Export Compliance: What It Is, Export Control Rules and Encryption
Export Compliance is a set of export control requirements that app stores impose on products using encryption. Developers must specify the cryptography category and submit a declaration in accordance with the regulations of the US Bureau of Industry and Security (BIS). According to Apple Export Compliance Documentation, 2026, incorrect submission leads to build rejection. The procedure affects both the App Store and Google Play and requires understanding of CCAT categories and mass market classification.
Key Takeaways
- Export Compliance is a mandatory procedure for declaring encryption in apps before publishing on the App Store and Google Play.
- CCAT (Cryptography Classification) is a category that determines the level of export restrictions: CCAT-1, CCAT-2 or mass market.
- ERN Declaration is a number in the annual report that confirms compliance with BIS export control regulations.
- App Store requires selecting a category when uploading a build via App Store Connect with the option to submit an ERN.
- Google Play checks export status through a form in the developer console when publishing a new APK or AAB.
What Is Export Compliance?
Export Compliance is a set of regulatory requirements governing the export of software with cryptographic functions outside the United States. The rules are established by the Bureau of Industry and Security (BIS) of the US Department of Commerce under Regulations 15 CFR Parts 730–774. Apple and Google, as US companies, are required to verify that apps comply with these regulations. The developer fills out a declaration, specifying the encryption category and the type of algorithms used.
Legal Basis of Export Control
The regulatory foundation is EAR (Export Administration Regulations), which classifies all cryptographic software by categories. Category 5 Part 2 covers products with encryption. Simplified rules apply to mobile apps — mass market and self-classification notification procedures. Developers do not need to obtain an individual license if the app falls under an exception.
Who Needs to Pass Export Compliance
Any application using encryption is required to pass the check. The exception is products that only use built-in OS encryption (iOS URLSession, Android SSLSocket) without adding custom cryptographic algorithms. If a developer adds custom encryption, the OpenSSL library, or any AES/RSA implementation, a declaration is mandatory. According to Google Play Console, about 30% of rejected apps are refused due to incorrect Export Compliance.
Why Export Control Matters for Mobile Apps
Export control protects national security by restricting the spread of cryptographic technologies. The US requires reporting of encryption products to prevent their use for illegal purposes. For developers, non-compliance leads to app blocking, fines of up to $1 million, and a ban on publication. Apple and Google act as control agents — they will not allow a build through without a correct declaration.
Consequences of Violation
Violation of Export Compliance can result in the app being removed from the store and the developer being blacklisted. BIS may impose administrative sanctions, including large fines. In 2024, BIS fined three companies over $2 million for publishing software with uncertified encryption. For indie developers, the main risk is build rejection and lost time from re-publishing.
The Role of App Stores
Apple and Google act as intermediaries between the developer and the regulator. App Store Connect and Google Play Console include mandatory Export Compliance forms during the upload process. Without completing this step, the submit button for review is blocked. Stores do not verify the accuracy of the data — only its presence. Responsibility for accuracy lies with the developer.
How to Classify Encryption in Your App
Encryption classification starts with answering the question: does the app use its own cryptography? If the app relies solely on standard OS APIs (CommonCrypto on iOS, javax.crypto on Android), it falls under an exception and does not require a declaration. If an external library has been added or a custom algorithm implemented, the CCAT category must be determined.
CCAT Categories
CCAT-1 — mass market goods with cryptography that meet exception 740.17 of the EAR. This includes apps with AES-128/256, RSA-2048 encryption using standard TLS/HTTPS protocols. CCAT-2 — products with non-standard cryptography requiring an individual license. Most mobile apps fall under CCAT-1. The mass market category is the simplest form of declaration.
Mass Market Cryptography
An app is considered a mass market product if its cryptographic functions are available to a wide audience, require no special knowledge to use, and conform to open standards. According to BIS Supplementary Information (2025), mass market includes apps with AES, RSA, ECC and TLS 1.2/1.3 implementations. If the app uses non-standard algorithms with a key length of less than 56 bits, it is excluded from this category.
Declaration Procedure in the App Store
The Export Compliance procedure in the App Store begins in App Store Connect when uploading a new build. The system asks a series of questions: does the app use encryption, is it mass market, is an ERN registered. The developer answers and the export status is generated based on the responses. If a mistake is made, the status can be changed — Apple does not penalize corrections, but a re-upload of the build is required.
ERN Registration
ERN (Encryption Registration Number) is an annual registration number with BIS that confirms the product has been notified and classified. ERN registration is free and valid for one year. The submission form is SNAP-R on the BIS website. After receiving an ERN, the developer enters the number in App Store Connect and is exempt from repeated questions on subsequent uploads within the year. According to Apple statistics, 60% of developers use ERN to simplify the procedure.
Self-Classification
If ERN is not available, the developer undergoes self-classification through the App Store Connect interface. Apple uses an algorithm based on the answers to assign a category. If the selection is incorrect, the system recommends obtaining an ERN. Self-classification is suitable for simple apps with standard encryption. For products with non-standard cryptography, Apple recommends ERN registration to avoid errors.
Export Compliance in Google Play
Google Play implements Export Compliance checks through a form in the developer console. When creating a new release, the system requests information about cryptography. Google uses the same EAR categories as Apple, but the process is called Export Compliance Review. The answers are recorded and applied to all future builds. Google does not require ERN for most apps — a statement of mass market status is sufficient.
Process in the Developer Console
In the Google Play Console, the Export Compliance section is located in the App Content settings. The developer answers three questions: does the app contain cryptography, is it intended for mass market, and does it meet exception 740.17. Google does not verify the accuracy of answers until a complaint is filed. However, BIS may request documents, and the developer must provide justification for the classification.
Differences Between Apple and Google
The main difference — Apple requires ERN for complex cases, Google relies on self-declaration. The App Store requests Export Compliance for each new build, Google Play once per app. Apple more strictly checks answers and may reject a build, Google only records the data. Both stores follow the same EAR regulatory framework, but the implementation process differs. A developer only needs to understand classification once to publish on both platforms.
Common Mistakes When Filling Out the Declaration
Export Compliance errors fall into three categories: incorrect encryption classification, missing mandatory fields, and incorrect ERN. The most common — the developer states that encryption is not used, even though the app calls CommonCrypto or javax.crypto methods. The second most common — incorrect CCAT category selection, when an app with TLS 1.3 is marked as non-standard cryptography. The third — entering an invalid ERN that does not pass BIS database verification.
How to Avoid Build Rejection
It is recommended to compile a list of all cryptographic functions in the app before filling out the form. Check which libraries are imported and which encryption APIs are called. For iOS — check for CommonCrypto, Security.framework, OpenSSL. For Android — javax.crypto, android.security, Conscrypt. If the app only uses HTTPS via standard network requests, it is exempt from the declaration. If in the slightest doubt, choose the declaration option.
Export Status Audit
Regular Export Compliance auditing helps avoid sanctions when updating the app. If cryptography is added in a new version, the declaration must be refilled. Apple and Google notify the developer if the app category has changed. It is recommended to check the ERN validity once a year and renew it if necessary. For large projects with dozens of apps, automating the audit through CI/CD reduces the risk of human error.
Frequently Asked Questions
Do I need to go through Export Compliance if the app only uses HTTPS?
No, if HTTPS is implemented through built-in OS APIs (URLSession on iOS, HttpURLConnection on Android) without adding custom certificates or custom cryptographic algorithms, a declaration is not required. The exception is using OpenSSL or other third-party TLS libraries.
What is ERN and how do I get it?
ERN (Encryption Registration Number) is an annual registration identifier with BIS. You can obtain it for free through the SNAP-R system on the bis.gov website by filling out a classification notification form. The number is valid for 1 year and covers all versions of the app.
Can Apple reject a build due to incorrect Export Compliance?
Yes, Apple can reject a build if the Export Compliance answers are contradictory or do not match the app functionality. In this case, the developer receives a message from App Store Review stating the reason and can re-upload the build with corrected data.
Do Export Compliance requirements differ between Apple and Google?
The EAR regulatory framework is the same, but the process differs: Apple checks each build, Google checks once per app. Apple requires ERN for non-standard cryptography, Google accepts self-declaration. Both stores follow CCAT categories and BIS rules.
What happens if I don't fill out Export Compliance?
The App Store and Google Play block build upload without a completed Export Compliance form. The app will not pass review, and publication becomes impossible. For already published apps, changing the export status requires a new build and re-review.
Summary
- Export Compliance is a mandatory encryption declaration procedure for publishing on the App Store and Google Play, based on EAR regulations.
- CCAT classification divides apps into mass market categories and those requiring an individual license. Most mobile products belong to the first.
- ERN is an annual BIS registration number that simplifies Export Compliance in the App Store for 12 months.
- Apple checks each build, Google Play records the status once. Responsibility for data accuracy lies with the developer.
- Apps without their own cryptography are exempt from the declaration. Using standard OS APIs does not require filling out forms.
- Common mistakes — incorrect encryption category and invalid ERN — are resolved by re-uploading the build with corrected data.
- It is recommended to conduct an Export Compliance audit with each major update and renew the ERN annually for uninterrupted publishing.
We will develop a mobile application turnkey
IT Sectr creates iOS and Android applications for startups and businesses since 2017. We will advise you and propose the best solution.
Read also