On May 31, 2026, the US Department of Commerce’s Bureau of Industry and Security (“BIS”) issued guidance clarifying that a license continues to be required under the Export Administration Regulations (“EAR”) for exports of advanced computing items to entities located in any country, if those entities are headquartered in Country Group D:5 (including China) or Macau, or have “an ultimate parent company” headquartered in Country Group D:5 or Macau. The BIS Guidance was prompted by industry questions as to whether a preexisting license requirement for these items, as imposed in November 2023, was still being enforced in light of BIS’s May 2025 announcement that it would rescind and replace, and in the meantime not enforce, the AI Diffusion Rule that was originally introduced in January 2025 and imposed expansive, worldwide licensing requirements for such items (covered here).
In summary, the BIS Guidance confirms that the May 2025 non-enforcement policy for the AI Diffusion Rule applies to ECCN 3A090.a, 4A090.a, and related .z items only where the export/reexport/transfer is (i) to a destination outside Country Group D:5 or Macau and (ii) not to an entity headquartered, or with an ultimate parent company headquartered in, those countries.
Snapback to the 2023 License Requirement
The license requirement at issue first took effect on November 17, 2023 as an end-user control in § 744.23(a)(3)(i), which applied to all advanced computing items (e.g., those specified in ECCNs 3A090.a and .b, 4A090.a and .b, and related .z paragraph items incorporating those ECCNs). For these items, a license would be required for exports/reexports/transfers to an entity “headquartered in, or whose ultimate parent company is headquartered in, either Macau or a destination specified in Country Group D:5,” regardless of the location of that entity. This requirement triggered questions at the time as to whether an entity could only have one “ultimate parent company” or perhaps multiple “ultimate parent companies,” and the BIS Guidance does not address this issue. Instead, the guidance arguably prolongs the debate by referring at one point to “entities headquartered in or that have ultimate parent companies headquartered in Country Group D:5 or Macau” (emphasis added).
In January 2025, the AI Diffusion Rule converted the November 2023 licensing requirement for the more sensitive 3A090.a and 4A090.a items from an end-user control (as reflected in § 744.23(a)) to a pure destination control (as reflected in § 742.6(a)(6)(iii)(A)), when BIS imposed its new worldwide license requirement. When BIS announced in May 2025 that it would not enforce the AI Diffusion Rule, that effectively meant a return to the end-user control license requirement described above, for entities headquartered in, or whose ultimate parent company is headquartered in, Country Group D:5 or Macau. While not referenced in the BIS Guidance, the same licensing requirement applies with respect to items controlled under ECCN 3A090.b., 4A090.b. and the related .z paragraph items incorporating those .b ECCNs (still reflected in § 744.23(a)(3)(i)). Accordingly, BIS licenses should still be obtained for all such transactions unless a license exception is available.
Safe Harbor?
The BIS Guidance also provides some comfort to “bona fide operators” of data centers that are otherwise acting in compliance with the EAR but may have obtained ECCN 3A090.a., 4A090.a. and associated .z paragraph items contrary to the BIS Guidance. Such operators may continue to use, store, dispose or service such items “until further notice from BIS,” which seems to provide relief from General Prohibition 10 for eligible “bona fide operators” of data centers—a term BIS does not define and could cover multiple types of actors in the data center ecosystem. That statement also serves as a reminder of the various other EAR requirements that must still be considered. As a practical matter, as such “bona fide operators” onboard new clients, add capacity or otherwise modify their offerings, they should continue to evaluate their obligations under the EAR and guidance previously issued by BIS, such as the BIS Policy Statement on Controls that May Apply to Advanced Computing Integrated Circuits and Other Commodities Used to Train AI Models (May 13, 2025).
Status of AI Diffusion Rule
This latest BIS guidance was issued shortly after the Government Accountability Office (“GAO”) issued a decision concluding that BIS has not yet completed the required notifications to Congress and the Comptroller General to effectuate the non-enforcement policy that was announced when BIS stated its intention to rescind the AI Diffusion Rule. This procedural irregularity determined by the GAO does not change the status quo for companies exporting pursuant to the pre-AI Diffusion Rule provisions, but this latest BIS guidance may help to clarify which key restrictions remain in place.
The authors acknowledge the assistance of Hunter Morgan with the preparation of this blog post.
