Content developed with the assistance of AI tools and reviewed by the author.
What technology exporters, manufacturers and distributors with Italian operations get wrong — and why the new 2026 criminal penalties make each error harder to absorb
An Italian subsidiary receives an order for industrial laser equipment from a trading company in a third country. The end-customer is unnamed. The sales team checks the HS tariff code, finds no specific import restriction, and ships. Three months later, the Guardia di Finanza — Italy's financial and trade police — opens an investigation. The laser equipment exceeded the technical thresholds in Annex I of Regulation (EU) 2021/821 (the EU Dual-Use Regulation). No licence was sought. The company's directors face personal criminal exposure under legislation that entered into force in Italy on 24 January 2026. That case is not hypothetical: it is the pattern UAMA (the Unità per le autorizzazioni dei materiali di armamento, Italy's national export-control authority within the Ministry of Foreign Affairs) flags repeatedly in enforcement guidance.
The question is not whether dual-use controls apply to your business — they almost certainly do, whether to a product in your range, software on your platform, or a technical transfer your engineers make by email. The decision is whether to map that exposure now or wait for a shipment to be stopped.
Until this year, violating Italy's dual-use export rules was serious but largely an administrative matter for most companies. That changed with Legislative Decree No. 211 of 30 December 2025 (D.Lgs. 211/2025), published in the Official Gazette on 9 January 2026 and in force from 24 January 2026. The Decree implements EU Directive 2024/1226 on criminal offences and penalties for the violation of Union restrictive measures, and introduces a negligent offence covering grossly negligent violations involving the import, export, trade, transport, or transfer of dual-use products listed in Annexes I and IV of Regulation (EU) 2021/821.
The numbers matter. For entities, the new legislation imposes criminal fines ranging from 1% to 5% of total worldwide turnover for the financial year preceding the offence, or up to EUR 40 million where turnover cannot be determined — thresholds that far exceed the previous maximum of EUR 1,549,000 under Legislative Decree 231/2001. For individuals, violation of authorisation conditions under new Article 275-quater of the Italian Criminal Code carries imprisonment from two to five years and a fine from EUR 25,000 to EUR 150,000.
The Decree also introduces a negligent tier. Article 275-quinquies adds a negligent offence related to transfers of sensitive items, punishable by imprisonment from six months to three years and a fine of between EUR 15,000 and EUR 90,000. Gross negligence is enough. You do not need intent to commit a crime. You need only to have failed to check.
The most common error in our files is the one from the opening scenario: the finance or logistics team runs an HS (Harmonised System) tariff code check, finds no obvious flag, and treats that as a dual-use clearance. It is not. An HS code is a customs classification used for tariff and statistical purposes; on its own it does not determine whether an item is subject to dual-use controls.
Classification under Regulation (EU) 2021/821 turns on Delete the second sentence entirely as a duplicate of the first. A company manufacturing precision sensors, cryogenic components, or semiconductor equipment must run a separate technical assessment against Annex I of the Regulation, now in its updated form under Commission Delegated Regulation (EU) 2025/2003.
Delegated Regulation (EU) 2025/2003 was published in the Official Journal on 14 November 2025 and entered into force on 15 November 2025, comprehensively revising Annex I of the Dual-Use Regulation. The update added quantum computers, electronic components designed to work at cryogenic temperatures, parametric signal amplifiers, cryogenic cooling systems, cryogenic wafer probers, atomic layer deposition equipment, equipment and materials for epitaxial deposition, lithography equipment, extreme ultra-violet pellicles, masks and reticles, scanning electron microscope equipment and etching equipment. Complete the truncated sentence.roduct falls in any of those categories and your last classification was done before November 2025, it is out of date.
Yes — and this is the layer most foreign companies miss entirely.
On 1 July 2024, Italy's Minister of Foreign Affairs published a decree adopting national controls on non-EU listed items, introducing controls on exports, brokering, and technical assistance services for three specific categories: Category 2 (Materials processing), Category 3 (Electronics) and Category 4 (Computers), under Article 9 of Regulation (EU) 2021/821. That Article allows Member States to impose an authorisation requirement on items not listed in Annex I for reasons of public security or human rights considerations. Italy used it. Italy's national list covers, among other things, equipment for additive manufacturing of metal components, cryogenic CMOS integrated circuits, dry etching equipment, extreme UV masks, silicon/germanium epitaxial materials, and quantum computers divided by qubit count and error specifications.
A foreign manufacturer who has classified its equipment against Annex I and found no match may still require a UAMA authorisation to export from Italy if the item falls within Italy's national list. The two checks are separate.
Regulation (EU) 2021/821 is not limited to requiring authorisation solely for the export of listed items contained in Annex I. Article 4 introduces the catch-all clause, which extends the authorisation obligation to dual-use items not included in Annex I if the exporter knows, or has reason to suspect, that such items may be used for the production or development of weapons of mass destruction or for military use in countries subject to international embargoes. This imposes an enhanced duty of care: the exporter must verify, accurately, both the identity of the end-user and the declared effective use of the goods.
The catch-all is where the red-flag system becomes legally binding. Red flags identified by European Commission guidance include: requests for unusual customisations or technical characteristics not justified by the market; incomplete information on the end-user; new customers or companies that declare civilian use but are connected to the military sector; requests for atypical shipping methods; and suspicious economic conditions such as full advance payment in cash or refusal of after-sales services.
An exporter may not deliberately ignore apparent indications; it is improper and may be tantamount to awareness to wilfully look away and intentionally pass up an obvious opportunity to note something any other person in that position would have perceived. The test is objective. "We did not know" is only a defence if the company had a process for finding out.
Export controls do not apply only to hardware. In the technology sector, software and "technology" — the information required for the development, production, or use of a product — are equally regulated. Emailing technical blueprints or providing remote cloud access to controlled software to a person in a non-EU country constitutes an "export" that may require a licence.
Unlike in most common-law jurisdictions, where export control enforcement has historically focused on physical shipments at the border and where "deemed export" liability for digital transfers is primarily a US concept, Italian and EU law captures electronic transmissions within the definition of export. The Italian customs authority (the Agenzia delle Dogane e dei Monopoli, ADM) has intensified export control enforcement alongside financial sanctions enforcement, increasing inspections of export documentation, end-user certificates and post-shipment verification for dual-use goods. An engineer in Milan who e-mails a controlled design file to an engineer in a third country is, in legal terms, an exporter. If no licence covers that transfer, there is a violation.
Implementing an Internal Compliance Programme (ICP) is no longer optional for companies seeking certain types of General Export Authorisations and is highly recommended for all technology exporters to mitigate legal risks. UAMA expects an ICP as a condition for access to the most efficient licensing routes.
What goes into a proper ICP? The key elements include: commitment of top management through an official compliance policy; a clear organisational structure including the appointment of a compliance officer for dual-use exports; periodic training for personnel involved in export processes; verification procedures covering item classification, end-user assessment and authorisation management; and internal audit mechanisms and continuous monitoring tools including whistleblowing channels for any violations.
If a violation of the Regulation constitutes a predicate offence, the administrative liability of the entity may be activated pursuant to Legislative Decree 231/2001, with the consequent application of financial penalties and disqualifications. An ICP that was adopted in writing, trained to staff and audited reduces exposure under Legislative Decree 231/2001 precisely because it demonstrates the company did not organisationally enable the offence.
A UAMA individual licence application for a single controlled export typically takes between 30 and 90 days to process, depending on the destination country and the sensitivity of the item. Build that lead time into your transaction timetable before signing commercial contracts.
The primary regulatory body in Italy is UAMA, located within the Ministry of Foreign Affairs and International Cooperation. UAMA handles the licensing decision. But enforcement arrives from a different direction. The Italian Customs and Monopolies Agency (ADM) enforces trade sanctions and export controls at the border, coordinating with the Ministry of Foreign Affairs which issues dual-use export licences. The Guardia di Finanza conducts investigations into financial crimes including sanctions evasion; it has broad investigative powers and works alongside prosecutors in criminal proceedings.
Three agencies, three different entry points for an investigation. A foreign company that deals exclusively with UAMA and ignores the ADM's documentary requirements at the point of physical shipment — or the Guardia di Finanza's red-flag monitoring — can have an authorisation in its files and still face a criminal inquiry if the export documentation and the end-user certificate do not align. UAMA and the Guardia di Finanza utilise sophisticated data monitoring systems that flag shipments of sensitive HTS codes.
Nemo ignorantia iuris excusatur — no one is excused by ignorance of the law. The maxim has particular force here: the Delegated Regulation updating Annex I was published in the Official Journal, UAMA published its national list, and the criminal penalties decree was published in the Official Gazette, all within the last twelve months. The law was made available. The question is whether the company read it.
As the novelist John le Carré once observed, the desk officer who does not look at the file has made a choice, not an omission. Compliance programmes fail for the same reason: the person with the authority to check decides, implicitly, not to.
Start with a product classification audit. Take every item in your Italian entity's export portfolio and run it against current Annex I — the version in force since 15 November 2025 — and Italy's national control list published on 1 July 2024. Note that the European Commission adopted a further draft delegated regulation on 14 September 2026, which will amend Annex I again once published in the Official Journal; confirm that date and re-audit immediately on publication.
For any item that hits a control, check whether a General Export Authorisation (available under Annex II of the Regulation for certain destinations and items) covers the shipment or whether you need an individual UAMA licence. If you need a licence, allow 30 to 90 days. Do not sign a delivery contract before knowing which route applies. For every export, obtain and keep a written end-user certificate. Records of dual-use transfers must be maintained for a minimum of three years after the end of the year in which the transfer occurred.
If your company has no written ICP, commission one before the next shipment. If it has one, verify it addresses the November 2025 Annex I update and the 24 January 2026 criminal liability changes. Then brief the director or officer whose name would appear on a licence application — because under the 2026 rules, that is the name that appears in a criminal indictment if the compliance process breaks down.
Does the EU dual-use licence from another Member State cover exports from Italy?
A General Export Authorisation (EU GEA) issued under Annex II of Regulation (EU) 2021/821 operates across the EU; a company established in Italy can use it for shipments from Italy where the GEA covers the destination and item. An individual or global export authorisation, however, is granted by the competent authority of the Member State where the exporter is established, which for an Italian entity is UAMA. A licence issued by, say, the German BAFA to a German entity does not authorise shipments by a separate Italian legal entity. Corporate groups with multi-country operations must map licences to the entity and country of export, not to the group.
What happens if we shipped a controlled item without a licence before 24 January 2026?
The criminal liability regime in force from 24 January 2026 applies to violations committed after that date. Pre-January 2026 violations remain subject to the framework then in force, which was primarily administrative for unlicensed exports, though some conduct could already attract criminal liability. If your review reveals a past unlicensed shipment, the appropriate step is to take legal advice on voluntary disclosure to UAMA before an investigation commences, as early engagement with the authority consistently produces better outcomes in Italian administrative and criminal proceedings than a company discovered in the course of an inquiry. Do not reconstruct or alter records.
We ship industrial machinery, not weapons. Why would dual-use controls apply to us?
Dual-use controls apply to capability, not to the product's marketing description or primary commercial purpose. This is a dangerous misunderstanding: dual-use regulations focus on the capability of the item, not just its intended use. Even if you sell high-performance sensors to a hospital, if those sensors exceed the technical thresholds in Annex I, they are controlled. Precision machine tools, lasers, vibration test equipment, high-performance computing components, and certain chemicals all appear in Annex I regardless of the industry they are sold into. The classification exercise is mandatory; it is not optional for manufacturers who consider themselves civilian-sector businesses.
HREFLANG BLOCK:
Editorial Team — Panato Law Firm Staff
