The US Department of Commerce’s Bureau of Industry and Security (“BIS”) published an interim final rule (“IFR”) on January 15, 2025, that introduces new export controls on artificial intelligence (“AI”) model weights and advanced computing integrated circuits (“IC”) in the Export Administration Regulations (“EAR”). The new controls are intended to simultaneously restrict exports to certain countries while establishing a framework to support the diffusion and supply of certain AI model weights and advanced computing ICs to allied countries. The IFR is also designed to enhance the US government’s visibility into the targeted transactions, including through the modification of earlier rules introduced to control exports of and investments abroad in AI technology and advanced computing ICs such as BIS’s verified end-user programs (as we have previously reported on here, here, here, and here). In issuing the IFR, BIS explains that the controls are necessary to “cultivate secure ecosystems for the responsible diffusion and use of artificial intelligence and advanced computing ICs” while protecting US national security and leadership in the sector.
The IFR became effective January 13, 2025, though certain provisions have a delayed compliance date of up to a year (i.e., until January 13, 2026). The IFR also includes a savings clause allowing exports, re-exports, and transfers (in country) of hardware, software, or technology subject to a license requirement or restriction under the IFR that will have already been en route on board a carrier under a pre-existing license exception on May 15, 2025 and completed by June 16, 2025. Public comments on the IFR’s changes to the EAR are due by May 15, 2025.
Brief summaries of the IFR’s key provisions are provided below:
- Expanded Export Controls on Advanced Computing ICs
The IFR expands existing controls on advanced computing ICs controlled under Export Control Classification Numbers (“ECCN”) 3A090.a and 4A090.a and corresponding .z items and introduces a more stringent review policy for license applications to authorize exports of such items.
EAR Section 742.6(a)(6)(iii)(A) introduces a global license requirement for the export of advanced computing ICs classified under these ECCNs, while new license exceptions are being added for exports of advanced computing ICs that pose a low risk of diversion or otherwise advance US national security or foreign policy interests. License Exception Artificial Intelligence Authorization (“AIA”) is being added in a new Section 740.27 for all transactions involving certain types of end-users in low-risk jurisdictions, identified at Supplement No. 5 to Part 740 when exporting cumulative total processing performance (“TPP”) of 253,000,000. License Exception AIA is not available to companies headquartered outside of these low-risk jurisdictions. This exception for exports, re-exports, and transfers (in country) of certain advanced computing ICs means that exports of such articles to countries identified at Supplement No. 5 to Part 740 should largely be unaffected by the IFR.
By contrast, exports of such advanced computing ICs will remain restricted to countries in Country Group D:5 and Macau, and license applications for exports to these destinations and to entities headquartered in (or whose ultimate parent is headquartered in) these countries will be subject to a presumption of denial. For all other countries, the IFR introduces a framework that allows for certain exports subject to the computing power of transactions (i.e., based on thresholds that fall short of the computing power necessary for the most advanced AI models) and security measures that recipients of such exports will implement. Exports that exceed the computing thresholds eligible for the license exception will be subject to a new licensing policy that factors in aggregate computing thresholds allocated to each country for the 2025 to 2027 period. Exports above those thresholds may be permitted for entities that obtain validated end-user status (see below).
The IFR also expands the advanced computing foreign direct product rule for articles classified under ECCN 3A090.a and 4A090.a and corresponding .z items to apply to exports worldwide. This change removes the exception for this foreign direct product rule for exports, re-exports, and transfers (in country) from or in countries in Country Groups A:5 and A:6.
Furthermore, the IFR imposes Regional Stability controls and new license requirements on exports of articles classified under ECCNs 3A090.b, 4A090.b, and corresponding .z commodities, software, and technology to or within Country Groups D:1, D:4, and D:5.
As a result, the license exception for low value shipments in Section 740.3 will no longer be available for exports, re-exports, or transfers (in country) of items classified under ECCN 3A001.z to these countries. The same is true for the license exception for exports of articles classified under ECCN 3A001.z.1.a items to Country Group B countries under License Exception GBS (Section 740.4).
In addition to License Exception AIA, the IFR introduces two new license exceptions to facilitate the new framework for exports, re-exports, and transfers (in country) of advanced computing ICs, expands the scope of existing License Exception Advanced Computing Authorized (“ACA”), and updates the information required to qualify for License Exception Notified Advanced Compute (“NAC”):
- New License Exception Advanced Compute Manufacturing (“ACM”) (Section 740.28): This license exception authorizes the export, re-export, and transfer (in country) of eligible items classified under ECCNs 3A090.a and 4A090.a and corresponding .z items to “private sector end users” located in a destination other than destinations listed in Country Group D:5 or Macau and that are not headquartered (or whose ultimate parent is not headquartered) in any such destination, and for which the ultimate end use is “development,” “production,” or storage of such eligible items.
- New License Exception Low Processing Performance (“LPP”) (Section 740.29): This license exception authorizes the export, re-export, and transfer (in country) of low amounts of compute of up to 26,900,000 TPP of eligible advanced computing ICs per calendar year to any individual ultimate consignee located in and or headquartered in (or whose ultimate parent is headquartered in) destinations other than Country Group D:5 or Macau, or to prohibited end-users or for a prohibited end-use under the EAR (15 CFR Part 744).
- Expanded License Exception ACA (Section 740.8): The IFR amends the destination scope of License Exception ACA to apply to export, re-exports, and transfers (in country) to any destination worldwide, excluding destinations listed in Country Group D:5 or Macau, or to any entity headquartered in (or whose ultimate parent is headquartered in) a destination listed in Country Group D:5 or Macau.
- Amended License Exception NAC (Section 740.8): The IFR expands the information required to notify BIS to rely on this license exception when exporting, re-exporting, or transferring (in country) qualifying commodities, software, and/or technology to destinations in Country Group D:5 or Macau. BIS will review the additional information solicited to carefully evaluate the national security risk of authorizing transactions to such destinations, including whether end-users have ties to military or intelligence organizations that raise national security or human rights concerns.
BIS also issued a separate interim final rule and request for comments on additional due diligence procedures for advanced computing ICs, which we have reported on in a separate post (available here).
- New Export Controls on Model Weights of Advanced AI Models
The IFR introduces new export controls that impose a global license requirement on certain unpublished model weights of the most advanced AI models, the diffusion of which could present national security concerns to the United States. The license requirement applies to model weights that are unpublished and have been trained on more than 1026 computational operations, and which are described in a new ECCN – 4E091. Technology classified under ECCN 4E091 on the Commerce Control List is subject to Regional Stability and Anti-Terrorism controls. In addition, the IFR introduces a new foreign direct product rule at EAR Section 734.9(1) applicable to such unpublished model weights exported from third countries.
The global license requirement on unpublished AI model weights is complemented by License Exception AIA, which authorizes exports of technology classified under 4E091 to certain end-users in countries listed in Supplement No. 5 to Part 740. This license exception extends to end-users headquartered in countries listed in subpart (a) to Supplement No. 5 to Part 740 for exports and re-exports to entities in all destinations except destinations in Country Group D:5 and Macau. License applications for exports of technology classified under ECCN 4E091 to destinations in Country Group D:5 and Macau will be subject to a presumption of denial.
ECCN 4E091 excludes and the associated license requirements do not apply to open-weight AI models or AI model weights that are less powerful than the most powerful open-weight AI models (as determined by the AI Safety Institute and the US Department of Energy). BIS explains that it is excluding these AI model weights to minimize the economic impact on developers of closed models but reserves the right to impose controls on these less powerful AI model weights in the future.
BIS also updated its “Know Your Customer” Guidance and Red Flags at Supplement No. 3 to Part 732 of the EAR to add a new red flag guidance for US infrastructure as a service cloud computing providers (“IaaS”) when training an advanced AI model.
- Updates to Validated End User Programs
Finally, the IFR amends the Data Center Validated End User (“VEU”) authorization created in October 2024 by creating two types of validated end-user authorizations: (1) Universal VEUs and (2) National VEUs. The criteria for applying for the two different VEU authorizations are briefly summarized below:
- Universal VEU: Companies headquartered in or whose ultimate parent is headquartered in destinations listed in subpart (a) to Supplement No. 5 of Part 740 are eligible to apply for the Universal VEU authorization. Companies relying on the Universal VEU will be subject to restrictions on where the AI computing power may be allocated.
- National VEU: Companies headquartered in or whose ultimate parent is headquartered in any destination other than Country Group D:5 or Macau are eligible to apply for the National VEU, subject to certain limitations. Companies relying on the National VEU authorization would likewise be subject to limitations on the installed base allocation of computing power (measured by TPP).
Companies that receive approval to use a Universal or National VEU will have to go through an “intensive application process” and comply with guidelines in Supplement No. 10 to EAR Part 748. VEUs will also be identified in the EAR, along with the address(es) identified in the applicable application (and in the case of Universal VEUs, any subsequent address that is notified to BIS 180 days prior to exporting, re-export, or transferring (in country) hardware, software, or technology to the new address).