FAQ
Q. What are the specific U.S. export laws that apply to Ariba products?
A.
- Export Administration Regulations (EAR) administered by the U. S. Bureau of Industry and Security (BIS), an agency of the U.S. Department of Commerce. See web site http://www.bis.doc.gov/
- International Traffic in Arms Regulations (ITAR) administered by the Directorate of Defense Trade Controls (DDTC), an agency of the U.S. Department of State http://www.pmddtc.state.gov/
- Executive Orders of the President of the U.S. related to trade restrictions (i.e., embargoes and sanctions) administered by the Office of Foreign Assets Controls (OFAC), an agency of the U.S. Department of the Treasury http://www.treas.gov/offices/enforcement/ofac/
Q. My company is just using Ariba products, not exporting them. Why do we need to be concerned with U.S. export laws?
A. Physical shipment of products to locations outside of the U.S. is not the only way to "export". U.S. export laws define "export" to include:
- Electronic transmission of products such as software or technical information (over the Internet for example)
- Delivering U.S.-origin goods to "foreign nationals" inside the U.S.
- Disclosure of technical information to "foreign nationals"
- U.S. citizen
- U.S. permanent resident alien ("green card" holder) or
- lawfully admitted refugee or asylee
In addition, U.S. export law prohibits many types of transactions with entities in certain countries that have been embargoed or sanctioned the U.S., so that transacting with entitles in these countries through Ariba's product systems would violate U.S. export law.
Q. My company is not a U.S. company. We are not subject to U.S. export laws, right?
A. Your company might not be directly subject to U.S. export laws if it is:
- not a U.S. company
- not owned or controlled by any U.S. entity
- not resident in the U.S. and,
- not producing U.S.-origin goods
Q. What is ITAR and do I need to be concerned about it?
A. ITAR stands for International Traffic in Arms Regulations. ITAR is a set of U.S. regulations administered by the Directorate of Defense Trade Controls (DDTC), an agency of the U.S. Department of State. See http://www.pmddtc.state.gov/
ITAR applies to all U.S.-origin items specifically designed for military use, and related technical information (referred to as "defense articles"). If your company is purchasing, sourcing, or producing U.S.-origin defense articles, you need to ensure that the correct ITAR controls are in place to protect sensitive information related to ITAR-products. If your company is engaged in such activities, you should check to see if someone in your company is already responsible for ITAR compliance.
Q. What can happen if I violate U.S. export laws?
A. U.S. citizens (including Ariba and individual Ariba employees) are subject to substantial fines, sanctions (such as suspension of export privileges), and even imprisonment for violation of U.S. export laws. All Ariba customers, resellers, suppliers and other business associates are required by their contracts with Ariba to comply with U.S. export laws, so non-compliance would constitute a breach of contract for which Ariba could seek contractual remedies under applicable law. Part of Ariba's compliance with U.S. export law mandates such contractual terms.
Do I have to investigate all the suppliers that I transact with through the Ariba Network (ASN) or Ariba OnDemand Sourcing to make sure I'm not violating export laws before I transact with them?
A. No. You do not have any obligation to investigate any third parties you transact with using the ASN or other Ariba products. However, if during the normal course of conducting business with a third party you become aware of facts that suggest that you might be violating U.S. export laws by transacting with them, then you have an obligation to: (i) investigate further; (ii) report the information to Ariba or to the Bureau of Industry and Security; and/or (iii) stop transacting with that entity. For example, if a supplier registered on the ASN indicated that they were a French company located in Kuwait, but during subsequent conversations you learned that they were actually an Iranian company, you would be obligated to: a) report to Ariba and/or BIS that there might have been an unintentional export violation; and, (b) stop transacting with that entity.
Q. What is an ECCN? What about a CCATS?
A. ECCN stands for Export Control Classification Number and is the way that products (including software) and related technical information is categorized by the Bureau of Industry and Security (BIS), the U.S. agency responsible for administering U.S. Export Administration Regulations (EAR). The EAR applies to all U.S.-origin "commercial" and "dual-use" items, and related technical information. "Commercial" and "dual-use" items are those that are not specifically designed for military use.
In order to understand what specific export restrictions might apply to a particular product, that product first must be categorized under a specific ECCN.
Ariba software products are categorized under the ECCN 5D002 (C.1) and qualify for the license exception ENC (sections 740.17(A) and (B)(3) of the EAR) for dual-use encryption items.
| Ariba Products | ECCN | License Authority | CCATS # |
|---|---|---|---|
| Ariba Spend Management Solutions (all modules) | 5D002 (C.1) | License Exception ENC EAR sections 740.17 (A) and (B)(3) |
G049265 |
What this information means is that Ariba software can be exported to most countries and most end users (including foreign government end users) without obtaining an export license from BIS. However, Ariba products cannot be exported (without a license) to any country that is subject to U.S. economic sanctions or embargoes.
The CCATS # is an administrative tracking number assigned by BIS to allow them to verify that BIS reviewed a particular product and confirmed issuance of the related ECCN and "license authority" (the particular reason why a product is permitted to be exported).
Q. What is an "embargoed" country and where can I find a current list?
A. Ariba (and others) sometimes use the term "embargoed countries" as a convenient way of referring to certain countries upon which the U.S. government has placed trade restrictions ("embargoes" or "sanctions"). These embargoes and sanctions can be very specific to certain products or transactions or can be so broad as to prohibit U.S. citizens (like Ariba) from conduting any business with entities in those countries at all. In some cases, Ariba products and services, as well as a large number of common products and services, cannot legally be exported without a specific license from the applicable U.S. agency controlling export to that location. Devising a discreet list of embargoed countries is extremely difficult because:
- "Embargoes" or "sanctions" are modified, lifted, and imposed on different countries by Executive Order which can happen at any time, without notice;
- The "embargoes" or "sanctions" differ widely from country to country. The sanctions imposed on one country are rarely identical to the sanctions imposed on another. For example, food and medicine can be exported to Sudan, but not to Cuba.
- "Embargoes" or "sanctions" are administered by different U.S. agencies - some by BIS, and some by OFAC.
Q. Why do I need to worry about "embargoes" and "sanctioned countries" if my company is not shipping any Ariba products there?
A. U.S. entities are prohibited from exporting to and in many cases from conducting business with entities in certain countries that are "embargoed" or "sanctioned" by the U.S. government. U.S. entities must use reasonable efforts to ensure that their systems or solutions are not utilized by third parties (Ariba customers or suppliers, for example) to conduct such prohibited transactions. You may be prohibited from conducting transactions with entities in these countries if you are:
- a U.S. company or controlled by a U.S. entity and therefore are subject to U.S. export regulations (apart from your use of Ariba products); or,
- using Ariba products to conduct such transactions; or,
- giving access to Ariba products to prohibited entities (i.e., foreign nationals of embargoed countries) as part of those transactions.
Q. Does my company still need to comply with U.S. export laws if we host the Ariba products outside of the U.S.?
A. Yes, in relation to your use and handling of Ariba products. Ariba is a U.S. corporation and our products are of U.S. origin, so all of our customer contracts require that our customers comply with U.S. export law in their use and handling of our products.
Q. I don't know whether my company's data is export-controlled or not. It's your product, Ariba, you should be responsible for all necessary export licenses related to my use of your product, right?
A. If your company has technical information that describes: (a) products controlled by ITAR (specially designed for military use and of U.S.-origin) or (b) controlled by Export Administration Regulations as "dual-use" (commercial and military uses) --- then whether or not you use Ariba products, you are required by these U.S. export regulations to monitor and control that information on whatever system it is stored. Any required export license required for exporting such technical information would necessarily be specific to the nature of that data and the product(s) it describes. Your company, as the owner of that technical information, is in the best position to understand what kind of information you have and, if necessary, to seek appropriate export licenses.
