Can AI Translation Handle Dual-Use Technical Data Under EU Regulation 2021/821
Yes, but only inside a controlled, EU-hosted workflow with no public cloud. Dual-use technical data falls under Regulation (EU) 2021/821, the EU regime for exports, brokering, technical assistance, transit and transfer of dual-use items. Translate a controlled datasheet by pasting it into a free online tool and you have likely moved controlled technical data outside your perimeter. Translate it on EU infrastructure, with vetted linguists and no training on client data, and translation stays a documentation task rather than an export event.
AD VERBUM is an EU-hosted AI translation company that keeps dual-use technical data on EU infrastructure, under ISO 27001 controls, with client-tuned open-weight models and no training on client data. We pair those models with certified engineering linguists, so a datasheet, an interface specification or a maintenance manual gets a fast draft without ever leaving a controlled environment. That boundary is the whole point when the content is export-controlled.
Dual-use components are everywhere at electronica 2026 in Munich, from power semiconductors to secure IoT chips and edge AI modules. Much of the engineering paperwork behind them sits close to export control, which is why defence engineering translation and dual-use work share the same handling rules. The show runs 10 to 13 November, and the electronica 2026 programme is full of the sensor, chip and power-electronics categories that end up on the control list.
What Regulation (EU) 2021/821 actually controls
Dual-use items are goods, software and technology that can serve both civilian and military use. Regulation (EU) 2021/821 (adopted 20 May 2021, a recast of 428/2009) sets the common EU control list and authorisation types, as the European Commission's guidance for exporters explains. Annex I is the list of controlled items. Annex IV covers the most sensitive items, which need authorisation even for a transfer inside the EU. Commission Delegated Regulation (EU) 2025/2003, published in the Official Journal on 14 November 2025, updated that Annex I, so the list a document maps to can move under you.
The part that catches translation sits in the definitions. Article 2(9) of the Regulation defines technical assistance as any technical support related to repairs, development, manufacture, assembly, testing or maintenance, and it names the forms that support can take: instruction, advice, training, and the transmission of working knowledge or skills, including by electronic means. Read that line against a translation project. Handing a controlled specification to a linguist, and getting back a rendered version, is a transmission of working knowledge by electronic means. That is the EU analogue to the United States concept of a deemed export.
National competent authorities enforce this, not Brussels. BAFA in Germany, DGA in France and UAMA in Italy license and investigate, and the penalties are not administrative tidying: substantial fines, criminal prosecution, bid disqualification and exclusion from future defence procurement. A translation shortcut that moves controlled data to an unvetted environment is the kind of detail an authority asks about after the fact.
Why a translation step can become a transfer
The risk is not theoretical. If you send a controlled interface specification to a public machine-translation service, the data leaves your control and lands on servers whose location and access you cannot attest to. If the recipient of the technical assistance, or the server, sits outside the EU, you may have made an unlicensed transfer. BAFA's export-control guidance names Regulation (EU) 2021/821 as the legal basis for exactly these controls, and a free translator gives you no record to show you stayed inside them.
A vetted linguist inside a controlled workflow is a different matter. Access is restricted to named, screened reviewers, the data stays on EU-hosted systems, and nothing is used to train a shared model. This is the same discipline we apply to engineering and technical documentation translation generally, tightened for data that carries an export-control classification. The linguist still reads the text, but inside a boundary you can describe to an auditor.
Which documents carry controlled technical data
Not every file in a dual-use product's paperwork is controlled, so classify before you translate. These are the ones that usually carry technical data mapped to Annex I or Annex IV:
Datasheets and technical specifications for components with a control-list entry, such as high-performance semiconductors, encryption modules or certain sensors.
Design and interface documentation that describes how a controlled item is built, integrated or tested.
Maintenance, repair and calibration manuals that reveal controlled technology or performance parameters.
Software documentation and source-related material for controlled software listed in Annex I.
Marketing copy, generic company profiles and public product pages rarely carry controlled data, so they do not need the same handling. The classification sits with your export compliance team, not with the translator, and the triage we use for electronics datasheets and embedded software starts from their call on what is controlled, not from a guess at the desk.
The real risk is the transfer, not the turnaround
Slow translation is an inconvenience. An unlicensed transfer is a legal event. Picture a European manufacturer translating the maintenance manual for a dual-use thermal camera into five languages for its service network. A technician pastes the English source into a consumer translation app to save an afternoon. The controlled technical data is now on third-party infrastructure, outside any licence, and no one can say where it was stored or who could read it. The fast option created the exposure.
Confidentiality and export control point the same way here. Controlled technical data should never sit on public-cloud translation tooling, which is also why data-security buyers weigh ISO 27001 against SOC 2 before they trust a vendor with sensitive files. We run every project on EU-hosted infrastructure under ISO 27001, with no public-cloud processing and no training on client data, and our note on secure AI translation with EU data residency sets out how those controls fit together for audit-sensitive content.
How we run dual-use translation safely
The workflow is the one our certified reviewers use for controlled technical content, built to keep the data inside a boundary you can describe:
We agree the data-handling scope with your export compliance officer first, including which documents are classified under Annex I or Annex IV and who may access them.
We ingest your translation memory and term base on EU-hosted systems, so controlled terminology is fixed before any segment is translated.
Our LangOps System generates the draft on client-tuned open-weight models hosted in the EU, with nothing sent to public cloud services and nothing used to train a shared model.
A certified linguist with engineering competence, screened and named for the project, reviews the draft for technical accuracy under ISO 17100 and ISO 18587.
We keep a traceable record of who accessed each document, each version and each change, so you can show an authority the data stayed inside the controlled environment.
One caution: this is not legal advice, and classification is a decision for your export compliance function. The certifications behind an AI translation provider tell you whether a vendor can hold controlled data defensibly, and public tender records on TED show how often EU defence and dual-use buyers now ask for exactly that proof. Route the control-list call to the officer who owns it, then bring the translation into a workflow that respects it.
Our dual-use and defence translation services
Our translation services for regulated sectors run on ISO 27001 and ISO 42001 certified, EU-hosted infrastructure, with no reliance on public cloud tooling for core processing. Every project runs through our AI+HUMAN hybrid workflow: we ingest client Translation Memories and Term Bases first, our proprietary LLM-based LangOps System generates output constrained by client terminology on client-tuned open-weight models, and our certified subject-matter experts review for technical accuracy and regulatory compliance. Our QA is aligned to ISO 17100 and ISO 18587, with sector-specific requirements such as AQAP 2110 quality assurance and Regulation (EU) 2021/821 controlled-data handling applied where relevant, and the same discipline extends to our secure translation workflows with EU data residency. We serve Life Sciences, Legal, Finance, Defense, and Manufacturing clients across 150+ languages with 3,500+ subject-matter linguists. For teams handling export-controlled technical data, contact us to discuss your security and compliance requirements directly.
FAQ
Is translating dual-use technical data regulated under Regulation (EU) 2021/821?
It can be. Article 2(9) of Regulation (EU) 2021/821 defines technical assistance to include the transmission of working knowledge or skills by electronic means, and handing controlled technical data to a linguist or a translation service can fall within that. Whether a licence is needed depends on the item's control-list status and where the assistance goes, which is a call for your export compliance officer.
Does using a public machine-translation tool count as an export?
Potentially yes. Sending controlled technical data to a public tool can place it on servers outside your control, and if the data or the provider sits outside the EU you may have made an unlicensed transfer under Regulation (EU) 2021/821. Keeping the data on EU-hosted infrastructure with vetted reviewers is how you avoid turning a translation step into a transfer.
What is the difference between Annex I and Annex IV of Regulation (EU) 2021/821?
Annex I is the main list of controlled dual-use items, updated most recently by Commission Delegated Regulation (EU) 2025/2003. Annex IV covers the most sensitive items, which require authorisation even for a transfer within the EU. The annex a document maps to changes how tightly its translation must be handled.
Who enforces dual-use export controls in the EU?
National competent authorities enforce Regulation (EU) 2021/821, including BAFA in Germany, DGA in France and UAMA in Italy. Penalties include substantial fines, criminal prosecution, bid disqualification and exclusion from future defence procurement, so the handling of controlled data in translation is not a quality matter alone.
Can AI translation be used for controlled technical data at all?
Yes, when it runs on EU-hosted infrastructure under ISO 27001, on client-tuned models with no training on client data, and with certified human review. The AI drafts and a screened linguist signs off, all inside a controlled boundary. Raw public machine translation of controlled data is the pattern to avoid, not AI translation as such.
Is this article legal advice on export classification?
No. Classification of an item under Regulation (EU) 2021/821, and any licensing decision, belongs to your export compliance function. This explains where translation intersects export control so you can route the control-list call correctly, then run the approved translation in a workflow that keeps the data contained.
