Legal

Export Compliance

How EU dual-use export controls apply to Osprio hardware, firmware, and software.

Effective date: 28 May 2026  ·  Last updated: 28 May 2026

Osprio products include cryptographic functionality (AES-128 in the OSDP Secure Channel). They are therefore subject to European Union dual-use export controls. This page describes how that classification applies and what you are responsible for when you re-export, transfer, or deploy our products. Nothing on this page is legal advice — consult a qualified export-control adviser for your specific situation.

1. Why this page exists

Items that contain cryptography are controlled under Regulation (EU) 2021/821 ("the EU Dual-Use Regulation") and the national export-control laws of EU member states. As a German company, Myur Labs UG (haftungsbeschränkt) operates under the supervision of the Bundesamt für Wirtschaft und Ausfuhrkontrolle (BAFA). We publish this notice so that researchers, integrators, and customers can determine their own obligations before re-exporting our products to a third country.

2. Classification

To the best of our current understanding, Osprio products that implement the OSDP Secure Channel fall under Annex I, Category 5 — Part 2 ("Information Security") of the EU Dual-Use Regulation:

  • 5A002 — "Information security" systems, equipment, and components — for hardware that performs cryptographic operations (OsprioPro, OsprioMini firmware images that include the secure channel).
  • 5D002 — "Software" specially designed or modified for the development, production, or use of items controlled by 5A002 — for OsprioView builds and SDK distributions that include OSDP secure-channel implementations.

The classification rests on the use of AES with a 128-bit symmetric key length, which is the algorithm specified by the SIA OSDP standard for secure channel encryption.

3. General Export Authorisation EU008

EU General Export Authorisation EU008 ("GEA EU008") simplifies the export of certain encryption items in Category 5 Part 2 when they implement only published, internationally-standardised cryptographic algorithms approved by recognised standards bodies. AES (FIPS 197 / ISO/IEC 18033-3) qualifies under this criterion.

Where GEA EU008 applies, exports to authorised destinations may be made without an individual licence, subject to registration with BAFA and the conditions set out in the authorisation itself. Customers and re-exporters are responsible for confirming GEA EU008 applicability to their specific transaction.

4. Sanctions and end-use restrictions

We do not knowingly export to, or permit transfers into, any country, region, entity, or end-user that is subject to comprehensive sanctions or arms embargoes under EU law, UN Security Council resolutions, or the export-control regimes of the country in which our products are manufactured or shipped. This currently includes (without limitation) destinations on the EU sanctions map and the German K-Liste.

Catch-all controls under Article 4 and Article 5 of the EU Dual-Use Regulation may also apply if there is reason to believe our products will be used in connection with weapons of mass destruction, military end-uses in embargoed destinations, or serious violations of human rights — regardless of formal Annex I classification.

5. Your responsibilities as a customer or re-exporter

  • Re-export. If you re-export Osprio products to a third country, integrate them into a system that is itself exported, or transfer them to a non-EU person, you are responsible for determining whether your transaction requires a licence under EU law or the law of your own jurisdiction.
  • End-user diligence. Screen your customers against applicable denied-party and sanctions lists (EU consolidated list, OFAC SDN, etc.) before delivering controlled items.
  • Documentation. Keep records of recipient, end-use, end-user, and the licence basis you relied on. Records retention requirements under German law are five years.
  • Notification. If you believe a third-party transaction may breach export-control law, notify your competent authority and pause the shipment until cleared.

6. United States and other jurisdictions

Although Myur Labs UG (haftungsbeschränkt) does not export from the United States, customers who re-export our products from the US, or who integrate them into US-origin systems, should also consider US Export Administration Regulations (EAR) classifications — likely ECCN 5A002.a or 5D002.a, potentially eligible for License Exception ENC depending on the destination and end-user. Customers in other jurisdictions are responsible for evaluating their own national export-control regimes.

7. Requests for classification documents

For procurement processes, due-diligence reviews, or licence applications that require a written classification statement from the manufacturer, contact [email protected] with "Export classification" in the subject line. We will respond within 10 business days.

8. Disclaimer

This page is provided for general information and reflects our good-faith assessment of how EU dual-use controls apply to our products as of the "Last updated" date above. Export-control law is technical, regulator-dependent, and changes frequently — the current EU control list was last updated in September 2025 and is reviewed annually. This page is not a substitute for advice from a qualified export-control practitioner, nor does it constitute a binding commitment regarding the legality of any specific transaction. You bear sole responsibility for compliance with the laws that apply to your activities.

9. Contact

Export-control questions: [email protected]. Operator: Myur Labs UG (haftungsbeschränkt), Germany.