You can translate ITAR-controlled documents into Slovak, or out of it, but only if you treat the translation as part of the export, not as an admin task after it. That means three things: know whether the file is technical data, control exactly who can open it, and keep the transfer encrypted and the records tidy. Sounds heavy? It’s a checklist, and we’ll walk through it.
A quick note first. This is practical guidance from a language provider, not legal advice. For a classification or licence question, talk to your export compliance officer or a lawyer who knows US export control.
What ITAR actually controls in a translation job
ITAR is the US regulation covering defence articles and related services. For translators, the key concept is technical data. Under 22 CFR 120.33, that means information needed to design, develop, produce, manufacture, assemble, operate, repair, test, maintain or modify defence articles. It includes blueprints, drawings, photographs, plans, instructions and documentation, plus software directly related to those articles.
So the typical documents are:
- engineering drawings and CAD files
- maintenance and repair manuals
- test procedures and specifications
- source code or firmware strings tied to a defence article
- technical proposals and work instructions
A brochure or a general company policy usually isn’t the problem. A maintenance manual for a controlled component is. If you’re unsure which side your file falls on, ask your compliance team before it goes anywhere near a vendor.
When does a Slovak translation become an export?
Here’s the surprise: nothing needs to cross a border for an export to happen. The same regulation text explains that releasing technical data to a foreign person inside the United States is a deemed export, and that shipping or transmitting data out of the US is an export too (see the definitions).
For an EU business, the practical triggers are these:
- You send US-origin technical data to a translator or agency. Whoever receives it gets access, wherever they sit.
- A linguist who isn’t authorised to see the data opens the file. Access is what matters, not the file’s location.
- Files are stored or processed on servers or tools nobody has vetted. Cloud translation platforms and machine translation engines count here.
The contractor side matters too. According to the International Programs Security Handbook, exporting technical data typically needs prior written authorisation from the US Directorate of Defense Trade Controls (DDTC), such as a DSP-5 licence, unless an exemption applies. Your translation vendor shouldn’t be the one deciding whether that applies. You should know before the project starts.
Checks to complete before you send anything
Run through this list first. It takes an afternoon and saves a very awkward conversation later.
- Classify the content. Is it technical data under the USML, or not? Get this in writing from whoever owns export compliance.
- Confirm the authorisation. Do you have a licence, agreement or exemption that covers sharing this data with this vendor and these linguists?
- Name the people. List who will touch the file, including project managers, translators, reviewers and IT admins.
- Agree the workflow. Decide where files live, how they travel and when they are deleted.
If you already work under a Technology Control Plan (TCP), use it. The US Bureau of Industry and Security lists the essential elements as management commitment, a physical security plan, an information security plan, personnel screening, training and awareness, and a self-evaluation or audit programme. Nothing stops you from applying the same logic to a translation project, even when your own rules call it something else.
Who may see the material: vetting translators and providers
Access is the heart of ITAR translation. A Technology Control Plan guide from CASRAI describes the plan as identifying the controlled technology, listing authorised personnel by name and citizenship, and documenting physical and IT safeguards. It also treats the plan as specific to an item and a project, to be reviewed periodically and updated when staff or scope changes.
Turn that into questions for any provider:
- Can they give you a named list of everyone who will open your files?
- Can they restrict the project to that list, and keep it restricted if the team changes?
- Do they have a written confidentiality process for linguists working on defence content? (We’ve set ours out in a buyer checklist for defence linguists.)
- Where are files stored, and who administers the systems?
- What happens to files at the end?
A provider who answers with vague reassurance is a red flag. A provider who asks you for the authorisation details is a good sign.
Moving and storing files: encryption, machine translation and AI
This is where most real-world mistakes happen, usually with an email attachment.
The 2020 ITAR update added a carve-out in § 120.54. According to the DDTC summary of changes, sending, taking or storing unclassified technical data is not an export if it is secured with end-to-end encryption using FIPS 140-2-compliant cryptographic modules or comparable security. The data must also not be intentionally sent to or stored in a proscribed country, and must not be sent from one.
The same document adds a catch: giving a foreign person the decryption keys is a violation if that person isn’t otherwise authorised to access the underlying data unencrypted. Encryption doesn’t wash away the access question.
What that means in practice:
- No ordinary email attachments and no consumer file-sharing links.
- Encrypt end to end and keep the keys with people who are authorised.
- Treat every public machine translation or AI tool as a place where your data is sent and stored. Until you’ve confirmed where it runs and who can reach it, keep controlled text out of it.
- Set up controlled access, secure storage and audit logs for the whole workflow. TextUnited makes the same point for technical documentation workflows, along with preserving non-translatable elements.
We go deeper on the basics in our guide to secure translation for businesses.
Keeping the Slovak version accurate and auditable
Controlled documents usually carry markings, part numbers and revision levels. A translation that drops one is a compliance problem, not just a typo. Good practice:
- Freeze the source. Translate one identified revision, and record its version number.
- Protect what isn’t translated. Part numbers, control markings, distribution statements and legal notices stay intact or follow a rule you agreed up front.
- Agree a glossary. Slovak technical terms for defence equipment vary between teams. Fix them once.
- Keep the layout. Drawings and tables carry meaning. Our note on CAD drawing translation shows how to avoid breaking them.
- Use two humans. One translates, one reviews against the source.
- Log changes. Every revision gets a date, a reviewer and a reason.
New to the field? Here is a primer on technical translation.
Records and what happens to working files
When the project closes, don’t just archive the folder and forget it. Decide in advance what is kept, what is deleted and who confirms it.
Keep: the authorisation reference, the list of people with access, transfer logs, the source and target versions, and the review sign-off.
Delete: translation memories, drafts and temporary copies held by the vendor, unless your contract says otherwise. Ask for written confirmation.
On how long to keep records, Slovak law has a relevant rule. Act No. 199/2004 Coll. obliges persons involved in the import, export or transit of goods to store related documents for ten calendar years, unless other legislation says otherwise. Whether that covers your translation files depends on your case, so confirm it with your compliance adviser and align your retention schedule with the longest period that applies to you.
Our perspective
Here’s our honest view: ITAR translation is mostly a process problem, not a language problem. Anyone good can render a manual into Slovak. The hard part is doing it with named people, controlled files and a paper trail you’d be happy to show an auditor.
That’s why we pair human specialists with tightly managed workflows. We work with defence, legal and engineering clients across Europe, using distributed professional teams in 76 languages. We’d rather talk through your access list, your file handling and your retention rules before the first word is translated than fix them afterwards.
And AI? We love it, in the right place. For controlled content, the question is always where the data goes. Start there, and the rest gets easier.
glocco®
Where glocco® can help
If your documents are technical, legal or defence-related, our HumanPro service puts specialist linguists on the job with human review. For contracts and regulatory text, see HumanLegal. Building defence software? Read our security-first localisation playbook, or get in touch and tell us about your project.
FAQ
Is every defence-related document subject to ITAR?
No. ITAR covers technical data for items on the US Munitions List, such as blueprints, manuals and related software. General marketing or corporate documents usually aren’t. Have your compliance team classify the file before you decide on a workflow.
Can I use machine translation for ITAR documents?
Only if you know where the data is processed and stored, and who can access it. Under the encryption carve-out, data must be secured end to end and kept out of proscribed countries. If you can’t confirm that, keep the content out of the tool.
Do I need a licence to send ITAR data to a translator in Europe?
Often you need prior written authorisation from DDTC, such as a DSP-5, unless an exemption applies. Whether it applies to you is a question for your export compliance officer or counsel, before any file is shared.
How long should I keep translation records?
Slovak Act No. 199/2004 Coll. sets ten calendar years for documents related to the import, export or transit of goods. Check with your adviser whether your translation records fall under it, and follow the longest applicable period.
Sources
- eCFR: 22 CFR Part 120 Subpart C, Definitions
- DDTC: Summary of Changes to ITAR (2020)
- BIS: Deemed Export FAQs
- International Programs Security Handbook, Chapter 2
- CASRAI: Technology Control Plan guide
- TextUnited: repeatable translation workflow for technical documentation
- Slovak Act No. 199/2004 Coll. (Slov-Lex)
