Companies that sell software often think of an export as a physical event: a box leaves the warehouse. The Commerce Department’s latest settlement with Lambda Research Corporation is a pointed reminder that for software companies, the export may be an automatic update pushed to a customer overseas months or years after the original sale. The Bureau of Industry and Security announced the settlement on Friday, citing 66 export control violations involving software and software updates provided to restricted parties in Japan and China between 2021 and 2025.

What BIS Alleged

Lambda, based in Westford, Massachusetts, designs and sells software and hardware for optical and illumination applications, along with related engineering services. According to the reported facts, it ships software on hardware keys, known as dongles, through distributors in Japan and China, and it automatically provides updates to that software. BIS said the company’s software and updates went to three customers: Huawei Technologies Japan, Shenzhen SiCarrier Technologies, and Sun Yat-sen University. Under the export regulations, those transactions required licenses, and none was obtained.

The first two are on the Entity List. Huawei and its international subsidiaries, including Huawei Japan, were added in 2019 over national security and foreign policy concerns, including suspected sales of products to Iran. Shenzhen SiCarrier was added in 2024, along with 108 other Chinese companies tied to the supply chain for high-end integrated circuits and computers. BIS said Lambda should have been aware that Huawei Japan and SiCarrier were on the list.

The third customer, Sun Yat-sen University in Guangzhou, is on the Unverified List, which is a different category with different consequences. Parties on the Unverified List are ones whose bona fides BIS has been unable to confirm, and exporters are required to take extra steps before shipping to them. BIS said Lambda failed to obtain an unverified list statement from the university, which is the paperwork the regulations require when exporting to such a party, and the agency noted that companies must verify the identity of entities they export to when the transaction is subject to a license requirement.

The Resolution

Lambda filed a voluntary self-disclosure with BIS in October 2025 after its own investigation into possible violations. BIS recognized that in the settlement. The agency set a $2 million penalty but deferred it, on condition that Lambda carries out specified improvements to its export compliance program. If the company meets the terms, the penalty is not collected.

The required steps are concrete. Lambda must designate two employees responsible for export compliance and train them within three months. Within nine months, it must complete an internal audit of its export control program, including a description of the program’s progress over the previous six months, and submit the audit report and supporting materials to BIS’s Boston Field Office, which will monitor the company’s program.

Why This Case Matters

Three features of this settlement deserve attention from any company that sells software or technology internationally.

First, updates and patches can be exports. A company that sells a license once may think its export risk was fixed at the point of sale. But if the product receives automatic or recurring updates, each delivery to a customer abroad may be a new export, reexport, or transfer, and each one requires the exporter to know who is on the receiving end at that time. A customer that was lawful to serve in 2018 may have been added to the Entity List later. That is exactly the situation here: Huawei Japan was added in 2019, and SiCarrier in 2024, which means a customer relationship that began before a designation can become unlawful the day the designation takes effect, unless the company is monitoring.

Second, screening must be continuous and must reach the real recipient. Selling through distributors in Japan and China does not remove the exporter’s responsibility to know who ultimately receives the software and its updates. A company that screens only at onboarding, or only the distributor and not the end customer, misses the point at which a customer’s status changes. The Unverified List requirement adds a second layer: it is not enough to ask whether a party is listed on the Entity List. Exporters must also check for other lists and for the specific documentation, such as unverified list statements, that those lists require.

Third, a small company can face the same regime as a large one. Lambda is a specialized software and hardware firm, not a multinational conglomerate. The case is a reminder that the Entity List and its related lists apply regardless of the size of the exporter or the sophistication of its customers, and that BIS will pursue four years of conduct, here 2021 to 2025, when it finds that a company should have known.

The Role of Voluntary Self-Disclosure

The deferred penalty shows how much voluntary self-disclosure can matter. BIS has said in recent policy statements that disclosure and cooperation are significant mitigating factors, and it has also warned that deciding not to disclose a significant violation can be treated as an aggravating factor. Lambda disclosed in October 2025, and the result was a $2 million penalty that it does not have to pay if it completes its compliance undertakings. A company that finds a problem in its own records should treat the decision whether to disclose as a prompt, carefully documented, counsel-led process, not a matter to be deferred.

Practical Steps for Software and Technology Companies

If your business ships software, firmware, or technology abroad, a few steps follow directly from this case.

Map your update channels. Identify every way software, patches, license keys, and cloud-delivered updates reach customers outside the United States, including through distributors, and treat each as an export event for screening purposes.

Screen continuously. Run your customer and end-customer lists against the Entity List, the Unverified List, and the other restricted-party lists on a recurring schedule and whenever lists change, not just at onboarding. Build a process to suspend updates to a party the day it is listed.

Know the difference between lists. An Entity List designation typically imposes a license requirement and often a policy of denial. The Unverified List triggers statement and documentation requirements. Your screening workflow should tell your team which obligation applies and what to do.

Look through distributors. Require distributors to report end customers, build contractual rights to terminate and to receive end-user information, and verify what they report.

Staff and train the function. The settlement requires two designated, trained export compliance employees. For a small company, the lesson is not the number but the principle: someone must own export compliance, with training and authority.

Audit and keep records. BIS wants an internal audit of the program, with evidence of progress. Do not wait for an agency to require it. The broader point is that export compliance for software companies is a continuous obligation, not a point-in-time one. A customer relationship that was lawful when it started can become unlawful with a single Federal Register notice, and an automatic update that no one thinks about can become a violation.