Export controls are no longer a niche compliance issue

Who needs to read it? Why?

This article will be of interest to New Zealand businesses operating in defence, defence-adjacent, aerospace, space, drone, advanced manufacturing and other technology-intensive sectors, as well as those exporting dual-use goods, software or technology more generally. It should also interest in-house legal, compliance, risk and governance teams, directors, and anyone responsible for sanctions, customs or supply-chain compliance.

Five global enforcement trends New Zealand businesses should understand

1. Export controls are increasingly being treated as national security issues

Governments are increasingly viewing export controls, sanctions and supply-chain compliance through a national security lens rather than solely as trade regulation. That shift is driving greater regulatory scrutiny, information sharing between agencies, and alignment between export controls, sanctions, customs and law enforcement functions. Two trends in particular are worth watching: the growing convergence of sanctions and export controls regimes, with many regulators now applying similar due diligence and enforcement expectations to both; and increasing scrutiny of diversion through third countries, as controlled technology bound for restricted destinations is rerouted through intermediate jurisdictions to obscure its ultimate end use.

See our earlier insight, Navigating export controls: Emerging considerations, for a fuller discussion of these global trends, including the implications of AUKUS Pillar II for New Zealand exporters.

2. Regulators are focusing on end users, not just customers

Historically, many compliance programmes focused on product classifications and restricted-party screening. That focus is no longer sufficient: a transaction can still breach export controls or sanctions even where the direct customer is not on a restricted-party list and the goods themselves are not separately controlled, if the ultimate end use or end user is prohibited.

Today, regulators increasingly expect businesses to understand:

who ultimately owns or controls the customer;
who the end user is;
how products will be used; and
whether there are diversion, circumvention or sanctions risks associated with the transaction.

It is no longer enough to establish that the immediate customer does not appear on a restricted-party list. Businesses may need to look further into their supply chains and investigate unusual transaction structures, intermediaries and destinations. Common red flags include a customer who cannot clearly explain the intended end use, a stated use that does not match the goods' technical complexity, and reluctance to provide end-user documentation.

3. More sectors are now in the spotlight

Export controls are no longer relevant only to traditional defence contractors. Particular attention is being paid to:

defence and defence-adjacent technologies;
space and satellite technologies;
drones and autonomous systems;
aerospace and aircraft-related technologies;
advanced manufacturing;
electronics and semiconductors;
telecommunications;
cybersecurity and cryptography;
artificial intelligence; and
research-intensive technologies with potential dual-use applications.

Many organisations are surprised to discover that technologies developed for entirely civilian purposes may still be subject to export controls, particularly where they have potential military, intelligence, surveillance, aerospace or other strategic applications. Artificial intelligence and advanced computing are a particular focus. Major technology-exporting nations have introduced new controls on advanced semiconductors, the equipment used to manufacture them, and the computing capacity needed to train frontier AI models, reflecting growing concern that these technologies have direct military and intelligence applications. US enforcement activity in 2026 illustrates the broader point: semiconductor, engineering and even medical research technology companies have all faced multi-million dollar penalties for unlicensed exports to restricted parties, including one settlement exceeding USD250 million.

4. Compliance programmes matter more than ever

One of the clearest themes emerging from international enforcement activity is that regulators assess not only whether a breach occurred, but also how an organisation identified and responded to compliance risk.

Voluntary disclosure, cooperation, effective compliance systems and prompt remediation can be important mitigating factors. Conversely, inadequate controls, repeated non-compliance, concealment and a failure to investigate warning signs may aggravate the position. Some regulators have now formalised this: the UK's 2026 strategic approach to sanctions enforcement, for example, expressly lists voluntary disclosure, cooperation, appropriate due diligence and a clean compliance history as mitigating factors, against deliberate, reckless or repeated non-compliance and concealment as aggravating factors.

Organisations should therefore be able to demonstrate that their compliance processes are proportionate, effective and actually operate in practice. In our experience, a robust programme typically includes a clear policy statement with senior management support, a risk assessment, a classification process, due diligence and screening procedures, staff training, clear escalation procedures, recordkeeping, and regular testing and audit.

See our earlier insight, 12 essential building blocks for a robust sanctions compliance policy, for a fuller discussion of these elements, which apply equally to export controls compliance programmes.

5. Investigations can be as disruptive as prosecutions

While public attention often focuses on prosecutions and penalties, organisations may experience significant disruption long before any enforcement outcome is reached.

Investigations, search warrants, customer audits, supplier due diligence, banking reviews and disclosure obligations can consume substantial management time and create commercial and reputational risk, even where no breach is ultimately established. How an organisation participates in an investigation, including understanding its scope, assembling the right team and engaging with the regulator in a considered way, can materially shape the outcome.

New Zealand authorities have demonstrated a willingness to investigate suspected export controls breaches, including through search warrants and other enforcement activity. Businesses should no longer assume that the relative rarity of publicly reported prosecutions means there is little risk of regulatory scrutiny.

See our earlier insight, 12 guiding principles for navigating regulatory investigations, for practical guidance that applies equally to export controls investigations.

What does this mean for New Zealand businesses?

New Zealand's export control regime regulates exports of military and dual-use goods, software and technology on the New Zealand Strategic Goods List (NZSGL), together with "catch-all" controls that can capture items not on the NZSGL where there is a risk of military or police end use. MFAT administers the regime, including maintaining the NZSGL and issuing permits, while New Zealand Customs is responsible for detecting, investigating and prosecuting breaches. An independent review of the regime in 2021 found that, while controlled goods exports were being managed in line with legislative requirements, the design and implementation of the regime fell short of contemporary best practice in several respects.

Further domestic regime change is likely. MFAT recently consulted on proposals to strengthen New Zealand’s export controls regime, with submissions closing on 16 January 2026. The proposals would significantly expand the regime, including new domestic ("deemed export") controls, controls on intangible technology transfers overseas, and a graduated regime of warnings and penalties. See our earlier insight, MFAT seeks submissions on strengthening New Zealand's Export Controls Regime, for a full summary of MFAT’s proposals.

MFAT's final decisions have not yet been announced, but regardless of the precise form reform ultimately takes, businesses should expect a broader and more sophisticated compliance environment: implementing the reforms will require new legislation and a transition period, and the regime should progress toward implementation over the next one to two years, irrespective of which party or parties form a government following the 6 November election.

For many New Zealand businesses, the greatest risk may not come from a domestic prosecution alone: companies may also become involved in overseas investigations, supplier audits or enforcement action led by foreign authorities where controlled technology or sensitive end users are involved.

Common compliance gaps

Across the sectors attracting regulatory scrutiny, several recurring gaps arise, most tracing back to the enforcement trends above. Businesses should ask whether they:

understand the export controls status of their products, software and technology, and reassess classifications as products or controls evolve;
look beyond the immediate customer to the ultimate end user, ownership structure and intended use;
capture intangible exports, including software, source code, technical data and engineering know-how;
train relevant staff to recognise and escalate diversion and sanctions risks, rather than relying too heavily on distributors or customer assurances;
maintain documented, risk-based procedures with clear escalation pathways and sufficient records to explain and support their decisions; and
can investigate and respond quickly to red flags involving ownership structures, intermediaries, transhipment routes or unusual end uses.

For many organisations, the greatest risk is not a deliberate breach. It is failing to recognise an issue early enough to manage it appropriately.

Looking ahead

The direction of travel is clear. Regulators increasingly expect organisations to understand not only their products, but also their customers, supply chains, end users and the broader national security implications of their transactions. We expect continued regulatory focus on intangible technology transfers, advanced computing and AI-related technologies, and diversion through third countries, as governments continue adapting export controls frameworks to evolving technology and supply chains. Against a backdrop of increasing enforcement activity, international coordination and anticipated reform of New Zealand’s export controls regime, a proactive, risk-based approach to export controls is increasingly a commercial and governance necessity.

How we can help

MinterEllisonRuddWatts has New Zealand’s leading export controls, sanctions and strategic trade practice. We advise New Zealand and international organisations across the full lifecycle of export controls risk, from product development and market entry through to complex investigations and enforcement matters.

Our specialist team regularly assists clients with:

classifying goods, software and technology;
developing permitting and regulatory strategies;
sanctions, end-user and supply-chain due diligence;
defence, aerospace, space, drone and advanced technology projects;
software, cryptography and intangible technology transfers;
internal compliance programmes, audits and training;
voluntary disclosures and remediation;
responding to search warrants, investigations, regulatory inquiries and prosecutions; and
engagement with MFAT, New Zealand Customs, New Zealand Police and overseas regulators.

Having advised on many of New Zealand’s most complex export controls, sanctions and strategic trade matters, we understand not only the legal framework, but also how regulators, customers, suppliers, banks and counterparties assess and manage these risks in practice. If your organisation is considering a sensitive transaction, reviewing its compliance framework or responding to a potential issue, early specialist advice can materially improve the available options and outcome.

Please contact our international trade team to discuss how we can assist.