How to import storage systems: enterprise arrays and backup across borders

To import storage systems without a local company, you need a registered importer at destination, the correct tariff classification for every array, shelf and drive, an encryption classification from the manufacturer, and proof that the product meets local rules. In the EU, that includes specific ecodesign rules for data storage products.

Enterprise storage looks like an easy import on paper. An all-flash array, a few expansion shelves and a tape library are standard IT equipment, usually duty-free or close to it, with no radio module and no special license in most countries. In practice, storage projects stall at customs for reasons that rarely show up on a quote: an invoice that lumps controllers, shelves and drives into one line, an encryption question nobody can answer, a lithium battery on a cache module, or a set of used drives that still holds a customer's data.

This guide explains how to import storage systems into Argentina, Brazil, the United States, the European Union and Uruguay without a company in the destination country: classification, encryption, the EU rules written for storage, the points that slow shipments in South America and the documents that keep an array moving to the data center floor.

What does it take to import storage systems?

Three things decide whether a storage shipment clears quickly: a party legally able to import in the destination country, an accurate description and classification of every component, and the regulatory evidence the destination expects. For storage, that evidence usually means encryption data, product compliance files and battery documents.

The first requirement is the one that catches most foreign companies. Customs authorities need an importer of record that is registered locally, pays the duties and taxes, and answers for the declaration afterwards. A storage vendor selling to a data center in São Paulo, a systems integrator delivering a backup platform in Frankfurt or a cloud provider expanding into Montevideo all face the same question: who is the importer if neither side has a registered entity? If the role is new to you, our guide on what an Importer of Record is explains what it covers and what stays with the seller.

The second and third requirements are where storage differs from other hardware. A storage system is rarely a single box. It is a controller enclosure, one or more expansion shelves, dozens or hundreds of drives, cables, rails, optics and sometimes a pre-integrated rack, and each element can have its own classification, its own origin and its own regulatory profile.

How is storage hardware classified at customs?

Most storage arrays, disk shelves and tape libraries fall under heading 8471 of the Harmonized System, as storage units of automatic data processing machines. Drives, cartridges, cables and optics can fall under other headings, so a detailed invoice with one line per part number is the safest basis for the declaration.

The Harmonized System is shared by all five destinations up to six digits, but national tariffs split those codes further and do not always read them the same way. Hard disk drives normally follow the array under heading 8471, while solid-state drives and tape cartridges can be classified elsewhere depending on how the destination interprets them. Fibre and copper cables, transceivers and rack hardware each have their own lines. That is why a single invoice line reading "storage system, 1 lot" is a problem: customs cannot check it, and the importer cannot defend it.

Pre-integrated racks raise a different question. When controllers, shelves and switches arrive cabled together in one rack and work together for a single defined function, the notes to Section XVI of the Harmonized System can allow them to be classified as a functional unit under one heading. Whether that applies is a technical decision that depends on the configuration, and it should be made before the commercial invoice is written, not argued at the border.

Does encryption change how you import storage systems?

It usually does not stop the import, but it adds paperwork. Almost every modern array encrypts data at rest, so the hardware carries an export classification under the United States Export Administration Regulations and under the EU Dual-Use Regulation. In some destinations, encryption also triggers a national declaration.

On the export side, encryption items are listed in Category 5, Part 2 of both the Commerce Control List and Annex I of Regulation (EU) 2021/821. Most commercial storage arrays and self-encrypting drives are classified by their manufacturers either as mass market products, often under ECCN 5A992.c, or under ECCN 5A002 with License Exception ENC, set out in section 740.17 of the Export Administration Regulations. The manufacturer's published ECCN is the starting point, and it should be on file before the shipment leaves, because the exporter and the freight forwarder will ask for it. When storage moves together with GPU servers, the export questions grow quickly, as our guide on GPU server export controls explains.

The EU list is updated regularly. The Commission adopted its latest amendment of Annex I in September 2026, adding new items and adjusting existing parameters, and it applies once it is published and enters into force. The European Commission page on EU dual-use export controls keeps the current list and guidance in one place, which matters when storage imported into the EU is later re-exported to a project outside the Union.

On the import side, the main exception is France. Under French law, importing certain cryptology means from outside the EU requires a declaration to ANSSI, the national cybersecurity agency, unless the product falls under an exemption. Most other destinations covered here do not ask for a separate encryption filing at import, but they do expect the description and classification to be consistent with the product's real functions.

How do the rules to import storage systems compare by country?

Duties on storage hardware are low or zero in most destinations, so the differences lie in registration, product rules and how each country treats encryption, batteries and used equipment. The table summarizes the points we check first for each market.

The table is a starting point, not a substitute for a shipment review: one storage order can mix new and used drives, batteries, optics and wireless management modules, each with its own rules.

What does the EU expect from storage products?

More than most buyers expect. Besides the usual CE marking rules, the EU has ecodesign requirements written specifically for servers and online data storage products, and the importer that places the product on the EU market has to make sure they are met.

Commission Regulation (EU) 2019/424 has applied to online data storage products since 1 March 2020. It sets minimum efficiency and power factor levels for power supply units, tightened from 1 January 2023, requires a secure data deletion function for all storage devices in the product, and requires that drives, memory, power supplies, batteries and other key components can be removed for repair or reuse. From 1 March 2021, the latest firmware must be made available for years after the model leaves the market, and security updates must be free for that period. Manufacturers or importers must also publish product information, including how the data deletion function works, on a free-access website.

The scope is narrower than it looks. The regulation covers online storage with a maximum time to first data under 80 milliseconds, so tape libraries fall outside it. It also excludes small data storage products with three or fewer storage devices and large ones with more than 400 in their maximum configuration.

Other EU rules sit on top. The electromagnetic compatibility, low voltage and RoHS directives apply as they do to any IT equipment. The WEEE Directive and the Batteries Regulation, Regulation (EU) 2023/1542, require registration as a producer in the member states where the equipment is placed on the market. And the Cyber Resilience Act, Regulation (EU) 2024/2847, now reaches storage arrays as products with digital elements: its vulnerability and incident reporting obligations have applied since 11 September 2026, and most of its other requirements will apply from 11 December 2027. Our guide on how to import into the EU without an EU entity explains EORI numbers, customs representation and import VAT.

What should you know about storage imports into the United States?

The United States does not restrict storage imports, and most arrays enter duty-free under their normal tariff line. The work lies in a correct formal entry, an accurate country of origin for each component and FCC compliance for the digital electronics inside.

Any commercial shipment valued above 2,500 US dollars requires a formal entry, which covers practically every enterprise storage order. The importer of record files it through a licensed customs broker and needs a continuous or single transaction bond. Country of origin is the field that deserves the most attention: an array assembled in one country with drives made in another may carry more than one origin on the same invoice, and additional duties tied to origin change more often than the base tariff. Storage arrays are digital devices under the FCC rules, so each model must have its equipment authorization in place, and the import declaration must state that the equipment meets the conditions of 47 CFR 2.1204.

Where do storage imports slow down in Brazil and Argentina?

In Brazil, the slowdown usually comes from importer qualification, import taxes and the restriction on used equipment. In Argentina, registration with ARCA and the treatment of used goods are the main points. In both countries, storage without a radio function does not need telecom approval.

A Brazilian importer must be qualified in Radar to file the Duimp, the single import declaration, and the full tax stack on storage hardware is far heavier than the import duty alone. Some models can qualify for an Ex-tarifário, a temporary reduction of import duty granted by Gecex for capital goods and IT goods without equivalent national production, which is worth checking for large projects. Used arrays and drives are a different story: under Portaria SECEX nº 249/2023, used capital goods need a non-automatic import license before shipment, granted only when identical goods are not produced in Brazil. Our guide on how to import refurbished servers explains that license and the equivalent rules in the other destinations.

In Argentina, the importer must be registered with ARCA and hold a CUIT. Used storage no longer needs a prior certificate since Decreto 273/2025, but it must be declared as used, with a sworn statement that the goods are not waste, and it can carry a higher import duty than new equipment. If any component has a wireless function, such as a management module with Wi-Fi, ENACOM registration applies as it would to any radio equipment.

Can Uruguay work as a hub for storage hardware?

Yes, and it often makes sense for regional projects. Uruguay's free trade zones, governed by Law 15.921, allow equipment to be stored, configured and redistributed without paying import taxes until it enters Uruguayan territory or is shipped to another country.

For a storage vendor serving several South American customers, that means arrays can be held close to the market and released when each destination has its paperwork ready. A data center operating inside a free zone can also install and run storage there without a definitive import. When equipment leaves the zone for the Uruguayan market, the import is declared through a licensed customs broker, which is mandatory in Uruguay.

Why do batteries and data on the drives matter?

Because they are the two details most likely to stop a storage shipment that is otherwise in order. Batteries on controller cache modules make the shipment dangerous goods for air transport, and drives that still hold data raise legal and contractual problems at both ends.

Many storage controllers protect their write cache with lithium-ion battery backup units. When those batteries are installed in the equipment, the shipment travels by air as UN3481, lithium ion batteries contained in equipment, and must follow the packing, labeling and documentation rules of the IATA Dangerous Goods Regulations. Spare battery units shipped loose follow stricter rules. A forwarder who finds an undeclared battery will hold the shipment, so the battery information should be on the packing list from the start.

Data is the other risk. Arrays returned for repair, migrated between subsidiaries or sold as refurbished can carry customer data, and if that data includes personal data from the EU, moving the drives outside the Union is a transfer under the General Data Protection Regulation. The simplest approach is to wipe or remove the drives before shipping and keep the sanitization certificate in the import file.

The documents below are the ones that, in our experience, decide whether a storage shipment clears in days or waits in a warehouse:

1. A commercial invoice with one line per part number, describing controllers, shelves, drives, cables and optics separately, with unit values and country of origin.
2. A packing list with the serial numbers of controllers, shelves and drives, matching the labels on the boxes.
3. The manufacturer's ECCN and encryption classification for each model, and the French ANSSI declaration when the equipment goes to France.
4. EU compliance files when the destination is the EU: declaration of conformity, ecodesign product information and the producer registrations for WEEE and batteries.
5. Battery data and the dangerous goods declaration when lithium batteries travel installed or loose.
6. A data sanitization certificate, or a statement that the drives are new or were removed, for every used or returned unit.

When does an Importer of Record make sense for storage systems?

When the storage has to be cleared and delivered in a country where neither you nor your customer has a registered importer, or when the project cannot afford a delay while one is set up. An Importer of Record takes the legal role of importer and makes sure the classification, the compliance files and the declaration match.

The cases we see most often are a vendor delivering arrays to a new customer abroad, a cloud or colocation provider opening capacity in a market where it has no entity yet, and a backup platform that has to be in place before a migration window closes.

If you are planning to import storage systems into Argentina, Brazil, the United States, the European Union or Uruguay, tell Comex IOR Services what you are shipping, where it is coming from and when it has to be running. As your IOR for data storage hardware, we will tell you plainly which rules apply to each component, which documents to prepare and how long clearance should take.