Posture assessment, Internal Compliance Programme build, and end-user / end-use due diligence under the Export Control Order, the EU Dual-Use Regulation and the UK sanctions regime.
The role is advisory and it stays advisory. We do not classify goods, rate against the control list, or opine on whether a licence is needed. That discipline is what keeps the work usable in front of the ECJU.
Whether the Internal Compliance Programme would stand up to an ECJU compliance visit, a prime contractor audit or a licence renewal, read element by element against ECJU and EU dual-use guidance.
When the diagnostic surfaces material gaps, or there is no programme to assess, we build one: policies, procedures, screening protocols, training, recordkeeping and an audit framework, handed to the designated senior officer with the SPIRE / LITE record in order.
For a specific shipment or transfer, the management-system due diligence: red-flag analysis under ECJU end-user guidance, screening against the OFSI consolidated list with EU and UN overlays, a diversion-risk view, and an evidence pack that goes on the file.
Sanctions designations move faster than annual reviews. A quarterly governance retainer keeps procedures current, the screening cadence live, and the programme ready for the next compliance visit.
All three run through the six-gate quality system from intake to handover; scope, sequencing and fee are fixed in the engagement letter.
If the ECJU, OFSI or a prime walked in tomorrow, would the export controls stand up? A structured read of programme maturity, element by element.
Where findings are material, or where no programme exists. The ICP built end-to-end, handed over to the senior officer.
Due diligence on consignee, end-user and ultimate consignee for a specific transaction, producing the evidence pack for the file and a signed decision record.
The UK strategic export-controls surface, the EU dual-use regime, the sanctions overlay, and the supplier-side assurance frameworks that travel alongside.
The UK strategic export controls regime. Military List, dual-use schedule (post-Brexit retained law from EU 2021/821), trade controls and the extraterritorial provisions binding UK persons. Where the ECO 2008 applies, ICP scope expands accordingly.
The EU dual-use regime applying to EU-incorporated operations. Annex I control list, catch-all controls under Article 4, cyber-surveillance controls, the brokering definition, and the explicit ICP expectation under Article 2(21). Drafted within for EU-side operations.
UK financial sanctions administered by the Office of Financial Sanctions Implementation. UK Sanctions List, country and thematic programmes, reporting obligations under SAMLA 2018. Travels alongside the export-controls regime in every transaction-level due diligence.
NATO supplier quality assurance for design, development, production and software. AQAP-recognised programmes hold a different evidence shape from ISO 9001-only programmes. Drafted within where the contract surface requires it.
The MoD security and cyber-assurance surface that travels with the contract. Defence cyber risk profile tier and the supplier baseline expectations under DCPP, and the Cyber Essentials Plus expectation common to MoD-flow-down PQQs.
A UK or EU supplier rarely faces one regime in isolation. The programme is designed with that overlap in view.
A UK-incorporated supplier takes a flow-down contract from a US prime. On the UK side the Export Control Order governs the export; on the US side the same goods, services or technical data may fall under ITAR or EAR, with DFARS cyber expectations arriving through the prime's flow-down clauses.
One management system has to satisfy two regulator audiences with a single, consistent set of records.
An EU-incorporated supplier incorporates US-origin content into a product destined for an EU end-user. The EU side is subject to the Dual-Use Regulation; the US-origin content carries forward EAR re-export and re-transfer obligations regardless of the supplier's domicile.
The ICP must track US-origin content through the product structure and apply EAR re-export discipline alongside the EU 2021/821 management-system expectations.
Where exposure is genuinely dual, the diagnostic covers both regimes from day one, the programme build produces artefacts that stand in front of either audience, and each transaction is screened against both list sets in one pass. See also ITAR & EAR → for the US framings.
Three situations that put this work on the desk.
A prime contractor's questionnaire on export controls or cyber has arrived, and the answers are not yet ones you would want on the record.
A SIEL or OGEL is up for renewal, or a fresh licence application is approaching, and the supporting programme needs to look the part.
A shipment, sale or technology transfer is close to contract, and the end-user and end-use need to be diligenced before anything moves.
Tell us the regime and what prompted the question. You'll get back a scoped diagnostic, programme build or per-transaction engagement, and the boundary in writing.