(3)

An effective common system of export controls on dual-use items is therefore necessary to ensure that the international commitments and responsibilities of the Member States and of the Union, especially regarding non-proliferation, are complied with.

(3)

An effective common system of export controls on dual-use items is therefore necessary to ensure that the international commitments and responsibilities of the Member States and of the Union, especially regarding non-proliferation and human rights , are complied with.

(5)

Considering the emergence of new categories of dual-use items, and in response to calls from the European Parliament and indications that certain cyber-surveillance technologies exported from the Union have been misused by persons complicit in or responsible for directing or committing serious violations of human rights or international humanitarian law in situations of armed conflict or internal repression , it is appropriate to control the export of those technologies in order to protect public security as well as public morals. These measures should not go beyond what is proportionate. They should, in particular, not prevent the export of information and communication technology used for legitimate purposes, including law enforcement and internet security research. The Commission, in close consultations with the Member States and stakeholders, will develop guidelines to support the practical applications of those controls.

(5)

Certain cyber-surveillance items have emerged as a new category of dual-use items that have been used to directly interfere with human rights, including the right to privacy, the right to data protection, freedom of expression and freedom of assembly and association, by monitoring or exfiltrating data without obtaining a specific , informed and unambiguous authorization of the owner of the data and/or by incapacitating or damaging the targeted system. In response to calls from the European Parliament, and evidence that certain cyber-surveillance items have been misused by persons complicit in or responsible for directing or committing violations of international human rights law or international humanitarian law in countries where such violations have been established , it is appropriate to control the export of those items. Controls should be based on clearly defined criteria. These measures should not go beyond what is necessary and proportionate. They should, in particular, not prevent the export of information and communication technology used for legitimate purposes, including law enforcement and network and internet security research for the purposes of authorised testing or the protection of information security systems . The Commission, in close consultations with the Member States and stakeholders, should make available guidelines to support the practical applications of those controls upon entry into force of this Regulation. Serious violations of human rights refer to situations as described in point 2.6 of Section 2 of Chapter 2 of the User’s Guide to Council Common Position 2008/944/CFSP  (1a) as endorsed by the Foreign Affairs Council on 20 July 2015.

(6)

As a result, it is also appropriate to revise the definition of dual-use items, and to introduce a definition of cyber-surveillance technology . It should also be clarified that assessment criteria for the control of exports of dual-use items include considerations regarding their possible misuse in connection with acts of terrorism or human rights violations .

(6)

As a result, it is also appropriate to introduce a definition of cyber-surveillance items . It should also be clarified that assessment criteria for the control of exports of cyber-surveillance items take into account the direct and indirect impact of these items on human rights, as reflected in the User’s Guide to Council Common Position 2008/944/CFSP. A technical working group should be set up for the development of the assessment criteria, in cooperation with the European External Action Service (EEAS) and the Council Working Party on Human Rights (COHOM). In addition, an independent group of experts should be established within that technical working group. The assessment criteria should be publicly available and easily accessible.

(6a)

With the aim to define cyber-surveillance technology, items to be covered by this Regulation should include the telecommunication interception equipment, intrusion software, monitoring centers, lawful interception systems and data retention systems connected with such interception systems, devices for the de-codification of encryption, the recovery of hard disks, the circumvention of passwords and the analysis of biometric data as well as IP network surveillance systems.

(6b)

With regard to human rights assessment criteria, it is appropriate to refer to the Universal Declaration of Human Rights, the Charter of Fundamental Rights of the European Union, the European Convention for the Protection of Human Rights and Fundamental Freedoms, the United Nations Human Rights Council Resolution on the Right to Privacy of 23 March 2017, the Guiding Principles on Business and Human Rights: Implementing the United Nations ‘Protect, Respect and Remedy’ Framework, the Report of the Special Rapporteur on the Right to Privacy of 24 March 2017, the Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism of 21 February 2017 and the Judgment of the European Court of Human Rights Zakharov v. Russia of 4 December 2015;

(7a)

Regulation (EU) 2016/679 of the European Parliament and of the Council  (1a) (General Data Protection Regulation) obliges data protection controllers and processors to implement technical measures to ensure a level of security appropriate to the risk of processing, including by the encryption of personal data. Since that Regulation stipulates that it applies to the processing of personal data regardless of whether the processing takes place within the Union or not, there is a strong incentive for the Union to remove cryptography items from the control list in order to facilitate the implementation of the General Data Protection Regulation, and increase the competitiveness of European businesses in this context. In addition, the current level of control on encryption runs counter to the fact that encryption is a key means to ensure that citizens, businesses and governments can protect their data against criminals and other malicious actors; to secure access to services that are crucial for the functioning of the Digital Single Market; and to enable secure communications, which are necessary to protect the right to privacy, the right to data protection and the freedom of expression, in particular of human rights defenders.

(9)

The scope of ‘catch-all controls’, that apply to non-listed dual use items in specific circumstances, should be clarified and harmonised , and should address the risk of terrorism and human rights violations . Appropriate exchange of information and consultations on ‘catch all controls’ should ensure the effective and consistent application of controls throughout the Union. Targeted catch-all controls should also apply, under certain conditions, to the export of cyber-surveillance technology.

(9)

The scope of ‘catch-all controls’, that apply to non-listed cyber-surveillance items in specific circumstances, should be clarified and harmonised. Appropriate exchange of information and consultations on ‘catch all controls’ should ensure the effective and consistent application of controls throughout the Union. Exchange of information should include support for the development of a public platform and the gathering of information from the private sector, public institutions and civil society organisations.

(10)

The definition of broker should be revised to avoid the circumvention of controls on the provision of brokering services by persons falling within the jurisdiction of the Union. Controls on the provision of brokering services should be harmonised to ensure their effective and consistent application throughout the Union and should also apply in order to prevent acts of terrorism and human rights violations.

(10)

The definition of broker should be revised to avoid the circumvention of controls on the provision of brokering services by persons falling within the jurisdiction of the Union. Controls on the provision of brokering services should be harmonised to ensure their effective and consistent application throughout the Union and should also apply in order to prevent human rights violations.

(11)

With the entry into force of the Lisbon Treaty, it has been clarified that the supply of technical assistance services involving a cross-border movement falls under Union competence. It is therefore appropriate to clarify the controls applicable to technical assistance services, and to introduce a definition of those services. For reasons of effectiveness and consistency, controls on the supply of technical assistance services should be harmonised and apply also in order to prevent acts of terrorism and human rights violations.

(11)

With the entry into force of the Lisbon Treaty, it has been clarified that the supply of technical assistance services involving a cross-border movement falls under Union competence. It is therefore appropriate to clarify the controls applicable to technical assistance services, and to introduce a definition of those services. For reasons of effectiveness and consistency, controls prior to the supply of technical assistance services should be harmonised and apply also in order to prevent human rights violations.

(12)

Regulation (EC) No 428/2009 provides for a possibility for Member States’ authorities to prohibit on a case-by-case basis the transit of non-Union dual-use items, where they have reasonable grounds for suspecting from intelligence or other sources that the items are or may be intended in their entirety or in part for proliferation of weapons of mass destruction or of their means of delivery. For reasons of effectiveness and consistency, transit controls should be harmonised and apply also in order to prevent acts of terrorism and human rights violations.

(12)

Regulation (EC) No 428/2009 provides for a possibility for Member States’ authorities to prohibit on a case-by-case basis the transit of non-Union dual-use items, where they have reasonable grounds for suspecting from intelligence or other sources that the items are or may be intended in their entirety or in part for proliferation of weapons of mass destruction or of their means of delivery. For reasons of effectiveness and consistency, transit controls should be harmonised and apply also in order to prevent human rights violations.

(13a)

Although the responsibility for deciding on individual, global and national export authorisations lies with the national authorities, an effective EU export control regime implies that economic operators, who intend to export items covered by this Regulation, exercise due diligence as set out, inter alia, in the OECD Guidelines for Multinational Enterprises, the OECD Due Diligence Guidance for Responsible Business Conduct, and the UN Guiding Principles for Business and Human Rights.

(14)

A standard requirement for compliance in the form of ‘internal compliance programmes’ should be introduced in order to contribute to the level-playing field between exporters and to enhance the effective application of controls. For reasons of proportionality, this requirement should apply to specific control modalities in the form of global authorisations and certain general export authorisations.

(14)

A standard requirement , definition and description for compliance in the form of ‘internal compliance programmes ’ as well as a possibility of being certified in order to obtain incentives in the authorisation process from the national competent authorities should be introduced in order to contribute to the level-playing field between exporters and to enhance the effective application of controls. For reasons of proportionality, this requirement should apply to specific control modalities in the form of global authorisations and certain general export authorisations.

(15)

Additional Union general export authorisations should be introduced in order to reduce administrative burden on companies and authorities while ensuring an appropriate level of control of the relevant items to the relevant destinations. A global authorisation for large projects should also be introduced to adapt licensing conditions to the peculiar needs of industry.

(15)

Additional Union general export authorisations should be introduced in order to reduce administrative burden on companies , in particular SMEs, and authorities while ensuring an appropriate level of control of the relevant items to the relevant destinations. A global authorisation for large projects should also be introduced to adapt licensing conditions to the peculiar needs of industry.

(16a)

Considering the rapid advance of technological developments, it is appropriate that the Union introduces controls on certain types of cyber-surveillance technologies on the basis of a unilateral list, in Section B of Annex I. Given the importance of the multilateral export control system, Section B of Annex I should be limited in scope only to cyber-surveillance technologies and not contain any duplications with Section A of Annex I.

(17)

Decisions to update the common list of dual-use items subject to export controls in Section A of Annex I should be in conformity with the obligations and commitments that Member States and the Union have accepted as members of the relevant international non-proliferation regimes and export control arrangements, or by ratification of relevant international treaties. Decisions to update the common list of dual-use items subject to export controls in Section B of Annex I, such as cyber-surveillance technology, should be made in consideration of the risks that the export of such items may pose as regards the commission of serious violations of human rights or international humanitarian law or the essential security interests of the Union and its Member States. Decisions to update the common list of dual-use items subject to export controls in Section B of Annex IV should be made in consideration of the public policy and public security interests of the Member States under Article 36 of the Treaty on the Functioning of the European Union. Decisions to update the common lists of items and destinations set out in Sections A to J of Annex II should be made in consideration of the assessment criteria set out in this Regulation.

(17)

Decisions to update the common list of dual-use items subject to export controls in Section A of Annex I should be in conformity with the obligations and commitments that Member States and the Union have accepted as members of the relevant international non-proliferation regimes and export control arrangements, or by ratification of relevant international treaties. Decisions to update the common list of cyber-surveillance items subject to export controls in Section B of Annex I, should be made in consideration of the risks that the export of such items may pose as regards their use for violations of international human rights law or international humanitarian law in countries where such violations, especially regarding the freedom of expression, the freedom of assembly and the right to privacy, have been established , or the essential security interests of the Union and its Member States. Decisions to update the common list of dual-use items subject to export controls in Section B of Annex IV should be made in consideration of the public policy and public security interests of the Member States under Article 36 of the Treaty on the Functioning of the European Union. Decisions to update the common lists of items and destinations set out in Sections A to J of Annex II should be made in consideration of the assessment criteria set out in this Regulation. Decisions to delete entire subcategories on cryptography and encryption, such as in Category 5 of Section A of Annex I or as in Section I of Annex II should be made in consideration of the Recommendation of 27 March 1997 of the OECD Council concerning Guidelines for Cryptography Policy.

(18)

In order to allow for a swift Union response to changing circumstances as regards the assessment of the sensitivity of exports under Union General Export Authorisations as well as technological and commercial developments, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of amending Section  A of Annex I, Annex II and Section B of Annex IV to this Regulation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States' experts, and their experts systematically should have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(18)

In order to allow for a swift Union response to changing circumstances as regards the assessment of the sensitivity of exports under Union General Export Authorisations as well as technological and commercial developments, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of amending Sections  A  and B of Annex I, Annex II and Section B of Annex IV to this Regulation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States' experts, and their experts systematically should have access to meetings of Commission expert groups dealing with the preparation of delegated

(19a)

The risk of cyber theft and re-exportation to third countries, as referred to in Council Common Position 2008/944/CFSP, calls for the need to strengthen the provisions on dual-use items.

(21)

Pursuant to and within the limits of Article 36 of the Treaty on the Functioning of the European Union and pending a greater degree of harmonisation, Member States retain the right to carry out controls on transfers of certain dual-use items within the Union in order to safeguard public policy or public security. For reasons of proportionality, controls on the transfer of dual-use items within the Union should be revised in order to minimise the burden for companies and authorities. Moreover, the list of items subject to intra-Union transfer controls in Section B of Annex IV should be periodically reviewed in light of technological and commercial developments and as regards the assessment of the sensitivity of transfers.

(21)

Pursuant to and within the limits of Article 36 of the Treaty on the Functioning of the European Union and pending a greater degree of harmonisation, Member States retain the right to carry out controls on transfers of certain dual-use items within the Union in order to safeguard public policy or public security. For reasons of proportionality, controls on the transfer of dual-use items within the Union should be revised in order to minimise the burden for companies , in particular SMEs, and authorities. Moreover, the list of items subject to intra-Union transfer controls in Section B of Annex IV should be periodically reviewed in light of technological and commercial developments and as regards the assessment of the sensitivity of transfers.

(22a)

Given the importance of accountability and public scrutiny of export control activities, Member States should make all relevant licensing data publicly available.

(25)

Outreach to the private sector and transparency are essential elements for an effective export control regime. It is therefore appropriate to provide for the continued development of guidance to support the application of this Regulation and for the publication of an annual report on the implementation of controls, in line with current practice.

(25)

Outreach to the private sector , in particular to SMEs, and transparency are essential elements for an effective export control regime. It is therefore appropriate to provide for the continued development of guidelines to support the application of this Regulation and for the publication of an annual report on the implementation of controls, in line with current practice. Given the importance of guidelines for the interpretation of some elements of this Regulation, those guidelines should be publicly available when this Regulation enters into force.

(25a)

It should be ensured that the definitions set out in this Regulation are in accordance with the definitions in the Union Customs Code.

(27)

Each Member State should determine effective, proportionate and dissuasive penalties applicable in the event of breach of the provisions of this Regulation. It is also appropriate to introduce provisions to tackle specifically instances of illicit trafficking of dual-use items in order to support effective enforcement of controls.

(27)

Each Member State should determine effective, proportionate and dissuasive penalties applicable in the event of breach of the provisions of this Regulation. The creation of a level playing field for Union exporters should be enhanced. Therefore, penalties for infringements of this Regulation should be similar in nature and effect in all Member States. It is also appropriate to introduce provisions to tackle specifically instances of illicit trafficking of dual-use items in order to support effective enforcement of controls.

(29)

Export controls have an impact on international security and trade with third countries and it is therefore appropriate to develop dialogue and cooperation with third countries in order to support a global level-playing field and enhance international security.

(29)

Export controls have an impact on international security and trade with third countries and it is therefore appropriate to develop dialogue and cooperation with third countries in order to support a global level-playing field , promote upward convergence and enhance international security. To promote those goals, the Council, the Commission and Member States should, in close cooperation with the EEAS, pro-actively engage in the relevant international fora, including the Wassenaar Arrangement in order to establish the list of cyber-surveillance items set out in Section B of Annex I as an international standard. In addition, assistance to third countries with regard to the development of a dual-use items export control regime and appropriate administrative capacities should be strengthened and expanded, in particular with regard to customs.

(31)

This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, notably the freedom to conduct business,

(31)

This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union,

(a)

items which can be used for the design, development, production or use of nuclear, chemical and biological weapons and their means of delivery, including all goods which can be used for both non-explosive uses and assisting in any way in the manufacture of nuclear weapons or other nuclear explosive devices;

(a)

traditional dual-use items meaning items , including software and hardware, which can be used for the design, development, production or use of nuclear, chemical and biological weapons and their means of delivery, including all goods which can be used for both non-explosive uses and assisting in any way in the manufacture of nuclear weapons or other nuclear explosive devices;

(b)

cyber-surveillance technology which can be used for the commission of serious violations of human rights or international humanitarian law, or can pose a threat to international security or the essential security interests of the Union and its Member States .

(b)

cyber-surveillance items including hardware, software and technology , which are specially designed to enable the covert intrusion into information and telecommunication systems and/or the monitoring, exfiltrating, collecting and analysing of data and/or incapacitating or damaging the targeted system without the specific, informed and unambiguous authorisation of the owner of the data, and which can be used in connection with the violation of human rights, including the right to privacy, the right to free speech and the freedom of assembly and association, or which can be used for the commission of serious violations of human rights law or international humanitarian law, or can pose a threat to international security or the essential security of the Union and its Members. Network and ICT security research for the purpose of authorised testing or the protection of information security systems shall be excluded .

13.

‘large project authorisation’ shall mean a global export authorisation granted to one specific exporter, in respect of a type or category of dual-use item which may be valid for exports to one or more specified end users in one or more specified third countries for the duration of a specified project the realisation of which exceeds one year ;

13.

‘large project authorisation’ shall mean a global export authorisation granted to one specific exporter, in respect of a type or category of dual-use item which may be valid for exports to one or more specified end users in one or more specified third countries for a specified project . It shall be valid for between one and four years, except in duly justified cases based on the duration of the project, and may be renewed by the competent authority ;

22.

‘internal compliance programme’ shall mean effective, appropriate and proportionate means and procedures, including the development, implementation, and adherence to standardised operational compliance policies, procedures, standards of conduct, and safeguards, developed by exporters to ensure compliance with the provisions and with the terms and conditions of authorisations set out in this Regulation;

22.

‘internal compliance programme’ (ICP) shall mean effective, appropriate and proportionate means and procedures (risk based approach) , including the development, implementation, and adherence to standardised operational compliance policies, procedures, standards of conduct, and safeguards, developed by exporters to ensure compliance with the provisions and with the terms and conditions of authorisations set out in this Regulation; the exporter shall have the possibility, on a voluntary basis, to have its ICP certified free of charge by the competent authorities on the basis of a reference ICP established by the Commission, in order to obtain incentives in the authorisation process from the national competent authorities;

23.

23a.

(d)

for use by persons complicit in or responsible for directing or committing serious violations of human rights or international humanitarian law in situations of armed conflict or internal repression in the country of final destination, as identified by relevant public international institutions, or European or national competent authorities, and where there is evidence of the use of this or similar items for directing or implementing such serious violations by the proposed end-user;

(d)

with regard to cyber-surveillance items, for use by natural or legal persons in connection with violations of international human rights law or international humanitarian law in countries where serious violations of human rights have been identified by the competent bodies of the UN, the Council of Europe, the Union , or national competent authorities, and there is reason to suspect that this or similar items may be used for the purpose of directing or implementing such violations by the proposed end-user;

(e)

for use in connection with acts of terrorism.

(d)

where known, the end-use and end-user of the dual-use items.

(d)

the end-use and end-user of the dual-use items.

(da)

the name and address of the end-user, where known;

(db)

the date on which the export took place.

(a)

Union and Member States’ international obligations and commitments, in particular the obligations and commitments they have each accepted as members of the relevant international non-proliferation regimes and export control arrangements, or by ratification of relevant international treaties and their obligations under sanctions imposed by 2 a decision or a common position adopted by the Council or by a decision of the OSCE or by a binding resolution of the Security Council of the United Nations;

(a)

Union and Member States’ international obligations and commitments, in particular the obligations and commitments they have each accepted as members of the relevant international non-proliferation regimes and export control arrangements, or by ratification of relevant international treaties;

(aa)

their obligations under sanctions imposed by a decision or a common position adopted by the Council or by a decision of the OSCE or by a binding resolution of the Security Council of the United Nations;

(ba)

the occurrence of violations of human rights law, fundamental freedoms and international humanitarian law in the country of final destination as has been established by the competent bodies of the UN, the Council of Europe or the Union;

(c)

the internal situation in the country of final destination — competent authorities will not authorise exports that would provoke or prolong armed conflicts or aggravate existing tensions or conflicts in the country of final destination;

(c)

the internal situation in the country of final destination — competent authorities shall not authorise exports that would provoke or prolong armed conflicts or aggravate existing tensions or conflicts in the country of final destination;

(da)

the behaviour of the country of destination with regard to the international community, as regards in particular its attitude to terrorism, the nature of its alliances and respect for international law;

(db)

compatibility of the exports of the items with regard to the technical and economic capacity of the recipient country;

(f)

considerations about intended end use and the risk of diversion, including existence of a risk that the dual-use items will be diverted or re-exported under undesirable conditions.

(f)

considerations about intended end use and the risk of diversion, including existence of a risk that the dual-use , and in particular, cyber-surveillance items will be diverted or re-exported under undesirable conditions , or be diverted to unintended military end-use or to terrorism .

(b)

The list of dual-use items set out in Section B of Annex I  may be amended if this is necessary due to risks that the export of such items may pose as regards the commission of serious violations of human rights or international humanitarian law or the essential security interests of the Union and its Member States.

(b)

The list of cyber-surveillance items set out in Section B of Annex I  shall be amended if this is necessary due to risks that the export of such items may pose as regards the commission of serious violations of human rights or international humanitarian law or the essential security interests of the Union and its Member States or if controls for a significant amount of unlisted items have been triggered pursuant to point d of the first paragraph of Article 4 of this Regulation. Amendments may also concern decisions to delist products already listed.

(ba)

The Commission may remove items from the list, in particular if, as the result of the fast-changing technological environment, those items have become lower tier or mass market products, which are easily available or technically easily modifiable.

(a)

information regarding the application of controls , including licensing data (number, value and types of licences and related destinations, number of users of general and global authorisations, number of operators with ICPs, processing times, volume and value of trade subject to intra-EU transfers etc), and, where available, data on exports of dual-use items carried out in other Member States ;

(a)

all information regarding the application of controls;

(b)

information regarding the enforcement of controls, including details of exporters deprived of the right to use the national or Union general export authorisations, reports of violations, seizures and the application of other penalties;

(b)

all information regarding the enforcement of controls, including details of exporters deprived of the right to use the national or Union general export authorisations, any reports of violations, seizures and the application of other penalties;

(c)

data on sensitive end users, actors involved in suspicious procurement activities, and , where available, routes taken.

(c)

all data on sensitive end users, actors involved in suspicious procurement activities, and routes taken.

(d)

where known, the end-use and end-user of the dual-use items.

(d)

the end-use and end-user of the dual-use items.

a.

The extraction of data or information, from a computer or network-capable device, or the modification of system or user data; or

a.

The unauthorised extraction of data or information, from a computer or network-capable device, or the modification of system or user data; or

b.

The modification of the standard execution path of a program or process in order to allow the execution of externally provided instructions .

b.

The modification of system or user data to facilitate access to data stored on a computer or network-capable device by parties other than parties authorised by the owner of the computer or network-capable device .

1.

‘Intrusion software’ does not include any of the following:

1.

‘Intrusion software’ does not include any of the following:

2.

Network-capable devices include mobile devices and smart meters.

2.

Network-capable devices include mobile devices and smart meters.

1.

1.

2.

2.

B.

LIST OF OTHER DUAL-USE ITEMS

B.

LIST OF CYBER-SURVEILLANCE ITEMS

(ea)

network and security research for the purposes of authorised testing or the protection of information security systems.

3.

Any exporter intending to use this authorisation shall register prior to the first use of this authorisation with the competent authority of the Member State where he is resident or established . Registration shall be automatic and acknowledged by the competent authority to the exporter within ten working days of receipt.

3.

A Member State may require exporters established in that Member State to register prior to the first use of this authorisation. Registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt.

4.

The registered exporter shall notify the first use of this authorisation to the competent authority of the Member State where he is resident or established, no later than 10 days before the date of the first export.

4.

The registered exporter shall notify the first use of this authorisation to the competent authority of the Member State where he or she is resident or established no later than 30 days after the date when the first export took place .

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.

3.

Any exporter intending to use this authorisation shall register prior to the first use of this authorisation with the competent authority of the Member State where he is resident or established . Registration shall be automatic and acknowledged by the competent authority to the exporter within 10 working days of receipt.

3.

A Member State may require exporters established in that Member State to register prior to the first use of this authorisation. Registration shall be automatic and acknowledged by the competent authorities to the exporter without delay and in any case within 10 working days of receipt.

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.

5.

The registered exporter shall notify the first use of this authorisation to the competent authority of the Member State where he is resident or established, no later than 10 days before the date of the first export.

5.

The registered exporter shall notify the first use of this authorisation to the competent authority of the Member State where he or she is resident or established, no later than 30 days after the date when the first export took place or, alternatively, and in accordance with a requirement by the competent authority of the Member State where the exporter is established, prior to the first use of that authorisation. Member States shall notify the Commission of the notification mechanism chosen for that authorisation. The Commission shall publish the information notified to it in the C series of the Official Journal of the European Union .

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.

6.

The registered exporter shall notify the first use of this authorisation to the competent authority of the Member State where he is resident or established, no later than 10 days before the date of the first export.

6.

The registered exporter shall notify the first use of this authorisation to the competent authority of the Member State where he or she is resident or established no later than 30 days after the date when the first export took place or, alternatively, and in accordance with a requirement by the competent authority of the Member State where the exporter is established, prior to the first use of this authorisation. Member States shall notify the Commission of the notification mechanism chosen for this authorisation. The Commission shall publish the information notified to it in the C series of the Official Journal of the European Union .

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.

1.

This authorisation authorises the transmission of the software and technology listed in Part 1 by any exporter resident or established in a Member State of the Union provided the item is only for use:

1.

That authorisation authorises the transmission of the software and technology listed in Part 1 by any company that is an exporter resident or established in a Member State to any sister company, subsidiary or parent company provided those entities are owned or controlled by the same parent company or are established in a Member State, provided the item in question is for use for company cooperation projects including commercial product development, research, servicing, production and usage and, in the case of employees and order processors, pursuant to the agreement establishing the employment relationship.

(2)

(4)

where known, the end-use and end-user of the dual-use items.

(4)

the end-use and end-user of the dual-use items.