Export compliance: when encryption needs documentation
An app needs an export compliance determination if it uses standard encryption algorithms, accesses the operating system’s crypto functionality, or implements proprietary or non-standard cryptography. Where documentation is required, it has to be approved and attached to the build before submission.
Why it matters
Non-standard here means cryptography not adopted by IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA or GSMA. Using a standard implementation through the OS is a different position from rolling your own.
Where documentation is required, a CCATS from the U.S. Bureau of Industry and Security may be needed, along with year-end self-classification reports.
France is treated separately: secure storage, secure communications and anti-virus apps are controlled there, while banking and medical apps are generally exempt.
The practical friction for most apps is not the determination but being asked the encryption questions on every single submission, which is what the Info.plist declaration exists to stop.
The word exempt is doing the work here, and it is not the same as not using encryption. An app making HTTPS requests through the system is using encryption; whether that use is exempt is the separate question the determination answers.
Where documentation is needed it has to be attached before submission rather than produced in response to a rejection, which is the difference between a delay measured in days and one measured in weeks.
How to fix it
- Work out which of the three cases your app is in, and remember that HTTPS through the system stack still counts as using encryption.
- Set ITSAppUsesNonExemptEncryption in Info.plist so App Store Connect stops asking on every upload.
- If documentation is required, obtain it and attach it to the build before you submit rather than in response to a rejection.
The guidelines behind it
Read from Apple’s App Review Guidelines as last updated October 16, 2026.
What ReviewAhead checks
Export compliance documentation. Non-exempt encryption needs approved documentation attached to the build.
- Reads the build’s own answer and the state of your encryption declarations from App Store Connect when your account is linked.
- Derives "not applicable" when ITSAppUsesNonExemptEncryption is false, because App Store Connect then asks for no documentation.
- Pairs with the Info.plist check on the same key, so the declaration in the build and the documentation on the record are reported as one subject rather than two.
Apple’s own documentation for this requirement: developer.apple.com. Where this page and Apple disagree, Apple is right and this page is a bug.