Encryption notification for the EAEU: what your Russian buyer will ask for before the shipment

1. Which of your products count as encryption goods

The category is much wider than security equipment. A device is considered to support encryption if any of the following applies:

• it uses wireless digital communication technologies: Wi-Fi, Bluetooth, WiMax, GSM and any mobile standards built on it — CDMA, UMTS, HSDPA, LTE and others;
• it restricts access or authenticates users with passwords, keys or electronic signature tokens;
• it runs on a common operating system with built-in encryption functions — Windows, Linux, iOS, Android;
• its very purpose is data protection, secure communication channels or the exchange of confidential information: bank cards and ATMs, devices supporting VPN, SSL or HTTPS, protected storage media.

The list of goods that may use cryptographic means, with the corresponding commodity codes, is set out in Section 2.19 of EEC Board Decision No. 30 of 21 April 2015 «On non-tariff regulation measures». Because the trigger is a technical feature rather than the type of product, a wireless speaker, a laptop, a machine tool with a remote-service module and a payment terminal can all end up in the same regulatory basket.

2. The notification: the document your buyer will ask for

The notification is by far the most common document used when goods with encryption functions cross the EAEU border. It is registered by the authorities responsible for cryptography in the member states: the FSB in Russia, the KGB in Belarus, the KNB in Kazakhstan and the NSS in Armenia. The form and the registration procedure are the same across the union, but the actual practice of each authority differs noticeably, which is why the same product file can move at different speeds in different countries.

For you as the shipper this changes one thing above all: the notification is prepared from your technical documentation. Whoever files it — your buyer, its customs broker or a representative acting for you — the description of the cryptographic algorithms and protocols can only come from the manufacturer. If your documentation package is thin, the file stalls before it even reaches the authority. Companies that handle clearance of electronics and home appliances usually start by auditing exactly this documentation, and the same applies to any equipment with a wireless module inside. Our certification service covers the whole chain, from analysing the technical file to obtaining the registered document.

3. What the buyer will request from you

Once your Russian counterparty realises the goods fall under Section 2.19, the questions arriving in your inbox become quite specific. It helps to know in advance why each of them is being asked.

4. Registration time and the risk of a border delay

Registration times are individual and depend on the technical parameters of the device, the breadth of the model series and the manufacturer. In practice a wide range of devices takes up to two weeks; for a few product units the process fits into ten days. Add to that the time you need to assemble the technical file and answer follow-up questions, and the realistic planning horizon is measured in weeks before departure, not days.

The notification must be in place by the time the goods are declared, not by the time they arrive. A container that reaches the border ahead of the document waits in a temporary storage warehouse, and the ten days to two weeks of registration cannot be compressed once the cargo is already standing there.

Clearance of goods with encryption functions is difficult even for experienced traders, and the difficulty rarely lies in the shipping itself. It lies in the moment someone finally opens the datasheet and finds a Bluetooth module in a product no one thought of as electronics.

5. What the exporter should do

1. Go through the item list of the planned shipment and flag every position with the features described above — including modules embedded in machinery, appliances and accessories.
2. Check the flagged positions against Section 2.19 of EEC Board Decision No. 30 by commodity code, before the contract and packing list are finalised.
3. Assemble the technical file: datasheets, manuals, descriptions of the cryptographic algorithms and protocols used, key lengths, exact model and series designations.
4. Agree with your buyer who files the notification and in which member state, and who covers the lead time in the delivery schedule.
5. Freeze the model designations before labels and shipping documents are printed — the registration is tied to specific models and series, so a model added later needs its own check.
6. Send the registered notification details to your buyer together with the shipping documents, so the declaration is filed without an extra round of correspondence.

6. Frequently asked questions

Does every electronic device need a notification?
No. It applies to goods that use cryptographic means and are covered by Section 2.19 by commodity code. The list is broad, though, so the safe assumption for anything with a wireless module, a password or a common operating system is that it needs checking.

Who obtains the document — we or the buyer?
It is registered by the authorised cryptography body of an EAEU member state. Whoever submits the file, the technical content comes from the manufacturer, so your documentation is needed either way.

How long does registration take?
Up to two weeks for a wide range of devices, and within ten days when only a few product units are involved. The exact time depends on the device parameters, the series and the manufacturer.

Can it be registered outside Russia?
Yes. Each member state has its own authority: the FSB in Russia, the KGB in Belarus, the KNB in Kazakhstan, the NSS in Armenia. We work with registration in Russia, Kazakhstan and Armenia.

7. Expert opinion

Yaroslav Loginov — expert in logistics and customs clearance with 40 years of experience.

«The mistake I see most often on the supplier side is not refusing to cooperate — it is answering too late. The buyer asks for a technical description, the request travels through a sales manager to an engineering department in another time zone, and two weeks disappear before anyone even looks at the algorithms. By then the goods are usually loaded. Nobody planned for the delay, yet everybody pays for it in storage.

The second mistake is treating the question as electronics-only. We regularly see notifications required for equipment, medical devices and household appliances whose sellers never considered themselves electronics exporters — the wireless service module inside was simply never mentioned in the offer. Check the item list for encryption features at the quotation stage, and the paperwork runs quietly in parallel with production instead of holding the container at the border.»

Summary

Goods with encryption functions enter the EAEU on the basis of a notification, registered by the cryptography authority of a member state and prepared from the manufacturer's technical documentation. Registration takes up to two weeks for a broad model range and around ten days for a few units, and it has to be finished before the declaration is filed. The practical conclusion for the shipper is simple: identify the affected positions and collect the technical file while the goods are still in production. Request a consultation and we will review your product range and handle the notification for your models.