BIS annual self-classification report for exempt mass-market encryption
Parent: Mac App Store Readiness: Residual Gaps for Sandboxed Monitors · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for BIS annual self-classification report for exempt mass-market encryption. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- Mass-market 5D992.c executable software and stand-alone toolkits/development kits no longer need the Feb 1 report, except where they implement non-standard cryptography. Only a limited set of mass-market components, and non-standard-crypto items, still require it. (high confidence) [source]
- Under 15 CFR 740.17(e)(3), the report covers mass-market components meeting Cryptography Note 3 (5A992/5D992) and non-mass-market 5A002/5B002/5D002 items self-classified under ENC. Reports for items exported in a calendar year must be received by February 1 of the following year. (medium confidence) (verified as of 2024-02-01) [source]
Facts and statements
- Effective 29 March 2021, BIS eliminated the annual self-classification report for most mass-market encryption items, and the email notification for publicly available encryption source code (except non-standard cryptography). (high confidence) [source]
- DWT's 2024 reminder defines mass-market products to include consumer apps and retail software, and excludes ECCN 5A992.c/5D992.c items from the Feb 1 report. (low confidence) (verified as of 2024-02-01) [source]
- Apple's export compliance guide says apps using standard encryption algorithms or OS crypto still need an export compliance determination. Apple defines non-exempt (non-standard) encryption as proprietary or unpublished cryptography not adopted by a recognized standards body (IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, GSMA). If no documentation is required, set the Info.plist key so App Store Connect stops asking at each submission. (medium confidence) [source]
- The Apple export-compliance overview page, as fetched, does not mention an annual self-classification report or name ITSAppUsesNonExemptEncryption. The report obligation is a BIS matter, not enforced by App Store Connect. (low confidence) (verified as of 2026-10-02) [source]
Children
- No children recorded.