Is your software company looking for new markets due to the impact of the COVID-19 pandemic on your existing customers? Are some of the markets you are considering selling to outside of North America? If so, you should ask yourself if you may require a federal export permit before selling your software solution abroad.

As world economies react to COVID-19 related shutdowns, many companies are finding a changed marketplace awaits them. Existing customers who earlier this year were on the verge of purchasing software solutions, may be cancelling or deferring these projects. In order to generate revenue, many software companies may now be considering offering their software solutions outside of their traditional North American markets. In these cases, software companies should investigate whether the sale of their software outside of Canada requires a federal export permit.

Why would I need an export permit to sell commercial software?

For over 70 years, Canada has had export control laws in place geared towards ensuring that military and strategic goods being exported are consistent with Canada's foreign and defense policies.

Many companies that produce products for the defense industry are fully aware of laws that govern the export of their products. However, software companies whose solutions are geared for business or civilian use may be required to obtain export permits if their software is of "dual use" - that is, their products could also be used or modified for military purposes. An example of where this may apply includes software that incorporates controlled encryption functionality.

Canada regularly maintains and updates its list of products subject to export controls. While most software that is generally available to the public or is in the public domain is not subject to export controls, certain dual-use software is subject to export controls. The potential dual-use software noted in this Export Control List includes the following:

  • software for digital computers,
  • Computer-Aided-Design software,
  • intrusion software,
  • cryptographic information security software,
  • software for numerical control systems used by manufacturers, and
  • software to restore microprocessors after an electro-magnetic pulse.

If your company develops dual-use software that appears on Canada's Export Control List, an export permit is needed before transferring or selling that software to customers in certain countries.

Do I really need an export permit to send an email?

For most people, exporting conjures up a picture of goods loaded onto a plane, train, truck or ship. However, Canada's export control laws apply to any method of delivery. For software products that are on Canada's Export Control List, exporting can include:

  • providing services or training,
  • sending software via email,
  • allowing software to be downloaded or through an electronic file transfer,
  • file sharing,
  • cloud access, and
  • communicating via fax, telephone conversation, teleconference or face-to-face meetings.

Therefore, if your software solution is a dual use product that is the subject of export controls, you could be in violation of the law if the software is emailed or otherwise transferred abroad without first getting an export permit.

What are the penalties for violating Canada's export control laws?

Violating Canada's export controls laws can result in fines of $25,000 or more, and a prison sentence of almost ten years. If your company has inadvertently violated Canada's export control laws, there is a process of disclosure that can allow a company to avoid liability. However, before disclosing, a careful review of the violation may take place. Depending on the gravity of the offence, investigations can be conducted into alleged non-complying conduct.

If we are a software company that is unsure if our products are the subject of export controls, what do we do?

If you are unsure whether your product is a dual use, there are three options.

  1. First, you can self-assess against Canada's Export Control List to determine if your software is subject to export control;
  2. Second, you can request an Advisory Opinion from the Export Controls Division of Global Affairs Canada on whether your products are subject to export controls; or
  3. Third, you can apply for an Export Permit before the software is transferred.

Of the three options, only a decision on an application for an Export Permit is binding.

If our software is subject to export controls, what should we do?

If you produce dual-use software and wish to sell or transfer it abroad, you may find that an export permit is not needed based on the country of destination. However, if an export permit is needed, the following needs to be completed before you transfer your product abroad:

  1. Ensure that you have conducted due diligence verifications on the actual and potential foreign customers who are in your export permit application.
  2. Apply for an export permit. Until an export permit is granted, the software should not be transferred.
  3. Make sure you set up a system that maintains all necessary documents needed for each export in case of a government audit.
  4. Where necessary, develop and put in place a policy or standard operating procedure to ensure your employees know what sort of action requires an export permit.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.