid significant premiums for platforms demonstrating production-grade AI capabilities and proprietary data assets.
United StatesCorporate/Commercial Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

DOJ Continues DEI False Claims Act Enforcement With $25 Million Accenture Settlement

The Department of Justice announced a $25 million settlement with Accenture Federal Services over allegations that the company violated the False Claims Act by falsely certifying compliance with anti-discrimination requirements while allegedly using race or sex in hiring, promotion, and access to professional development programs. This marks the third major DEI-related FCA enforcement action in 2026, following similar settlements with IBM and Deloitte.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

DOJ's $2 Million Honeywell Settlement Under The Civil Cyber-Fraud Initiative: What Compliance Failures Mean For Defense Contractors

The Department of Justice secured a $2 million settlement with Honeywell Aerospace for allegedly failing to comply with NIST SP 800-171 cybersecurity requirements under a Department of War contract. This case demonstrates how cybersecurity compliance failures can trigger False Claims Act liability even without an actual data breach or cyberattack, and highlights the growing role of whistleblowers in exposing contractors' gaps between contractual obligations and actual security practices.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

No More SEC Responses To Rule 14a-8 No-Action Requests: What Public Companies Should Know For The Upcoming Proxy Season

The SEC's Division of Corporation Finance has announced it will no longer respond to Rule 14a-8 no-action requests, marking a significant shift in the shareholder proposal process. Companies must still comply with notification requirements under Rule 14a-8(j), but without staff guidance on exclusion decisions, they will need to rely on existing SEC guidance, precedent, and judicial decisions.
United StatesCorporate/Commercial Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

CAS Board Raises Contract Thresholds To $35 Million And Eliminates CAS 407: What Federal Contractors Need To Know As DoW Demands Cost And Pricing Transparency

The CAS Board has raised contract thresholds to $35 million and eliminated CAS 407, fundamentally changing cost accounting requirements for federal contractors. At the same time, the Department of War is demanding unprecedented cost and pricing transparency through new memoranda requiring actual cost information for negotiations valued at $10 million or more, creating a complex landscape where contractors face fewer formal CAS requirements but heightened scrutiny of their pricing data.
United StatesAccounting and Audit
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Still Tracking, Still Suing: Website Privacy Litigation After SB 690

California's SB 690 eliminates private lawsuits under CIPA for pen register and trap-and-trace device theories, but website tracking litigation continues under federal wiretapping statutes, ECPA's crime-tort exception, and sector-specific claims. Businesses face ongoing risk from cookies, pixels, and tracking technologies that may unlawfully intercept visitor communications or collect routing data without proper consent.
United StatesPrivacy
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

BIS Settlement Highlights Export Control Risks For Medical And Research Technology

The U.S. Department of Commerce's Bureau of Industry and Security reached a $1.7 million settlement with Plexon, Inc. over unlicensed exports of neural recording systems to a Chinese research institution on the Entity List. This enforcement action demonstrates that medical and research products are subject to U.S. export controls, and even EAR99 items may require licenses based on destination, end user, or end use.
United StatesInternational Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC