A Question That Comes Up More Often Than It Should
Defense contractors call me regularly with some version of the same question: "We have an ITAR issue—do we need a lawyer or a consultant?" It is a fair question, and the honest answer is: it depends on what you are actually dealing with. The two disciplines overlap in meaningful ways, but they serve fundamentally different functions. Confusing them can cost you money, time, and—in serious cases—your export privileges.
This post is a practical guide for compliance managers and executives who need to make that call confidently. We will break down what each brings to the table, where the lines are drawn, and how to recognize situations that require one, the other, or both working together.
What ITAR Consulting Actually Is
ITAR consulting is a compliance and operational discipline. A qualified ITAR and export controls compliance consultant helps your organization understand the International Traffic in Arms Regulations, build systems to meet them, train your workforce, and sustain a defensible compliance posture over time. The work is programmatic, practical, and ongoing.
Here is what experienced ITAR consulting typically covers:
- Assessing your current compliance program against ITAR requirements
- Classifying products, technology, and technical data under the U.S. Munitions List (USML)
- Developing and implementing internal compliance policies and procedures
- Training employees on ITAR obligations, including foreign national access controls and proper data labeling
- Conducting compliance gap assessments and internal audits
- Supporting license determination processes and helping prepare license applications
- Standing up or remediating a compliance program after a merger, acquisition, or organizational change
- Providing ongoing compliance monitoring and program management
What consulting does not do is provide legal advice. Consultants cannot represent you before the Directorate of Defense Trade Controls (DDTC), advise on litigation strategy, or provide attorney-client privilege. Those distinctions matter enormously when things go wrong.
What Legal Counsel Provides That Consulting Cannot
Export control attorneys bring a different set of capabilities—ones rooted in legal interpretation, regulatory representation, and the protections that come with the attorney-client relationship.
You need legal counsel when the situation involves:
- Voluntary disclosures to DDTC: If your organization has identified a potential ITAR violation, a voluntary disclosure is a legal proceeding. You want an attorney structuring that submission, not a consultant.
- DDTC enforcement actions or investigations: Any formal government inquiry requires legal representation.
- Responding to subpoenas or federal inquiries: Full stop—get an attorney immediately.
- Complex licensing questions with significant legal ambiguity: When the regulatory interpretation is genuinely unclear and the stakes are high, legal counsel should weigh in.
- Contract negotiations involving ITAR flow-down clauses: Legal review of contractual obligations and liability exposure belongs to counsel.
- Transactional due diligence involving export-controlled technology: Mergers, acquisitions, and technology transfers with foreign parties typically require legal review of ITAR implications.
Attorney-client privilege is not a formality—it is a critical protection. Communications with legal counsel about potential violations are protected. Communications with consultants are not. If there is any real possibility of a violation or enforcement action, establish legal privilege first and layer in consulting support from there.
Where the Two Roles Complement Each Other
In practice, the strongest ITAR programs use both. The attorney sets the legal strategy and owns the privileged analysis. The consultant operationalizes the compliance program—building the policies, procedures, training infrastructure, and audit mechanisms that demonstrate good faith and reduce violation risk in the first place.
Think of it this way: legal counsel handles the situations where you may already have a problem. ITAR consulting helps ensure those situations do not arise. If you have a robust consulting-supported compliance program, your need for emergency legal intervention drops significantly.
For organizations in the aerospace and defense sector, this division of labor is not theoretical—it is operational reality. Prime contractors and their supply chains deal with ITAR daily. The question is not whether you will encounter legal gray areas; it is whether you have the programmatic infrastructure to navigate them before they become enforcement matters.
Common Scenarios and the Right Resource for Each
Scenario 1: You are new to ITAR and need to build a compliance program
This is a consulting engagement. You need someone to assess your products, map your technical data flows, identify your USML exposure, and build a compliance program from the ground up. Our compliance program development service is designed specifically for this situation. Legal counsel may be useful for initial regulatory interpretation, but the heavy lifting is operational.
Scenario 2: An employee may have shared controlled technical data with a foreign national without authorization
Call an attorney first. This is a potential violation. Establish privilege, conduct a legally protected internal investigation, assess your voluntary disclosure obligations, and then engage consulting support to remediate the programmatic gap that allowed the incident to occur. Our blog post on ITAR violations guidance for compliance managers provides useful context on what to expect in these situations.
Scenario 3: You need to apply for a DSP-5 or other ITAR license
Most license applications are a consulting function. An experienced consultant who understands USML classifications, end-use requirements, and DDTC expectations can guide the application process efficiently. For complex or novel licensing situations—particularly those involving foreign ownership, new technology categories, or prior enforcement history—legal review adds a valuable layer of protection. You can also reference our overview of ITAR licenses to orient yourself on the landscape.
Scenario 4: You are undergoing a merger or acquisition involving ITAR-registered entities
This requires both. Legal counsel handles the transactional and regulatory dimensions—DDTC notifications, agreement reviews, and disclosure obligations. Consulting support handles the integration side: reconciling compliance programs, assessing the acquired entity's ITAR posture, and building a unified compliance infrastructure. We have extensive experience supporting ITAR compliance after mergers and can work alongside your legal team effectively.
Scenario 5: You are preparing for a DDTC audit or compliance review
Again, both. Legal counsel should be involved in any direct DDTC interaction. Consulting support helps you prepare your documentation, demonstrate the maturity of your compliance program, and identify any gaps before the government does. Use our ITAR compliance checklist as an internal readiness benchmark.
How to Evaluate Your ITAR Consulting Partner
Not all ITAR consulting is equal. When evaluating a firm, look beyond generic "compliance" credentials. You want practitioners who understand the USML deeply, have experience across your specific industry sector, and can demonstrate a track record of building programs that hold up under scrutiny.
Key questions to ask any ITAR consulting firm before engaging include:
- Have they worked with organizations in your industry and with your type of ITAR-controlled products?
- Can they demonstrate experience with USML classification, not just general export control policy?
- Do they have a structured methodology for gap assessments, program development, and ongoing compliance management?
- How do they handle situations that cross from consulting into legal territory—do they have relationships with qualified export control counsel?
- What does their engagement model look like, and can it flex as your compliance needs evolve?
Our detailed post on evaluating an ITAR compliance services provider walks through these criteria in depth.
The Cost of Getting This Wrong
ITAR violations carry civil penalties of up to $1.3 million per violation and criminal penalties of up to $1 million and 20 years imprisonment per violation. Debarment from U.S. government contracting is also on the table. These are not theoretical risks—DDTC enforcement is active, and the defense industrial base is under heightened scrutiny.
Trying to use a consultant to handle what is fundamentally a legal matter—or relying on an attorney to do what requires operational compliance expertise—is a false economy. Understanding which resource to deploy, and when, is itself a compliance management competency.
For manufacturers navigating these obligations, our post on ITAR compliance for manufacturers provides additional sector-specific context. Organizations in the manufacturing sector face particularly complex ITAR challenges given the intersection of controlled hardware, technical data, and foreign supplier relationships.
Build the Program First—Then You Will Need Legal Counsel Less
The single most effective thing a defense contractor can do to reduce ITAR legal exposure is invest in a robust compliance program before a problem occurs. A well-built program—with clear policies, trained employees, documented procedures, and regular internal audits—is your best protection against the kinds of incidents that generate legal fees, enforcement actions, and reputational damage.
ITAR consulting is how you build that program. Legal counsel is how you handle the situations the program fails to prevent. The goal is to minimize the latter by investing seriously in the former.
If you are ready to assess where your ITAR compliance program stands today or build one from the ground up, Cleared Systems can help. Request a quote to speak with our team about your specific situation, or explore our engagement models to understand how we structure ITAR consulting engagements for organizations at every stage of compliance maturity.