Sweeping New Framework Expands BIS Export Controls on Advanced Computing ICs and AI Technologies

BIS also issued a related Interim Final Rule on January 16, 2025 that expands licensing requirements and due diligence measures for foundries and packaging companies that seek to export certain computing equipment (the “AI Due Diligence Rule”).³ Both rules took immediate effect upon publication, but compliance is not required under the AI Due Diligence Rule until January 31, 2025 and under the AI Diffusion Rule until May 15, 2025.

New and Expanded Controls on Advanced Computing ICs and AI Technologies

The new Interim Final Rules implement a number of changes to the Commerce Control List (“CCL”), the EAR’s scope, and other requirements. First, the AI Diffusion Rule establishes a worldwide regional stability (RS) license requirement, broadening export controls on advanced computing ICs subject to Export Control Classification Numbers (“ECCNs”) 3A090.a and 4A090.a, as well as items in corresponding “paragraph .z” of certain other ECCNs:

• ECCN 3A090.a includes integrated circuits with one or more digital processing units having either a “total processing performance” (“TPP”) of (i) 4800 or more or (ii) 1600 or more combined with a “performance density” of 5.92 or greater.⁴
• ECCN 4A090.a covers computers, electronic assemblies, and components containing ICs that meet or exceed the limits in ECCN 3A090.a.
• Certain ECCNs in Categories 3, 4, and 5 of the CCL have a “paragraph .z” that relies on the specifications of ECCNs 3A090 or 4A090.

Second, the AI Diffusion Rule introduces new technology ECCN 4E091 to impose controls on the model weights and other parameters (i.e., values learned during training) of certain advanced closed-weight dual-use AI models. An AI model that is “closed-weight” is a model that does not have published weights available; it is “dual-use” if it can be used for both civilian and military purposes (e.g., using scientific expertise learned during cancer drug development to develop biological weapons). The new 4E091 controls model weights from closed-weight AI models trained on more than 10²⁶ computational operations. BIS will apply a presumption of denial review policy to license applications for ECCN 4E091 exports. However, BIS has not added the model weights of open-weight models to the CCL, meaning these parameters have an export classification of EAR99 if they are subject to the EAR. EAR99 items can generally be exported “no license required” except to certain prohibited destinations, end users, and end uses.

Third, the AI Diffusion Rule also introduces a new Foreign Direct Product (“FDP”) rule for AI model weights under ECCN 4E091. This rule brings certain foreign-produced items meeting the parameters of 4E091 under the jurisdiction of the EAR when destined anywhere in the world, if the item is produced by ICs, servers, and other electronic equipment that are subject to the EAR and fall under certain ECCNs such as 3A090, 4A090, or the various “paragraph .z” ECCNs. Once a foreign-made 4E091 item is brought under the EAR’s jurisdiction under the new FDP rule, the applicable license requirements for a given destination follow those of other 4E091 items, as well as any end user and end use controls under the EAR. The AI Diffusion Rule further expands the existing Advanced Computing FDP rule to include all global destinations, beyond its previous limitation to specific Country Group D destinations.

Fourth, the AI Due Diligence Rule requires foundries and other “front-end fabricators” that complete the final packaging for ICs on behalf of approved or authorized IC designers (now enumerated at Supplement No. 6 to Part 740) to submit quarterly compliance reports to BIS.

Finally, the AI Diffusion Rule adds a new “red flag” indicator to assist infrastructure-as-a-service cloud computing providers in the U.S. with compliance.⁵ If an AI developer that is a U.S. subsidiary of a foreign entity uses the cloud computing provider’s infrastructure to train an AI model that falls within ECCN 4E091 and, once trained, exports the model’s weights to a foreign entity (such as a parent entity), then this scenario creates a risk that the export of the weights is in violation of BIS controls. New red flag 28 puts these providers on notice to take additional steps to ensure model weights are not exported, reexported, or transferred in violation of BIS license requirements. Depending on their enhanced diligence, providers may need to apply for an export license, or inform their customers of the obligation to do so, prior to exporting.

Key Provisions for License Exceptions

The AI Diffusion Rule introduces three license exceptions to balance national security concerns with private-sector innovation and supply-chain resilience:

• Artificial Intelligence Authorization (“License Exception AIA”):⁶ Allows for the export, reexport, or transfer (in-country) of certain advanced computing ICs and related software and technology without prior BIS authorization, subject to certain compliance obligations, to entities that are located and headquartered in (and whose ultimate parent company is headquartered in) the United States and one of 18 allied countries (the “AI Authorization Countries”).⁷ As modified by the AI Due Diligence Rule, ICs controlled by ECCN 3A090.a and the corresponding “paragraph .z” ECCNs in 5A002 and 5A992 may only be exported, reexported, or transferred (in-country) pursuant to License Exception AIA if designed by approved or authorized IC designers, as enumerated at Supplement No. 6 to Part 740 of the EAR.
• Advanced Compute Manufacturing (“License Exception ACM”):⁸ Allows for the export, reexport, or transfer (in-country) of certain advanced computing hardware, software, and technology to a private-sector end user that is not located in China (which, for purposes of the EAR, includes Hong Kong and Macau) or any other “Arms-Embargoed Country,”⁹ if the ultimate end use is solely for the purpose of development, production, or storage of eligible ICs. As modified by the AI Due Diligence Rule, ICs controlled by ECCN 3A090.a and corresponding “paragraph .z” ECCNs in 5A002 and 5A992 may similarly only be exported, reexported, or transferred (in-country) pursuant to License Exception ACM if designed by approved or authorized IC designers enumerated at new Supplement No. 6 to Part 740.
• Low Processing Performance (“License Exception LPP”):¹⁰ Allows exports and reexports of certain advanced computing ICs in limited quantities that do not present significant national security risks (up to 26,900,000 TPP of advanced computing ICs per calendar year to any individual ultimate consignee) anywhere except to an Arms-Embargoed Country, and except to an ultimate consignee headquartered in or with an ultimate parent company headquartered in an Arms-Embargoed Country.

Additionally, the AI Diffusion Rule contains updates to the existing Notified Advanced Computing (“NAC”) and Advanced Computing Authorized (“ACA”) license exceptions to streamline the approval process for regulated items.

Recognizing the importance of data centers in global AI development, BIS has bifurcated the existing DC VEU Authorization into two categories:

• Universal VEUs (“UVEUs”) Authorization: Allows U.S. entities and entities headquartered in (or whose ultimate parent is headquartered in) the AI Authorization Countries to secure a single authorization enabling the construction of data centers worldwide without requiring additional approvals, except in an Arms-Embargoed Country. However, UVEUs must comply with the following restrictions:
  • UVEUs headquartered in (or whose parent entity is headquartered in) an AI Authorization Country cannot transfer or install more than 25% of their total AI computing power to or in locations outside of the AI Authorization Countries;
  • UVEUs headquartered in (or whose parent entity is headquartered in) an AI Authorization Country cannot transfer or install more than 7% of their total AI computing power to or in any single country other than an AI Authorization Country; and
  • UVEUs headquartered in the United States cannot transfer or install more than 50% of their total AI computing power outside of the United States.
• National VEUs (“NVEUs”) Authorization: Allows entities based outside of Arms Embargoed Countries to secure an authorization permitting the construction of data centers in designated locations without requiring additional approvals, except in an Arms-Embargoed Country.

For transactions requiring a license that do not meet the conditions of the above license exceptions, entities may apply to BIS for a specific export license under the traditional process described at Part 748 of the EAR. The AI Diffusion Rule, however, modified the traditional license review policy to restrict cumulative exports, reexports, or transfers (in-country) of advanced computing ICs to countries that are not AI Authorization Countries or Arms-Embargoed Countries to a maximum of 790,000,000 TPP.¹¹

Important Dates

Although the AI Due Diligence Rule and the AI Diffusion Rule were both published as Interim Final Rules, both took immediate effect. Exporters, reexporters, and in-country transferors, however, are not required to comply with the changes made in these rules until January 31, 2025 and May 15, 2025, respectively. Certain of the DC VEU requirements in the AI Diffusion Rule have a further delayed compliance date of January 15, 2026.

BIS has requested any public comments on the AI Due Diligence Rule by March 14, 2025, and the AI Diffusion Rule by May 15, 2025. Stakeholders are encouraged to submit any comments by these deadlines.

Implications for Industry Stakeholders and the Incoming Trump Administration

The AI Diffusion Rule and the AI Due Diligence Rule significantly increase compliance obligations for companies dealing with advanced computing ICs and leading-edge closed-weight AI model weights. Companies must carefully review their export control programs to navigate the expanded licensing requirements and ensure secure handling of regulated technologies. At the same time, the AI Diffusion Rule opens opportunities for entities based in the AI Authorization Countries, as they will face fewer regulatory hurdles. However, restrictions on certain destinations and the introduction of allocation limits may force stakeholders to reassess supply chains and distribution strategies.

President Donald Trump has frequently criticized export control policies that, in his view, hinder U.S. innovation while failing to sufficiently counter the technological advancements of nations, like China, that are perceived to be rivals. With his administration expected to reassess existing BIS rules, significant adjustments aimed at tightening restrictions on non-allied nations and reducing perceived domestic overregulation are likely. Trump’s deregulatory inclination overall suggests a broad reevaluation of existing policies. However, in the realm of export controls — especially concerning advanced technologies like AI and semiconductors — we expect the incoming Trump administration to maintain or even strengthen existing measures. As of the date of publication, President Trump has not repealed the AI Diffusion Rule or the AI Due Diligence Rule.

The Vinson & Elkins Export Controls and Technology Transactions teams are available to assist clients in navigating these complex regulatory changes and are available for clients who wish to submit comments to BIS. If you have questions, please contact your V&E attorney.

¹ An “interim final rule” is published without the agency having first published a proposed rule. These types of rules are like final rules in that they become effective immediately, but — unlike final rules issued after the publication of a proposed rule and a public notice and comment period — the agency invites comments on the interim rule. The agency will then either make changes to the interim rule as warranted based on public comments and publish an amended “final rule” or will publish a brief statement in the Federal Register that the “interim final rule” will not be changed and is now a “final rule.” Comments on the AI Diffusion Rule are due no later than May 15, 2025. Comments on the AI Due Diligence Rule are due no later than March 14, 2025.

² 90 Fed. Reg. 4,544 (Jan. 15, 2025).

³ 90 Fed. Reg. 5,298 (Jan. 16, 2025).

⁴ The terms “total processing performance” and “performance density” are defined according to formulas detailed in Technical Notes 1 and 4, respectively.

⁵ See BIS’s “Know Your Customer” Guidance and Red Flags at Supplement No. 3 to Part 732 of the EAR.

⁶ See 15 C.F.R. § 740.27.

⁷ The AI Authorization Countries are Australia, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, the Netherlands, New Zealand, Norway, South Korea, Spain, Sweden, Taiwan, the United Kingdom, and the United States.  See Supplement No. 5 to Part 740 of the EAR.

⁸ See 15 C.F.R. § § 740.28.

⁹ The Arms-Embargoed Countries are those countries subject to a U.S. arms embargo restrictions under the EAR, as specified in Country Group D:5 at Supplement No. 1 to Part 740, which is based on Section 126.1 of the International Traffic in Arms Regulations (“ITAR”). The Country Group D:5 countries are currently Afghanistan, Belarus, Burma, Cambodia, Central African Republic, China, Cuba, Democratic Republic of the Congo, Eritrea, Haiti, Iran, Iraq, Lebanon, Libya, Nicaragua, North Korea, Russia, Somalia, South Sudan, Sudan, Syria, Venezuela, and Zimbabwe. In addition, Section 126.1 of the ITAR prescribes a policy of denial with respect to exports of defense articles to Cyprus and to certain users in Ethiopia, although the policy with respect to Cyprus is currently suspended through September 30, 2025. Per the EAR, the State Department’s list of countries subject to arms embargo under the ITAR controls over the EAR’s Country Group D:5 list, and as such, exporters would be prudent to consider Cyprus and Ethiopia to be arms embargoed for purposes of the new license exceptions and other regulations, absent more specific analysis.

¹⁰ See 15 C.F.R. § 740.29.

¹¹ As always, exporters should verify applicable license requirements and license exception availability based on the specifics of the transaction under the most current version of the EAR. As of the date of this article, the countries that are not enumerated on either list are Albania, Algeria, Andorra, Angola, Antigua and Barbuda, Argentina, Armenia, Aruba, Austria, Azerbaijan, the Bahamas, Bahrain, Bangladesh, Barbados, Belize, Benin, Bhutan, Bolivia, Bosnia and Herzegovina, Botswana, Brazil, Brunei, Bulgaria, Burkina Faso, Burundi, Cameroon, Cape Verde, Chad, Chile, Colombia, Comoros, Costa Rica, Cote d’Ivoire, Croatia, Curaçao, Czechia (Czech Republic), Djibouti, Dominica, Dominican Republic, Ecuador, Egypt, El Salvador, Equatorial Guinea, Estonia, Eswatini, Fiji, Gabon, Gambia, Georgia, Ghana, Greece, Grenada, Guatemala, Guinea, Guinea-Bissau, Guyana, Honduras, Hungary, Iceland, India, Indonesia, Israel, Jamaica, Jordan, Kazakhstan, Kenya, Kiribati, Kosovo, Kuwait, Kyrgyzstan, Laos, Latvia, Lesotho, Liberia, Liechtenstein, Lithuania, Luxembourg, Madagascar, Malawi, Malaysia, Maldives, Mali, Malta, Marshall Islands, Mauritania, Mauritius, Mexico, Micronesia, Moldova, Monaco, Mongolia, Montenegro, Morocco, Mozambique, Namibia, Nauru, Nepal, Niger, Nigeria, North Macedonia, Oman, Pakistan, Palau, Panama, Papua New Guinea, Paraguay, Peru, the Philippines, Poland, Portugal, Qatar, Republic of the Congo, Romania, Rwanda, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and Grenadines, Samoa, San Marino, San Tome and Principe, Saudi Arabia, Senegal, Serbia, Seychelles, Sierra Leone, Singapore, Sint Maarten (Netherlands), Slovakia, Slovenia, Solomon Islands, South Africa, Sri Lanka, Suriname, Switzerland, Tajikistan, Tanzania, Thailand, Timor-Leste, Togo, Tonga, Trinidad and Tobago, Tunisia, Turkey, Turkmenistan, Tuvalu, Uganda, Ukraine (other than the Crimea, so-called Donetsk People’s Republic, and so-called Luhansk People’s Republic regions), United Arab Emirates, Uruguay, Uzbekistan, Vanuatu, Vatican City, Vietnam, Western Sahara, Yemen, and Zambia.