Wassenaar Arrangement

Based on Wikipedia: Wassenaar Arrangement

The Gentleman's Agreement That Governs Who Gets Dangerous Technology

In the summer of 2013, a peculiar debate erupted among forty-two nations gathered in Vienna. The question before them: should they add a new category to their list of dangerous technologies that require export controls? Not nuclear centrifuges. Not missile guidance systems. Not stealth coatings for fighter jets.

They were debating surveillance software.

Specifically, they wanted to control "intrusion software"—the kind of code designed to break into computers, defeat security measures, and extract information without detection. The same tools that authoritarian governments were using to spy on journalists and dissidents.

This is the Wassenaar Arrangement in action. It's one of the most consequential international agreements you've probably never heard of, and it sits at the heart of almost every major technology export decision made by Western democracies.

What Exactly Is the Wassenaar Arrangement?

The Wassenaar Arrangement is not a treaty. That distinction matters enormously.

Treaties are legally binding. Countries that sign them can be held accountable under international law. The Wassenaar Arrangement is more like a club—a voluntary association of forty-two countries that agree to coordinate their export control policies for weapons and sensitive technologies. There are no penalties for breaking the rules because, strictly speaking, there are no enforceable rules.

The arrangement was born in 1996 in the small Dutch town of Wassenaar, just outside The Hague. It replaced something far more aggressive: the Coordinating Committee for Multilateral Export Controls, known by its acronym CoCom (pronounced "CO-com").

CoCom was a creature of the Cold War. Its purpose was blunt: prevent advanced Western technology from reaching the Soviet Union and its allies. Any member could veto an export, and they frequently did. The system was designed for confrontation.

When the Berlin Wall fell and the Soviet Union dissolved, CoCom lost its reason for existing. But the participating nations realized they still needed some mechanism to coordinate on technology exports. So they created something softer, more cooperative, and considerably more complicated.

How It Actually Works

Every six months, representatives from the forty-two participating states meet in Vienna, where a small secretariat administers the arrangement. They exchange information about what conventional weapons and dual-use technologies they've exported to non-member countries.

Dual-use is the key term here. It refers to technologies that have legitimate civilian applications but could also be used for military purposes. A high-performance computer chip might power a hospital's diagnostic imaging system or guide a cruise missile. The same encryption software that protects your online banking could secure a foreign military's communications.

The arrangement maintains two lists of controlled items. The first is the Munitions List, which covers obvious military hardware: tanks, artillery, warships, military aircraft, missiles, and firearms. The second is the Dual-Use List, also called the Basic List, which is where things get interesting.

This list is organized into ten increasingly sophisticated categories:

• Special materials and related equipment
• Materials processing
• Electronics
• Computers
• Telecommunications
• Information security
• Sensors and lasers
• Navigation and avionics
• Marine technology
• Aerospace and propulsion

Within each category, items are further classified by type. Physical goods and components get one designation. Manufacturing equipment for those goods gets another. Raw materials, software, and underlying technology each have their own classifications. It's an intricate taxonomy of everything that might give a nation a military edge.

The Sensitive and the Very Sensitive

Not all items on the list receive equal scrutiny. The arrangement creates nested tiers of sensitivity.

The Very Sensitive List includes the technologies that keep defense ministers awake at night. Stealth materials that make aircraft invisible to radar. Advanced submarine detection systems. Next-generation jet engine designs. These items receive the most restrictive treatment.

The Sensitive List is a step below—still consequential, but not quite at the level of game-changing military capability.

Here's the crucial thing to understand: the Wassenaar Arrangement doesn't actually prohibit any exports. It creates a framework for member states to apply their own national export controls. When your country's export authority reviews a license application for, say, advanced semiconductor manufacturing equipment destined for a non-member country, they're almost certainly consulting Wassenaar categories and classifications.

The arrangement aims for transparency and responsibility, not enforcement. Members share information about what they're exporting, which creates a kind of peer pressure. If Germany approves an export that France would have blocked, that information gets shared. Countries can question each other's decisions, even if they can't override them.

Who's In the Club?

The forty-two participating states include all the major Western democracies you'd expect: the United States, the United Kingdom, France, Germany, Japan, Australia, and the rest of the European Union. The North Atlantic Treaty Organization, better known as NATO, is well represented.

But the membership list contains some surprises.

Russia is a member. So is Ukraine. Both have been participating states since the arrangement's founding. South Africa joined. India became the forty-second member in December 2017, with support from Russia, the United States, France, and Germany—a rare moment of agreement among those powers.

Admission requires consensus. Every existing member must agree before a new country can join. Applicants must demonstrate that they're significant producers or exporters of arms and dual-use technology, and they must maintain robust non-proliferation policies and export control systems.

Some notable absences: China is not a member. Neither are Israel, Pakistan, or any Middle Eastern country except Turkey. The arrangement's membership reflects a particular moment in post-Cold War optimism about integrating former adversaries into cooperative security frameworks.

The Surveillance Software Controversy

In December 2013, the arrangement took an unusual step. For the first time, it added purely digital capabilities to the control list: intrusion software and network surveillance systems.

The logic seemed straightforward. Western technology companies had been selling sophisticated surveillance tools to governments with terrible human rights records. These tools allowed regimes to monitor their citizens' communications, track dissidents, and identify sources talking to journalists. The Arab Spring had demonstrated how governments could weaponize such technology against their own people.

By adding these capabilities to the control list, member states could require export licenses and potentially block sales to the worst actors.

The technology industry was not pleased.

Google and Facebook led the criticism. The problem, they argued, was that the controls were drafted too broadly. Intrusion software, as defined, could cover the tools that security researchers use to find and fix vulnerabilities. Penetration testing—where companies hire experts to break into their own systems and identify weaknesses—might require government approval. Bug bounty programs, where companies pay researchers who discover security flaws, could become legally complicated.

The companies made a counterintuitive argument: by restricting security research tools, the arrangement might actually weaken cybersecurity in participating nations while doing little to prevent adversaries from developing their own capabilities.

When Russia Says No

The arrangement's consensus requirement created an unexpected problem when geopolitical tensions returned.

In 2022 and 2023, several member states proposed updates to the control lists. They wanted to add emerging technologies that were becoming strategically significant: advanced quantum computers, the specialized equipment needed to manufacture cutting-edge semiconductors, and artificial intelligence chips.

Russia, which was facing international sanctions over its invasion of Ukraine, blocked these proposals. The consensus requirement meant that a single member could prevent any changes to the lists.

So member states went around the arrangement entirely.

Spain enacted its own controls on quantum computers containing more than thirty-four qubits with error rates below certain thresholds. The Netherlands restricted exports of extreme ultraviolet lithography equipment—the machines that only one company in the world, the Dutch firm ASML, knows how to make, and which are essential for producing the most advanced microchips.

The United States imposed sweeping controls on AI chips and related technology.

These unilateral actions technically fell outside the Wassenaar framework. But throughout 2024 and into 2025, other member states began harmonizing their national controls to match. The United Kingdom and Canada adopted similar restrictions. What started as unilateral measures evolved into informal coordination—a shadow Wassenaar operating beside the official arrangement.

The Limits of Voluntary Cooperation

The Wassenaar Arrangement embodies a particular theory about how international cooperation should work. Rather than imposing binding obligations, it assumes that transparency and peer pressure will encourage responsible behavior. Rather than giving any country veto power over another's exports, it trusts each member to make good-faith decisions.

This approach has advantages. It's flexible. It can adapt to changing circumstances without the cumbersome process of treaty amendments. It includes former adversaries in a common framework rather than drawing sharp lines between blocs.

But it also has profound limitations.

When members' interests diverge sharply—as happened with Russia after 2022—the arrangement loses its ability to function. The very inclusiveness that seemed like a virtue becomes a vulnerability. A country can block changes to the control lists while simultaneously being the reason those changes are needed.

The arrangement also struggles with the pace of technological change. The bureaucratic process of adding new items to the lists can't keep up with innovation. By the time consensus forms around controlling a particular technology, adversaries may have already developed their own versions or found alternative suppliers.

Beyond Wassenaar

The Wassenaar Arrangement exists within a broader ecosystem of export control regimes. The Nuclear Suppliers Group coordinates controls on nuclear technology and materials. The Missile Technology Control Regime focuses on rockets and their components. The Australia Group handles chemical and biological weapons precursors.

Each regime has its own membership, rules, and politics. But they share a common architecture: voluntary coordination among like-minded states, control lists of sensitive items, and information sharing about exports.

For countries seeking to join these clubs, the requirements overlap significantly. Prospective Wassenaar members must adhere to the Nuclear Non-Proliferation Treaty, the Biological Weapons Convention, and the Chemical Weapons Convention. They must participate in other relevant export control regimes.

Chile, for example, has been working since 2015 to join both the Nuclear Suppliers Group and the Wassenaar Arrangement. It's part of the country's broader commitment to non-proliferation, undertaken in response to United Nations Security Council resolutions after the September 11 attacks.

What It Means for Technology Companies

If you work in technology, the Wassenaar Arrangement shapes your world in ways you might not realize.

That export classification number on your product? It likely maps to a Wassenaar category. That training you took on export compliance? It referenced Wassenaar guidelines. That customer you couldn't sell to because of their country of origin? Wassenaar was probably part of the calculus.

The arrangement's categories get translated into national regulations. In the United States, they become Export Control Classification Numbers administered by the Bureau of Industry and Security. In the European Union, they inform the common control list. Each national system has its own quirks, but Wassenaar provides the underlying architecture.

This creates challenges for companies operating globally. An item might be controlled in one jurisdiction but not another. A software tool that's freely downloadable in one country might require an export license to share with colleagues in another. Compliance teams spend considerable resources navigating these complexities.

The Future of Technology Control

The last few years have revealed the arrangement's structural weaknesses. When a major member state becomes an adversary, the consensus model breaks down. When technology evolves faster than bureaucratic processes can adapt, the control lists become obsolete.

The informal harmonization that occurred outside Wassenaar in 2024 suggests a possible future. Like-minded democracies might increasingly coordinate through bilateral agreements and ad hoc coalitions rather than through the formal arrangement. The arrangement might continue to exist while becoming less relevant.

Or the membership might eventually change. Russia's continued participation seems increasingly anomalous given the broader rupture in its relations with Western states. But removing a member would require—you guessed it—consensus.

The underlying challenge isn't going away. Advanced technology confers military advantage. Countries want to sell their technology abroad for economic reasons. But they don't want that technology strengthening adversaries. Balancing these imperatives requires coordination, and coordination requires institutions.

The Wassenaar Arrangement, for all its flaws, remains the primary venue where that coordination happens. When discussions turn to whether American AI chips should be sold to certain countries, or whether Dutch lithography equipment can be exported to Chinese semiconductor factories, the debates inevitably reference Wassenaar categories and classifications.

It's a gentleman's agreement governing some of the most consequential technology decisions in the world. And like many gentleman's agreements, it works—until it doesn't.