The intersection of US export controls and artificial intelligence represents the fastest-moving and most consequential area of export control law since the Cold War. Beginning in October 2022, the Bureau of Industry and Security has issued a series of increasingly comprehensive rules imposing new export controls on advanced semiconductors, semiconductor manufacturing equipment, and AI-related technology, with the explicit strategic objective of preventing China and other adversary nations from acquiring the advanced computing infrastructure necessary to develop cutting-edge artificial intelligence capabilities with military and surveillance applications. These rules have reshaped the global semiconductor industry, triggered retaliatory measures from China, driven US and allied investment in domestic semiconductor manufacturing, and forced every company in the AI and semiconductor supply chain to conduct a comprehensive reassessment of its compliance obligations.
For machine learning companies, semiconductor designers and manufacturers, cloud computing providers, and the hundreds of companies that supply the AI compute ecosystem, these rules create direct compliance obligations that touch the core of their business: what chips they can sell, to whom, in what quantities, and for what applications; what manufacturing equipment they can export to foundries in various countries; what software and technology they can share with foreign nationals working on AI research; and what due diligence they must perform on their customers and distributors to prevent controlled chips from reaching prohibited end users. Understanding the current state of the rules, their rapidly evolving scope, and the compliance framework they require is essential for any company operating at the frontier of AI and semiconductor technology.
The October 2022 Advanced Computing Rule
On October 7, 2022, BIS published a landmark rule — the most significant expansion of US semiconductor export controls in decades — that imposed new export controls on advanced computing integrated circuits and semiconductor manufacturing equipment. The rule created new controls covering advanced chips with processing performance above specified thresholds, measured by the chip’s aggregate bidirectional transfer rate and processing performance. Specifically, the rule restricted export of chips with performance above a ‘A100 line’ — roughly equivalent to the performance parameters of NVIDIA’s A100 GPU — for use in China (both mainland and Macau), with license requirements for chip sales to Chinese customers and a presumption of denial for those license applications.
The October 2022 rule also imposed new controls on advanced semiconductor manufacturing equipment (SME) used to produce chips at or below 16 nanometer logic processes, 128-layer NAND flash memory, and 18 nanometer half-pitch DRAM — the process nodes necessary to manufacture the most advanced chips. These manufacturing equipment controls were designed to prevent China from developing an indigenous capability to produce frontier chips even if US chip exports were restricted, targeting the tools, software, and technical expertise supplied by US companies and their allies that make advanced semiconductor manufacturing possible.
The October 2023 Rule: Closing Loopholes
In October 2023, BIS published a successor rule that addressed several significant gaps and loopholes that had emerged in the October 2022 controls. Chip designers had responded to the 2022 rule by developing product variants — the A800 and H800 GPUs, designed specifically to fall just below the 2022 rule’s performance thresholds while providing nearly the same practical AI training performance. The 2023 rule closed these loopholes by adopting a new performance metric (the ‘total processing performance’ or TPP/interconnect metric) designed to capture the practical AI computing capability of a chip rather than relying on specific bidirectional transfer rate thresholds that manufacturers could engineer around.
The 2023 rule also significantly expanded the geographic scope of the advanced computing controls. Rather than focusing exclusively on China, the rule divided countries into three tiers based on their national security risk level, with different license requirements for each tier. Tier 1 countries — US allies and partners including members of NATO, Japan, South Korea, Australia, and others — face no license requirement for most advanced computing chips. Tier 2 countries — a large group of countries not in Tier 1 but not subject to US arms embargoes — face a license requirement for the most advanced chips above specified performance thresholds, reflecting concerns that chips purchased in Tier 2 countries might be diverted to China or other prohibited end users. Tier 3 countries —ountries subject to US arms embargoes —ontinue to face the most restrictive treatment.
The October 2024 Rule and Further Restrictions
In October 2024, BIS published a third major rule further tightening controls on advanced semiconductors and expanding controls to additional applications. The rule extended controls to certain advanced packaging technologies that allow multiple chips to be connected in ways that achieve aggregate performance above the controlled thresholds, addressing concerns that high-bandwidth memory (HBM) and chip-to-chip interconnects were enabling Chinese customers to build high-performance AI clusters using chips that individually fell below the controlled thresholds. The rule also imposed new controls on AI model weights —arge pre-trained model parameters that contain the distilled intelligence of a trained AI system — recognizing that exporting a trained AI model may be equivalent to exporting all of the compute power and data used to train it.
The model weight controls represent a new frontier in export control law: for the first time, US regulations impose explicit controls on a specific type of AI artifact. The controls apply to model weights for ‘closed’ AI models with performance above specified capability thresholds, covering models that have certain dangerous capabilities (such as providing assistance with weapons of mass destruction development, enabling highly sophisticated cyberattacks, or providing militarily significant AI assistance). BIS has acknowledged that calibrating AI model controls is technically challenging and that the rules will continue to evolve as the technology advances.
Deemed Export Implications for AI Research
The rapid expansion of advanced computing and AI controls has created significant deemed export compliance challenges for US AI research companies, academic institutions, and cloud computing providers. AI research typically involves foreign national employees and collaborators from a wide range of countries —rained in the same techniques, using the same infrastructure, working on the same systems — many of whom are citizens of countries now subject to the Tier 2 or Tier 3 controls. Giving a foreign national from a Tier 2 country access to controlled AI development software, controlled computing infrastructure, or controlled AI model weights may constitute a deemed export requiring a license.
AI companies must therefore apply deemed export analysis not only to their physical chip and equipment sales, but to the access they provide to controlled technology through their research environments, developer platforms, cloud computing services, and model APIs. A cloud service that gives users access to advanced computing hardware subject to the new controls, or that allows users to fine-tune or access controlled model weights, may be making a technology export to those users’ countries of citizenship. The compliance implications for hyperscalers and AI platform companies are significant and largely unresolved in the current regulatory guidance.
Compliance Strategies for AI and Semiconductor Companies
Companies operating in the AI and semiconductor space should build their export compliance programs around several priority areas. First, maintain current ECCN classifications for all products, components, and software, and review those classifications whenever significant BIS rulemaking occurs. The pace of regulatory change in this area means that annual reviews are not sufficient — companies should monitor BIS regulatory developments on an ongoing basis and update their classifications promptly. Second, implement robust customer screening and due diligence procedures, particularly for chip sales and cloud computing services targeting customers in Tier 2 countries and in industries with high diversion risk. BIS has made clear that it expects companies to exercise heightened vigilance about the ultimate destination and use of their most advanced products, and that willful blindness to diversion risk will not be treated as a mitigating factor.
Third, address the deemed export implications of foreign national access to controlled technology, including AI development environments, advanced computing infrastructure, and controlled model weights. This requires the same nationality-based screening and access control processes as other deemed export contexts, applied to the specific technologies that have been newly controlled. Fourth, monitor compliance developments from allied governments: the US has worked closely with Japan, the Netherlands, and other key chip technology countries to implement parallel export controls on semiconductor manufacturing equipment, and the multilateral dimension of these controls — both as a compliance obligation and as a competitive factor —ust be tracked. Fifth, participate actively in BIS’s public comment processes on new rules: the complexity of the AI and semiconductor ecosystem means that BIS regularly solicits industry input on the technical parameters of new controls, and companies that engage constructively with the rulemaking process can influence outcomes that significantly affect their business.