On June 17, 2026, the Department of Justice announced that its National Security Division had declined to prosecute Robert Bosch GmbH for potential violations of the Export Control Reform Act. It was the division's first declination under the department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy.
The underlying conduct was not marginal. Between September 2020 and September 2024, two non-U.S. Bosch subsidiaries — Bosch Sensortec GmbH and ETAS GmbH — exported more than $70 million in foreign-produced micro-electro-mechanical systems sensor products and CycurHSM software to Huawei Technologies, without the license from the Bureau of Industry and Security that the foreign direct product rules required.
Bosch disclosed the conduct voluntarily, cooperated, and remediated. DOJ declined to prosecute. For general counsel weighing whether to self-report an export violation, the abstract policy has now been given a concrete price.
What the Resolution Actually Cost
A declination is not an acquittal, and it is not free.
The Bureau of Industry and Security imposed a $36 million civil penalty for violations of the Export Control Reform Act and the Export Administration Regulations. DOJ conditioned its declination on Bosch disgorging $11,430,098 in pre-tax profits derived from the sales to Huawei. Bosch also undertook remediation and organizational changes.
The total outlay is substantial. What Bosch avoided was a criminal conviction, the collateral consequences that follow one, and the multiple of that penalty a contested prosecution would likely have produced. That is the actual trade the policy offers: significant financial cost and sustained disruption in exchange for the elimination of criminal exposure.
Framing this internally as a route to a cheap outcome will lead to the wrong decision. Framing it as insurance against an existential one is closer to correct.
The Extraterritorial Warning Inside the Good News
The most important feature of this case for non-U.S. companies is easy to miss because the headline is favorable.
The exporters were German subsidiaries of a German parent. The products were foreign-produced. The customer was Chinese. Nothing about the transaction structure was American — and the Export Control Reform Act applied anyway, because the foreign direct product rules extend U.S. jurisdiction to foreign-made items produced using U.S.-origin technology, software, or equipment.
Any non-U.S. company whose compliance posture rests on the proposition that it is not a U.S. company, does not ship from the United States, and therefore sits outside U.S. export control jurisdiction should read the Bosch declination letter as a direct rebuttal. The jurisdictional hook is technological, not geographic, and it reaches deep into product lines that were never designed with U.S. controls in mind.
Sensor components and embedded security software are not the categories most compliance programs flag first. They should be now.
The Disclosure Decision, Made Concrete
The self-disclosure calculus has always suffered from an asymmetry: the costs of disclosing are immediate and quantifiable, while the benefits are speculative and depend on prosecutorial discretion. The Bosch resolution reduces that asymmetry. It does not eliminate it.
Five factors should drive the analysis when a potential violation surfaces:
- How the conduct was discovered, and who else knows. Disclosure credit depends heavily on being genuinely voluntary. A disclosure made after a subpoena, a whistleblower complaint, or media contact is worth substantially less.
- Whether aggravating factors are present. Executive involvement, deliberate concealment, recidivism, or transfers to end users of acute national security concern can move a matter outside declination territory regardless of cooperation.
- Speed. The value of a disclosure decays quickly. Extended internal investigation before reporting is often read as delay rather than diligence.
- The parallel civil exposure. A DOJ declination does not resolve BIS. The Bosch matter involved a coordinated resolution across both, and any disclosure strategy must be built for both from the outset.
- Privilege and remediation sequencing. Cooperation credit requires producing facts. Structuring the internal investigation so that facts can be shared without waiving protection over legal advice is a decision to make at the start, not once DOJ has asked.
The Bigger Picture
Enforcement intensity and leniency are rising together, and that combination is not contradictory. It is the design.
The department is offering a documented, now-demonstrated path from a serious export violation to no prosecution, and simultaneously making clear that the path is available only to companies that come forward first. The corollary is unavoidable: every quarter a known violation goes unreported, the value of the remedy declines and the likelihood that the government learns of it from another source rises.
For companies with global manufacturing footprints and U.S.-origin technology anywhere in their supply chain — which is to say most of them — the practical response is to find out what is in the pipeline before deciding what to do about it. Bosch's outcome was available because Bosch knew.
