On January 13, the Bureau of Industry and Security (BIS) released an interim final rule to revise U.S. export controls on advanced computing integrated circuits (ICs) and add a new control on artificial intelligence (AI) model weights for certain advanced, closed-weight, dual-use AI models. According to news reports, Biden administration officials have indicated that they consulted with President-elect Trump’s team on the interim final rule. The rule’s key changes are outlined below.
New worldwide license requirements:
- Items controlled under Export Control Classification Numbers (ECCNs) ECCNs 3A090.a, 4A090.a, and corresponding .z items, including those subject to the Export Administration Regulations (EAR) through the advanced computing foreign direct product (FDP) rule, will require a license to export, reexport, or transfer (in-country) to or within destinations worldwide.
- Items controlled under ECCNs 3A090.b, 4A090.b, and corresponding .z items will require a license to export, reexport, or transfer (in-country) to or within Country Groups D:1, D:4, and D:5, except those destinations that are also in Country Groups A:5 and A:6.[1]
- Additionally, BIS is expanding the destination scope of the advanced computing FDP rule. Consequently, a foreign-produced item will meet the destination scope if there is knowledge that the item is destined worldwide or will be incorporated into any part, component, computer, or equipment not designated EAR99 to any destination worldwide.
New controls on AI model weights: The rule imposes a global licensing requirement on the model weights of the most advanced AI models. Model weights are central to how AI models learn and make decisions. A worldwide license will be required to export, reexport, or transfer (in-country) model weights trained on more than 1026 computational operations (specified in the newly created ECCN 4E091). BIS will apply a presumption of denial to every license application for these model weights.
New AI model weights FDP rule: Because many foreign entities are training advanced AI models using advanced computing ICs and related items produced with U.S. technology, BIS is adding a new AI model weights FDP rule to controlled certain closed-weight models produced in foreign destinations.
New license exceptions: Because of the worldwide license requirements, BIS is adding three new license exceptions applicable to advanced computing ICs:
- License Exception Artificial Intelligence Authorization (AIA): This license exception authorizes the export, reexport, or transfer (in-country) of eligible advanced computing ICs and associated software and technology to and within the United State and 18 allied countries: Australia, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, the Netherlands, New Zealand, Norway, South Korea, Spain, Sweden, Taiwan, and the United Kingdom. License Exception AIA also applies to the export and reexport of model weights to end users in these destinations.
- License Exception Advanced Compute Manufacturing (ACM): This license exception authorizes the export, reexport, or transfer (in-country) of eligible items to “private sector end users”[2] in a destination other than those included in Country Group D:5[3] or Macau if (1) the private sector end user is not headquartered in Macau or a destination included in Country Group D:5; (2) the private sector end user does not have an ultimate parent company headquartered in Macau or a destination included in Country Group D:5; and (3) the ultimate end use is the development, production, or storage of the eligible items. License Exception ACM cannot be used if the ultimate end use is training an AI model or any other activity not related to the development, production, or storage of eligible items.
- License Exception Low Processing Performance (LPP): This license exception authorizes the annual export and reexport of low amounts of compute that do not present significant national security risks to any individual ultimate consignee. Under License Exception LPP, the ultimate consignee is the entity that owns the items. The license exception is not available for exports or reexports through distributors or in-country transfers. The ultimate consignee must (1) be outside of destinations in Country Group D:5 or Macau;(2) not be headquartered in Macau or Country Group D:5; and(3) not have an ultimate parent company headquarters in Macau or Country Group D:5. License Exception LPP also includes certification and notification requirements.
Amended license exceptions: BIS is amending two existing license exceptions:
- License Exception Advanced Computing Authorized (ACA)’s destination scope is being expanded to include any destination worldwide except Macau; a destination in Country Group D:5; any entity headquartered in, or with an ultimate parent headquartered in, Macau or a destination in Country Group D:5; and transfers (in-country) within Macau or a Country Group D:5 destination.
- License Exception Notified Advanced Computing (NAC)’s notification process for exports and reexports to Macau or destinations in Country Group D:5.
Expanded Data Center Validated End Users (DC VEUs) Authorization: BIS is expanding the DC VEU Authorization with (1) universal VEUs for companies headquartered in, or whose ultimate parent is headquartered in, the United States or one of the 18 allied countries eligible to use License Exception AIA and (2) national VEUs for companies headquartered outside of, or whose ultimate parent is headquartered outside of, Macau or a Country Group D:5 destination. Limitations will apply to where universal VEUs can located their AI computing power. Certain total processing performance (TPP) limitations will apply to national VEUs.
Country-specific advanced IC allocations: Exports and reexports of advanced ICs will be subject to country-specific allocations. From 2025 through 2027, countries will be subject to a cumulative maximum installed base allocation of 790 million TPP. The TPP allocations can be increased up to 100% for destinations whose governments commit to protecting advanced computing ICs consistent with U.S. national security interest. BIS will annually review allocations for subsequent years.These country-specific allocations will require license applicants to include the total aggregated TPP volume of each item to be exported on their license application.
New “red flag” guidance on AI model weights: The rule also adds one new red flag for companies providing Infrastructure-as-a-Service (IaaS) products or services, or other computing products or services, to assist in training an AI model with model weights captured by ECCN 4E091 for an entity headquartered, or whose ultimate parent is headquartered, in any destination other than those listed in paragraph (a) of Supplement No. 5 to Part 740, which includes the United States and 18 other allied countries. According to the new “red flag,” this type of assistance creates a substantial risk that the AI model weights will be exported or reexported to a destination for which a license is required and, if a license is not obtained, that the IaaS provider will have aided and abetted in a violation of the EAR. In these cases, IaaS providers should inquire if the customer intends to export the model and apply for a license if required.
* * *
Although the rule is effective on January 13, 2025, exporters, reexporters, and transferors are not required to comply with the new rules until 120 days after its publication in the Federal Register (scheduled for January 15). Certain security requirements for national and universal VEUs have a delayed compliance date of January 2026.
BIS will accept public comments on the interim final rule until May 15, 2025.
[1] The destinations in Country Groups D:1, D:4, and D:5 that are not also in Country Groups A:5 and A:6 are: Afghanistan, Armenia, Azerbaijan, Belarus, Bahrain, Burma, Cambodia, the Central African Republic, China, Cuba, Cyprus, the Democratic Republic of the Congo, Egypt, Eritrea, Georgia, Haiti, Iran, Iraq, Jordan, Kazakhstan, Kuwait, Kyrgyzstan, Laos, Lebanon, Libya, Macau, Moldova, Mongolia, North Korea, Oman, Pakistan, Qatar, Russia, Saudi Arabia, Somalia, South Sudan, Sudan, Syria, Tajikistan, Turkmenistan, Ukraine, the United Arab Emirates, Uzbekistan, Venezuela, Vietnam, Yemen, and Zimbabwe.
[2] A “private sector end user” is either (1) an individual who is not acting on behalf of any government other than the U.S. government or (2) a commercial firm that is not wholly owned by, or otherwise controlled by, any government other than the U.S. government.
[3] Country Group D:5 includes Afghanistan, Armenia, Azerbaijan, Belarus, Burma, the Central African Republic, China, Cuba, Cyprus, the Democratic Republic of the Congo, Eritrea, Haiti, Iran, Iraq, Lebanon, Libya, North Korea, Russia, Somalia, South Sudan, Sudan, Syria, Venezuela, and Zimbabwe.