BIS Announces New Regulatory Framework for AI and Controls on Advanced Computing Technology and AI Models
On January 13, 2025, the U.S. Department of Commerce, Bureau of Industry and Security (BIS) announced an interim final rule (IFR) that modifies and expands export controls on advanced computing integrated circuits (IC) and artificial intelligence (AI) models. The IFR’s stated goal is to keep advanced AI models out of the hands of malicious actors while ensuring that secure and responsible foreign entities and destinations will have access to the most advanced U.S. AI models and large clusters of advanced computing ICs necessary to train those models. The IFR introduces new controls on advanced closed-weight AI models, expands controls on advanced computing technology and ICs, and establishes new license exceptions for both AI models and advanced computing technology and ICs. Additionally, it modifies existing license authorizations for data centers and existing license exceptions for advanced computing.
The new rules are effective immediately; however, public comments remain open, and impacted parties are not required to meet most compliance requirements until May 15, 2025 (with certain compliance requirements not effective until January 15, 2026). Below is a summary of key changes described in the IFR and their impact on both U.S. and non-U.S. companies.
New Controls on Advanced Closed-Weight AI Models
Export Control Classification Number (ECCN) 4E091: The IFR creates a new export control classification (ECCN 4E091) for closed-weight AI models trained utilizing 1026 or more operations. Exports covered by this ECCN are subject to a global licensing requirement for all destinations unless a license exception applies (described below). License applications will be reviewed under a presumption of denial except licenses for the following destinations, which BIS indicates have a presumption of approval: Australia, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, Netherlands, New Zealand, Norway, Republic of Korea, Spain, Sweden, Taiwan, the United Kingdom, and the United States.
AI Model Foreign Direct Product Rule: The IFR also introduces a new Foreign Direct Product Rule (FDPR) for AI models. Under this FDPR, a foreign produced item described in ECCN 4E091 is subject to the Export Administration Regulations (EAR) and covered by the noted global export license requirement where the item is produced by a complete plant or ‘major component’ of a plant that is located outside the United States and (a) the complete plant or (b) ‘major component’ of a plant, whether made in the United States or a foreign country, is subject to the EAR and specified in ECCN 3A001.z, 3A090, 4A003.z, 4A004.z, 4A005.z, 4A090, 5A002.z, 5A004.z, or 5A992.z. ICs, servers, and other equipment described in those ECCNs are ‘major components’ of a plant under this FDPR. The FDPR also states that 4E091 covers any foreign-produced item that is further trained or modified via post-training techniques such as fine-tuning, quantization, or other techniques.
Changes to License Requirements for Advanced Computing Technology and ICs
The IFR also updates controls for advanced computing technology and ICs, implementing a worldwide licensing requirement for select products classified under ECCNs 3A090.a, 4A090.a, and related paragraph .z items in section 742.6(a)(6)(iii) of the EAR.
New License Exceptions
In addition to the increased licensing requirements, BIS also created three new license exceptions and authorizations to mitigate the impact of the new requirements.
Artificial Intelligence Authorization (AIA): Subject to certain restrictions and requirements, the AIA license exception authorizes the export, reexport, or transfer of (a) eligible advanced ICs and associated software and technology to entities located in the allied and partner countries noted in the discussion above on ECCN 4E091, unless the entity is headquartered outside of, or has an ultimate parent company headquartered outside of, these destinations; and (b) AI Model Weights specified by ECCN 4E091 to entities headquartered in, or whose ultimate parent company is headquartered in these allied and partner countries AND the entity obtaining the items is not located in Macau or a country listed in Country Group D:5 (countries subject to U.S. arms embargoes).
Advanced Compute Manufacturing (ACM): The ACM license exception authorizes export, reexport, or transfer of eligible advanced computing technology and ICs to a “private sector end user” not located in or with an ultimate parent company in Country Group D:5 or Macau, where the ultimate end use is development, production, or storage of such technology or ICs. Additional limitations apply to use of ACM, namely that the private sector end user is not acting on behalf of an entity wholly owned or controlled by a non-U.S. government and that items produced via the ACM exception may not be exported to Macau or Country Group D:5. This exception builds upon an existing temporary general license intended to prevent disruption of supply chains.
Low Processing Performance (LPP): The LPP license exception authorizes the export and reexport of low amounts of compute that do not present significant national security risks, up to 26,900,000 cumulative Total Processing Performance (TPP) of advanced computing ICs per-calendar year to any individual ultimate consignee. There is no restriction on the number of shipments from exporters or reexporters, provided the volume limit is not exceeded. LPP is unavailable for exports or reexports through distributors or in-country transfers, nor is it available for destinations in Country Group D:5 or Macau or to any ultimate consignee headquartered in Macau or Country Group D:5. LPP also cannot be used in transactions involving prohibited end uses or end users under 15 C.F.R. part 744.
Changes to Existing License Exceptions and Authorizations
Advanced Computing Authorized (ACA): The IFR expands the scope of eligibility for the ACA license exception to any destination except Macau or Country Group D:5, or an entity headquartered in, or with an ultimate parent headquartered in, Macau or Country Group D:5.
Notified Advanced Computing (NAC): For exports and reexports to or involving Macau or destinations specified in Country Group D:5, users of the NAC license exception will be required, in their prior notification submission, to provide information on all uses of NAC and license approvals to end-users in the past 12 months under select ECCNs, the memory bandwidth of the item(s), and if items are destined to be aggregated into a datacenter or computing cluster (in which case additional information is required).
Data Center Validated End-Users Authorization (DC VEU): The IFR bifurcates the DC VEU authorization into a Universal VEU (UVEU) and a national VEU (NVEU) and outlines a range of compliance requirements, including meeting security standards equivalent to those set by the FEDRAMP program, National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) requirements, and National Institute of Standards and Technology standards.
National VEUs (NVEU): Permits entities headquartered, having an ultimate parent headquartered, or located in a destination specified in Country Groups A, B, or D:1-D:4, except Macau or destinations specified in Country Group D:5, to request authorization to build data centers in specific locations (subject to quarterly limits on TPP per-company per-country and a prohibition on data centers located in Macau or Country Group D:5), without any additional licenses.
Universal VEUs (UVEU): Permits entities headquartered in, or having their ultimate parent company headquartered in, the U.S. and certain allied and partner countries to request authorization to build data centers in any location around the world, (subject to limits on TPP and a prohibition on data centers located in Macau or Country Group D:5), without any additional licenses. UVEUs will be prohibited from transferring or installing (a) more than 25% of their total AI computing power (including subsidiaries and parents) to or in locations outside of allied and partner countries and (b) more than 7% of their total AI computing power to any single such country. Additionally, a UVEU headquartered in the U.S. cannot transfer or install more than 50% of its total AI computing power outside of the U.S. We would expect the largest U.S. cloud computing hyperscalers to the be primary initial recipients of UVEU authorizations.
Key Takeaways
The IFR has already received considerable pushback from U.S. allies and domestic AI industry leaders, who argue that the new rules may weaken global competitiveness and undermine AI innovation. We expect significant public comment on the IFR, and the incoming Trump Administration’s plans regarding implementation of AI rules are unclear, including whether they would suspend, amend, or roll-back the IFR entirely. Despite the uncertainty, continued global competition to achieve leadership in cutting-edge technology such as AI is certain to continue into the upcoming Administration, and clients should expect continued federal actions to ensure U.S. technological leadership with respect to AI.
Wiley’s National Security and International Trade teams have unparalleled experience and expertise representing a broad range of U.S. and multinational clients in complex export control, sanctions, international trade, and supply chain matters, and frequently collaborate with Wiley’s Artificial Intelligence practice on All Things AI. Should you have any questions, please do not hesitate to contact one of the attorneys listed on this alert.
Zachary Roten, an International Trade Specialist at Wiley Rein LLP, contributed to this alert.
