Regulation explainerGeopolitics
AI chip export controls: classification, screening and a process that survives rule changes
Export controls on advanced computing now reach chip buyers, server resellers, data center operators and model developers, not only semiconductor makers. This guide explains how the US Export Administration Regulations classify and restrict advanced chips and computers, when end-user, end-use and foreign direct product rules apply, how deemed exports and cloud access fit in, where EU and UK regimes differ, and how to run a process that holds up while the rules keep moving.
On this page
- Read this first: a moving target, and not legal advice
- Who advanced computing controls now reach
- Terms that decide whether a control applies
- Which regimes apply, and what each requires
- Is it an export? Common advanced compute scenarios
- Rescinded, suspended and revised rules: designing for volatility
- An export compliance process for advanced compute
- Questions and answers
- Sources
Read this first: a moving target, and not legal advice
Who advanced computing controls now reach
These controls began with chipmakers and equipment suppliers but now reach server resellers, data center and cloud operators, AI developers sharing technology across borders, firms whose foreign-national engineers work on controlled technology, and integrators shipping systems with controlled chips inside.
The test is not whether you make chips. It is whether you export, reexport or transfer within a country any item, software or technology subject to the Export Administration Regulations, and to whom, which can include items made outside the United States.
ColdAI's geopolitics practice offers export control advisory within its sanctions and trade compliance work2; this page sets out how we structure that work, in a form an in-house team can also use.
Terms that decide whether a control applies
- ECCN (Export Control Classification Number)
- The code on the Commerce Control List that identifies a controlled item and its reasons for control. Advanced chips fall under ECCN 3A090 and computers containing them under 4A090, alongside related entries for items that incorporate them3.
- Total processing performance and performance density
- The metrics that set the 3A090 thresholds, combining a chip's computational throughput with its die area. The thresholds have shifted between rules, so confirm current values in the regulation rather than in a datasheet summary.
- Deemed export
- Releasing controlled technology or source code to a foreign person inside the United States, treated as an export to that person's most recent country of citizenship or permanent residency3.
- Foreign direct product (FDP) rules
- Provisions that bring certain items made abroad under US controls when they are the direct product of specified US technology or software, or of a plant whose major components are; some target advanced computing items and listed end users.
- Entity List
- Foreign parties, listed in a supplement to the EAR, for which a license is needed before supplying items subject to the regulations, often under a presumption of denial.
Which regimes apply, and what each requires
US Export Administration Regulations (EAR)[^3]
United States, with extraterritorial reachApplies whenItems, software or technology subject to the EAR are exported, reexported or transferred, including some foreign-made items caught by FDP rules and releases of technology to foreign persons3.
- Classify items against the Commerce Control List, including the advanced computing entries.
- Screen destinations, end users and end uses, including the Entity List, the military end-use and end-user rules in §744.21 and the advanced computing and supercomputer end-use controls in §744.23.
- Obtain a license, or confirm that a license exception applies, before shipping or releasing technology.
- Resolve red flags before proceeding and keep the required records.
EU Dual-Use Regulation (Regulation (EU) 2021/821)[^4]
European UnionApplies whenDual-use items listed in Annex I are exported from the EU, or unlisted items are caught by catch-all controls for military, weapons of mass destruction or cyber-surveillance end uses4.
- Obtain authorization from the competent authority of the member state where the exporter is established.
- Check national controls that member states may impose on items not listed in Annex I, which the Commission publishes.
- Operate an internal compliance program, which the Regulation requires of exporters using global export authorizations.
UK Export Control Order 2008 and the UK Strategic Export Control Lists[^5]
United KingdomApplies whenControlled goods, software or technology leave the UK, including technology sent electronically, or end-use controls catch unlisted items5.
- Apply to the Export Control Joint Unit for a license, or use an open general license whose conditions you meet.
- Apply end-use controls to unlisted items when you know or are told of a military or weapons of mass destruction end use.
- Keep records and meet each license's conditions.
Is it an export? Common advanced compute scenarios
| Scenario | Usually an export or transfer? | What to check |
|---|---|---|
| Shipping GPUs or servers to a customer abroad | Yes | Classification, destination license requirements, end user and end use, and whether the buyer may reexport. |
| Giving a foreign-national engineer in a US lab access to controlled technology | Yes, a deemed export | The technology's classification, the person's citizenship and residency, license needs and access controls. |
| Selling remote access to GPUs in your data center | Generally not an export of the hardware itself, but end-use and end-user controls and technology transfers can still apply | Who the customer is, what they are building, and whether controlled technology leaves with the service. |
| Sending model weights or training code abroad | Depends on how the technology is classified at the time, which has been unsettled | The current status of any model-weight controls and whether the code or know-how is controlled technology. |
| Shipping a non-US-made accelerator board built with US design tools | Possibly, through a foreign direct product rule | Whether the board is a direct product of specified US technology or software and whether the destination or end user triggers the rule. |
A planning simplification: the answer always turns on classification, destination and parties.
Rescinded, suspended and revised rules: designing for volatility
The AI Diffusion Rule, published in January 2025, would have introduced worldwide licensing tiers and controls on certain model weights6. BIS announced its rescission in May 2025 and has applied a non-enforcement approach while formal removal is pending, and in May 2026 it reminded exporters that the rules in force before it still apply1.
The Affiliates Rule, published in September 2025, extended Entity List and military end-user restrictions to entities owned 50 percent or more by listed parties7. It was suspended from November 10, 2025 through November 9, 2026, and is scheduled to return on November 10, 2026 unless BIS extends the suspension7. At the time of writing that date is weeks away, so ownership screening for affiliates of listed parties should already be in preparation.
In January 2026 BIS also moved the license review policy for certain advanced computing commodities from a presumption of denial to case-by-case review for exporters meeting security, testing and production criteria1.
Treat the rulebook as a feed rather than a reference book: follow BIS notices in the Federal Register, EU delegated acts updating Annex I and UK notices to exporters, and make one person responsible for assessing each change against your classification register and recording the conclusion, even when nothing changes.
An export compliance process for advanced compute
Build a classification register
List every chip, server, board, software product and body of technology you export or release, with its control entry under each relevant regime, the reasoning and the date it was last checked.
Screen parties and end uses
Screen customers, intermediaries and end users against the Entity List and other restricted-party lists, ask what the compute will be used for, and resolve red flags before shipping or provisioning.
Manage licenses and exceptions
Track each license or exception in use, its conditions and expiry, and link it to the transactions it covers.
Control access to technology
Tag controlled technology in repositories, labs and model registries, and grant access through rules agreed with HR and legal, so deemed exports are licensed or avoided.
Monitor rule changes
Review each new rule and guidance document, re-run classifications touched by threshold changes, and update screening when lists or ownership rules change.
Keep records and train by role
Retain export records for the period set in Part 762 of the EAR, and train sales, engineering and data center staff on the red flags that apply to their own work.
Test, audit and decide on disclosures
Sample transactions against the register and screening records, fix process gaps, and decide with counsel whether an apparent violation warrants a voluntary self-disclosure.
Questions and answers
Does selling cloud GPU capacity to foreign customers need an export license?
Providing remote computing capacity is generally not treated as an export of the hardware, because the chips stay where they are. That does not end the analysis: end-use and end-user controls can still apply, controlled technology shared alongside the service can be an export, and due diligence expectations for cloud providers remain under debate. Screen customers and understand what they are building either way.
Are non-US companies subject to US chip export controls?
Often, yes. US-origin items remain subject to the EAR when reexported or transferred abroad, some foreign-made items with enough controlled US content are caught, and the foreign direct product rules reach certain items made abroad with US technology or software. A non-US company handling advanced accelerators should check each product and transaction rather than assume it is outside scope.
Do EU export controls on advanced chips match the US rules?
No. The EU control list in Annex I of the Dual-Use Regulation largely follows multilateral regimes, while several US advanced computing controls are unilateral. Member states can add national controls on unlisted items, and some have done so for semiconductor and quantum technology. The same product can be license-free from one jurisdiction and controlled from another, so classify under each regime you export from.
What changes when the Affiliates Rule suspension ends?
Unless the suspension is extended, entities owned 50 percent or more by parties on the Entity List or military end-user list will again be treated as restricted themselves, even if they are not named7. Exporters then need ownership data for counterparties and their owners, not just name screening. Preparing that data before the scheduled return date avoids halting shipments while ownership is researched.
Where do ITAR and defense technical data fit?
Defense articles and related technical data fall under the International Traffic in Arms Regulations, a separate State Department regime not covered here. If your AI work touches defense programs, see our guide to ITAR and EAR controls on AI in aerospace and defense and confirm jurisdiction with counsel before classifying anything.
Sources
- BIS Export Controls: 2025 Year in Review and 2026 Mid-Year Update — Miller & Chevalier · checked 10 October 2026
- Geopolitics capability: sanctions and trade compliance offering — ColdAI
- Export Administration Regulations (15 CFR Chapter VII, Subchapter C) — Electronic Code of Federal Regulations · checked 10 October 2026
- Regulation (EU) 2021/821 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items — EUR-Lex · checked 10 October 2026
- The Export Control Order 2008 — legislation.gov.uk · checked 10 October 2026
- BIS Rescinds Its AI Diffusion Rule and Issues Compliance Guidance Regarding Advanced Computing Items — Akin Gump · checked 10 October 2026
- Federal Register document 2025-19846: one-year suspension of the Affiliates Rule — Office of the Federal Register · checked 10 October 2026