The Export Before the Enquiry: Releasing Controlled CNC Data to China
Photo: Internet Archive Book Images, No restrictions, via Wikimedia Commons
Most UK engineers treat an RFQ as the beginning of a commercial conversation. In export-control terms, it can be the beginning of an export. A STEP file, a PDF drawing, a material specification or a page of process notes may carry technical data that is controlled under UK export control legislation, or that carries re-transfer obligations because of its US origin. Once that packet is sent to a Chinese supplier, it has left the UK. The fact that no physical part has moved does not make the transfer neutral.
As of November 2026, the practical test remains the same: identify what is being released, classify it, check whether a licence is needed, and only then choose a transfer route. The protocol below is not legal advice, but it is a workable discipline for a sourcing team that sends drawings to China.
Separate the part from the packet
A drawing is rarely just geometry. It can contain tolerances, material call-outs, surface requirements, inspection criteria, assembly context and notes about manufacturing process. Some of that data may be controlled because the part itself appears on the UK Strategic Export Control Lists. Some may be controlled because it is technology for the development or production of a controlled item. Some may be uncontrolled in the UK but still subject to US re-transfer rules because it was derived from a US-origin item or data package.
The first mistake is to ask only whether the part is controlled. The better question is whether the data packet, as assembled, contains controlled technology. A simple bracket can sit inside an assembly whose drawing package reveals controlled geometry, performance parameters or manufacturing know-how. A supplier does not need the full assembly to quote a bracket, so the release should not include it unless there is a reason.
Classify before the RFQ leaves the building
Classification should happen before the enquiry, not after the supplier has quoted. Engineering should confirm the item's performance parameters, material, tolerances, end use and whether it is designed for a military, aerospace, nuclear or other sensitive application. The buyer should record the classification basis and date. A note that says 'standard part' is not a classification.
Where the position is unclear, the Export Control Joint Unit can provide advice, and specialist legal advice may be appropriate for higher-risk programmes. The important point is that uncertainty is not a release authority. If the team cannot classify the data, it should not send the drawing. It can send a capability enquiry that describes the family of work without disclosing controlled geometry or process data.
A licence check is not a formality
If the data is controlled, the next question is whether a licence is required for transfer to China. That depends on the control entry, the destination, the end user and the end use. A licence may also carry conditions: named consignees, restrictions on sub-suppliers, limits on onward transfer, or reporting obligations. Those conditions need to be read before the data is released, because they shape what the supplier is allowed to do with it.
For US-origin data, the UK firm may also need to consider US re-transfer authorisations. A Chinese supplier is a foreign person for these purposes, and a UK intermediary does not automatically remove the US obligation. Contract flow-downs and supplier declarations should be checked alongside the UK position. The buyer should not assume that a Chinese supplier can obtain a UK licence on the UK firm's behalf. It cannot.
Secure transfer reduces risk, but it is not a licence
Encrypted portals, time-limited links, watermarks, access logs and need-to-know permissions are sensible controls. They do not change the classification. Sending controlled data by encrypted email is still a transfer of controlled data. A secure channel is evidence of good practice, not a substitute for authorisation.
Data minimisation is the more useful discipline. If the supplier only needs one component, release one component. If the quotation only needs outside geometry and material, redact internal features and process notes. If the first conversation is about capability, do not send a drawing at all. Each reduction in the data packet reduces the export-control burden and the commercial risk of over-disclosure.
Supplier undertakings should be specific
A generic NDA is not an export-control undertaking. Before controlled data is released, the supplier should sign an undertaking that identifies the data, the permitted purpose, the named individuals with access, the storage location and the prohibition on disclosure to third parties or subcontractors without written approval. It should require return or destruction on request, notification of any suspected loss or unauthorised access, and flow-down of the same obligations to any approved sub-supplier.
Where a licence applies, the undertaking should reference the licence conditions. The entity that signs should match the entity that will receive the data and the entity named on the purchase order. A common failure is a signed undertaking from a trading company while the drawing goes to a separate factory. That is not a controlled release; it is an uncontrolled one.
A five-gate release protocol
A practical protocol can be built around five gates. First, nominate a data owner and record the classification. Second, complete the licence determination and record the outcome. Third, minimise the packet and redact anything not needed for the enquiry. Fourth, select a secure transfer route and an access list. Fifth, obtain the signed undertaking and retain the release record.
No gate should be skipped because the enquiry is urgent. If any gate is open, the RFQ waits, or the scope is reduced to a non-controlled capability discussion. This is not bureaucracy for its own sake. It is the difference between a sourcing process that can be defended and one that depends on nobody asking a question later.
When the answer is no
Sometimes the correct decision is not to send the drawing. The programme may need a UK supplier, a licence application, a redesigned data package or a staged release after authorisation. Those options cost time, so they should be considered early, not on the day the quote is due. Export control is a condition of supply, not a paperwork tax added at the end.
The first RFQ is an export event. Treating it as one protects the UK buyer, the Chinese supplier and the programme. The drawing may describe a part, but in export-control terms it is also data, and data travels.
