undefined

Add a bookmark to get started

Global Site
Africa
MoroccoEnglish
South AfricaEnglish
Asia Pacific
AustraliaEnglish
Hong Kong SAR ChinaEnglish简体中文
KoreaEnglish
New ZealandEnglish
SingaporeEnglish
ThailandEnglish
Europe
BelgiumEnglish
Czech RepublicEnglish
HungaryEnglish
IrelandEnglish
LuxembourgEnglish
NetherlandsEnglish
PolandEnglish
PortugalEnglish
RomaniaEnglish
Slovak RepublicEnglish
United KingdomEnglish
Middle East
BahrainEnglish
QatarEnglish
North America
Puerto RicoEnglish
United StatesEnglish
OtherForMigration
24 January 202514 minute read

Commerce Department unveils new rules on responsible diffusion of artificial intelligence technology

During its last week before the inauguration, the Biden Administration issued significant and complex new export controls on semiconductors and related technology for artificial intelligence (AI) applications worldwide.

These last-minute additions under the Biden Administration face an uncertain future under President Donald Trump, who has already repealed President Joe Biden’s AI executive order (EO) and signaled an intent to review all Biden-era AI guidance. That said, keeping the inner workings of the next generation of frontier models from foreign adversaries may be a rare area of common ground.

On January 13, 2025, the US Department of Commerce’s Bureau of Industry and Security (BIS) published an interim final rule (IFR) on artificial intelligence diffusion (AI IFR) that includes updates to prior controls on US semiconductors, as well as new restrictions on the export of US semiconductor chips.

On January 15, 2025, BIS published a subsequent IFR on additional due diligence measures for advanced computing chips (Advanced Computing IFR), which includes amendments to two of the new license exceptions created in the Advanced Computing IFR.

In its press release accompanying the AI IFR, BIS explained that this “new regulation serves key US national security and foreign policy interests and supports the Biden-Harris Administration’s broader strategy to cultivate a secure and trusted technology ecosystem for the responsible use and diffusion of AI.”

This is BIS’s third set of restrictions regarding the diffusion of AI technology. In October 2022, BIS implemented its first set of restrictions, which prevents foreign military and intelligence services from accessing advanced computing ICs and semiconductor manufacturing equipment (SME).

According to BIS, those rules were designed to prevent foreign military and intelligence services from developing advanced weapons modeling and advanced AI capabilities. In October 2023, BIS broadened the list foreign entities that the controls applied to and revised the technological parameters of the advanced computing controls.

Published on January 13, 2025, the AI IFR (1) aims to streamline controls for advanced computing chips and associated license exceptions, (2) updates the requirements under the Validated End User (VEU) Program for Data Centers (DCs), and (3) creates controls on the model weights of highly advanced AI models.

Following the change in administration on January 20, 2025, many within the US semiconductor industry are urging the new Trump Administration to undertake a comprehensive review and possibly revise the export controls on chips that were enacted during the Biden Administration.

The Semiconductor Industry Association (SIA) reportedly has suggested that the new Trump Administration should assess whether the policies of the Biden Administration have achieved their desired effect or harmed US technology leadership and commercial interests.

The AI IFR will be open to public comment until May 15, 2025, and the Advanced Computing IFR will be open to public comment until May 14, 2025.

Advanced computing chips control updates

New worldwide license requirements

The AI IFR amended its Regional Stability controls in 15 CFR § 742.6(a)(6)(iii) to impose a worldwide license requirement for exports, reexports, and transfers (in-country) on certain advanced computing items classified under Export Control Classification Numbers (ECCNs) 3A090.a, 4A090.a, and corresponding .z items.

The AI IFR removes eligibility for license exceptions Shipments to Group B Countries (GBS) and Shipments of Limited Value (LVS) for certain items classified under ECCN 3A001.z and amends the advanced computing foreign direct product (FDP) rule in § 734.9(h).

Previously, foreign-made items that satisfied the product scope of the advanced computing FDP rule were subject to the EAR if there was knowledge that the foreign-made items were destined to only certain countries for incorporation into or use in certain advanced computing items.

The AI IFR expands the destination scope to apply to foreign-made items meeting the product scope of the advanced computing FDP rule that are destined to any country.

The Advanced Computing IFR also revises the Note 1 to ECCN 3A090.a to specify that, when an Outsourced Semiconductor Assembly and Test (OSAT) company seeks to export, reexport, or transfer (in-country) an applicable advanced logic chip, there is a presumption that the item is controlled under ECCN 3A090.a. However, the Advanced Computing IFR creates a new list of approved OSAT companies in Supplement No. 7 to Part 740. The presumption that an item is controlled under 3A090.a may be overcome if one of the approved OSATs provides a required attestation.

New and amended license exceptions

To facilitate low-risk transactions, the AI IFR creates several new license exceptions and other authorizations that will allow the export of these advanced computing items to destinations that present a low risk to US national security or foreign policy interests:

  • License Exception Artificial Intelligence Authorization (AIA) – authorizes the export, reexport, and transfer (in-country) of eligible advanced computing chips and associated software and technology, as well as advanced AI model weights specified in new ECCN 4E091 to entities located and owned by parties in one of the 18 allied countries listed in paragraph (a) of Supplement no. 5 to Part 740 (Artificial Intelligence Authorization Countries), including, for example, the UK, the Netherlands, Canada, Germany, Japan, South Korea, Australia, and others.

  • License Exception Advanced Compute Manufacturing (ACM) – authorizes the export, reexport, and transfer (in-country) of advanced computing chips classified under ECCNs 3A090, 4A090, and related .z commodities, software, and technology to private-sector end users located and owned by parties in a country that is not subject to a US arms embargo for the purposes of development, production, or storage of the eligible items. The US currently has an arms embargo on 23 countries, including China.

  • License Exception Low Processing Performance (LPP) – authorizes the export and reexport of low volume of compute up to 26,900,000 Total Processing Performance of advanced computing ICs per calendar year to any individual ultimate consignee. Eligible items classified under ECCNs 3A001, 3A090, 4A003, 4A004, 4A005, 4A090, 5A004, and 5A992 may be exported to ultimate consignees located and owned by parties in a country that is not subject to a US arms embargo. License Exception LPP is not available for exports or reexports made through distributors or for transfers (in-country).

As part of the amendments announced in the Advanced Computing IFR, BIS added a requirement that certain of the eligible commodities in License Exception AIA and License Exception ACM must be designed by an approved or authorized chip designer described in new Supplement No. 6 to Part 740. That list includes several well-known companies.

The AI IFR also amends existing License Exceptions Notified Advanced Computing (NAC) and Advanced Computing Authorized (ACA), as follows:

  • License Exception ACA – amends the destination scope to authorize the export, reexport, and transfer (in-country) of certain items classified under ECCNs 3A090, 4A090, 3A001, 4A003, 4A004, 4A005, 5A002, 5A004, 5A992, 5D002, or 5D992, to or within any destination worldwide, except to entities located or headquartered in, or whose ultimate parent organizations are headquartered, in a destination subject to a US arms embargo.

  • License Exception NAC – amends the NAC notification process to seek additional information regarding specified ICs and related commodities, software, and technology (except items designed or marketed for use in a data center and meeting certain parameters), that must be reported to BIS prior to exports or reexports under License Exception NAC:
    • All NAC and license approvals to end users in the past 12 months
    • Memory bandwidth of the item(s) requested, and
    • Whether the items are destined to be aggregated into a data center or computing cluster, and, if so:
      • The computing power of the computing cluster, measured in the aggregate total processing performance (TPP) of all chips used in the cluster once the cluster in complete, and
      • Whether the cluster will be:
        • Exclusively for internal use by a company headquartered in the US or a destination specified in Country Group A:5 or A:6, or
        • Used by any other companies not headquartered in A:5 or A:6, or by external parties such as through cloud services.

Amendments to Data Center Validated End User (DC VEU) authorization

In October 2024, BIS created the DC VEU authorization to effectively pre-authorize a data center end user to qualify for exports under a single authorization with the aim to facilitate international AI development while minimizing risks to US national security interests. The AI IFR now splits the DC VEU into two categories: a universal VEU (UVEU) and a national VEU (NVEU) authorization.

Universal Validated End Users (UVEUs)

Companies headquartered in, or whose ultimate parent is headquartered in, a destination listed in the Artificial Intelligence Authorization Countries (Supplement No. 5 to Part 740) are eligible to apply for UVEU status.

The UVEU authorization provides a single authorization for data centers that own their own advanced computing capacity to allow the UVEU to build data centers in other countries not subject to a US arms embargo, provided the UVEU complies with certain requirements.

For instance, according to the AI IFR, UVEUs must keep at least 75 percent of their AI computing power (measured in TPP of chips that meet or exceed the scope of ECCN 3A090.a) within the Artificial Intelligence Authorization Countries. UVEUs may not transfer or install more than seven percent of total AI computing power to non-Artificial Intelligence Authorization Countries. Further, UVEUs headquartered in the US must keep at least 50 percent of their chips within the US.

To achieve UVEU status, the data center that owns the advanced computing capacity must certify to BIS that it will follow the guidelines provided in Supplement No. 10 to Part 748, per the AI IFR.

Among the several requirements, a UVEU data center must agree to comply with the outbound investment regulations administered by the US Department of the Treasury in 31 CFR Part 850 as if it were a US person.

The outbound investment regulations restrict a broad range of investment activity in the semiconductor sector involving countries of concern (ie, China, Hong Kong, and Macau).

National Validated End Users (NVEUs)

Companies headquartered in, or whose ultimate parent is headquartered in, certain destinations not subject to a US arms embargo or comprehensive sanctions program are eligible to apply for NVEU status. The NVEU authorization provides a single authorization for a data center operator that owns its advanced computing capacity to receive certain specified items subject to the EAR.

Unlike the UVEU authorization, the NVEU must obtain separate NVEU authorizations for each additional country in which the owner of the advanced compute wants to operate, according to the AI IFR. The NVEU authorization also imposes a per-company, per-country installed base allocation of TPP for 2025 to 2027.

Non-VEU transactions

For transactions that do not qualify for a license exception or one of the VEU authorizations, parties may apply for a license to BIS. The AI IFR institutes specific country allocations of TPP for license applications involving items classified under ECCNs 3A090.a, 4A090.a, or corresponding .z items. License applications for such items must include a purchase order or equivalent agreement reflecting the actual volume of TPP that the applicant seeks to export.

The AI IFR also revises the licensing policy for various countries, as follows:

  • Presumption of Denial
    • Countries subject to a US arms embargo, or any entity headquartered in, or whose ultimate parent is headquartered in an arms embargoed country
    • Countries not listed in either paragraph (a) or (b) of the Artificial Intelligence Authorization Countries and that are not subject to an arms embargo after the country’s TPP allocations are met (790,000,000 TPP for the period from 2025 to 2027)
  • Presumption of Approval
    • Countries listed in paragraph (a) of the Artificial Intelligence Authorization Countries (Supplement No. 5 to Part 740)
    • Countries not listed in either paragraph (a) or (b) of the Artificial Intelligence Authorization Countries and that are not subject to an arms embargo that have not met their TPP allocation

New advanced closed-weight AI model weight controls

The AI IFR imposes new controls on the model weights for advanced AI models under new ECCN 4E091. ECCN 4E091 controls weights of models trained with 10^26 computational operations or more. The AI IFR imposes a worldwide licensing requirement on the export, reexport, and transfer (in-country) of model weights controlled under 4E091.

However, the AI IFR provides authorization under License Exception AIA for such AI model weights destined to countries listed in paragraph (a) of the Artificial Intelligence Authorization Countries. Open models and models that are less powerful than the most advanced open-weight models are not subject to controls under this rule. An “open model” is considered a model with widely available model weights.

The AI IFR establishes a new AI model weights foreign direct product (FDP) rule. Under the AI model weight FDP rule, foreign-produced AI model weights are subject to the EAR if they (1) meet the requirements of 4E091 model weights that are produced by a complete plant or major component of a plant located outside the US, when the complete plant or major component of a plant, whether made in the US or a foreign country, is subject to the EAR and specified in certain ECCNs that control advanced computing items; and (2) are destined to any location worldwide.

Red flag guidance on AI model weights

The AI IFR provides new red flag 28 as part of BIS’s “Know Your Customer” Guidance and Red Flags in Supplement No. 3 to Part 732 regarding exports, reexports, and transfers (in-country) of AI model weights.

New red flag 28 provides guidance to US Infrastructure as a Service (IaaS) cloud computing providers to help them identify when training an advanced AI model that falls within new ECCN 4E091 for a customer that is a US subsidiary of a foreign entity creates a potential diversion concern.

What the future holds

As expected, President Trump repealed President Biden’s October 2023 EO, which had previously set in motion a vast number of federal efforts on the governance of AI technologies.

While President Trump has signaled support for at least one area of interest under President Biden – domestic investment in AI data centers – President Trump issued a new EO on January 23, 2025, titled “Removing Barriers to American Leadership in Artificial Intelligence.”

The new order sets timetables to review and revoke actions under President Biden’s EO or that “present obstacles” to President Trump’s stated policy of “to sustain and enhance America’s global AI dominance in order to promote human flourishing, economic competitiveness, and national security.” We will continue to monitor the fate of the AI IFR and other Biden-era AI initiatives in the weeks and months ahead.

DLA Piper is here to help

DLA Piper has a robust National Security and Global Trade practice that provides global coverage and deep experience with complex compliance, licensing, and enforcement matters. Our AI & Data Analytics practice has been consistently recognized by The Financial Times, The American Lawyer, and others for its leadership.

DLA Piper’s multidisciplinary team of lawyers and data scientists assist organizations in navigating the complex workings of their AI systems to ensure compliance with current and developing regulatory requirements.

For more information on AI and the emerging legal and regulatory standards, visit DLA Piper’s focus page on AI.

For further information, please contact any of the authors.