Export control of technology transfer and international sanctions
Below is an overview of guidelines in the export control regulations and international sanctions with regard to important definitions, responsibilities, information resources and tools, as well as assessments for institutional management and academic communities.
Recently edited : 2. December 2025Threat assessments from NSM, PST, and the Norwegian Intelligence Service (In Norwegian only) in recent years have indicated that certain states attempt to acquire knowledge that can be used for military purposes, contrary to national security and defense policy interests. This is done, among other things, by recruiting and placing their own citizens in advanced educational and research environments. The struggle for access to knowledge and research is at the center of geopolitical rivalry and the race to convert new technology into military capabilities.
Norwegian higher education and research institutions maintain a high international standard in fields with military relevance. Underwater and materials technology are examples of knowledge that we know some foreign actors attempt to obtain from Norway for military use in their home countries. Export control assessments must therefore be carried out when recruiting scientific personnel, hosting guest researchers, and admitting students to certain Ph.D.-level courses. Export control in the knowledge sector requires an overview of assets and awareness of data security, hiring practices, and the exchange of candidates and employees.
The export control regulations apply to research collaboration regarding the sharing of information and research results with foreign institutions and foreign nationals. Based on estimates from Sweden and the USA, we assume that less than ten percent of research projects should apply for a license, and that approximately two percent of projects will be problematic in terms of export control.
What Are International Sanctions?
The Directorate for Export Control and Sanctions (DEKSA) administers sanction regulations, which concern Norway’s obligations to implement sanctions adopted by the UN Security Council, as well as certain restrictive measures adopted by the EU. The regulations are anchored in the Act on the Implementation of International Sanctions.('Act relating to the implementation of international sanctions' – in Norwegian only). Sanctions vary in form, and it is recommended that knowledge institutions and professional environments map which prohibitions apply to the relevant partner country, for example regarding financial transfers or use of equipment.
In cases where individuals are from sanctioned countries, specific sanction regulations apply in addition to export control. It is important to note that sanction regulations can be more comprehensive than the item lists in the export control regulation. For example, the SEM microscope is listed under the Iran Regulation but is not found on Item List II – dual-use technology under export control.
What Is New in the Regulation for Export Control of Technology Transfer?
The regulation was amended on August 13, 2025. The following changes are noteworthy:
- The regulation replaces the term “knowledge” with “technology.”
- Technology is defined as: “Specific information necessary for the development, production, or use of goods. Such information will be technical data or technical assistance.”
What Is New in the Guidelines for Export Control of Technology Transfer?
The new regulation uses TRL levels to determine whether technology transfer requires a license.
- License requirement applies only when the technology meets all sub-specifications in the item lists.
- License is required from TRL level 5 to 9 for technology listed in Item Lists I, II, III. For TRL levels 3 and 4, this must be assessed case by case. TRL 1 and 2 are exempt from licensing.
- For universities, colleges, designated research institutes, and healthcare enterprises, there is an exemption from licensing for the export of technology listed on Item List II (dual-use items) and Item List III (critical technology) when this occurs in Norway to citizens of EEA or NATO countries. This means these citizens will not need a license, for example, to work or exchange within these institutions in Norway in these technology areas.
- There is no license requirement for technology transfer to Norwegian citizens, even if the person has multiple citizenships. This also applies if these Norwegian citizens are abroad.
- Technology uploaded to cloud services is not considered exported until someone authorizes read access to foreign nationals. The person authorizing access is considered the exporter. See separate guide for cloud services (only in Norwegian).
- Anyone publishing must assess whether the publication contains licensable technology that meets the criteria in the technology definition:
“Technology listed in Annexes I, II, and III to this regulation means specific information necessary for the development, production, or use of goods. Such information will be technical data or technical assistance. In §7, technology also includes any other technical data and technical assistance.”
If the publication falls under this definition, a license must be applied for.
For a full overview of changes in the export control regulation, see regjeringen.no (in Norwegian only).
What Is Export Control of Technology Transfer?
Through international agreements, Norway is committed to preventing the proliferation of chemical and biological weapons, preventing the spread of goods and technology relevant to nuclear weapons, and controlling conventional weapons, military goods, and sensitive high technology. This is laid down in the Act on the Control of the Export of Strategic Goods, Services, and Technology (Export Control Act) from 1987 and operationalized in the Regulation on the Export of Defense Material, Dual-Use Items, Technology, and Services (Export Control Regulation).
The regulation has three item lists showing which goods, technology, and services require a license. A license requirement means that permission must be sought from DEKSA to transfer or sell the technology listed. Item List I concerns defense-related goods, Item List II covers dual-use items.
From November 1, 2024, the Ministry of Foreign Affairs introduced a national list – Item List III – to the Export Control Regulation. This list includes certain critical goods and technologies not currently controlled under Item List II. The list includes goods and technologies for producing advanced microchips and quantum computers. The items and technologies listed in Item List III are considered breakthrough or emerging technologies that should be subject to control. Similar listings have been introduced by Denmark, Finland, the Netherlands, Spain, and the United Kingdom. The list is expected to expand with additional goods and technologies in the future.
The lists apply to all technology transfers from Norway, including the export of goods and services. Export control in the knowledge sector mainly concerns controlling technology transfer and research collaboration, including mapping licensable equipment and technology, awareness of data security, and the exchange of students and employees, as well as guest lecturers. Control of technology transfer applies to new knowledge that is not already publicly available.
What is the purpose of the export control regulations?
- To ensure that the export of defense material from Norway is carried out in accordance with Norwegian security and defense policy.
- To ensure that the export of dual-use items does not contribute to the proliferation of weapons of mass destruction (WMD – nuclear, chemical, and biological weapons), as well as delivery systems for such weapons. Delivery systems may include underwater technology, advanced electronics, and materials. Dual-use items refer to goods, software, and technology originally developed for civilian purposes but which can have significant military applications.
Which Authorities Are Responsible for Export Control?
The government has established the Norwegian Agency for Export Control an Sanctions (DEKSA). DEKSA is responsible for controlling the export of defense material, technology, and dual-use items, as well as administering the sanctions regulations. The agency ensures that Norway complies with international obligations and contributes to national security. It issues export licenses and monitors compliance with sanctions, particularly in light of the geopolitical situation, including the war in Ukraine. The goal is to strengthen Norway’s ability to address security challenges and prevent illegal exports.
If you are uncertain about the sensitivity of a subject area or applicable export restrictions, contact DEKSA for clarification and advice.
Read more about export control at regjeringen.no (in Norwegian only).
If a knowledge institution is concerned that illegal technology transfer has occurred or may occur, contact the Norwegian Police Security Service (PST) for dialogue and advice (page in Norwegian only).
License for Technology Transfer – What Is Required?
Self-Assessment
For the knowledge sector and civilian research, an assessment must be made as to whether the knowledge development in the research collaboration falls under the categories in Item List II – dual-use items or Item List III – national list. The following categories are found in Lists II and III:
- Nuclear materials, facilities and equipment
- Special materials and related equipment
- Materials processing
- Electronics
- Computers
- Telecommunications and “information security”
- Sensors and lasers
- Navigation and avionics
- Marine
- Aerospace and propulsion
Subcategories of these categories include:
- Systems, equipment and components
- Test, inspection and production equipment
- Materials
- Software
- Technology
In research contexts, E – Technology is most commonly used. Technology in category E is only subject to licensing if the technical knowledge is required to develop or improve, produce, or use the controlled item.
Knowledge institutions and professional environments are responsible for the initial classification of the technology. It must be assessed whether the technology is covered by the lists and is therefore subject to licensing. If the technology is not included in the lists, it is exempt from licensing. The technology may also be covered by exceptions that mean a license is not required. Exceptions are found in §8 of the Export Control Regulation.
The following points should be included in the assessment:
- The technology must be clearly defined.
- The link between the technology and the relevant point on the list must be close and clear.
- The technology must be essential for the controlled item (not just generally related).
DEKSA can assist with classification if needed. See more information on self-assessment.
Extended Licensing Requirement
The lists of goods and knowledge regulated by the Export Control Regulation are updated annually through international negotiations. The links on this page refer to sites where the updated lists are published. However, technological and scientific development moves faster than international processes. Therefore, licensing requirements and control of knowledge transfer may also apply to knowledge or technology not included in Item Lists I, II, and III.
A legal safeguard – a so-called “catch-all” – has been developed for technology and knowledge related to Norwegian security and defense interests. This means that knowledge institutions and professional environments must assess potential harmful use in technology transfer in international cooperation and apply for a license even when the technology and knowledge are not yet included in the negotiated lists. Such assessments are also part of research ethics.
Residence permits for foreign researchers and students
The Directorate of Immigration (UDI) processes applications for residence permits to work or study in Norway. The applications must be assessed in relation to matters affecting national security, which are set out in The Act relating to the admission of foreign nationals into the realm and their stay here (Immigration Act) Chapter 14 and the Regulations relating to the admission of foreign nationals into the realm and their stay here (Immigration Regulations) Chapter 19A.
The case processing is described in GI-03/2023 – Instruks om behandling av saker som kan berøre grunnleggende nasjonale interesser eller utenrikspolitiske hensyn etter utlendingsloven kapittel 14, og saker etter eksportkontrollregelverket ('Instruction on the processing of cases that may affect fundamental national interests or foreign policy considerations under Chapter 14 of the Immigration Act and cases pursuant to the export control rules' – in Norwegian only).
The instructions also give an indication of what information should be included with a residence permit application. When applying for a residence permit, the applicant will receive a checklist of the documentation required, based on the type of application.
How Do I Apply for a License for Technology Transfer?
Applications should be submitted well in advance of hiring or hosting foreign researchers and admitting foreign Ph.D. students whose research falls under Item List II or Item List III. Here you will find an overview of estimated processing times(In Norwegian only). Ensure that the application is correctly completed and that all required attachments and documentation are included. For more information on application requirements, license types, and country categories, see DEKSA’s information pages.
What responsibility do the universities and research institutes have?
The knowledge institutions must comply with the export control rules, and the following measures are recommended in this connection:
- Obtain an overview of which areas of knowledge are regulated by export control legislation.
- Obtain an overview of which international cooperation activities, education levels and positions in the institution, the export control regulations will apply to.
- Identify equipment, lab facilities and information that require additional protection in the form of access control and develop security systems to safeguard these assets.
- Develop internal procedures that ensure control of knowledge transfer in all activities associated with the sensitive subject areas.
Assessments must be made when recruiting academic staff, receiving visiting researchers and admitting students to certain courses at PhD and master's degree level.
Proposed assessments and procedures for management and administration
- Incorporate export control as part of the institution's overall risk management. Consider assigning responsibility for export control to dedicated persons at the institution. However, it is important that the institution's security work is rooted in the management.
- Valuation of the research areas forms the basis for which security measures must be introduced in order to comply with the regulations. The scope of values/assets covered by the regulations should be used to dimension administrative support and control systems in this field.
- Conduct a mapping of sensitive research areas, cooperation projects, interdisciplinary activities, master's and PhD programmes, laboratories and equipment.
- Consider whether the academic environments covered by the export control regulations are sufficiently familiar with them.
- Ensure regular updates, awareness and knowledge of internal export control procedures in the relevant academic environments.
- Consider the need for enhanced access control to laboratories and equipment.
- Obtain an overview of equipment that requires a licence included on list II in the export control regulations and sanctions and restrictive measures.
- The knowledge institution should keep an overview of countries subject to sanctions that may entail restrictions on international knowledge cooperation. Note that prior licence must always be applied for in order for persons with Iranian nationality/connections to Iran to use the equipment/technology/knowledge listed in the annexes to the Iran Regulations.
- Introduce standardised background checks for appointments in subject areas and positions covered by the export control regulations (see page about recruitment and appointment).
- Consider whether positions with expanded authority, rights and access should be routinely authorised through a background check.
- If an educational or research institution is concerned that illegal knowledge transfer has or may take place, contact the Police Security Service for further dialogue and advice.
Proposed assessments and procedures for the academic community
- Is your subject area on the list of knowledge areas covered by the export control regulations?
- Does your research, teaching or international project cooperation depend on the use of a laboratory/technology/equipment/software that is on List II - dual-use technology?
- Can the knowledge developed through the collaboration have a potential military application (including delivery technology)?
- Is the country involved in the planned knowledge cooperation covered by the sanctions regulations? Consider possible implications for the cooperation.
Other resources and tools for compliance with export control regulations for knowledge transfer
- The Ministry of Foreign Affairs' website with an overview of sanctions and restrictive measures
- The National Threat Assessment provides information about the countries the Police Security Service considers to be security threats and that could engage in covert attempts to collect information.
- The National Security Authority's annual threat assessment 'Risiko' ('Risk' – in Norwegian only)
- The Norwegian Intelligence Service's annual threat assessment 'Focus'
- EU compliance guidance for research involving dual-use items
- Report No 26 to the Storting (2018-2019) – Eksportkontroll av forsvarsmateriell fra Norge I 2018, eksportkontroll og internasjonalt ikke-spredningsarbeid ('Export control of defence materiel from Norway in 2018, export control and international non-proliferation work' – in Norwegian only).
- Sikresiden.no has created an e-learning course on export control.
- The Council for Public Security and Preparedness in the research and education sector has prepared a memo: Kontroll med kunnskapsoverføring ('Control of knowledge transfer' – in Norwegian only). In the appendices, there are examples of how to word call texts and reservations in connection with appointments.
Examples of internal security procedures
Examples of internal security procedures related to critical areas in the export control regulations for knowledge transfer at a research institute.
Ensure independence. Among other things, this means not entering into agreements that cannot be terminated at short notice. It requires a thorough assessment of the financial consequences of entering into the agreement and the financial and practical consequences of terminating the agreement for the institution. This ensures independence, since the institution does not commit to 'advertising' on behalf of equipment suppliers, and it is not contractually obligated to open doors to new customers or to markets.
Researchers are not funded in a way that gives them incentives to share data with unauthorised persons or adjust conclusions in order to secure their position in future.
Ensure that equipment from foreign suppliers with security risks is kept physically separate from internal infrastructure in separate rooms ('air-gap'). Air-gap is a security measure that involves isolating a computer or network by preventing it from establishing a remote connection to wirelessly or physically connect with other computers/devices.
Relevant authorities to contact
The Norwegian Agency for Export Control and Sanctions (DEKSA) is a newly established directorate responsible for administering and managing the regulations related to export control and sanctions, and is the authority that decides whether a licensing requirement applies. The directorate can provide advice and guidance on which subject areas and activities are regulated.
The Police Security Service (PST) (in Norwegian) is Norway's domestic intelligence and security service and is subordinate to the Minister of Justice and Public Security. PST’s main task is to prevent and investigate serious crime that threaten national security. PST collects information about individuals and groups that may pose a threat, prepares analyses and threatand provides advice.
The Directorate of Immigration (UDI) considers applications for residence permits etc. in accordance with the Act relating to the admission of foreign nationals into the realm and their stay here (the Immigration Act). The applications must be assessed in relation to circumstances affecting fundamental national interests and foreign policy considerations, cf. the Immigration Act C14 and the Regulations relating to the admission of foreign nationals into the realm and their stay here (the Immigration Regulations) Chapter 19A.
Glossary
Protective security is a term used in the Security Act. It covers both measures that reduce the likelihood of an event occurring and measures that limit the effects of such an event.
Dual-use items refers to items that were originally designed for civilian purposes, but have important military applications. In the context of knowledge, dual use refers to research that can be expected to generate knowledge or technology that has a potential to be exploited for harmful purposes and that threatens public health or national security, even if the research has a different purpose
National security is defined as state security and a limited part of the social security area which is essential for a state's ability to safeguard national security interests.
National security interests are a country's sovereignty, territorial integrity and democratic system of government, as well as general political security interests related to (a) the activities, security and freedom of action of the highest state bodies, (b) defence, security and contingency preparedness, (c) relations with other states and international organisations, (d) economic stability and freedom of action, and (e) fundamental societal functions and the basic security of the population.
On the one hand, 'values' refers to norms and principles, such as academic freedom. However, the term 'values' or 'assets' is also used in the context of valuation and risk analysis. Here, the terms refer to anything that is worthy of protection and can be threatened, such as life and health, information, material assets and reputation. Measures cannot influence the values/assets and threats themselves. An organisation can however take measures to limit is its vulnerabilities (for example organisational or technical), which will in turn reduce the risk.