Every Update Is an Export

On October 2, 2026, BIS announced a settlement with Lambda Research Corporation, a Westford, Massachusetts company that sells optical and illumination design software. The headline number is modest: a $2 million penalty, fully suspended for a year and then waived if Lambda complies with its terms. The more important number is 66, the count of violations BIS charged for conduct running from April 2021 to August 2025. None of the software was controlled. BIS describes all of it as designated or believed to be EAR99. That is exactly why this case is worth your time.

Read the Proposed Charging Letter and Settlement Agreement.

The 66 charges fall into three buckets, and the middle one is the one to study.

Eleven knowledge charges (§ 764.2(e)). These cover sales to Huawei Technologies Japan, which has been on the Entity List since May 2019: five exports of CodeMeter USB dongles carrying software licenses, routed through a Japanese distributor, and six annual maintenance and support subscriptions. The subscriptions gave Huawei Japan access to Lambda's support and download portal, plus automatic updates of the licensed software.

Fifty-four update charges (§ 764.2(a)). Forty-seven automatic updates went to Huawei Japan (42 TracePro, five OSLO) and seven went to SiCarrier, another Entity List party. BIS's position is stated flatly in the charging documents: each automatic update is an export, and each one needed a license. These charges carry no knowledge element: BIS did not need to show that Lambda knew or had reason to know, which is what makes the update count so dangerous for software companies.

One Unverified List charge. In November 2023, a license for TracePro and RayViz software reached a laboratory tied to Sun Yat-Sen University (on the Unverified List since October 2020) through a Chinese distributor without the UVL statement that § 744.15 requires, even though no license was needed. The purchase order named the Southern Marine Science and Engineering Guangdong Laboratory (Zhuhai), and Lambda's own new-license form listed an associate professor at a Sun Yat-Sen University address.

If you read Issue 02, you know the cloud advisory opinions rest on a distinction: BIS said in 2014 that a foreign user who works inside a hosted application without downloading the software hasn't received an export of that software. Lambda sits on the other side of that line. Its customers held installed software under license, and Lambda kept sending them new versions.

Three features of the SiCarrier and Huawei Japan facts deserve attention from anyone who ships software.

First, a lawful sale doesn't immunize the updates that follow it. Lambda sold 15 perpetual TracePro licenses between May and September 2024 to ChinaSoft Technology through a China-based distributor, Shanghai LightPaths, before SiCarrier was listed on December 2, 2024. Three of those licenses ended up with SiCarrier. The violations are the seven updates sent after the listing, because from that date a license was required for any item subject to the EAR going to SiCarrier, with a presumption of denial.

Second, the end-user information was in Lambda's own files. The May 2024 invoice identified the end user for 11 of the 15 licenses as "ChinaSoft (Sicarrier)." Distributor chains don't launder knowledge when the paperwork names the real customer. Note the limit of the point, though: the seven charged updates went to three licenses that Lambda tied to SiCarrier only after its July 2025 disclosure, and the charging letter does not say whether those three were among the 11. That gap is the no-knowledge-required problem in a nutshell: Lambda was charged for updates to a listed party it had not yet identified.

Third, a license key can be treated as the software. BIS treated the CodeMeter dongles as transfers of "access information" under § 734.19, which requires an authorization comparable to the one the software itself would need if the exporter knows the transfer will release the software. The license documentation shipped with each dongle named Huawei Japan as the licensee. If your product ships credentials, tokens, or keys that unlock software or hosted capability, that provision is written for you.

The knowledge charges turn on facts BIS recites about the company's own conduct, and they are worth reading as a negative example of diligence.

According to the agreement, the CEO, other senior managers, and sales personnel were aware of media reporting on Huawei's 2019 listing and "investigated the legal implications." That investigation consisted of reading news articles and press releases and checking whether competitors kept selling to Huawei. A former employee reportedly emailed BIS in June 2019; Lambda has provided no documentation of it, and does not allege that anyone followed up after the employee left. Lambda learned in September 2024 that a competitor had stopped selling to Huawei in 2019, and it still didn't end the relationship immediately. From 2019 to April 2025 it sought no legal guidance. It had no written export procedures and no one trained or specifically tasked with compliance.

Under § 772.1, the definition of knowledge is broader than just actual knowledge. It also includes awareness of a high probability, and BIS says that awareness can be inferred from conscious disregard or willful avoidance of known facts. Reading about a listing and then watching what your competitors do is not a diligence process. It is evidence of awareness.

The $2 million figure is a fraction of the exposure. The charging letter cites a per-violation maximum of $374,474, which across 66 violations is roughly $24.7 million before you consider the alternative of twice the transaction value where that is greater. Against that, BIS accepted a fully suspended penalty with conditions: at least two designated compliance personnel, training within three months, an internal audit within nine months covering the six months after the order (with the results sent to BIS's Boston Field Office and any violations found promptly disclosed), and a waiver and tolling of the statute of limitations.

Compare the rest of 2026. Applied Materials paid about $252 million in February, the statutory maximum at twice the transaction value. Bosch agreed to pay $36 million in June. Lambda's resolution is closer to the small-company end of that range. Lambda disclosed on its own, first on July 2, 2025 and then in a full disclosure on October 31, 2025. The agreement doesn't say how much of the outcome reflects that credit. Published summaries attribute the suspension to Lambda's limited ability to pay, so the suspended figure should not be read as a measure of that credit. One detail the documents leave unexplained: the last charged update shipped on August 12, 2025, six weeks after the first disclosure.

•      Screen your installed base, not just new orders. Entity List additions create obligations on existing customers. The question after every list update is what you are still sending to anyone on it.

•      Find your automatic channels. Updates, patches, license refreshes, support portals, and telemetry-driven downloads all move without a sales event. If nobody owns the screening of those channels, they are your Lambda exposure.

•      Build a per-customer stop switch. Disclosing a problem to BIS is the moment to halt the flow. Make sure you can suspend updates and support for one entitlement without waiting on engineering.

•      Read your own paperwork. Invoices, purchase orders, and license forms often name the real end user. Train sales and finance to escalate when a distributor's customer shows up on a screen.

•      Check the Unverified List separately. A transaction with no license requirement can still require a UVL statement.

•      If you ship software development kits (SDKs) or client software, classification doesn't end the analysis. EAR99, 4D906, anything else: the Entity List overlay applies to all of it.

•      The Affiliates Rule snapback. BIS suspended the rule for a year effective November 10, 2025, and it was scheduled to return on November 10, 2026. In late September 2026, Treasury Secretary Bessent announced a two-month extension of the U.S.-China Busan truce through January 10, 2027, and the pause on the rule is expected to follow, which would push its return to that date, but as of mid-October no Federal Register notice had confirmed it. When it returns, restrictions reach entities owned 50 percent or more by listed parties. Lambda's facts are adjacent rather than squarely within the rule: ChinaSoft was an intermediary, not (on the public record) an affiliate owned 50 percent or more by SiCarrier. But the diligence the rule demands, knowing who stands behind the buyer, is the discipline Lambda lacked.

•      Whether BIS keeps counting updates one by one. The schedule counts per license, not per release: the February 7, 2024 TracePro 24.1 release produced three charges, one for each active Huawei Japan license. Per-update charging multiplies violation counts quickly for any software company with a long-lived installed base.

•      Lambda's compliance deadlines. Training is due within three months and the audit within nine. A miss can activate the suspended $2 million penalty, and timely completion of both is a condition of any export license, license exception, or privilege Lambda holds.

This issue is for informational purposes and is not legal advice. If your organization has specific exposure here, talk to export control counsel before your next product launch, not after.