EUROPEAN COMMISSION Brussels, 28.9.2016 SWD(2016) 315 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT

Report on the EU Export Control Policy Review Accompanying the document Proposal for a Regulation of the European Parliament and of the Council setting up a Union regime for the control of exports, transfer, brokering, technical assistance and transit of dual-use items



(Recast) {COM(2016) 616 final}

{SWD(2016) 314 final}



IMPACT ASSESSMENT REPORT INTRODUCTION CHAPTER 1 - PROBLEM DEFINITION: WHAT IS THE PROBLEM AND WHY IS IT A PROBLEM? 1.1 The problem: ensuring security and competitiveness in a changing world. 1.1.1 Risk that controls may not adjust to evolving security threats. 1.1.2 Risk that controls may not keep pace with rapid technological and scientific developments. 1.1.3 Lack of control on cyber-surveillance technologies. 1.1.4 Vulnerability of global supply chains and lack of level playing field. 1.1.5 Excessive administrative burden. 1.1.6 Uneven implementation and enforcement within the EU. 1.2 Identification of the problem drivers: What are the main drivers? 1.2.1 Evolving and new security threats. 1.2.2 Rapid technological and scientific development. 1.2.3 Transformations in global economic activity. 1.2.4 Asymmetric implementation of controls within the EU. 1.4 Identification of the stakeholders: Who is affected by the problem? 1.4.1 Industry stakeholders. 1.4.2 SMEs. 1.4.3 Service providers and researchers.

1.4.4 Government stakeholders. 1.4.5 Civil society stakeholders. 1.5 Dimension of the problem. 1.5.1 The economic dimension: the EU dual-use industry. 1.5.2 The trade dimension: dual-use exports. 1.5.3 The social dimension. 1.5.4. The regulatory dimension. 1.6 Analysis of the export control system: the case for a review of export control policy. CHAPTER 2 - THE NEED FOR EU POLICY INTERVENTION: SUBSIDIARITY AND PROPORTIONALITY CHAPTER 3 – OBJECTIVES: WHAT SHOULD BE ACHIEVED? 3.1 General Objectives 3.2 Specific Objectives 3.3 Consistency with other EU Policies CHAPTER 4 – POLICY OPTIONS: WHAT ARE THE VARIOUS OPTIONS TO ACHIEVE THE OBJECTIVES? 4.1 Identification and description of the policy options 4.1.1. Policy Option no. 1 – "Baseline". 4.1.2. Policy Option no. 2 – "Implementation and Enforcement Support". 4.1.3. Description of Policy Option no. 3 – "EU System Upgrade". 4.1.4. Policy Option no. 4 - "EU system modernisation". 4.1.5. Policy Option no. 5 - "EU system Overhaul".

CHAPTER 5 – ASSESSMENT OF THE IMPACT OF POLICY OPTIONS. 5.1 Impacts of Policy Option 1 – "Baseline". 5.2 Impacts of Policy Option 2 – "Implementation and Enforcement Support". 5.2.1 The Development of an EU export control network. 5.2.2. The development of a partnership with the private sector. 5.2.3 Export Control dialogue with key partners 5.3. Impacts of Policy Option 3 – "EU System Upgrade". 5.4. Impacts of Policy Option 4 – "EU system modernisation". CHAPTER 6 – COMPARISON OF POLICY OPTIONS: HOW DO POLICY OPTIONS COMPARE? 6.1 Comparison of policy options. 6.2 Preferred option. CHAPTER 7 - MONITORING AND EVALUATION: HOW WOULD ACTUAL IMPACTS BE MONITORED AND EVALUATED? 7.1 Monitoring 7.2 Evaluation List of acronyms ANNEX 1: PROCEDURAL INFORMATION ANNEX 2: STAKEHOLDER CONSULTATION Introduction 1. The preliminary phase: the Green Paper consultation (2011-2013) 2. Export control conferences and seminars – regular dialogue with stakeholders.

3. Targeted outreach to key stakeholders 4. Data collection and analysis project 5. Online open public consultation on the EU Export Control Policy Review ANNEX 3. WHO IS AFFECTED BY THE INITIATIVE AND HOW ANNEX 4. QUANTITATIVE DATA ON EXPORT CONTROLS. ANNEX 5 – SIPRI/ECORYS DATA COLLECTION REPORT. ANNEX 6 – INTERVENTION LOGIC: LINK BETWEEN PROBLEMS, OBJECTIVES AND OPTIONS. ANNEX 7 – DETAILED PRESENTATION OF THE ASSESSMENT OF IMPACTS OF REVIEW OPTIONS AND ACTIONS



INTRODUCTION The trade in dual-use items - goods, software and technology that can be used for both civilian and military applications and/or can contribute to the proliferation of Weapons of Mass Destruction (WMD) – is subject to controls to prevent the risks that these items may pose for international security. United Nations Security Council Resolution 1540, adopted on 28 April 2004, decides that all States shall enforce effective controls to prevent the proliferation of nuclear, chemical or biological weapons and their means of delivery. Efforts to prevent proliferation through international trade are also required under relevant international agreements, such as the nuclear Non Proliferation Treaty, the Chemical Weapons Convention and the Biological and Toxin Weapons Convention, and in line with commitments agreed upon in multilateral export control regimes. I An effective common system of export controls on dual-use items is therefore necessary to ensure that the international commitments and responsibilities of the Member States and of the European Union (EU), especially regarding non-proliferation, are complied with. Moreover, the EU Strategy against proliferation of Weapons of Mass Destruction of 12 December 2003 (EU WMD Strategy), as updated by the Council Conclusions of 21 October 2013 on ensuring the continued pursuit of an effective EU policy on the new challenges presented by the proliferation of weapons of mass destruction, calls for the strengthening of EU export control policies and practices. The EU export control system is governed by Regulation (EC) No 428/2009 setting up a Community regime for the control or exports, transfer, brokering and transit of dual-use items ("the Regulation"). The Regulation provides for common control rules, a common EU control list and coordination of implementation. Controls apply to export – including electronic transmission - brokering and transit as well as, for some most sensitive items, internal transfer within the EU. The Regulation essentially transposes the commitments agreed upon in the multilateral export control regimes into EU law – e.g. the main control parameters and the EU list of dual-use items closely reflect decisions agreed upon in the regimes II . It is directly applicable throughout the EU and forms part of the common commercial policy under Article 207 Treaty on the Functioning of the European Union (TFEU). EU Member States nevertheless need to take certain complementary measures for implementing some of its provisions, e.g. in relation to licensing and enforcement, and may adopt, in some cases, specific national control measures III . As required by the Regulation, the Commission launched in 2011 a broad public debate IV on the functioning of the EU export control regime and its future strategic options. The European Parliament and the Council, for their part, also called for a review and strengthening of export controls V . In a 2013 report to the European Parliament and Council VI the Commission concluded that although the system provides solid legal and institutional foundations, it cannot remain static and must be upgraded in order to face new challenges and generate the modern control capabilities the EU needs for the coming decade and beyond. The report opened the way to a 2014 Commission Communication VII outlining a long-term vision for EU export controls and announcing policy initiatives for their modernisation and adaptation to rapidly changing technological, economic and political circumstances. The Commission subsequently conducted an impact assessment of the review options outlined in this Communication to identify the most suitable regulatory and non-regulatory actions to bring them into effect. The export control policy review has also been identified as an intiative under the Regulatory Fitness and Performance Programme (REFIT) and the Commission has in particular assessed the costs and benefits associated with the various options, notably as regards potential regulatory simplification and burden reduction. CHAPTER 1 - PROBLEM DEFINITION: WHAT IS THE PROBLEM AND WHY IS IT A PROBLEM? 1.1 The problem: ensuring security and competitiveness in a changing world. The EU export control system applies high standards of controls and serves as a benchmark for many countries around the world. The system is generally considered robust and provides solid legal and institutional foundations for the EU to fulfil its international obligations, and public consultations have demonstrated that stakeholders mostly agree that it reduces significantly the ability of states to proliferate by procuring sensitive items from European suppliers. In spite of this, denials issued by competent authorities and enforcement and violations of controls emphasise that risks remain acute. In this context, the primary challenge for the EU export control system is to continuously strike the right balance between the EU's overarching foreign and security policy objectives and its economic and commercial interests in a changing security, economic and technological environment. This is, in essence, why the export control system cannot remain static: its parameters need to be continuously adjusted to respond to evolving security risks, rapid technological developments and transformations of economic activity and it must be upgraded in order to face new challenges and generate the modern control capabilities the EU needs for the coming decade and beyond. 1.1.1 Risk that controls may not adjust to evolving security threats. The last decade has witnessed dramatic shifts in the global security environment., and a first problem relates to the need for EU export controls to keep pace with evolving security threats and proliferation patterns at a time when the threat environment is dynamic and complex..Lessons learnt and stakeholder consultations show that the Regulation is not fully adapted to today's evolving security threats. Outdated or insufficient control provisions generate potential loopholes. For example, the application of the definition of exporter to natural persons is unclear in some situations. The determination of the competent authority is also unclear in certain specific situations and there are cases where the Regulation does not enable to clearly identify a single competent authority. Furthermore, controls on brokering and transit do not provide a clear basis for controlling items that maybe misused for terrorism or human right violations Another aspect of the problem is that the Regulation essentially establishes a system for the control of legal exports, but lacks dedicated provisions to tackle illicit trafficking of dual-use items, which appears as an increasing threat. The Regulation also does not clearly address the risk of terrorism and misuse of dual-use items by non-state actors.

The problem is multifaceted and dual-use export controls are not the only security trade instrument in the EU's toolbox. Dual-use controls directly complement controls on arms exports and pursue largely similar objectives. Restrictive measures (sanctions) play an important role in combating WMD proliferation and terrorism, and also promote regional security and human rights. Regulation (EC) 1236/2005 (the "Anti-torture" Regulation) specifically addresses trade that could be misused for torture and capital punishment. Other regulations or directives e.g. on firearms, drug precursors or intra-EU transfer of defence material also play an important role in regulating the trade of sensitive items. However, each of those instruments deals either with a specific and different category of items and/or end-uses, or addresses different types of situations. Therefore, in spite of their importance as part of the overall EU response to evolving security threats, those instruments cannot address the 'dual dimension' of security. 1.1.2 Risk that controls may not keep pace with rapid technological and scientific developments. Dual-use items are typically high-technology advanced items and the EU export control system therefore needs to integrate the security implications of an ever growing number of emerging technologies – e.g. cloud computing, Unmanned Aerial Vehicles (UAV), additive manufacturing, life sciences, nanotechnologies… - in order to ensure their peaceful use. The problems is that the EU system lacks the flexibility and adaptability to keep pace with technology and ensure timely adjustments of controls. Thus, the list of items benefiting from EU General Export Authorisations can only be modified through a legislative procedure, thus making it difficult to adjust it to rapid changes in technology. The EU system is also constrained by limited technical capacity – expertise and resources - to assess the security threats associated with new technologies of concern and adapt accordingly. Thus, the EU has so far not issued any guidance on the control of emerging technologies, while for ex., some competitors like the US and Japan have clarified their approach, for the benefit of their operators, to the control of technology transfers through the cloud. 1.1.3 Lack of control on cyber-surveillance technologies. Over the last years, the emergence and controversial export of new types of cyber-tools (e.g. spyware or malware and telecommunication and internet surveillance technologies - hereunder "cyber-surveillance technologies") have evidenced new threats for security and human rights and have fuelled a debate about the need for the EU to control the trade in cyber-surveillance technologies and its effects on human rights and security. The problem is that, although some initial steps have been taken to subject some cyber-surveillance technology to control, the Regulation does not fully address the risks associated with the burgeoning trade in cyber-surveillance technologies and does not clearly identify cyber-surveillance technologies as a new category of dual-use items. A particular aspect of this problem relates to the fact that "cyber-proliferation" is not as such covered by existing international arrangements, so that the EU needs to charts its own course in this area. The lack of a robust legal basis for controlling exports of cyber-surveillance technologies hampers the EU's ability to prevent exports that may be misused for human rights violations or against the EU's critical infrastructure. The insufficient legal framework can also have dramatic consequences for EU companies: thus, one company is subject to a criminal court case in France and accused of complicity with human rights abuses in Libya VIII . 1.1.4 Vulnerability of global supply chains and lack of level playing field. Proliferation strategies evolve to exploit the vulnerability of the interconnected global trading and information systems. As a result, current EU controls, essentially based on physical geography (i.e. export from the EU customs territory) and focused on tangible goods, appear increasingly at odds with global supply chains and global data networks. The Regulation insufficiently address the specificity of intangible technology transfer - transmission of software and technology (e.g. technical data) by electronic media - which cannot be controlled by customs at the border, and for which individual licences appear ill-suited. The Regulation also insufficiently covers services such as technical assistance, which are increasingly integrated with trade in goods. For example, IT services, including maintenance and upgrades, are essential to the functioning of many cyber-surveillance technologies and as sensitive as the goods exported in the first place. Moreover, the increasing foreign availability of dual-use items has become an important competitive factor in the absence of global control standard, as distortions of competition due to higher compliance costs and delivery delays sometimes put EU operators at a disadvantage vis-à-vis foreign competitors. 76% of surveyed industry associations affirm that current controls give rise to significant distortions of competition IX . This may result from some key trade partners having more streamlined export control systems. For example, 2.4% of EU exports require a license X under the Regulation, as compared to approximately 1.0% under US regulations XI , which places a comparatively heavier burden on EU exporters. Distortions of competition may also appear as some competitors from countries that are not members of multilateral export control regimes produce and export dual-use items. For example, China, the EU's second biggest trade partner and a major producer of dual-use items, does not participate in all export control regimes and is therefore not bound by all their decisions. As a result, EU exporters are subject to comparatively higher requirements than their competitors. Against this background, the emerging bilateral dialogue with third countries does not, at this stage, sufficiently support regulatory convergence. 1.1.5 Excessive administrative burden. Security has a cost, and export controls inherently have a cost. The problem arises when controls generate excessive administrative burden. Thus 81% of surveyed companies XII complain that the administrative burden related to compliance with export controls is "heavy and time-consuming" especially due to complex procedures, licensing delays and lack of clarity of export denial XIII . For their part, surveyed licensing authorities identify challenges primarily in terms of insufficient staff resources and lack of specialised technical expertise XIV . In this sense, the licensing architecture in the EU appears sub-optimal, as 76% of EU authorisations take the form of individual licences (Figure 1) XV , with an inherent risk of delay and cost for exporters. Indeed, out of the four types of authorisations (individual, global and EU or national general authorisations), only individual licences require prior assessment of each single export , which can be time-consuming and can be problematic when just-in-time delivery of product to foreign customers or the real-time sharing of data and technology in research and development is required The divergent application of controls by competent authorities also generates costs within the Single Market, as operators are sometimes faced with accumulated delays and legal uncertainty. Also, certain specific controls under the Regulation result in exceptional costs.Thus, controls on intra-EU transfers of certain sensitive items (so-called 'Annex IV items' XVI ) constitute a significant exception to the Single Market and an obstacle to the free-movement of goods. Therefore, at a time when key partners XVII are reforming their systems with a view to reducing regulatory burden on companies, it is important for the EU to ensure that control processes under the Regulation do not unduly disrupt trade due to excessive administrative burden or legal uncertainty. The export control policy review is thus expected to contribute to a simplification of certain control procedures and a more clear and consistent application of controls throughout the EU, and has therefore been identified as a REFIT initiative. `Figure 1: Comparative number of licences and authorisations per category (2013 data) Furthermore, certain provisions of the Regulation give rise to legal uncertainty, which in turn adds to the cost of compliance since companies spend time and money finding out if and how they are affected. This is illustrated by complaints by exporters regarding the lack of clarity of "catch-all controls", which are applied by competent authorities on non-listed dual-use items, and for which little information is made available to exporters, 1.1.6 Uneven implementation and enforcement within the EU. Important steps have been taken, under the Regulation, to support consistent implementation e.g. with the introduction since 2012 of a common IT infrastructure – the 'Dual-Use Electronic System' (DUeS XVIII ) – providing for some exchange of information between Member States and the Commission. However, divergences in the interpretation and application of controls continue to result in different export conditions, as well as a lack of legal transparency and predictability for companies and ultimately affect the effectiveness of controls and the level-playing field within the Single Market.

Exchange of information with Member States and dialogue with industry reveals problems associated with such divergences in the interpretation and application of controls in the EU. Thus, 60% of the industry associations declare that current export controls give rise to significant distortions between companies located in different Member States, and about 14 % of the companies declare that they have received a denial for a licence application when another exporter fulfilled the deal through an identical export from another Member State XIX . Catch-all controls offer, here again, a good illustration as the Regulation does not provide for a sufficient exchange of information regarding authorisation requirements, so that catch-all controls may be imposed by one Member States on the exporters established on its territory, while other EU exporters are not subject to the same requirement. There are also reports that export authorizations issued by the competent authority of a Member State (where the exporter is established) have been rejected by other national authorities (typically when production is outsourced or sub-contracted in another Member State) thus obliging the exporter to apply for another authorization and causing additional delays and a risk that the exporter be confronted with contradicting decisions. 1.1.7 – Design and implementation dimensions of the problem. An important point to note is that the problems are linked both to the design of the regulation and its implementation. The design of the Regulation is associated with a series of problems, as some of its provisions are not entirely "fit for purpose" any longer. This applies e.g.to controls and provisions mentioned in Section 1.1.1, but also to the requirement for individual licences for intra-EU transfers within the Single Market, which stems directly from the Regulation and offers a good example of an outdated legal provision creating excessive administrative burden. In some cases, the design of the Regulation entirely fails to address an issue, as illustrated by the lack of clear legal provisions for controlling cyber-surveillance technology or for denying an export based on human rights considerations. Problems also relate to the – uneven - implementation of the Regulation. For example, the Regulation's licensing architecture provides a good basis for controls, with four different types of licenses. However, it also leaves open the possibility for MS to introduce more flexible control modalities (such as National General Export Authorisations), thereby resulting in more favourable export conditions for some operators and a distortion of competition. The implementation of catch-all controls provides another example, since Member States who decide to control non-listed items do not need to inform other Member States or exporters, which inevitably results in "uneven implementation within the EU". 1.2 Identification of the problem drivers: What are the main drivers? The following changes and trends have been identified as the main drivers resulting in the above mentioned problems: 1.2.1 Evolving and new security threats. 1.2.1.1 Changing proliferation patterns. Export controls are a key instrument to counter WMD proliferation which is "one of the greatest security risks for the EU" XX and has been in constant evolution over the last years: In recent years, the risk of nuclear proliferation has become multifaceted. A growing number of states are developing capabilities of proliferation concern. North Korea and Iran's nuclear and missile programmes have been a major international concern, while at the same time, global nuclear risks have increased with the emergence of additional nuclear threshold states, building a latent capacity for the leveraging of civilian nuclear power for potential nuclear weapons breakout capability. Additionally regional conflicts create chaotic situations that weaken states’ ability to protect nuclear and radiological materials from theft or diversion XXI , increasing the risk that they could be misused to build a “dirty bomb”. With respect to chemical non-proliferation, the Syrian conflict revealed the first use of chemical agents since the 1980-1988 Iran-Iraq war. Moreover, there are concerns regarding possible covert chemical weapons programmes XXII , potentially exploring new categories of dual-use chemicals with broad industrial and commercial applications. Evolving risks associated with trade in dual-use chemicals have become acute, as illustrated by the extradition in 2015 of an EU citizen to the U.S. to face charges of illegally exporting laboratory equipment, including items used to detect chemical warfare agents, to Syria XXIII . Biological weapons are complex and difficult to produce, but with the increasing mobility and accessibility of knowledge, the risk of developing new strains of dangerous viruses is of increasing concern. This was recently illustrated by the decision of the Dutch licensing authority, in June 2012, to subject to an export licence the publication of biological research on the transmissibility of H5N1 virus as part of an effort to discover a vaccine against the virus; the decision was recently confirmed by an appeal court in June 2015 XXIV . Risks also result from advances in missile technology, including hypersonic missiles and the proliferation of missile guidance components. Experts report that 75 countries currently possess cruise missiles and 19 countries manufacture them XXV . The space security landscape also changes rapidly, with more countries and private entities joining the launch business. Importantly, WMD proliferation risks are not limited to states any longer, as non-state actors are increasingly involved in trafficking through clandestine procurement programmes, using sophisticated techniques to evade controls (such as complex procurement networks including series of front companies and deception techniques to hide the end-use, moving sensitive items through areas with weak domestic institutions and trans-shipment hubs etc). Experts highlight a confluence of transnational security threats involving drug organizations and crime groups in relation to nuclear smuggling and terrorism XXVI . In 2015, the Associated Press reports at least four attempts in which criminal networks sought to sell radioactive material to extremists in 2015 XXVII . Also in 2015, the potential for terrorist use of chemical agents was illustrated by reports that the Islamic State (ISIS) used chemicals in military operations XXVIII . These are not isolated cases: a recent report found nearly 300 cases of export control violations by non-state actors supplying nuclear-related goods to Iran XXIX . The December 2015 Plenary meeting of the Wassenaar arrangement "underlined the importance of further strengthening export controls … to prevent the acquisition of … dual-use goods and technologies by terrorists XXX ". 1.2.1.2 Emergence of new risks of cyber-surveillance trade. New risks are emerging and appear increasingly relevant to export controls. Since the Arab Spring in 2011, there have been numerous reports of cyber-surveillance technologies being exported to repressive regimes and/or in conflict areas, in some cases by companies based in the EU, and misused in violation of human rights. Moreover, over the last years, cybersecurity - sometimes described as the '4th dimension' of war - has emerged as a key security consideration and the threats that cyber-technologies pose to international security are an increasing concern. In particular, there is a risk that items with inherent dual-use capabilities may be misused against countries' critical infrastructures, or even to steal intellectual property from companies including trade secrets and confidential business information. A resolution of the European Parliament of 17 December 2015 thus emphasises that "the proliferation of certain surveillance and intrusion technologies around the world cannot only be detrimental to human rights but might also pose a significant threat to European strategic interests and our digital infrastructure" XXXI . Cyber-surveillance technologies have legitimate and regulated law enforcement applications, but have also been used for internal repression by authoritarian or repressive governments to infiltrate computer systems of dissidents and human rights activists, at times resulting in their imprisonment or even death. As evidenced by numerous reports XXXII , the export of cyber-surveillance technology under such conditions poses a risk for the security of those persons and to the following fundamental human rights:

Right to privacy Freedom of expression Freedom of association Freedom from arbitrary arrest and detention Right to life Freedom from torture, inhuman treatment and degrading treatment. In certain instances, the Regulation may also affect certain other fundamental rights: in particular, controls of dual-use research need to respect academic freedom and the right to health. The European Parliament has called repeatedly for the EU to ensure transparency and accountability of the trade in surveillance technology XXXIII . Most recently, the Parliament urged for action following the hacking of "Hacking Team", an Italian company that sells spyware all over the world, as revelations from leaked internal documents demonstrated that these tools were sold to the governments of countries whose human rights records the EU has criticised, in the absence of applicable legislation XXXIV . From a legal perspective, the EU has recognised the threat of illegal interception of electronic data transmission: Directive 2013/40 on attacks against information systems XXXV provides that "intercepting, by technical means, non-public transmissions of computer data … intentionally and without right, is punishable as a criminal offence…". In December 2015, the European Data Protection Supervisor (EDPS) published an Opinion on Intrusive surveillance technology, and warned that “as the unregulated market for the trading and use of covert monitoring technology continues to grow, the EU must not underestimate the appetite for such technology. By addressing weaknesses in existing legislation and policies as well as developing new legislation, the EU legislator can help protect against the very real threat posed to our privacy and data protection rights." 1.2.2 Rapid technological and scientific development. The rapid spread of technological and scientific developments is a traditional challenge in many areas of control such as nuclear, chemical, and biological or aerospace. Some dual-use items such as semiconductors are at the heart of a myriad of innovative products such as computers or automobiles, wind turbines, solar panels or LED bulbs, but also have numerous military applications e.g. for night-vision cameras or missile guiding systems. Consequently, multilateral export control regimes devote considerable resources to the regular updating of controls so that they remain technologically and commercially current, and the EU, in turn, updates its control list each year XXXVI . Since the turn of the century, however, the emergence of new and advanced technologies with dual-use applications - such as additive manufacturing/3-D printing, cloud computing, nanotechnology, graphene research – increasingly add to the complexity of strategic controls. For example, research in synthetic biology supports the development of innovative medical solutions, but also raises the possibility that new pathogens could be created and creates a need for authorities to develop an understanding of the challenges it poses. As another example, additive manufacturing is also increasing the challenge posed by technology transfers: in the US, judiciary proceedings are ongoing after the publication of a 3-D printed gun was prohibited under export control legislation in 2013 XXXVII . 1.2.3 Transformations in global economic activity. The rise of global supply chains means that the development and production of dual-use items happen in a series of steps across many countries and is increasing the risks associated with dual-use trade. Expanding global trade and interconnected data networks increase the opportunities for state and non-state actors to acquire dual-use equipment and technology – legitimately or not. As a result, proliferation risks move across borders and jurisdictions along integrated value chains, as proliferators take advantage of their complexity and vulnerability. Proliferators mobilise increasingly sophisticated support networks characterised by the presence of unsuspicious legitimate operators (such as suppliers, service providers or transport operators unfamiliar with proliferation risks). Global supply chains also mean that the volume of dual-use goods being trans-shipped via third countries is continuously expanding, thus increasing the risks of diversion to countries of concern (for example, EU exports to major trans-shipment hubs such as the United Arab Emirates have increased by 130% from 2004 to 2014, at a time when they were significant risks of diversion to e.g. Iran). Moreover, as exports are increasingly 'transmitted, not transported', online trading platforms are transforming the nature of supply chains and making it possible for anyone, anywhere to act as a middleman or broker in a dual-use export transaction. Also, the greater diffusion of dual-use knowledge offers easier acquisition pathways as sensitive information – "intangible technology" - is easy to transfer via electronic means (e.g. plans for a nuclear bomb available on the internet). Furthermore, the growing importance of emerging economies, multinational companies and industrial processes within worldwide production networks and supply chains results in an increasing foreign availability of dual-use items. Foreign availability can be illustrated by economic data concerning some key dual-use sectors XXXVIII . Thus, in the aerospace sector, world regional shares of global civilian revenues are projected as follow for 2020: 33% North America, 33% Europe, 15% Asia Pacific and the rest divided equally between Middle-East, Latin America and Africa. In the chemical sector, the total value of EU sales (EUR527 billion in 2013) has been continuously growing, but overall world chemical sales have outpaced that rate of growth and the EU contribution to world chemical sales between 2003 and 2013 dropped by 14.5%, from 31.2% in 2003 to 16.7% in 2013. In the machine tool sector, where the EU is still a leader with a production of EUR 19.8 billion, big producers now include China (EUR 12.9 billion), Japan (EUR 9.7 billion), South Korea (EUR 4.2 billion), the United States (EUR 3.7 billion) and Taiwan (EUR 3.5 billion). For its part, the Information and Communication Technology (ICT) industry is highly globalised, and European operators face stiff competition from other developed and emerging economies, particularly in Asia. 1.2.4 Asymmetric implementation of controls within the EU. The EU system provides for a number of actions, especially with respect to implementation and enforcement, to be conducted by national competent authorities. This flexibility is inherent to the system and, to an extent, supports the effective implementation of harmonised EU controls thanks to the proximity of authorities to economic operators and their capacity to adjust to national economic conditions. This however also results in diverging interpretation/application of controls within the Single Market in relation to certain provisions of the Regulation (e.g. the determination of the competent authority), with respect to licensing conditions and requirements, and the application of catch-all controls on non-listed items. In some cases, the Regulation itself provides, by design, for the possibility of national controls. In total, 12 Member States have introduced some form of national control measures. For example, seven Member States have National General Export authorisations (NGEAs) XXXIX These national measures sometimes cover a significant portion of licensed exports (approximately 6%): a total of over EUR 2.8 billion was exported under NGEAs in 2014. In other cases, the lack of detailed provisions open the door to diverging application of controls. For instance, the lack of indications regarding the validity of licences or the licensing timeline result in greatly varying situations throughout the EU, with inevitable distortions of competition among exporters operating from the Single Market.

Differences between Member States also appear as regards the cost of controls. With approximately 39.000 applications and 28.000 individual licenses XL granted in 2013 in the EU, the volume of licences processed highlights the fact that export controls represent a significant administrative burden for both companies and competent authorities. Figure 2: Volume of applications, authorisations and denials for (2010-2013) In parallel to the asymmetric implementation of controls, the overall administrative burden relating to controls masks a variety of situations. Throughout the EU, resources and budgets allocated to export control differ markedly from one Member State to another, ranging from approximately EUR 100,000 up to EUR 6 million in 2014 XLI . In practice, the administration cost of controls is not limited to licensing, which is only the tip of the iceberg as export controls require inter-agency cooperation involving various ministries as well as customs, intelligence and technical services, e.g. for international representation, technical expertise and enforcement. With respect to economic operators, the administrative burden associated with controls essentially relates to compliance costs, licensing delays and legal uncertainty. Costs are mainly related to the classification of items (large enterprises can have thousands of items – including parts and components - potentially falling under dual-use lists or affected by catch-all provisions), but also to licencing procedures, dedicated IT infrastructure, training etc. Compliance costs vary greatly between companies and are not separate from other security trade measures (such as sanctions). From available data, it appears that, at central (headquarters) level, resources dedicated to controls remain limited: 77% of surveyed companies declare that they have up to 10 full-time equivalent (FTE) staff in charge of export control and that related costs can be as high as EUR 4 million per year for big companies. For SMEs, equivalent figures provided by companies were substantially below, often less than four FTE and approximately EUR 200,000 per year. Based on licensing data and consultations with key experts, it can be estimated that the overall yearly cost of licensing in the EU exceeds EUR 100 mln. XLII Licensing delays appear as an important risk for economic operators, especially as they may in some cases lead to a cancellation of sales and thus cause a potentially large financial loss. On average, a few weeks are required for processing licence applications (UK published data report an average licensing time of 15 days), but this overall figures mask large variations in processing times - from a few days to several months in certain cases. 1.3 Problem tree. 1.4 Identification of the stakeholders: Who is affected by the problem? 1.4.1 Industry stakeholders. A variety of economic operators in a variety of sectors are concerned by export controls, as they affect directly the freedom to conduct a business. This includes primarily exporters and manufacturers involved in the supply of goods, technology and services with dual-use applications in areas such as energy, aerospace, defence and security, transport and navigation, telecommunications, chemical and pharmaceutical industries, manufacturing and material-processing equipment, electronics, semiconductor and computing industries. While there is little authoritative data describing the "elusive dual-use sector", sector data may provide useful indications regarding key "dual-use industries" – i.e. industries affected, to some extent, by export controls – and their economic significance. The aeronautics, space, defence and security industries in Europe has a turnover of EUR 197.3 billion, invest EUR 20 billion in Research & Development (R&D), and counts over 3000 companies and 80,000 suppliers, many of which are SMEs XLIII . According to the Aerospace Security and Defence association (ASD), much of its activity is affected by export controls. The machine tools industry is a key sector of modern manufacturing, with Europe as a global leader: European machine tools production reached EUR 19.8 billion in 2014 and exports reached EUR 9.1 billion. The sector is significantly affected by controls: the European association of machine-tool industries (CECIMO) estimates that more than 80% of European cutting machine tools are classified as dual-use XLIV . The electronics / semi-conductor industry supports around 200,000 jobs directly and more than 1,000,000 indirect jobs in Europe. EU exports of integrated circuits exceeded EUR 11 billion in 2014. Semi-conductors enable the generation of more than 10% of GDP in Europe and the world and the value of products comprising micro- and nano-electronic components represents around EUR 1,250 billion XLV . The ICT industry is widely affected by controls since encryption (which is controlled at a certain level) is an integral part of most digital technology. In 2014, dual-use related exports of electronics were worth EUR 28.8 billion, dual-use related exports of telecommunications and ‘information security’ were worth EUR 32.5 billion, and dual-use related exports of computers were worth over EUR 15.6 billion XLVI . Within the broader ICT sector, the size of the cyber-surveillance industry is difficult to estimate precisely, but estimates for the cyber-security industry indicate for example that it reached USD 75.4 billion in 2015. XLVII Some studies offer insight into specific industry segments and indicate that the cyber-surveillance industry itself is significantly smaller in size – some NGOs estimate that it is worth USD 5 billion a year XLVIII . In its strictest sense, when targeting security firms that market highly-specialized systems of intrusion or surveillance to law enforcement and intelligence agencies, the market appears to be limited to a few small but highly mobile (companies may easily relocate in other countries) and global companies. The EU chemical industry ranks second globally, but is the leading exporter of chemicals in the world, with exports totalling EUR 139 billion. The sector is partially affected by controls with less than 10% of exports concerning dual-use chemicals XLIX . The civil nuclear sector generates 27% of the EU’s electricity, representing half of the EU’s greenhouse gas free electricity L , and supports 217,589 direct jobs in the EU LI . The civil nuclear sector is almost entirely subject to dual-use controls, as nearly all of the principal items and components are listed. Critically, dual-use controls affect emerging sectors which are key to the EU's Innovation capacity. For example, drones have a variety of civilian and military applications and appear as the most dynamic segment of the aerospace industry. The market for military drones is expected to almost double by 2024 to beyond USD 10 billion LII . Naturally, industry stakeholders will only be affected by changes to export controls to the extent that they apply to the type of dual-use items they trade. For example, the chemical industry could be directly affected by changes to licensing processes for low-value shipments (since chemicals can typically be exported in samples) but would hardly be concerned by changes to encryption controls.

1.4.2 SMEs. Industry stakeholders include multinationals and some of the biggest companies in the EU, but also a large number of SMEs. The example of the defence sector, which typically produces items with both military and civilian uses (i.e. dual-use), provides a good example. In 2012 there were around 1,184 firms operating in the defence industry in Europe LIII , with a total turnover of more than EUR 17 billion and employing around 120,000 people. The majority were small firms: firms of less than 10 employees represented 76.7% of the total number operating in the sector in Europe LIV . Figure 3. Distribution of the number of firms in the defence sector, with their respective turnover, number of employees and investments according to size, 2012 LV . 1.4.3 Service providers and researchers. Industry stakeholders also include service providers involved in dual-use trade - such as brokers, consultants providing technical assistance or resellers. Specific communities may be affected by specific aspects of controls e.g. Intangible Technology Transfers (ITT) controls particularly affect multinational companies and research institutes/universities. As another example, the internet security research community is concerned specifically by controls on cyber-surveillance technology. 1.4.4 Government stakeholders. Member States have a direct interest in the initiative due to their responsibility in the negotiation of decisions on controls in multilateral regimes, and their administration, implementation and enforcement at national level. Departments involved in managing, monitoring and enforcing export controls include licensing authorities, ministries of economy and trade, foreign affairs, defence as well as customs and intelligence agencies. Third countries may also have an interest in the initiative, as it will affect bilateral trade and/or security (for ex. the export of dual-use items for military applications in one country may cause concerns in another country). 1.4.5 Civil society stakeholders. Civil society has an increasing interest in export controls, in particular due to their positive impacts on human rights. For example, various NGOs formed in 2014 the Coalition Against Unlawful Surveillance Exports (CAUSE) LVI calling for the control of exports of cyber-surveillance technologies in order to prevent human rights violations. The wider public may also indirectly benefit from increased security and competitiveness of EU dual-use industries, especially as export controls aim at preventing sensitive technologies from falling into the "wrong hands" and the broader security implications are of relevance for virtually all citizens. Exports of dual-use items may also affect fundamental rights, in particular those of people in third countries, such as the right to life and the prohibition of torture and inhuman and degrading treatment, the right to security LVII , to health and to academic freedom. In addition, cyber-surveillance technology creates new risks to specific human rights (as outlined in 1.2.1.2.), and civil society in third countries – and in particular human rights activists and dissidents - may also benefit from enhanced controls. 1.5 Dimension of the problem. Although there is little authoritative quantitative data on the 'dual-use sector LVIII ', the magnitude of the problem associated with the export control policy review may be approximated in relation to 1) the scope of the dual-use industry, 2) the importance of dual-use trade and 3) the extent to which problems are already addressed by the Regulation. Dual-use related data or partial/sectoral data may be useful to illustrate the importance of dual-use controls for the EU economy and to assess the dimension of the problem at a general level, while duly recognising the limitations of this exercise, in particular as the security and human rights dimensions of the problem are inherently not quantifiable, and considering the lack of data relating to specific control provisions. 1.5.1 The economic dimension: the EU dual-use industry. The EU has an extensive dual-use industry that brings together thousands of small, medium and large companies providing high value-added jobs and know-how - including significant R&D work. Dual-use industries may be found in all Member States, but there is a degree of concentration of dual-use industries in certain Member States, with the top 4 exporters (Germany, UK, Netherlands and France) accounting for over 80% of dual-use exports in value. Dual-use items are often high-tech products and include leading edge technologies that are crucial to the EU's drive towards innovation and competitiveness. For example, the semiconductor industry, is one of the most innovative industrial sectors in Europe and consistently ranked among the very top R&D intensive sectors. In reality, dual-use items have ramifications across a wide range of key sectors of the EU economy. The classification of dual-use items in the Regulation is as follows: Category 0: Nuclear materials, facilities and equipment Category 1: Special materials and related equipment Category 2: Materials processing

Category 3: Electronics Category 4: Computers Category 5: Telecommunications and “information security” Category 6: Sensors and lasers Category 7: Navigation and avionics Category 8: Marine Category 9: Aerospace and propulsion. A quantification of the dual-use industry based on production values would be useful to assess its share in the EU economy, but there are no dedicated statistics, and estimates can only be based on the corresponding production data for the largest relevant sectors. The size of the EU ‘dual-use related industries' –- that produce, inter alia, dual-use items - has thus be estimated at over EUR 600 billion LIX . This data usefully sheds some light on the economic context of controls, but presumably largely exceeds the actual size of dual-use production itself and cannot be used a reliable estimate when assessing the impact of specific review actions. 1.5.2 The trade dimension: dual-use exports. Licensing data is probably the most direct and reliable measure for assessing the importance of the dual-use industry to EU trade. According to the 2013 data, the value of EU 'controlled exports' LX reached EUR 85 billion, representing approximately 4.9 % of extra-EU exports. Authorised exports of dual-use items amounted to EUR 48 billion, representing 3.1%. By contrast, only a small portion of exports were actually denied: approx. 260 denials were issued in 2013, representing about 0,06% of the value of controlled dual-use exports in that year, and a negligible portion of total EU exports (Figure 4) LXI . Figure 4: Value of applications, authorisations and denials for (2010-2013) (mln EUR) In some cases, available licensing data shed some light on the importance of the problems relating to specific control provisions –such data is used, where available, in the assessment of concrete actions. It should however be noted that the low number and value of denials is not a reliable indicator of the dimension of the problem or of the administrative burden placed on administrations and exporters, since export controls do not operate as a ban and are designed in a way as to minimise negative impact on trade, and most dual-use exports concern purely civilian operations. The EU is a major exporter of dual-use items and trade in dual-use items is an integral part, and represents a significant portion, of trade with key partners (Figure 5). Figure 5: Destination countries and sub-regions for EU dual-use related exports in 2013 LXII . Here again, available licensing data do not precisely relate to the dimension of the problems identified in the review, but offer useful contextual elements. Some data more precisely relates to certain aspects of the problems. For instance licensing data on brokering controls or transit controls enable a more precise assessment of the dimension of those particular aspects of problems. Where available, such data is used when assessing the potential impact of review actions. 1.5.3 The social dimension. Industry associations recognise that they are not in a position to assess the potential social dimension of the dual-use sector with precision, for lack of relevant data. In spite of the scarcity of data, it is clear that EU dual-use industries are important in terms of employment: in the period 2008-2012, between 7 and 8.5 million employees were active in dual-use related sectors, though, again, the number of employees working in actual dual-use enterprises is likely to be much smaller LXIII . Considering that, across the EU, 31 million jobs, i.e. 14% of total employment, depend on exports LXIV , it can be estimated that extra-EU dual-use exports support approximately 1 million jobs LXV . It should be noted that dual-use industries, taking into consideration also production and intra-EU trade, support an even higher number of jobs. Sector data may provide useful insight into the social dimension of controls in general - for example:

the European machine tools industry employed about 135,000 people in 2013 and creates approximately an additional 600,000 jobs via its supply chain LXVI ; chemical companies employed about 1.2 million people in the EU, and the sector generates a greater number of indirect jobs that is estimated to be up to three times higher LXVII ;  the aeronautics, space, defence and security industries employ close to 778,000 people LXVIII . As for economic and trade data, however, data cannot be disaggregated to the level of review options and actions, and offer more of a contextual information for the overall assessment. 1.5.4. The regulatory dimension. The Regulation ensures that international commitments of the EU and its Member States are complied with, and problems arise only insofar as the Regulation does not sufficiently or effectively address and imperfectly adjusts to evolving risks or changing technological and economic developments. The review, by its very nature, will therefore essentially consist in adjustments to existing controls and the dimension of the problems will be limited to this need to adjust the system to changes in the environment.. Most review actions envisaged under options 2 and 3 of this report in fact aim at adjusting and refining existing controls: they seek to clarify, simplify or, in certain cases, possibly extend certain existing provisions of the Regulation. For example controls on brokering, transit or technical assistance are already in place under the Regulation, but e.g. differ among Member States or do not take into consideration specific aspects such as terrorism or human rights. 1.6 Analysis of the export control system: the case for a review of export control policy. In light of the requirements of Article 25 of the Regulation, the Commission issued in 2011 a Green Paper LXIX highlighting the development of the EU export control system over the last decade and launching a broad public debate concerning its functioning and future strategic options. The Green Paper marked the first step toward preparing the review required under Article 25 of the Regulation. As a result, the Commission Staff Working Document LXX “Strategic export controls: ensuring security and competitiveness in a changing world" identified the main issues raised by stakeholders as regards the strengths and weaknesses of the EU export control system. It showed that most stakeholders agree that the EU export control system provides solid legal and institutional foundations, but also concur that it cannot remain static and needs to adjust to a changing security, technological and economic environment, to prevent the emergence of potential security gaps, and to avoid trade distortions affecting the competitiveness of EU companies. As requested under Article 25.2 of the Regulation, the Commission then presented, in October 2013, a report to the Council and the Parliament LXXI , which recognized the need to upgrade the EU export control system and opened the way to the review of EU export control policy. For their part, the European Parliament, the Council and the Commission have jointly agreed that a "modernisation and further convergence of the system is needed in order to keep up with new threats and rapid technological changes, to reduce distortions, create a genuine common market for dual-use items (uniform level playing field for exporters) and continue serving as an export control model for third countries" LXXII . CHAPTER 2 - THE NEED FOR EU POLICY INTERVENTION: SUBSIDIARITY AND PROPORTIONALITY As confirmed by the Court of Justice LXXIII , dual-use export controls form an integral part of the Common Commercial Policy. The EU therefore has the right to act, based on exclusive competences under Article 207 TFEU. Even so, according to the subsidiarity principle, the EU should act only where it can provide better results than interventions at Member States level. With due respect to Member States' prerogatives in the area of security, EU intervention is necessary as the security objectives pursued can only be achieved collectively, if competent authorities act in close collaboration and in accordance with the same principles so as to ensure that there is no "undercutting" of exports. Action at EU level is also necessary to address distortions of competition within the Single Market. Thirdly, EU intervention and dialogue with key trade partners is valuable to promote the level-playing field globally. EU intervention is also necessary to protect fundamental rights in light of the Charter of Fundamental Rights, since a number of human rights have been identified as potentially affected by exports, in particular in relation to exports of cyber-surveillance technology, but also e.g. related to biological items LXXIV . EU legal acts must comply with the Charter of Fundamental Rights of the EU and, in line with the Better Regulation principles, an assessment of impacts on fundamental rights must be carried out when designing EU policies and legislation. The options identified in this document therefore comply with the principles of proportionality in so far as they are limited to what is necessary in order to attain the objectives laid down in section 3. CHAPTER 3 – OBJECTIVES: WHAT SHOULD BE ACHIEVED? 3.1 General Objectives According to Article 207 TFEU, the common commercial policy shall be conducted in the context of the principles and objectives of the Union's external action and in accordance with the EU's international commitments.

Accordingly, the EU export control policy review aims at supporting the overall policy objectives of the Union, as laid out in Article 3 of the Treaty on European Union, i.e. "contribute to peace and security, as well as free and fair trade and the protection of human rights". Modernised and effective export controls will also ensure that the EU and its Member States effectively comply with their international obligations, in particular with respect to WMD non-proliferation. 3.2 Specific Objectives In light of the identified problems, the specific policy objectives of the export control policy review are to: Ensure that EU export controls adjust to evolving security risks and threats; Ensure that controls adjust to rapid technological and scientific developments; Prevent the export of cyber-surveillance technology misused in violation of human rights; Reduce the distortions of competition and administrative burden associated with controls; Promote a global level playing field; Support effective and consistent application of controls in the EU. Overall, the review options and actions identified and assessed in this document aim at striking the right balance so that facilitating trade and reducing the administrative burden does not come at the expense of security or human rights. Ultimately, enhancing the security of the supply chain through robust export controls will protect legitimate trade and contribute to its development. Annex VI provides a detailed description of the links between problems, obectives and options. 3.3 Consistency with other EU Policies The objectives are fully in line with EU foreign and security policies. The export control policy review will contribute to the European Security Strategy, and in particular responds to the 2013 Council Conclusions on ensuring the continued pursuit of an effective EU policy on the new challenges presented by the proliferation of weapons of mass destruction (WMD) LXXV . The review options concerning "Human security" and the control of cyber-surveillance technologies could contribute to the protection of human rights globally as illustrated by the 2012 and 2015 Human Rights Action Plan and the EU's Guidelines for Freedom of Expression, which explicitly call for tightening controls on the export of such technologies. The objectives are also fully in line with EU trade policy's aim to foster competitiveness and reduce distortions to trade, and with the 2015 "Trade for All" Communication's LXXVI announcement of specific proposals for "an ambitious modernisation of the EU´s policy of export controls of dual-use goods, including the prevention of the misuse of digital surveillance and intrusion systems that results in human rights violations”. The export control policy review will also contribute indirectly to other EU policies e.g. proposals for fixing the vulnerabilities created by the trade in cyber-surveillance technologies are in line with the digital single market strategy. Since the export control policy review aims, in particular, to make EU law simpler and less costly and seeks for more effective ways to achieve its objectives, it serves the objectives of the REFIT programme. CHAPTER 4 – POLICY OPTIONS: WHAT ARE THE VARIOUS OPTIONS TO ACHIEVE THE OBJECTIVES? 4.1 Identification and description of the policy options In light of the initiatives envisaged in the 2014 Communication, five options have been identified which range from the continuation of the current export control system to its complete overhaul and full harmonisation, with other options between these extremes. 4.1.1. Policy Option no. 1 – "Baseline". This option would leave the current legislation, administrative and IT arrangements unchanged, maintaining a well-known system in place. The current system would allow limited regulatory actions to take into consideration security, economic and technological evolutions e.g. since 2014 the EU list of dual-use items can be adjusted regularly through delegated acts. Similarly, limited cooperation and exchange of information between competent authorities is possible with the existing system, using current administrative resources, to support consistent implementation and enforcement.

4.1.2. Policy Option no. 2 – "Implementation and Enforcement Support". This option would address problems associated with the lack of clarity and transparency and uneven implementation of controls, and with rapid technological and scientific developments. This option would combine a series of soft law, non-regulatory actions (avoiding regulatory changes and concrete support actions by national and EU administrations to develop the EU system and promote a consistent and effective implementation and enforcement of controls. The following actions are envisaged: Development of an EU export control network. This action would focus on strengthening cooperation and coordination between the competent authorities of the Member States. Its operational objective would be to develop a more integrated and effective EU export control network. The action could be put in practice via the following measures: Enhanced information exchange between competent authorities. The Commission and national authorities could develop structured exchange of information on key data (e.g. catch all controls, sensitive destinations and end-users, violations, global licence users), using and expanding, as necessary, the existing IT information-exchange system – the DUES. This would provide a common and robust information basis for risk assessments by competent authorities and thus support the effective and consistent implementation of controls throughout the EU; Development of security export controls synergies. The EU implements various instruments (regulations, directives, decisions) to control the trade of various sensitive or strategic commodities (such as dual-use items, arms/defence items, firearms, 'torture goods', goods subject to restrictive measures/sanctions), conflict diamonds, drugs etc). These instruments rely on common principles and tools but are managed by different services, at EU and national levels. The action LXXVII could involve the pooling of expertise and the development of a common IT infrastructure to serve as a shared platform for exchange of information on controlled exports (possibly building on the existing DUeS IT platform); Enhanced cooperation with Member State enforcement agencies. While enforcement is the responsibility of specific agencies of the Member States, cooperation and information exchange could be improved at EU level, e.g. through the setting-up of an "enforcement coordination centre" attached to the Dual-Use Coordination Group LXXVIII and the development of synergies with other security & trade related programmes such as Authorised Economic Operators (AEO) LXXIX programme (in cooperation with customs); Development of an EU capacity-building programme. This action would imply the development, by the Commission and national authorities, of a common training programme for officials of relevant authorities (primarily licensing and customs but also other enforcement agencies) – a so-called EU "Inreach" training programme - could be inspired by the ongoing "outreach programme" providing capacity-building to third countries LXXX . Transparency and partnership with the private sector. This action is based on the observation that regulatory compliance and competitiveness are mutually reinforcing and would focus on the interaction between authorities and the private sector as the 'first line of defence' against evolving security risks. The operational objective is to enhance the security and resilience of the global supply chain and reduce the risk of corporate involvement in exports that expose firms to penalties and wider reputational damage. It could be put in practice via the following measures: Transparency measures would expand outreach and information-sharing with operators, e.g. through the publication of informative annual reports by the Commission and of information supporting the application of controls (for example guidance for exporters on topical issues, "technical notices" laying out best practices helping companies to apply controls to new technologies LXXXI ). Transparency would also enable the European Parliament and civil society organisations to fully contribute to the formulation and implementation of export control policy. The development of tools for operators. This would form another key element of the partnership and respond to industry's call for a common interpretation and application of rules. It would involve the development of e.g. EU-wide industry compliance standards for private sector, confidence-building measures such as codes of conduct for dual-use researchers. It could also include the introduction of electronic licensing systems in all Member States, based on the experience of those competent authorities that already operate such systems, thus providing for IT-based management of licensing processes and relations with economic operators. The development of a 'smart security' mechanism could take the form of "technical advisory committees", as inspired by US practice, bringing together key industry players with Government experts to engage in a dialogue on the technical parameters for controls. Such technical consultations would support regular updates of the EU control list and also pave the ground for EU coordinated inputs into discussions in multilateral export control regimes. Export control dialogue with third countries. The action would involve the development of regular dialogues between the EU and key trade partners, and could consist of measures such as regular and reciprocal exchange of information, the possibility to negotiate agreements with third countries e.g. to allow for end-user verification programmes (whereby selected third-country companies could be granted special status of "Verified end-user" and obtain EU-wide recognition and facilitation of controls), mutual recognition of Internal Compliance Programmes (ICPs) etc. Its operational objective would focus on regulatory convergence and the global level-playing field. 4.1.3. Description of Policy Option no. 3 – "EU System Upgrade". Drawing on "lessons learnt" from the implementation of various provisions of the Regulation, this option would address problems associated with lack of clarity and transparency, uneven implementation of controls and the risks associated with rapid technological and scientific developments and the interconnected global trading system. It would consist of various adjustments to the current regulatory framework, introducing amendments to the Regulation in order to simplify it and/or to make it more effective and efficient. It would essentially combine 4 actions: Modernisation of existing control provisions. The operational objective of this action would be to clarify, simplify and improve the regulatory framework in light of "lessons learnt" and new developments. This could be put in practice via changes to various control provisions: The clarification of key export control notions should reflect new realities. Thus, the definition of exporter in Article 2.3 of the Regulation reflects the original focus of controls on exports of tangible goods while the notion of exporter today extends to e.g. service providers, researchers, consultants and even a person downloading "controlled technology". As another example, experience has evidenced difficulties with the determination of the competent authority in Article 9 of the Regulation, e.g. in situations where the owner of the controlled items is established outside of the EU. This provision also fails to capture the situation of natural persons, which may be "exporters", especially when it comes to technology transfers. Moreover, in order to avoid conflicting decisions by competent authorities, it is important to clarify that the determination of the competent authority applies to all control operations (incl. e.g. a decision on decontrol of items), and not only to the granting of a licence, as it currently does. 64% of surveyed industry associations see a need for a legal clarification of intangible technology transfers controls (ITT), especially as experts reports suggest that ITT, including technical assistance, plays an increasing role in proliferation. For example, an amendment to the Regulation is need to ensure the control of technical assistance where the supply of services or the transmission of technology involves a cross-border movement of persons, as this has become EU competence since the entry into force of the Lisbon treaty LXXXII . The action could also involve the introduction of references to ITT in various definitions, such as the definition of exporter; Tackling illicit trade: the Regulation sets up a system for controls of legal exports, but should be strengthened to counter the illicit trafficking of dual-use items – a dimension largely absent from the Regulation - and provide a robust basis for enforcement. Also, best practices from other security trade instruments, such as sanctions regulations, could be transposed in the export control area. For example, the Regulation applies controls on the export of items from the EU customs territory, which is ill-suited to intangible technology transfers and does not address the risk of circumvention by EU persons in third countries. In line with best practice in other trade security instruments (sanctions), it could be appropriate to apply controls throughout the EU jurisdiction – including on EU persons located in third countries. Similarly, it would be useful to introduce an anti-circumvention clause, i.e. a prohibition of actions which intentionally circumvent controls, thus establishing a solid EU-wide legal basis for the prosecution of export control violations. Strengthening of brokering controls: the EU controls brokering services for dual-use items where there are concerns about a particular transaction LXXXIII . Experience however shows that the definition of brokering does not capture certain situations e.g. when the items are located in the EU or when the broker is resident outside of the EU. Moreover, brokering controls include optional elements regarding their extension to non-listed dual-use items and for military end-uses. These discrepancies create legal confusion and fragmentation of controls across the internal market, and increase the risk that controls are circumvented. In order to ensure the consistency and effectiveness of controls, it could therefore be appropriate to harmonise their application to non-listed items and military end-uses and to extend their application to terrorist use and human rights violations. It could also be envisaged to cover brokering of export from the EU to a third country, and to strengthen the control mechanism e.g. through the introduction of registration and/or reporting requirements for brokers. Consistency of transit controls: as transit is used by proliferators to mask the final destination of items and thus evade controls, the EU controls the transit of dual-use items where there are concerns about a particular transit operation LXXXIV . Based on lessons learnt, measures could be proposed to enhance the consistency and effectiveness of transit controls. For example, the Regulation contains optional elements for Member States regarding the control of non-listed items and of military end uses, which could be harmonised at EU level in order to ensure a uniform level of control, and thus avoid distortions of competition and the risk of weak links in the chain of controls. The control of transit could also be extended explicitly to terrorist use and human rights violations, which are currently only indirectly covered.

Optimisation of EU licensing architecture. The operational objective of this action would be to further harmonise licensing processes and reduce the share of individual licences in favour of control modalities that do not disrupt commercial transactions such as general authorisations. It could be put in practice via the following measures: Harmonisation of licensing processes: this could be achieved through common parameters for global and EU general authorisations (EUGEAs) e.g. validity period and conditions for use of the licences (registration, reporting requirements...). A standard requirement for authorities' transparency on licensing timelines could also be introduced with a view to reducing differences in licensing timelines. While under the current system, a majority of transactions are authorised under individual licenses, a shift towards open licensing would support increased use of general authorisations to facilitate trade while ensuring a sufficient level of security through robust control modalities e.g. reporting, compliance audits of companies, etc. This could be achieved through the following measures: a regular review of NGEAs, by Member States and Commission experts, to examine their possible transformation, where appropriate, into EUGEAs. National authorisations would thus remain in place in recognition of the fact that they are considered by some operators as a useful element of flexibility, but would be subject to regular review and, where appropriate, their benefit would be extended to all EU operators; a delegation of competence for the Commission to modify destinations or items on existing EUGEAs and/or introduce new EUGEAs (including as a result of the review of NGEAs mentioned above); the introduction of additional EUGEAs and/or new licence categories for trade with non-sensitive countries, such as: -Cryptography: the facilitation of controls for products containing cryptography could be especially useful to compete with license exceptions existing in non-EU countries and given the commercial importance and wide circulation of these items; -Low Value Shipments: this would facilitate controls for shipments under a certain value (currently that value is set, under national control rules, at EUR 5000 in Germany and GBP 6000 in the UK) provided the shipment and destinations are eligible and certain conditions are met; -intra-company technology transfers: this would address the growing importance of ITT by facilitating transfers of dual-use technology within a company in other non-sensitive countries, in particular for R&D purposes, as long as the technology remains under the ownership of the company; -Large-projects: this would adapt licences to the specificities and duration of large multiannual projects e.g. construction of a nuclear power plant, providing the benefit of one single licence for all related export operations, for the duration of the project, subject to certain conditions (e.g. reporting, auditing). Convergence of catch-all controls LXXXV . This action would address the lack of consistency of catch-all controls, which are imposed by national authorities without consultation or information of other authorities and thus result in distortions of competition and uneven implementation of controls. The operational objective would be to improve the convergence of catch-all controls at EU level, via the following measures: Clarification and harmonisation of the definition and scope of catch-all controls: as experience shows that competent authorities introduce catch-all controls with widely different scope and parameters, this could clarify that a catch-all control should covers specific items (rather than entire ranges of goods) and specific entities (rather than entire countries); EU-wide application and validity of catch-all decisions: a mandatory consultation procedure between competent authorities could ensure that a common approach is defined for the application of specific catch-all controls; Regular exchange of information: the Commission and Member States could set up a 'catch-all database' recording catch-all licensing requirements, end-users and items of concern. Data could be shared with customs and other enforcement agencies. Additionally, the transparency of catch-all controls could be enhanced, with some information available to the public (e.g. watch list of items published as guidance) so that operators are aware of risks. Re-evaluation of intra-EU transfers. This action would aim at minimising the burden and the remaining barriers to trade in dual-use items within the Single Market, while ensuring sufficient control of intra-EU transfers on certain particularly sensitive items (Annex IV items). It could consist of the following measures: Review Annex IV: the list in this annex should be revised in order to focus controls on an updated list of most sensitive items, taking account of technological and commercial developments; EUGEA for intra-EU transfers: a general transfer authorisation for the updated list of most sensitive items in Annex IV could facilitate trade within the EU, allowing for free circulation under certain conditions (e.g. registration, reporting, auditing, post-shipment verification) ensuring the security of transfers. 4.1.4. Policy Option no. 4 - "EU system modernisation". This option would introduce a new "human security" dimension to the EU export control system, recognising the links between security and human rights and addressing the specific problem posed by the insufficient control of cyber-surveillance technologies. Its operational objective would be to respond to the proliferation of cyber-surveillance technologies whose misuse poses a risk to international security and the protection of human rights and digital freedoms in a globally connected world. This option would essentially consist of two series of actions: A review of the general approach to 'dual-use'. The human security approach moves beyond the traditional military and state-centred approach to security – which underpins current regulations - towards a wider approach also taking into consideration the security of the EU, its citizens and companies. This could imply, firstly, a review of the definition of dual-use items to extend it beyond purely 'military' and WMD proliferation-related end uses to address broader security implications, including effect on security of populations e.g. terrorism, human rights violations.

A revised definition for 'dual-use items' could be combined with a review of the control criteria, explicitly providing for controls to prevent exports where there is a clear risk of human rights violations. It could also include a clarification that criteria apply to all controls e.g. also transit, technical assistance and brokering, as this is not explicitly mentioned in the Regulation. An initiative to control exports of cyber-surveillance technologies. This action would build on measures outlined above and introduce specific provisions for an effective and comprehensive control of cyber-surveillance technologies. It could take the form of measures such as: A due diligence requirement for companies to ensure that their exports of cyber-surveillance technologies are not destined to be misused in violation of human rights and do not pose a risk to international security; An EU autonomous list of cyber-surveillance technologies, which would list specific items to be subject to controls, with detailed technical parameters. This would allow for EU decisions to control specific other dual-use items of concern, where considerations regarding the EU's essential security interests or respect for human rights warrant it. A catch-all control, either integrated in the general catch-all clause or taking the form of a dedicated catch-all control for cyber-surveillance technology, which would allow controlling non-listed items where there is evidence that they could be misused. 4.1.5. Policy Option no. 5 - "EU system Overhaul". This option would imply radically changing the EU approach to export controls, including full centralisation and harmonisation of controls towards the establishment of a central licensing agency at EU level. It would likely bring considerable costs – administrative, financial as well as in terms of legal transition – while potential benefits appear uncertain and remote. Consultations show that it would also likely face strong opposition as there is little evidence of any stakeholder support, while on the contrary many stakeholders – in particular Member States, but also some industry associations and companies - highlight the need to preserve the 'optimal equilibrium' between the EU and national levels of the system. This option is therefore not assessed further in this report. Options 2, 3 and 4 include actions that could be complementary e.g. guidance or IT support tools to support the implementation of legislation – while options 1 and 5 appear as purely alternative policy options. CHAPTER 5 – ASSESSMENT OF THE IMPACT OF POLICY OPTIONS. A thorough analysis was conducted to assess the impact of the different review options identified. Then, option 2, 3 and 4 were compared to option 1 – the baseline. The assessment is based on Commission services' own analysis and practical experience, on data and contributions provided by Member States, on the findings of an independent data collection study, and on the results of consultations of stakeholders, including an online public consultation in July-Oct. 2015. The following potential impacts were identified: Economic & trade Social, incl. security & human rights Environment Direct EU dual-use exports Level playing field (incl. trade barriers, distortions of competition) compliance costs & administrative burden for economic operators Legal clarity administrative burden for public authorities WMD proliferation Transfer of sensitive technology to countries/persons of concern Terrorism Human rights violations N.A. Indirect International competitiveness Innovation & research / ITT Investment & production Employment Poss. climate change, transport, resource use, waste generation, environmental risks Table 1: Overview of impacts. The assessment of the economic, social and environment impacts requires some methodological precautions. Considering that the export control policy review is not about setting up a new regulatory system, but rather suggests changes to an existing system, review options can only produce a marginal impact that will depend essentially on the scope of the controls concerned and on the importance of the change introduced by the review actions. As far as economic impact is concerned, it is also important to note that export controls affect a limited share of total exports so that the economic impact of review actions will necessarily be very limited in relation to the overall economic activity in the EU. Even so, export controls can have a direct impact on the trade performance of specific industries, but review actions mostly concern – and will impact - only a fraction of all stakeholders subject to controls. Due to the fact that there are no official statistics on dual-use production and trade, the impact assessment is based largely on qualitative analysis, results of industry surveys conducted in the context of a "data collection project" and of the online public consultation conducted by the Commission, with supporting quantitative data where available. Quantitative data include licensing data collected by Member States, sectoral or company data provided by industry, and analysis of related trade flows derived from EU trade statistics LXXXVI . The public consultation highlighted that most respondents did not foresee significant social impacts stemming from the review options. Social impact can therefore rather be assessed in terms of security and human rights, as the export of dual-use items may have direct consequences in this respect. It should however be noted that controls are only one of many instruments in the toolbox to address security and human rights– therefore, here again, the impact of review actions can only be partial. No direct impact on the environment is noted. 70% of surveyed companies do not identify any environmental effects related to the trade of dual-use items. Some of the associations, however, take the view that the use and consumption of certain dual-use items – e.g. advanced micro-processors – might generate mainly positive environmental effects, e.g. on air pollution and emissions, and energy and resource use. Facilitating the trade in dual-use items might thus, albeit very indirectly, have positive impacts on the environment. Overall, however, environmental impacts appear to be so indirect as to be irrelevant to the detailed assessment of review actions and could not be assessed in line with the principle of proportionate impact assessment. The impact analysis below therefore focuses on the economic, security and human rights impacts, as outlined in Table 1, that any of the proposed review actions identified under option 2, 3 and 4 would have for the stakeholders concerned. The impact of the various actions is analysed individually and then as a package or "review option". A detailed presentation of impacts for each option and action is presented in Annex 7.

5.1 Impacts of Policy Option 1 – "Baseline". This option would present the advantage of stability, maintaining a well-known system in place and stabilising administrative costs for EU and national administrations. It would however also perpetuate the administrative burden and costs for operators and the distortions associated with certain elements of that system, as evidenced during stakeholder consultations. Economic impact is thus likely to be negative in the medium to long-term, especially as data shows an increase in the number of licensed transactions, and, consequently, of associated costs. The majority of rrespondents to the public consultation thus consider that the review could significantly enhance the efficiency of export control administration and EU companies' competitiveness. Specifically, most respondents consider that the export control policy review would "likely facilitate dual-use exports by SMEs". The social impact of the baseline scenario is likely to be negative on jobs and production in the long term, as the competitiveness of EU exporters is gradually eroded by the lack of adaptability of the export control system. From a security perspective, this option would fail to take into consideration the challenges posed by a rapidly changing security, economic and technology environment. Problems would not only persist, but would in some cases increase, e.g. as transit volumes continue to grow and new technologies continue to emerge, while being imperfectly addressed by the Regulation. This assessment is supported by 86% of respondents to the public consultation, who agree that the review would improve the export control system, in particular with regards to its capacity to address evolving security risks and to respond to rapid scientific and technological developments. Lastly, the impact on human rights would be negative as the export of cyber-surveillance technology is not clearly addressed. As the internet of things becomes more widespread, the risks associated with trade in cyber-surveillance items will become even more significant. 5.2 Impacts of Policy Option 2 – "Implementation and Enforcement Support". 5.2.1 The Development of an EU export control network. This would imply, firstly, a series of practical measures for enhanced information exchange between competent authorities, which are likely to require additional administrative resources and to increase the administrative burden in a first stage, both at national and EU level, as procedures and systems need to be put in place. However, information exchange could be developed gradually and in a way as to minimise transition costs e.g. by systematically weighing the costs and benefits of specific proposals for additional information exchange rather than proceeding across the board. It will eventually support the efficient administration of controls, as decisions can be made more quickly and more consistently throughout the EU, thereby reducing the administrative burden for operators and national administrations alike. It could also be beneficial for operators in terms of competitiveness and trade, by addressing the fragmentation of controls across the EU and reducing trade distortions between exporters from different Member States. Likewise, it would bring benefits in terms of security, by reducing the risk of "license shopping" by dubious exporters seeking the most accommodating licensing conditions. Surveyed licensing authorities consider that it could have a slightly negative impact on staff resources, but a substantial positive impact on security and human rights. The development of synergies between various security export controls can be expected to optimise the use of resources and increase the consistency and effectiveness of the instruments over time. For instance the development of a common IT infrastructure is expected to reduce IT development costs at national level, as compared to the development of different systems - but would require the mobilisation of additional resources at EU level. It would also bring benefits in terms of security, as data of different origins could be more easily accessed and compared by authorities, where necessary. Measures to support enhanced cooperation with Member State enforcement agencies are also likely to have some resources implications and increase the administrative burden in the short run, both at national and EU level. However, beyond the short term transition cost, they can be expected to support the efficient and effective administration of controls at national level e.g. by providing customs with all the information they need to detain or release a suspicious shipment. Such actions would also be beneficial to legitimate operators, e.g. as the number of detained shipments – and related delays - could be reduced. They can also be expected to bring benefits in terms of security as enforcement agencies will be better equipped to respond to illicit trafficking. The development of an EU capacity-building programme is likely to bring administrative and financial costs for authorities LXXXVII , both at national and EU level, but can be expected to enhance their capacity to make sound decisions in a timely and consistent manner, thus reducing, in turn, licensing delays and compliance costs for exporters and enhancing security. Licensing authorities consider that it would have a slightly negative impact on resources, but a substantial positive impact on security and human rights. 89% of respondents to the public consultation consider that this would be beneficial, and stakeholders repeatedly noted that, while the EU has been funding capacity-building programmes in third countries, there is thus far no common training programme for EU officials. 5.2.2. The development of a partnership with the private sector. This action is supported by a large share of stakeholders: the quasi-totality of respondents to the public consultation and to the targeted consultations ran by SIPRI and ECORYS agree that enhanced transparency in the form of information-sharing with industry would be beneficial, especially as it could improve legal predictability and reduce the administrative burden for business. For instance, the clarification of controls of technology transfers through the cloud could help companies compete globally by taking the full advantage of cloud services LXXXVIII . It could also significantly improve security, e.g. by raising awareness of operators about specific risks known to the authorities, thereby empowering them to implement controls more effectively, and by raising awareness of specific sensitive sectors e.g. the dual-use research community. The development of tools for operators is likely to have positive economic impacts. For instance, the development of common industry compliance standards would provide a basis for a level playing field within the EU, and for possible convergence with key trade partners. Most respondents to the public consultation (78%) thus agree that standard ICP requirements for global licence holders could enhance the level-playing field while containing compliance costs and administrative burden. It could also enhance security, as companies would follow a more structured approach to the detection of possible illicit transactions. Similarly, 78% of respondents to the public consultation note that the introduction of electronic licensing in all Member States would increase the efficiency of licensing processes and reduce licensing delays for both authorities and companies. It would also facilitate trade convergence as most key trading partners have such systems in place. Once established, it could in turn facilitate the interconnection of national IT systems and support enhanced exchange of information between authorities, and bring benefits in terms of security. The development of tools for operators would however have costs for administrations, also at EU level. For example, the introduction of electronic licensing can be expected to increase costs notably in the short run as the IT software needs to be developed (preliminary estimates are that it could cost approximately EUR 2-3 million for the EU budget) and maintain, even if these could be optimised by drawing on the experience of the Member States that already operate such systems. Lastly, a 'smart security' approach would initially entail some limited administrative costs for administrations – at both Member States and EU levels - and industry players as they would contribute resources (technical experts) to the consultation mechanism. However, it would benefit Member States that would otherwise not have access to the same level of expertise. Crucially, it would enhance the EU's capacity to bring controls in line with technological and scientific developments, thus reducing inefficient or outdated controls that represent an undue burden for operators and a competitive disadvantage where such items are not controlled in third countries. It could also have a positive security impact, as the EU could more actively contribute to discussions on control list updates in multilateral export control regimes. The large majority of respondents to the public consultation (circa 70%) thus agree that a "smart security approach", in the form of voluntary and regular technical consultations on dual-use items, would be beneficial. 5.2.3 Export Control dialogue with key partners More active dialogue with partners would bring some additional administrative cost for the EU (50% of an FTE) and its Member States as resources would have to be devoted to those dialogues, but this could be limited by focusing on a few key partners. On the other hand, it would address surveyed companies' assessment that different rules between the EU and its trade partners have a 'strong negative economic impact' LXXXIX , and bring significant economic benefits in terms of regulatory convergence – e.g. as more countries use the EU list as a benchmark. It would also bring benefits in terms of security, as partners could be made aware of denied entities and act accordingly to avoid dangerous exports. All in all, Option 2 is likely to have positive impacts in terms of promoting consistent and effective application of controls and reducing distortions within the Single Market, and to promote the global level playing field, as well as on security, especially as controls could adjust more rapidly to technological developments. However, impacts on administrative burden are mixed. At national level the additional administrative costs are expected to mostly transitional in nature. At EU level, the development of the EU network and private sector partnership are likely to require 2-3 FTEs, though the level of resources could be scaled back once tools have been deployed to about 1-2 FTE. Option 2 can however be expected to generate efficiency gains and to thus reduce administrative costs in the long term, both for operators and administrations. 5.3. Impacts of Policy Option 3 – "EU System Upgrade". 5.3.1 Option 3 would involve firstly a modernisation of existing control provisions, which impact can be assessed as follows: 5.3.1.1 The clarification of key legal provisions would streamline the export process and save exporters time and money by reducing confusion over definitions and legal concepts and improving legal clarity and predictability. Such legal revisions would not only be beneficial in terms of simplification of the rules , but should also bring benefits in terms of security, as potential loopholes can be closed. For example, the Regulation's provisions could be revised to ensure that a competent authority is always identified, including in situations when no license will be granted. Most respondents to the public consultation agree that a clarification of legal provisions would increase the