Dear Clients and Friends,
On 18 November 2025, Israel’s Minister of Defense signed an order to revoke the Order Governing the Control of Commodities and Services (Engagement in Encryption Items) – 1974 (“Encryption Order”). The revocation will take effect on March 21, 2026, four months following its publication in Israel’s official legal gazette. The Encryption Order’s repeal introduces a significant regulatory change for companies exporting items with encryption and/or decryption capabilities. Once the revocation goes into effect, many consumer products (B2C) are expected to be decontrolled, while many commercial products (B2B) will now fall under the control of Defense Export Controls Agency (“DECA”) within the Ministry of Defense or the Export Control Agency within the Ministry of Economy and Industry (“ECA”).
Background:
The Encryption Order was enacted in 1974 pursuant to the Control of Commodities and Services Law , 5718-1957, subjecting encryption items to regulatory control. From 1998 on, the Ministry of Defense was tasked with supervising and licensing “engagement in encryption items”, including development, production, integration, sale, import and export of encryption items. The Encryption Order created an anomalous framework for controlling the export of dual-use encryption items as compared to other dual-use items.
Israel generally controls the export of dual-use items listed in the international control lists of the Wassenaar Arrangement. This list includes a chapter on Information Security items (Category 5 – Part 2 – Information Security), which enumerates a variety of encryption means, including various items that contain encryption capabilities, even as a secondary function. Exports of Dual-Use items to defense end-users are generally controlled by DECA under Orders issued further to the Defense Export Control Law, 5767-2007 (“DECL“), and when such items are exported for civilian end-users, the exports are controlled by ECA under the Import and Export Order (Control of Export of Dual-Purpose Goods, Services and Technology Exports), 5766-2006 (“the Import and Export Order“). However both orders issued under the DECL and the Import and Export Order categorically exclude from DECA’s and ECA’s control any items already controlled under the Encryption Order.
The recent revocation of the Encryption Order comes as part of the Ministry of Defense’s policy to align Israeli controls with the framework customary in Wassenaar Arrangement Participating States, and to transfer control of all dual-use items to DECA and ECA.
Controls Over Exports of Encryption Items: Transitioning to a New Regulatory Framework:
The revocation of the Encryption Order automatically transfers control over the export of encryption and/or decryption items, including various items that include encryption capabilities, to the control frameworks under the defense and civilian dual-use equipment orders. As mentioned, these orders already include a reference to the Wassenaar Arrangement’s control lists, such that the revocation of the Encryption Order automatically transfers the control over the export of encryption means listed in the Wassenaar Arrangement to the two existing regulatory frameworks for dual-use items, as follows:
- The export of items for “defense use” (by or for Defense Forces) will be under the supervision of DECA in accordance with the Defense Export Control Law, 5767-2007 and the Defense Dual-Use Equipment Order.
- Export for any other use – will be under the supervision of the Export Control Agency within the Ministry of Economy and Industry in accordance with the Import and Export Order.
In light of the new control framework for encryption items, exporters currently controlled under the Encryption Order must examine whether their products require control in accordance with Category 5, Part 2 of the Wassenaar Arrangement’s List of Dual-Use Goods and Technologies. Products and technologies that do not meet the control threshold set by the Wassenaar Arrangement are expected to be completely removed from control.
Transitional Provisions and Grandfather Clauses:
During the next four-month preparatory period until the revocation of the Encryption Order, it will still be possible to submit applications for licenses in accordance with the Encryption Order.
Licenses granted under the Encryption Order which are set to expire during the 8 months following the revocation of the Encryption Order will automatically be extended. This extension will be in place for 8 months from the date the revocation comes into force (11.21.2026).
Encryption Order licenses issued before the revocation of the Order will not be shortened.
Licenses granted under the Encryption Order for encryption items not controlled under the Wassenaar Arrangement list, or licenses granted under the Encryption Order for engagement in encryption items other than exports – will be immediately revoked on the day the Encryption Order is revoked (03.21.2026).
Preparing for Control under the New Regulatory Framework:
The revocation of the Encryption Order will create regulatory relief for certain companies that will no longer be subject to control after the revocation of the Encryption Order due to their items or activities not being controlled under the new framework. At the same time, for other companies, there is potential for an increased regulatory burden as control is transferred under the frameworks of the Defense Export Control Law or the Import and Export Order.
Currently, control under the Encryption Order generally involves a quick, single-stage licensing process and even allows for broad licensing by country. In contrast, control under both the frameworks of the DECL and the Import and Export Order involves a longer and more burdensome regulatory process.
Control under the Defense Export Control Law:
The process of controlling defense exports under the Defense Export Control Law is managed by DECA and is based on a multi-stage control model. First, any entity wishing to engage in defense exports must register in DECA’s “Defense Export Registry” as a prerequisite for any activity. Thereafter, and prior to conducting negotiations or any marketing activity related to a defense export, the exporter must obtain an ‘ID’ for the item subject to export, which will determine the item’s classification and the marketing restrictions that will apply to it. In some instances, it is also necessary to obtain a specific marketing license as a prerequisite for any marketing activity regarding the registered item. Finally, before carrying out a ‘defense export’ activity, the exporter must submit a separate application to obtain an export license, which authorizes the export of the item from Israel and/or the transfer of knowledge to a foreign entity, as applicable. Each stage of the process is carefully examined, taking into account various considerations, including national security, foreign relations, and international commitments, and in cooperation with professional bodies in the Ministry of Defense and the Ministry of Foreign Affairs. However, in an explanatory note published by DECA ahead of the revocation of the Encryption Order, it was stated that defense marketing and export licenses “will be adapted to the characteristics of the activities of companies engaged in encryption items.”
In order to prepare for the control of exports of items that will now be transferred to DECA’s supervision, on November 23, 2025, DECA published a notice about the revocation of the Encryption Order, which included several key guidelines:
- DECA called on exporters to conduct a thorough review of the sections in Category 5 (Part 2) of List of Dual-Use Goods and Technologies under the Wassenaar Arrangement. The note included a link to a presentation containing highlights about this chapter, while clarifying that the presentation does not replace the language of the control lists.
- DECA called on exporters whose products will be transferred to its supervision to take several actions during the preparatory period until the revocation of the Encryption Order:
- Submit an application for registration in the Defense Export Registry, through DECA’s Registry Division.
- Submit an application for product registration, through DECA’s Technological Division.
- Submit an application for a marketing license, if necessary.
Control under the Import and Export Order
The process of controlling dual-use exports not for defense use, under the Import and Export Order, is generally managed by the Export Control Agency within the Ministry of Economy and Industry and is based on a single-stage model. However, unlike the control under the Encryption Order which allows for broad licenses, the control under the Import and Export Order requires a separate license for each country and for each transaction, which is conditional on the joint approval of the Ministry of Defense and the Ministry of Foreign Affairs.
However, there currently exists uncertainty as to the extent and framework under which the Ministry of Economy and Industry plans to execute control over encryption items. On November 10, 2025, the Ministry of Economy and Industry published for public comment the draft Import and Export Order (Control of Export of Dual-Use Goods, Services and Technology) (Amendment to the Addendum to the Law), 5786-2025 (the “Draft Import and Export Order“). The purpose of the Draft Import and Export Order was to delete the Wassenaar Arrangement’s Information Security chapter from the scope of the Import and Export Order, thereby removing the control of Information Security items from the Ministry of Economy and Industry’s control. The explanatory notes to the order stated that “applying control to goods currently included in the Encryption Order requires resources that are not currently available to the Ministry of Economy and Industry, and there is a concern that under the existing conditions, the regulatory burden on the industry will outweigh the benefit of controlling the field.” It was also noted that transferring the control over the export of dual-use encryption items to the Ministry of Economy “is expected to lengthen the duration of existing processes and impose a significant regulatory burden on many companies.“
Given the revocation of the Encryption Order despite the publication of the Draft Import and Export Order, there is currently uncertainty regarding the future control framework for the export of dual-use encryption items civilian users under the Export Control Agency within the Ministry of Economy and Industry. It is recommended to follow developments in this area.
This memorandum provides access to certain material developments in the field of international trade regulation. The information in this memorandum is provided as general information only and should not be relied upon in any specific case without additional legal advice.
