ITAR-Registered Milling Shops for Defense-Controlled Machined Parts

The International Traffic in Arms Regulations (22 CFR 120-130) are administered by the Directorate of Defense Trade Controls (DDTC) within the State Department. Any US person who manufactures defense articles, even if they never export, must register with DDTC under 22 CFR Part 122. So when a milling shop says it is ITAR registered, the precise meaning is that it has filed a Statement of Registration (Form DS-2032), paid the annual fee, and holds a current registration code. That is the floor, not the whole picture. Registration is mandatory for manufacturers of items on the United States Munitions List (USML), the 21 categories at 22 CFR Part 121 that include military aircraft and parts (Category VIII), launch vehicles and missiles (IV), firearms (I), and ground vehicles (VII), among others. A milling shop cutting a part defined on the USML is a manufacturer of a defense article and must be registered regardless of whether it ever ships overseas. Critically, registration by itself confers no export authorization; any actual export of hardware or technical data requires a separate license (DSP-5, DSP-73) or a recognized exemption. What registration does not do is certify quality, validate processes, or guarantee tolerances. A shop can be ITAR registered and a poor machinist. That is why defense milling almost always pairs ITAR registration with a real quality system, typically AS9100 for flight hardware, so the buyer gets both lawful data handling and engineering competence. Treat ITAR as the gate that lets the supplier touch the work, and a quality cert as the proof it can do the work.

For a milling shop, the heaviest ITAR burden is rarely the parts themselves; it is the technical data. Drawings, models, specifications, tooling data, and process instructions for a USML item are ITAR-controlled technical data under 22 CFR 120.10. Disclosing that data to a foreign person, even one standing on the shop floor in the United States, is a deemed export and requires authorization. This drives concrete controls: US-person-only access to controlled drawings, segregated or access-controlled servers, restricted areas around machines running controlled jobs, visitor controls, and personnel screening to establish US-person status. Cloud and IT handling is a frequent failure point. Technical data stored or transmitted through systems accessible to foreign persons can constitute an unauthorized export. Compliant shops use access-controlled, often US-based and sometimes ITAR-aware cloud environments, and many defense primes now also require CMMC and NIST SP 800-171 controls on top of ITAR for protecting controlled unclassified information. ITAR and CMMC overlap but are distinct; a shop can be ITAR registered and still fail a CMMC assessment. Flow-down is the other obligation buyers should verify. If the milling shop sends your controlled part out for plating, heat treat, or NDT, the controlled technical data and the article travel to that subcontractor, who must also be a compliant US person or registered manufacturer. A clean ITAR posture at the prime machine shop means nothing if the anodize vendor downstream is uncontrolled. Confirm the supplier has a documented technology control plan and controls its supply chain, not just a registration code.

The single most common and costly mistake in defense milling is jurisdictional miscategorization, assuming a part is ITAR-controlled when it is actually EAR-controlled, or the reverse. Export Control Reform moved many military-derived but less sensitive items off the USML and onto the Commerce Control List under the Export Administration Regulations, administered by the Bureau of Industry and Security. The USML now uses a positive-list, often specially-designed standard, and many brackets, fasteners, and generic machined components that feed military programs are actually EAR 9A610 or similar, not USML. Getting this wrong cuts both ways. Treating an EAR part as ITAR wastes money on unnecessary controls and can needlessly restrict your supplier pool. Treating an ITAR part as EAR, or worse as uncontrolled, exposes both buyer and shop to serious civil and criminal penalties, with ITAR violations historically reaching into the millions per violation. The jurisdiction is determined by the technical characteristics of the item and the governing specification, and when in doubt a Commodity Jurisdiction request to DDTC settles it authoritatively. For the milling buyer, the practical discipline is to know your part's jurisdiction and classification before sourcing, communicate it on the PO, and confirm the supplier's registration and controls match. An ITAR-registered shop is the right home for a confirmed USML part. For an EAR part, you want a shop competent in EAR compliance and the relevant ECCN, which may or may not also be ITAR registered. Do not let a supplier's marketing claim of being ITAR registered substitute for your own determination of what the part actually is.