Desiree Sainthrope stands at the absolute forefront of international trade law, bringing a wealth of experience in drafting complex trade agreements and advising on global compliance strategies. As a recognized authority on the intersection of national security and commerce, she has spent years helping organizations navigate the shifting sands of intellectual property and the regulatory hurdles presented by emerging technologies like artificial intelligence. Her expertise is particularly vital as we move through 2026, a year defined by heightened geopolitical sensitivities and a radical transformation in how governments monitor the flow of technology. In this discussion, we explore the move from technical compliance to high-level governance, the intense focus on ultimate end-users, and the expanding reach of export controls into civilian sectors like AI and advanced manufacturing. We also delve into the specific legislative reforms taking shape within New Zealand and why a proactive, risk-based approach has become a commercial necessity for any business operating on the global stage.
Export controls have transitioned from a technical classification exercise to a high-level governance priority. How is this shift fundamentally changing the way organizations approach their global trade strategies?
For many years, export controls were treated as a niche compliance task—a matter of checking boxes, classifying a product, and ensuring the right permit was in the file before a shipment left the dock. That era has ended, and today, we are seeing regulators around the world treat export controls, sanctions, and supply-chain integrity as deeply interconnected national security issues. In the boardroom, this means that export control is no longer just a “compliance” issue; it has become a “governance” issue where directors and senior leaders must oversee how their products move through every link of the global chain. This shift is driven by a growing convergence between different regulatory regimes, where agencies are sharing information more freely and aligning their enforcement functions to prevent sensitive technology from falling into the wrong hands. For New Zealand businesses, this often requires navigating a complex web of overlapping controls from the US, UK, EU, and other allies, particularly through initiatives like AUKUS Pillar II which seeks to harmonize export regimes among partner nations.
Historically, businesses focused on who was paying the bill, but today the spotlight is on the ultimate end-user. What does “due diligence” look like in this new era of scrutiny, and why is the immediate customer no longer the finish line for compliance?
The reality of modern trade is that a transaction can be perfectly legal on the surface—with a customer who isn’t on any restricted list—and yet still result in a major breach if the ultimate end-user is prohibited. Regulators now expect businesses to look far beyond the immediate transaction and investigate the ultimate ownership structure of their clients, as well as the final destination of the goods. This requires a level of detective work that goes beyond simple screening; you have to understand how the products will actually be used and whether there are diversion or circumvention risks lurking in the background. We often see red flags like a customer who cannot clearly explain their intended end-use, or a situation where the technical complexity of the goods doesn’t match the customer’s stated needs. In 2026, businesses must be prepared to investigate unusual transaction structures and intermediaries, especially when controlled technology is being rerouted through third countries to obscure its final destination.
We’re seeing export controls reach far beyond traditional defense contractors into civilian sectors like AI and medical research. How are these “dual-use” labels catching companies off guard, and what are the stakes?
It is a common misconception that if you aren’t making missiles or tanks, export controls don’t apply to you, but the current spotlight is shining brightly on aerospace, space, drones, and advanced manufacturing. We are seeing a massive surge in interest regarding “dual-use” technologies—items developed for civilian purposes that could have military, intelligence, or surveillance applications. This is especially true for artificial intelligence and advanced computing; major technology-exporting nations have introduced stringent controls on semiconductors and the equipment used to build them, simply because they provide the “brains” for modern military hardware. The stakes are incredibly high, as evidenced by enforcement actions in 2026 where even medical research companies have faced multi-million dollar penalties for unlicensed exports. One recent settlement exceeded $250 million, proving that the financial and reputational fallout for failing to recognize the strategic nature of your technology can be catastrophic for any firm, regardless of their sector.
With regulators now assessing the quality of a company’s compliance program as a mitigating or aggravating factor, what are the essential building blocks that a robust system must have to protect an organization?
One of the clearest themes from recent international enforcement activity is that regulators aren’t just looking at whether a breach occurred, but how the company behaved before and after the incident. A robust compliance program acts as a shield; if you can demonstrate that you have clear policies, senior management support, and regular staff training, it can serve as a significant mitigating factor during an investigation. Conversely, if a company shows a pattern of repeated non-compliance or attempts to conceal a warning sign, the penalties will be much harsher. A truly effective program includes 12 essential building blocks, such as a formal risk assessment, a dedicated classification process, and clear escalation procedures for when a red flag is spotted. It’s about creating a culture where recordkeeping and regular audits are the norm, ensuring that the compliance process actually operates in practice rather than just existing as a document on a shelf.
New Zealand is currently undergoing a significant reform of its own export control regime. What should domestic businesses expect as these legislative changes move toward implementation over the next year or two?
The New Zealand regime is evolving rapidly to meet contemporary best practices, moving away from the gaps identified in the 2021 review and toward a more sophisticated framework. Following the consultation that closed on January 16, 2026, we are anticipating new legislation that will likely include “deemed export” controls—which regulate the sharing of technology with foreign nationals within New Zealand—and stricter controls on intangible technology transfers like software and technical data. Regardless of the outcome of the election on November 6, the direction of travel toward a broader and more rigorous regime is set. This means businesses will need to be much more mindful of how they share know-how and source code overseas, even if they aren’t shipping physical goods. Implementing these reforms will require a transition period, but the expectation is that New Zealand will align more closely with its strategic partners to manage the risks associated with the New Zealand Strategic Goods List and various “catch-all” controls.
You’ve noted that investigations can be just as disruptive as an actual prosecution. Could you describe the operational and psychological toll these regulatory probes take on a company and its leadership?
Public attention usually fixates on the final penalty, but the real damage often happens long before a case ever reaches a courtroom. An investigation is an incredibly high-pressure event that can involve search warrants, extensive customer audits, and intrusive reviews of banking records, all of which consume a staggering amount of management time and focus. It creates a cloud of commercial and reputational risk that can freeze a company’s ability to secure new contracts or maintain the trust of its suppliers. Even if no breach is ultimately established, the sheer disruption of having to assemble a team to respond to regulators and manage disclosure obligations can be overwhelming. We’ve seen New Zealand authorities demonstrate a strong willingness to use these enforcement tools, and for a company, the experience of being under the microscope is often enough to force a total re-evaluation of their risk appetite and internal culture.
What is your forecast for the future of global trade compliance?
I expect that we will continue to see a tightening of the knot around intangible technology, with a particular focus on the “know-how” and engineering data that fuels the development of frontier AI and advanced computing. Governments are becoming much more adept at tracking how technology moves through digital channels, meaning that the old focus on physical shipping containers is being replaced by a focus on cloud access, software downloads, and technical collaborations. We will also likely see a more aggressive use of “catch-all” controls, where regulators intervene in transactions involving items not explicitly listed on a control schedule if they suspect a sensitive end-use. For businesses, the greatest risk in the coming years will not be a deliberate attempt to break the law, but rather a failure to recognize a national security issue early enough to manage it. Those who adopt a proactive, governance-led approach will find themselves with a significant competitive advantage, while those who remain reactive will find the global trade environment increasingly difficult to navigate.
