A prime’s supplier onboarding form asks for one number: your DDTC registration code. Your team builds deployable booms and has never shipped anything overseas, so nobody registered. The purchase order stalls. Then your counsel asks a harder question: how long have you been manufacturing Category XV hardware without one?
ITAR registration is the obligation NewSpace teams miss most often, because it has nothing to do with exporting. Under 22 CFR 122.1, manufacturing a defense article in the United States is enough. And with DDTC’s “specially designed” rewrite open for comment until 30 November, whether you need to register at all may depend on BOM lines whose classification is about to be revisited.
What triggers the ITAR registration requirement
The rule is short, and it does not care whether you export. 22 CFR 122.1(a) requires anyone who engages in the United States in the business of manufacturing, exporting or temporarily importing defense articles, or furnishing defense services, to register with DDTC. Being “in the business” takes only one occasion of manufacturing. The regulation says it plainly: a manufacturer that does not engage in exporting must still register.
“Defense article” is where space hardware teams get caught. USML Category XV covers spacecraft, and it reaches parts and components through the “specially designed” catch-all. A bracket machined to fit a controlled bus, or a hinge built for a controlled array, can make your company a manufacturer of defense articles without anyone deciding that it should. We walked through how that catch-all works, and how DDTC proposes to narrow it, in the “specially designed” rewrite and the BOM re-review trap.
Registration is not a license, but it sits in front of every license. Section 122.1(c) says registration confers no export rights. It is, however, generally a precondition for DDTC approving anything. The first time you need a DSP-5, a TAA, or authorization for a foreign national engineer to see technical data, registration moves onto the critical path. Teams that wait until then add weeks to a timeline that is already tight, a problem we covered in the ITAR deemed export trap and the remote engineering risk.
The cost of compliance is small compared with the cost of the gap. New registrants pay the Tier 1 fee of $3,000 per year under 22 CFR 122.3. Manufacturing without registration is a violation in its own right, separate from any unauthorized export, and it is the kind of finding that surfaces at the worst moment: supplier qualification, a financing round, or acquisition diligence.
Three assumptions that leave teams unregistered
The first is “we are still in R&D.” Section 122.1(b)(4) exempts persons who engage only in the fabrication of articles for experimental or scientific purposes, including research and development. The important word is “only.” Once you build flight units for a paying customer, run a production contract, or sell a qualified product line, the exemption no longer describes your business. A company can drift out of it gradually, with no single day when anyone notices. Note also that the exemption is from registration, not from licensing: an exempt company that later needs an export license must register first.
The second is “we only produce technical data.” Section 122.1(b)(2) exempts persons whose business is limited to producing unclassified technical data. That fits a pure design consultancy. It does not fit a company that designs a subsystem and also builds, integrates or tests it in-house.
The third is “our machine shop is registered.” Registration attaches to each person engaged in the regulated activity. Your supplier’s registration covers your supplier. If your team assembles, integrates or modifies controlled hardware in your own facility, that work counts on its own, whatever your suppliers’ status.
Why the 30 November deadline matters for your registration
Your registration status is only as accurate as your classifications. Whether you must register turns on whether anything you build is a defense article. If every USML item you make is caught only by the “specially designed” catch-all, and those parts fall within the releases DDTC has proposed, a final rule could change whether you need to register at all. If even one enumerated item remains on the list, nothing changes. Your obligation stays.
That is a reason to look now, not a reason to wait. A proposed rule changes nothing until DDTC publishes a final rule. If you manufacture defense articles today, the requirement applies today. But the same exercise answers both questions at once: split your BOM into enumerated USML lines and catch-all lines, and you will know whether you should already be registered and how a final rule could change that. The comment window on docket DOS-2026-0991 closes on 30 November, and it is the last chance to influence which parts get released.
If the review shows you should have registered, the order of steps matters. First, scope the gap: what you manufactured, when, and for whom, along with any exports or technical data releases made along the way. Second, register. Third, talk to export counsel about a voluntary disclosure under 22 CFR 127.12, which DDTC treats as a mitigating factor when it decides penalties. The alternative is DDTC finding the gap first, and we have set out what that remediation bill looks like in ITAR consent agreements and the remediation bill startups can’t absorb.
Expect investors and acquirers to ask. Registration status is one of the first export control questions in a diligence checklist, because it is easy to check and hard to explain away. A company that cannot show why it is, or is not, registered hands the buyer a reason to hold back part of the price.
The question to ask your team this week
Registration is one of the cheapest ITAR obligations to meet and one of the most expensive to miss. The teams that get it right can answer one question quickly: for every USML line you build, can you show whether it is enumerated or caught by the catch-all, and does that answer match your registration status?
If the answer is no, you are carrying unnecessary regulatory risk. We built Astrolytics specifically to eliminate this blind spot, giving you a classification register that ties every BOM line to its USML basis so you can prove, line by line, that your registration status matches what you actually build. See how we secure your mission architecture at astrolytics.space.