Introduction
On January 15, 2025 [5] [7], the US Department of Commerce Bureau of Industry and Security (BIS) introduced the AI Diffusion Rule [1], marking the first instance of export controls on artificial intelligence (AI) models. This interim final rule (IFR) imposes global licensing requirements for advanced computing integrated circuits (Advanced ICs) and related equipment, reflecting the US government’s strategy to manage the global supply chains of emerging technologies [6], particularly AI systems. Compliance with these new regulations is mandated by May 15, 2025.
Description
The IFR establishes a global licensing requirement for the export [3] [5] [7], reexport [1] [2] [3] [4] [5] [6] [7], and transfer of Advanced ICs classified under specific Export Control Classification Numbers (ECCNs) [1], particularly targeting adversaries and malicious actors [7]. A key component of the IFR is the introduction of ECCN 4E091, which applies to closed-weight AI models trained with 1,026 or more operations [4]. Exports under this classification will face a presumption of denial for most destinations, except for AI Authorization (AIA) countries such as Australia, Canada [1] [4], Japan [1], and the United Kingdom [1] [4], which will benefit from a presumption of approval.
Additionally, the IFR categorizes countries into three groups: the Whitelisted Country Group [3], which includes the United States and 18 allied countries where exports of Advanced AI Chip Items are permitted without quantity restrictions unless the end user is linked to a country in the Prohibited Country Group; the Prohibited Country Group [3], consisting of 23 arms-embargoed countries [3], including China [3], where exports are subject to strict licensing requirements and are generally presumed to be denied; and All Other Countries [3], which require a license for exports and are subject to a default allocation of processing performance [3], with potential increases for countries that provide satisfactory national security commitments [3].
The IFR implements a Foreign Direct Product Rule (FDPR) for AI models [4], extending export control requirements to foreign-produced items described in ECCN 4E091 if they are produced by a plant or major component located outside the US [4]. This rule encompasses foreign-produced items that undergo further training or modification [4]. The IFR also seeks to limit the quantity of Advanced ICs that foreign entities can receive based on their total processing performance (TPP) [5], which quantifies the capability of these circuits [5], indirectly restricting the training of advanced AI models [5].
To facilitate transactions aligned with US national security and foreign policy [7], the IFR introduces several new license exceptions: the Artificial Intelligence Authorization (AIA) [4], which allows exports to allied countries under certain conditions; the Advanced Compute Manufacturing (ACM) exception [4], which permits transfers to private sector users outside specified countries; and the Low Processing Performance (LPP) exception [4], which allows limited exports of low-performance computing without significant national security risks [4]. The Notified Advanced Computing (NAC) exception has been updated to streamline the authorization process by specifying required information for submissions, including a notification requirement for certain lower-end chips 25 days in advance. The Data Center Validated End-Users Authorization (DC VEU) is divided into Universal VEU (UVEU) and National VEU (NVEU) [4], with specific compliance requirements for each [4]. Entities in the Whitelisted Country Group can apply for UVEU status [3], allowing them to obtain large quantities of Advanced AI Chip Items without separate authorization [3], while maintaining specific retention requirements [3]. Similarly [3], entities in All Other Countries can apply for NVEU status for large quantity procurement under stringent vetting [3].
BIS provides guidance on the DC VEU Program [5] [7], indicating that the owner of advanced computing systems must submit the application [5] [7], and both the owner and operator require VEU authorization if they are different entities [5] [7]. If a transaction does not qualify for a license exception and the end user is not part of the DC VEU Program [5] [7], an export license is necessary [5] [7]. Applications for exports to D:5 Countries or Macau will face a presumption of denial [7], while those to AIA Countries will be presumed approved [5] [7], subject to specific TPP allocations [7]. A policy of denial will be enforced once country allocations are exhausted [7], although allocations may increase for countries that assure the US government of their commitment to protecting Advanced ICs [7].
The IFR has faced criticism from US allies and domestic AI industry leaders [4], who express concerns that these new regulations may hinder global competitiveness and innovation in AI technology [4]. Industry groups and chip manufacturers argue that the requirements are excessively broad and burdensome [6], particularly for Infrastructure-as-a-Service (IaaS) and cloud computing providers [6], who must assess their compliance obligations under these new controls [6]. While the rule is effective immediately [2], compliance will not be required until 120 days after its publication in the Federal Register [2]. Stakeholders are invited to submit comments on the rule within the same 120-day period [2]. The complexity of these regulations necessitates careful review by both US and non-US companies involved in the Advanced IC market [7], data center operations [7], and AI [5] [7], highlighting the need for legal guidance to navigate the implications of these changes [7].
In addition to the IFR, the US government has issued an Executive Order to advance US leadership in AI infrastructure, directing federal agencies to identify suitable sites for AI data centers [6]. This initiative underscores the government’s commitment to securing the advanced computing supply chain while fostering domestic AI development [6]. The rule indicates that the threshold for controls may be adjusted in the future [6], with guidance from the US AI Safety Institute and the Department of Energy to determine which AI models are subject to these export controls [6].
Conclusion
The implementation of the AI Diffusion Rule signifies a pivotal shift in the regulation of AI technologies, with significant implications for global trade and national security. While the rule aims to safeguard emerging technologies, it has sparked concerns regarding its potential impact on innovation and competitiveness. As stakeholders navigate these complex regulations, the need for strategic compliance and legal guidance becomes paramount. The US government’s concurrent efforts to bolster domestic AI infrastructure further highlight the strategic importance of AI in national policy.
References
[1] https://natlawreview.com/article/parting-blow-biden-administration-issues-sweeping-export-controls-ai-models-and
[2] https://kpmg.com/us/en/taxnewsflash/news/2025/01/tnf-us-bis-revises-export-controls-advanced-computing-ics-ai-model-weights.html
[3] https://www.jdsupra.com/legalnews/us-department-of-commerce-issues-5941076/
[4] https://www.jdsupra.com/legalnews/bis-announces-new-regulatory-framework-1676127/
[5] https://www.eversheds-sutherland.com/en/global/insights/new-export-controls-on-ai-model-weights-and-advanced-computing-integrated-circuits-supply-chain
[6] https://www.stblaw.com/about-us/publications/view/2025/01/15/bis-announces-worldwide-export-controls-on-advanced-chips-and-ai-models
[7] https://www.jdsupra.com/legalnews/new-export-controls-on-ai-model-weights-8747156/
