What records are usually excluded from a manufacturing data license?

The exclusion checklist for manufacturers#

The exclusion checklist for manufacturers covers records that a law may restrict, that belong to someone else, or that carry risks no license fee justifies. Most of these categories are excluded in every deal; a few move to review when the facts allow.

Use the third column as a search guide. Excluded material rarely sits in one tidy folder, so the people who know each system should confirm where it lives before any scoping conversation.

Why export-controlled work is excluded by program#

Export-controlled work is excluded by program because the restriction attaches to technical data, and technical data spreads across many systems once a job runs. A controlled part's drawing may be attached in the ERP, referenced on the traveler, copied into a CAM file and discussed in a nonconformance.

Picking controlled files out one by one invites misses. The safer practice is to identify every customer program, part family or contract that involved work controlled under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR), or subject to defense safeguarding requirements, and remove all of its records from scope. Whether a specific item is controlled is a question for your export compliance lead and counsel.

The definitions explain why. Under the ITAR, technical data includes information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles, including blueprints, drawings, photographs, plans, instructions and documentation (22 CFR 120.33(a)(1)). Under the EAR, releasing controlled technology to a foreign person inside the United States is itself an export, known as a deemed export (15 CFR 734.13). Travelers, setup photos and work instructions for a controlled part can therefore carry the same restriction as its drawing, and a buyer's staff may include foreign persons.

Exclude, redact or review: a decision rule#

The decision rule is simple: exclude when rights or restrictions attach to the whole record, redact when personal or identifying details sit inside a record you otherwise control, and send to review when contracts are unclear. Applying it consistently keeps scope discussions short.

The rule also protects the rest of the package. A license built only on records the company clearly controls is easier to approve, easier to defend later and easier for a buyer to accept.

Where excluded material hides in ERP, MES and QMS records#

Excluded material hides in attachments, free-text fields and shared drives more often than in structured tables. A part master may be clean while its attachment tab holds the customer's drawing, and a nonconformance may look generic while its notes quote the customer's specification.

Timeclocks and access systems are easy to overlook because they feel like HR tools. Many plants use fingerprint or face readers for time and attendance, and those templates and logs should stay out of scope. Labor records drawn from them may be able to proceed once names and badge numbers are replaced with role codes, subject to counsel's review.

Configuration files are the other blind spot. Machine programs, PLC projects and IT tickets can hold passwords, network addresses and remote access details, which are excluded or scrubbed whatever else proceeds.

How exclusions should be documented#

Exclusions should be documented in a register that lists each excluded category, the reason, the systems searched and who approved the decision. The register becomes part of the package record, so the buyer and the company can both see what was left out and why.

Published provenance standards offer a useful vocabulary. The Data & Trust Alliance's Data Provenance Standards, for instance, include use metadata for confidentiality classification, consent documentation, excluded processing and storage geographies, license to use, and copyright, patent and trademark status. Capturing those points for each package keeps exclusions explicit.

Illustrative: a heat exchanger maker carves out a naval program#

Illustrative: a fictional maker of industrial heat exchangers and pressure vessels serves chemical plants and HVAC equipment makers, and builds one family of units for a naval shipbuilding program. Its ERP, QMS and CAM systems hold all of these jobs together, and its plant uses fingerprint timeclocks.

The general counsel and COO exclude every job, quote, drawing, weld record and nonconformance tied to the naval program, the units built to HVAC customers' drawings, and the timeclock templates. Labor records are kept with names replaced by roles. The remaining history covers the company's own catalog exchangers and moves into a licensing review with a written exclusion register that lists each carve-out and who approved it.

A pre-scoping checklist for counsel and operations#

A pre-scoping checklist lets counsel and operations agree the boundaries before anyone exports a file. Each item should end with a named owner and a yes, no or unknown answer.

• 1Which customer programs, part families or contracts involved export-controlled work or CUI?
• 2Which customers supplied designs, and what do their terms say about confidentiality and work product?
• 3Which supplier NDAs or agreements cover drawings, pricing or process data in our systems?
• 4Do we use biometric timeclocks or access readers, and where are their records stored?
• 5Where do injury, medical, drug test and leave records live, and are any copied into operations systems?
• 6Which files are privileged or under legal hold?
• 7Where could credentials or network details appear in machine programs, configurations or tickets?
• 8Who approves the exclusion register for the company?

How SourceX applies exclusions#

SourceX applies exclusions in the Rights and Preparation steps of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. Export-controlled and defense work, customer-owned designs and sensitive personal data categories are identified on metadata first, before any records are prepared.

The company's exclusion register travels with the package inside the SourceX Evidence Packet, so the buyer can see what was left out and why, and the company approves the final scope before delivery.