News

ITAR Registration: What It Actually Means for Your Defense Supply Chain

Jun 18, 2026

The new supplier checked every box. AS9100D on the wall, tight-tolerance capability, competitive pricing, a clean on-time delivery history.

The new supplier checked every box. AS9100D on the wall, tight-tolerance capability, competitive pricing, a clean on-time delivery history. Procurement added them to the approved-supplier list, the program awarded, and the drawing package went out on a Friday.

The following Wednesday, legal flagged it: the supplier wasn't ITAR-registered. Those drawings are export-controlled technical data, and they'd just been transmitted to a company with no legal basis to receive them. Now the program isn't just delayed, there's a potential violation to assess, disclose, and remediate.

This happens more often than anyone admits, and it usually happens the same way: ITAR shows up as a line on a credential sheet, and nobody asks what it actually means.

What ITAR actually is

The International Traffic in Arms Regulations are administered by the U.S. State Department's Directorate of Defense Trade Controls (DDTC). They control the export of defense articles, defense services, and critically for manufacturing the technical data behind anything on the United States Munitions List (USML categories I–XXI).

Two things make ITAR different from the quality certs on a supplier's wall. First, registration is mandatory, not voluntary: any U.S. company that manufactures defense articles must register with the DDTC, whether or not it ever ships a part overseas. Second, "export" doesn't only mean sending something abroad. Releasing technical data to a foreign person including a foreign-national employee standing on a shop floor in Ohio, is a deemed export. The drawing never has to leave the building for a violation to occur.

What registration actually requires on the floor

The DDTC registration number is the visible part. The compliance program behind it is what matters:

Physical access controls — controlled production areas, badge access, visitor logs and escorts.
Personnel screening — verification of U.S.-person status; an Empowered Official who owns the program; a documented process (and licensing path) for any dual- or foreign-national who would need access.
Data control — controlled drawings stored, transmitted, and destroyed under a technology control plan; Technical Assistance Agreements before any data crosses to a foreign party.
Training — floor and front-office staff who can recognize controlled data and know what triggers a licensing question.

This is why "we follow ITAR" and "we are ITAR-registered" are different claims. The first is a sentiment. The second is a filed, annually renewed registration you can verify backed by infrastructure that shapes who badges into which areas, who opens which drawings, and how data moves through the building.

What it means for your supply chain

An ITAR-registered supplier can legally receive controlled technical data and sit on the bill of materials for an export-controlled program. An unregistered one cannot and a single unregistered supplier breaks the chain, no matter how strong everyone else's compliance is.

That's why primes audit ITAR down through the supply base: supplier surveys, ITAR clauses in purchase orders, DFARS flow-downs. And it's why the sub-tier question matters most. When your machine shop sends a part out for plating or heat treat, the controlled drawing often travels with it. If that sub-tier isn't registered, your machine shop just created your violation.

The common gaps

The failures we see are rarely malicious. They look like: a shop that "follows ITAR" but never filed a registration; a registration that quietly expired; a foreign-national employee with full network access to controlled drawings and no license; a shop that received an ITAR drawing package from a customer years ago without realizing it triggered a registration requirement and has been unregistered and noncompliant ever since.

Four questions to ask before you source

What is your DDTC registration number and expiration date? Registration renews annually — an expired number means the gate is closed.
How do you handle foreign nationals who need access to controlled drawings or production areas? The answer should reference screening, a technology control plan, and licensing — not "we don't really have any."
What ITAR flow-down language goes into your sub-tier POs — plating, heat treat, finishing — and how do you verify it?
When was your ITAR compliance program last audited, and by whom?

A supplier who answers in specifics is running a compliance program. A supplier who answers in generalities is hoping the question doesn't come up.

The work demands it

BoldX has been ITAR-registered and actively compliant since before most of our customers asked. The registration, the physical controls, the personnel screening, and the training are all in place because we built the shop around the kind of work that demands them. We've machined in Batavia, Ohio since 1957. Defense programs aren't a sideline here; they're the work.

Safety First. Compliance Always.

If you're sourcing an ITAR-controlled program and need a domestic supplier where compliance is already infrastructure — send the RFQ. We typically quote within a week of receiving drawings.

BoldX Industries

NADCAP-accredited under AC7108. AS9100D certified. ITAR-registered. Precision machining, value-added assembly, and QPL-qualified circular hermetic connectors for MIL-DTL-5015, 38999, 83723, and 26482. Batavia, OH. U.S. owned and operated. getboldx.com

If you are qualifying a connector supplier for a flight-critical program and want a walkthrough of our QPL scope, our most recent audit posture, and how we support first-article packages, I'm reachable directly.