An export compliance manager at a defense supplier learns on a Tuesday that a controlled design file reached a foreign national engineer at a vendor eight months ago. The shipping records are intact. The license file is intact. The design review where someone decided the drawing could go out was never recorded.
She now has 60 days to explain why it happened.
That asymmetry is the whole problem, and it is not an accident of drafting. The ITAR is unusually specific about record integrity — it does not merely say “keep records,” it specifies retention period, immutability, attribution and timestamping. Then it asks the disclosure to supply a category of fact that none of those records contain.
The Clock Starts the Day You Discover It
22 CFR 127.12(c)(1) sets the sequence: notify the Directorate of Defense Trade Controls “immediately after a violation is discovered,” then “conduct a thorough review of all defense trade transactions where a violation is suspected.”
127.12(c)(1)(i) closes it. If the initial notification does not contain everything the rule requires, a full disclosure must be submitted within 60 calendar days of that notification, “or the Directorate of Defense Trade Controls will not deem the notification to qualify as a voluntary disclosure.”
Read the consequence precisely, because it is not a fine. The submission does not become late — it stops being voluntary. The entire mitigating posture of the exercise, the reason a registrant discloses at all, is what falls away.
An extension exists under 127.12(c)(1)(ii), but only in writing, and only from an empowered official or senior officer. So the relief is real, and it is also a document that a specific person has to put their name on. Sixty days to review months of transactions and reconstruct the reasoning behind them.
Notice what the two halves of 127.12(c)(1) actually demand. The thorough review of all defense trade transactions is a records exercise, and it is tractable: pull the shipments, the licenses, the exemption citations, the technical data transfers. The registrant already has all of it, in the form the ITAR required them to keep it. The second half is where the difficulty concentrates, and it is not a records exercise at all.
The Rule Asks for Things Only People Remember
Documents establish what shipped and when. The disclosure has to answer more than that.
- 127.12(c)(2)(ii) requires “the exact circumstances surrounding the violation (a thorough explanation of why, when, where, and how the violation occurred).”
- 127.12(c)(2)(iii) requires “the complete identities and addresses of all persons known or suspected to be involved in the activities giving rise to the violation.”
- 127.12(c)(3) asks whether the violation was “intentional or inadvertent,” how familiar the responsible person was with the regulations, whether the violations are systemic, and what training was in place.
Sort those by where the answer lives and the gap becomes obvious. When and where are in the file. Why and how are not. And 127.12(c)(3) goes further still: it asks about a state of mind — intentional or inadvertent, familiar with the regulations or not. No shipping record has ever established what someone understood at the moment they attached a file to an email.
Why it happened, and whether anyone knew better, lives in one place: the recollection of engineers and shippers, questioned eight months after a routine call.
127.12(d) then requires the written disclosure to be “accompanied by copies of substantiating documents.” For the transactional half, that is straightforward. For the explanatory half, there is frequently nothing to attach — not because the registrant was careless, but because no rule ever asked anyone to create the document in the first place.
The ITAR Protects Paper Far Better Than It Protects Testimony
Compare the standards. 22 CFR 122.5(a) makes registrants keep records for five years, and requires electronic records be stored so that “none of it may be altered once it is initially recorded without recording all changes, who made them, and when they were made.”
Unpack that clause, because it is doing more work than a casual read suggests. It is a tamper-evident history. It carries attribution — who made the change. It carries timestamps — when they made it. It runs five years deep. That is a serious evidentiary standard, and the ITAR mandates it for shipping paperwork.
For the conversation, the ITAR sets no standard at all. 127.12(f) says plainly that “oral presentation is generally not necessary to augment the written presentation,” with a meeting available only if you request one.
So the two lanes run side by side and only one has a floor under it. The lane the government can verify independently is the lane the government required you to preserve. The lane that decides how the case is characterized — inadvertent or intentional, isolated or systemic — is the one with nothing preserved and no requirement to preserve it.
Someone Signs for All of It
127.12(e) requires a certification “that all of the representations made in connection with the voluntary disclosure are true and correct to the best of that person's knowledge and belief,” executed by an empowered official or a senior officer.
22 CFR 120.67(a)(4)(ii) defines that official as someone with independent authority to “verify the legality of the transaction and the accuracy of the information to be submitted.”
Put those two provisions next to the timeline and the position is uncomfortable in a structural way. One person certifies a narrative built from other people's memories of meetings they did not attend. The regulation gives that official independent authority to verify accuracy — and for the transactional half, they can genuinely exercise it against a tamper-evident five-year record. For the explanatory half, verification means asking people what they recall and deciding whether to believe them.
The Timing Is Not Yours to Control
127.12(b)(2) treats a disclosure as voluntary only if it arrives before any U.S. government agency learns the same information elsewhere and opens an inquiry.
That provision quietly changes the character of the 60 days. It is not only a deadline — it is a race against an event you cannot see. A vendor, a former employee, a partner agency or a routine audit elsewhere can start a clock nobody told you about. Which means the 60-day window is the outer bound on the time available, not a reliable allowance of it, and every week spent reconstructing why something happened is a week spent inside a race whose other runner is invisible.
The Fix Sits Upstream of the Discovery
The obvious responses do not hold, and it is worth being precise about why.
- Better recordkeeping will not close this gap. The 122.5(a) records were never the weak point. They were complete on the Tuesday she found out. The missing material is a different category of fact, and no improvement to shipping documentation produces it.
- An investigation after discovery cannot manufacture contemporaneity. Interviews conducted in month nine produce month-nine recollections. They are worth conducting, but a decision-maker weighing “intentional or inadvertent” under 127.12(c)(3) can tell the difference between a dated contemporaneous account and a reconstruction.
- The extension is not slack in the schedule. 127.12(c)(1)(ii) requires a written request from an empowered official, and 127.12(b)(2) keeps running regardless of whether an extension is granted.
So the fix sits upstream of the discovery. The design reviews, the technical exchange calls, the “can we just send him the drawing” moments are where the answer to “why” gets created, months before anyone needs it. By the time the 60-day clock starts, the window to capture that answer cheaply has already closed.
AmyNote captures those conversations while they are still ordinary. Transcription runs on OpenAI's latest Speech API and holds up on the vocabulary this work uses: USML category and subcategory, deemed export, retransfer, exemption citations, empowered official. Speaker identification carries across sessions, so a statement stays attached to the person who made it — which matters directly for 127.12(c)(2)(iii), where the disclosure has to identify everyone involved. Anthropic's Claude Opus adds summaries and semantic search across every session, which is how you answer “did anyone flag this as controlled technical data” in minutes instead of weeks.
Honest limits. Recording requires checking applicable consent law and company policy first, and interviews run during an internal review usually belong to counsel, so coordinate before recording those. A searchable archive of ordinary technical meetings is a different thing from an investigation file, and it should stay a different thing.
On privacy, AmyNote states plainly that it does not use customer data to train AI models and does not sell content. Audio and text are encrypted in transit with TLS, and the saved library of recordings, transcripts and notes lives on the user's own iPhone or iPad. AmyNote is equally clear about the limit: local-first is not local-only, and when transcription or an AI summary runs, a processing copy may be retained on its cloud so the request can complete. For a compliance function that reads retention rules for a living, a vendor that writes its own caveat down beats one that leaves it to be discovered.
Getting Started
Sixty days is not enough to rebuild eight months of reasoning, and the certification still has to be signed.
The ITAR is not going to grow a recording requirement for design reviews. The five-year, tamper-evident, attributed standard already exists in 122.5(a) — it simply points at the forms rather than at the conversation that explains them. Closing that distance is the registrant's own choice, made long before anyone needs it to have been made.
Capture the technical conversations while they are ordinary, and keep them searchable. AmyNote does that in a few taps, supports over 120 languages with real-time translation, and the trial needs no credit card.
Originally published as an X Article by @AmyNoteApp.
