Preparing CAD files for an AI data license: export controls, NDAs and clean-up

Engineering data is in demand for AI training. Models that read drawings, generate parts or check designs need real CAD files, not textbook examples. But a CAD archive is not like an email archive. Before you can license it, someone has to answer three questions: are any of the files export-controlled, do your client contracts allow it, and can the files be stripped of who made them and for whom? ITAR CAD files and other export controlled drawings are the hardest part, so most of this guide is about them.

This guide describes how things generally work today. It is not legal advice. Every archive and every deal is different – export control and contract questions depend on your specific files and agreements, and are assessed case by case. And that's what we're here for – we do the groundwork with you, involve the right experts when needed and put good deals on the table.

Why preparation decides whether a license happens

A buyer is not paying for files. It is paying for files it can use without legal risk. That means documented provenance: where the data came from, who owns it, what restrictions apply and what was removed. Buyers also have their own disclosure duties. California's AB 2013 requires developers of generative AI systems to post training-data documentation on their website, including a high-level summary of the datasets, so they ask sellers for clear documentation up front.

In practice, preparation comes down to three screens:

• Export controls. Is any of the data ITAR technical data or EAR-controlled technology?
• Contracts. Which projects are under an NDA, a client contract or a government contract that limits use?
• Identifiers. What in the files points to a client, a site or a person?

An archive that passes all three is easier to license and usually worth more. For how buyers price engineering data, see how much is CAD data worth.

ITAR CAD files: when drawings are technical data

The International Traffic in Arms Regulations (ITAR) control defense articles on the US Munitions List (USML) and the technical data behind them. Under 22 CFR 120.33 (the definition used to sit at 120.10 before the 2022 reorganization), technical data includes information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of defense articles. The rule says this includes information in the form of "blueprints, drawings, photographs, plans, instructions, or documentation." CAD models and drawings of defense articles generally fall within that definition.

The definition does not cover general engineering principles taught in schools, information in the public domain, or basic marketing information about what a system does.

What makes ITAR relevant to AI licensing is the definition of an export. Under 22 CFR 120.50, an export includes not only sending data out of the US but also releasing technical data to a foreign person inside the US – a "deemed export." Under 22 CFR 120.56, a release can happen through visual inspection, written exchanges, or giving someone access information that lets them view unencrypted data.

For a license, that matters in three places:

• The buyer's team. AI labs often employ foreign nationals, including at US offices. Giving them access to USML-related drawings can be an export.
• Storage and transfer. Where the files are stored and how they move matters. ITAR has specific rules on encrypted data and access information, and they are for counsel to apply.
• Authorization. Licensing USML-related drawings to an AI company generally requires authorization from the State Department before any release.

How it usually works in practice: defense, military aerospace, space and weapons-related jobs – including subcontract work where the firm only made a part – are flagged and kept out of the first selection while they are reviewed. The rest of the archive can move ahead in the meantime.

EAR technical data: dual-use and commercial designs

Most engineering work is not defense work, but it can still be controlled. The Export Administration Regulations (EAR) cover commercial and dual-use items. The EAR calls the relevant information "technology," defined in 15 CFR 772.1 as information necessary for the development, production, use, operation, installation, maintenance, repair, overhaul or refurbishing of an item. A note to that definition lists the forms it can take, and it names "computer-aided design files" explicitly, along with drawings, plans, models and engineering specifications.

The EAR has its own deemed export rule. Under 15 CFR 734.13, releasing technology to a foreign person in the US is a deemed export to that person's most recent country of citizenship or permanent residency. 15 CFR 734.15 defines a release as visual or other inspection, or oral or written exchanges.

Whether a release needs a license depends on classification:

• ECCN. Items and technology listed on the Commerce Control List have an Export Control Classification Number. Some ECCNs require a license for many destinations; others for very few.
• EAR99. Items subject to the EAR but not listed on the Commerce Control List are designated EAR99, per 15 CFR 734.3. EAR99 generally means a license is needed only in limited cases, such as embargoed destinations, restricted parties or prohibited end uses.

Many commercial files – buildings, consumer products, general machinery – turn out to be EAR99, but classification is done item by item rather than assumed. Designs for things like advanced electronics, sensors, propulsion, certain materials processing or encryption can carry an ECCN even when the client was a commercial company. The EAR also says that sending or storing unclassified technology secured with end-to-end encryption is not an export in some circumstances (15 CFR 734.18), but that does not cover a buyer's staff working with the decrypted files.

Government contracts and DFARS data rights

If any of your work was done under a Department of Defense contract or subcontract, the contract may include DFARS 252.227-7013, "Rights in Technical Data – Other Than Commercial Products and Commercial Services." The clause sets out the government's rights in technical data delivered under the contract – such as unlimited, government purpose or limited rights – and how deliverables are marked.

We don't interpret those clauses. In practice, projects delivered under a government contract are identified, the contract and any data-rights markings on the drawings are noted, and they are reviewed separately. Those files often overlap with the ITAR and EAR screens anyway.

NDAs and client confidentiality

How ownership of CAD files generally works is covered in our guide on who owns CAD files. Here the goal is just a practical sort of the archive – what each agreement means differs from case to case:

• Projects under an NDA. A CAD data NDA often covers more than expected, including drawings the firm produced itself.
• Projects under a client contract with IP or confidentiality terms. Note whether the client owns the deliverables or only gets a license.
• Projects with no written restrictions. Typically the easiest place to start.
• Clients you could ask. Some long-standing clients will give written permission, especially when the files are de-identified. A short list of who to ask is worth more than a long legal memo.

The sort does not need to be perfect. It tells us where to start the selection and what counsel needs to read.

How to anonymize CAD drawings

De-identifying engineering files is mostly about removing the context around the geometry. Here is what to look for:

• Title blocks. Remove the title block or blank its fields: client, project name and number, site, drawing number, revision history, drawn-by and checked-by.
• Client and project names. These show up outside the title block too – in notes, sheet names, view labels and file names.
• Site addresses and coordinates. Street addresses, survey data and georeferenced coordinates can identify a building or facility.
• PE and RA stamps and seals. Professional engineer and registered architect stamps carry a name and license number. Remove them along with wet and digital signatures.
• Xrefs and file paths. External reference paths often contain server names, client names and project folders.
• Layer names. Layer standards sometimes encode client codes or project names.
• File properties and metadata. Author, company, last-saved-by, custom properties and comments sit inside DWG, DXF, STEP and native CAD files.
• Embedded images and notes. Logos, site photos, scanned markups and redline comments.
• PDM and PLM metadata. Vault exports carry user names, approval workflows and part-numbering schemes tied to a client.
• Third-party library parts. Manufacturer models and purchased content libraries come with their own license terms. These often need to be removed or replaced rather than licensed on.

Names of engineers, drafters and client contacts are personal data, so they are handled the same way as in any other dataset – see data privacy and AI training. Removing a name is not always enough on its own; a project type, date and location together can point to a client. More on that distinction in anonymized vs de-identified data. If EU clients or staff appear in the files, GDPR can also apply to their names.

Seller checklist

What we handle and what your counsel handles

We do the assessment and the selection, and we work with our partners and the buyer on the clean-up in the best possible way to close the deal. That includes looking at what is in demand, which parts of the archive are the strongest, and how identifiers are removed in a way that holds up when a buyer asks. The assessment is free, and we are paid only when a deal goes through.

Export classification and contract interpretation are specialist work, and we help you bring in the right experts for them. We will flag what we see – a defense customer, a government contract, a restrictive NDA – but we don't decide whether a file is ITAR technical data, which ECCN applies or what an agreement allows.

Throughout, you stay in control. Nothing is shared until an NDA is in place, and you approve every deal. Licenses are non-exclusive by default and limited in scope, time and use, so you keep ownership of the archive and can license it again. Read more about how to license your CAD archive.

Summary

CAD files can be valuable AI training data once they are screened. Typically, defense and USML-related projects are set aside for ITAR review, the rest is classified under the EAR rather than assumed to be EAR99, and government contract work is reviewed separately. Projects are sorted by NDA and client terms, and title blocks, stamps, paths, layers and metadata are removed. Every archive and every deal is different: export-controlled archives are not automatically off the table, but some will not be licensable, and that is better known early. If you are considering selling CAD and engineering data, the first step is a free assessment.