Posture assessment, Internal Compliance Programme build, and end-user / end-use due diligence under the Export Control Order, the EU Dual-Use Regulation and the UK sanctions regime.
The boundary protects the client and keeps the work durable under regulator scrutiny. State it. Hold to it.
Whether the Internal Compliance Programme would withstand an ECJU compliance visit, a prime contractor audit or a licence renewal. Scored across the seven ICP elements recognised by ECJU and EU dual-use guidance.
Where findings are material, or where there is no programme at all, we build the ICP. Policies, procedures, screening protocols, training, recordkeeping, audit framework, handover to the ECJU senior officer.
For specific shipments, the management-system due diligence. Red Flag analysis per ECJU end-user guidance, restricted-party screening against UK OFSI, EU and UN consolidated lists, diversion risk, evidence pack for the file.
Programmes decay. Counterparty risk shifts. Sanctions lists update. Where the work continues past first build, a quarterly governance retainer keeps the programme current and the screening cadence live.
Each runs through the six-gate quality system from intake to handover. Final scope, sequencing and fee are set at engagement letter.
If the ECJU, OFSI or a prime walked in tomorrow, would the export controls hold up? A maturity read against the seven ICP elements.
Where findings are material, or where no programme exists. The ICP built end-to-end, handed over to the senior officer.
Per-transaction due diligence on consignee, end-user and ultimate consignee. The evidence pack for the file, the decision record for the client.
The UK strategic export-controls surface, the EU dual-use regime, the sanctions overlay, and the supplier-side assurance frameworks that travel alongside.
The UK strategic export controls regime. Military List, dual-use schedule (post-Brexit retained law from EU 2021/821), trade controls and the extraterritorial provisions binding UK persons. Where the ECO 2008 applies, ICP scope expands accordingly.
The EU dual-use regime applying to EU-incorporated operations. Annex I control list, catch-all controls under Article 4, cyber-surveillance controls, the brokering definition, and the explicit ICP expectation under Article 2(21). Drafted within for EU-side operations.
UK financial sanctions administered by the Office of Financial Sanctions Implementation. UK Sanctions List, country and thematic programmes, reporting obligations under SAMLA 2018. Travels alongside the export-controls regime in every transaction-level due diligence.
NATO supplier quality assurance for design, development, production and software. AQAP-recognised programmes hold a different evidence shape from ISO 9001-only programmes. Drafted within where the contract surface requires it.
The MoD security and cyber-assurance surface that travels with the contract. Defence cyber risk profile tier and the supplier baseline expectations under DCPP, and the Cyber Essentials Plus expectation common to MoD-flow-down PQQs.
Most defence-sector transactions land in more than one regime. The ICP is built to recognise this, not to ignore it.
A UK-incorporated supplier wins a flow-down contract to a US prime contractor. The goods, services or technical data may be subject to ITAR or EAR on the US side alongside the UK Export Control Order, and DFARS cyber expectations under the prime's flow-down clauses.
The ICP must hold both regimes simultaneously: a single management system, two regulator audiences, one consistent set of records.
An EU-incorporated supplier incorporates US-origin content into a product destined for an EU end-user. The EU side is subject to the Dual-Use Regulation; the US-origin content carries forward EAR re-export and re-transfer obligations regardless of the supplier's domicile.
The ICP must track US-origin content through the product structure and apply EAR re-export discipline alongside the EU 2021/821 management-system expectations.
Where exposure is genuinely dual, the diagnostic (C-07) is scoped to both regimes from the outset. The programme build (C-08) produces one set of artefacts that hold under either audience. The per-transaction work (I-07) screens against both list sets in a single pass. See also ITAR & EAR → for the US framings.
Honest indicators that this work is the right step right now.
A prime contractor has issued a supplier questionnaire on export controls or cyber, and the answers cannot honestly be given today.
A SIEL or OGEL is up for renewal, or a fresh licence application is approaching, and the supporting programme needs to look the part.
A specific shipment, sale or technology transfer is on the table, and the end-user / end-use needs to be diligenced before it ships.
The regime, the trigger, the timeframe. We'll come back with a scoped C-07, C-08 or I-07 and the boundary written plain.