BIS Issues Multiple Rules Targeting Technology Sector

In recent weeks the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) has published several new and proposed rules that apply to the technology sector, including artificial intelligence (AI), advanced computing integrated circuits (ICs), laboratory equipment, and unmanned aircraft systems (UAS). These rules, along with additions to the Entity List this week, are aimed at protecting U.S. national security and foreign policy interests while maintaining U.S. technological leadership. A brief summary of each of these rules, along with information on how to submit comments, is provided below.

Framework for Artificial Intelligence Diffusion

To regulate the global diffusion of the most advanced AI models and large clusters of advanced computing ICs, BIS published an interim final rule that revises the Export Administration Regulations (EAR) to expand existing controls and establish new ones in order to protect U.S. national security and foreign policy interests. These revisions and additions limit the types and quantities of AI technology that can be exported globally.

Although the use of AI models can lead to economic and social benefits, such as access to healthcare and education, they can also pose unique threats to U.S. national security and foreign policy. These include the use of AI in advanced military and intelligence applications; the development of weapons of mass destruction; support for cyber operations; and human rights violations, such as through mass surveillance. The framework established by BIS aims to prevent the diversion of advanced AI technology to malicious actors, and to create pathways for global partners to have access to the most advanced U.S. AI technology. Summarized briefly below, these measures include the following:

• Adds a new control for closed-source AI model weights under new ECCN 4E091
  • Covers model weights of closed-weight AI models trained using more than 10²⁶ computational operations
  • Applies a new foreign direct product rule
• New controls on advanced computing ICs
  • Add new worldwide license requirement for ICs classified under 3A090.a and 4A090.a and corresponding .z items
  • Creates exceptions to facilitate transactions that pose a low risk of diversion or would otherwise advance U.S. national security or foreign policy interests, including technological leadership
  • License review policy based on destination and quantity
• Creates three new license exceptions:
  • License Exception Artificial Intelligence Authorization (AIA)
    • Allows for the export, reexport, or transfer (in-country) of eligible advanced computing chips and related software and technology without an authorization to 18 key allies and partners (Australia, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, the Netherlands, New Zealand, Norway, Republic of Korea, Spain, Sweden, Taiwan, and the United Kingdom)
  • License Exception Advanced Compute Manufacturing (ACM)
    • Allows for the export, reexport, or transfer (in-country) of advanced computing chips and related software and technology without an authorization for the purpose of development, production, and storage of these chips, except for arms-embargoed countries and Macau
  • License Exception Low Processing Performance (LPP)
    • Allows limited quantities of advanced ICs to flow globally to ultimate consignees in destinations outside of arms-embargoed countries and Macau, up to 26,900,000 Total Processing Performance (TPPs) per end user per calendar year
  • Expands the country scope of License Exception Advanced Computing Authorized (ACA)
    • Allow exports of AI chips (except 3A090.a chips designed for data center use) worldwide, except to companies located or headquartered in arms-embargoed countries or Macau
  • Creates a new AI Model Weights Foreign Direct Product Rule to address production of AI model weights outside of the United States
    • Items classified under new ECCN 4E091 are subject to the EAR based on product scope criteria to any location, worldwide
  • Bifurcates the Data Center Validated End User (VEU) Authorization into “Universal” and “National” VEUs
    • Universal VEU (UVEU): Entities headquartered in the United States or close ally countries can obtain UVEU status and place up to 7% of their global AI computational capacity in data centers around the world under a single authorization
    • National VEU (NVEU): Entities headquartered worldwide (except arms-embargoed countries) can obtain NVEU status to build data centers in specified locations without additional authorizations

The majority of these changes go into effect on May 15, 2025, at which point exporters, reexporters, and transferors involved in AI and advanced ICs must be in compliance with these new rules.

Given the breadth of these changes, BIS is strongly encouraging comments on revisions and additions to this rule, which are due no later than May 15, 2025. Interested parties may submit comments via the Federal rulemaking portal at regulations.gov, docket number BIS-2025-0001.

Implementation of Additional Due Diligence Measures for Advanced Computing Integrated Circuits

Along with new AI rules, and in response to requests from the public, BIS has issued an interim final rule with new to provide additional due diligence procedures regarding advanced computing ICs. This new rule is designed to restrict China’s ability to obtain certain high-end chips that could provide strategic military advantages, and also holds foundries accountable for ensuring that their chips are not diverted to restricted entities. These include changes to the EAR in the following areas:

• Adds five new definitions for the terms “16/14 nanometer node,” “Aggregated approximated transistor count,” “Applicable advanced logic integrated circuits,” “Front-end fabricator,” and “Outsourced Semiconductor Assembly and Test (OSAT)”;
• Revises License Exceptions AIA and ACM so that commodities classified in ECCNs 3A090.a; 5A002.z.1.a, z.2.a, z.3.a, z.4.a, z.5.a; and 5A992.z.1. are eligible only if they are designed by an approved or authorized IC designer;
• Establishes a list of approved IC designers and a list of approved OSAT companies;
• Establishes new reporting requirements for front-end fabricators producing any IC specified in ECCN 3A090.a for authorized IC designers, including the designer, product names, model number (if known), and quantity sold during the reporting quarter;
• Changes to the advisory opinion process used to request being added, modified, or removed from the lists of approved IC designers or approved OSAT companies;
• Adds Note 1 to ECCN 3A090.a to clarify that when a front-end fabricator or OSAT company seeks to export, reexport, or transfer (in-country) any “applicable advanced logic integrated circuit” there is a presumption that the item is 3A090.a and designed or marketed for datacenter; and
• Revises the December 2 FDP rule to make technical corrections and update the definition of DRAM “advanced-node integrated circuit.”

Comments on this rule are due by March 14, and may be submitted via regulations.gov, docket number BIS-2024-0055; the comment period for the December 2 FDP rule (docket number BIS-2024-0028) has been extended to March 14.

Certain Laboratory Equipment and Related Technology

Biotechnology has numerous benefits, and when combined with AI and data science, its use is essential for the safeguarding of public health, agriculture, food production, and the environment. This technology, however, can also be misused to develop certain militarily relevant applications, such as brain-machine interfaces, synthetic materials, and biological weapons.

To prevent uses contrary to U.S. national security and foreign policy interests, BIS has issued an interim final rule placing new controls on a subset biotechnology equipment and related technology. Specifically, certain high-parameter flow cytometers and mass spectrometry equipment will be subject to controls under new ECCN 3A069:

• a – Flow cytometers and cell sorters used for spectral analysis or containing 26 or more detectors or channels
• b – Liquid chromatography mass spectrometry instruments (LC/MS and LC-MS/MS) specifically designed for top-down proteomic analysis

Related technology for these items is controlled in 3E001 and new ECCN 3E069.

These items generate high-quality, high-content biological data that could be used to facilitate the development of AI and biological design tools. Certain flow cytometers and mass spectrometers that are FDA-approved medical devices are excluded from ECCN 3A069.

BIS is soliciting comments on this rule, which must be received by March 17, 2025. Interested parties may submit comments via regulations.gov, docket number BIS-2024-0050.

Securing the Information and Communications Technology and Services Supply Chain: Unmanned Aircraft Systems

The use of unmanned aircraft systems (UAS) is increasing throughout various sectors of the economy, including agriculture, the chemical industry, physical infrastructure and transportation, emergency response, health care, energy, and media. As critical infrastructure becomes more reliant on UAS, foreign adversary involvement in supply chains may increase risks and vulnerabilities that can pose threats to U.S. national security.

To address these potential risks, BIS has issued an advanced notice of proposed rulemaking (ANPRM) seeking public comment on issues related to securing and safeguarding transactions involving information and communication technology and services (ICTS) designed or developed by foreign adversaries or their agents that are utilized in UAS. This rule is aimed particularly at Russia and China, which possess political and legal frameworks through which they can compel entities under their jurisdiction to comply with requests for information regarding U.S. persons, access to systems in the U.S. ICTS supply chain, or the installation of malicious updates or vulnerabilities.

BIS is seeking comments on a number of factors in order to assess how transactions involving ICTS that are designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries may pose threats to U.S. national security and U.S. persons. The ANPRM includes 50 questions that commenters can address, which touch on the following:

• The appropriate definition of “unmanned aircraft systems”;
• The data collection risks posed by mechanisms such as sensors, actuators, telecommunications equipment, and software with intelligent algorithms;
• How components that enable remote access and control behave (network connectivity chips, operating software, AI software and machine learning applications, and data transmission devices) and the associated risks of unauthorized access and related cyber vulnerabilities;
• The potential consequences of UAS exploitation by foreign adversaries and how those could manifest, such as access to sensitive data on U.S. persons and infrastructure by intelligence agencies of foreign adversaries;
• The processes or mechanisms that BIS could implement to authorize otherwise prohibited transactions if the parties to the transaction adopt certain mitigation measures or otherwise reduce the transactions’ risk to U.S. national security; and
• The potential economic impact on U.S. businesses.

BIS is also soliciting general comments from the public in order to better understand the implications of foreign adversary ICTS use in UAS supply chains and to tailor the rule to simultaneously address U.S. national security concerns and business interests.

Comments are due by March 4, 2025, and can be submitted via regulations.gov, docket number BIS-2024-0058, or emailed directly to UnmannedAircraftSystems@bis.doc.gov (include “RIN 0694-AJ72” in the subject line).

Additions to the Entity List

Finally, via two separate notices, BIS announced the addition of 27 entities to the Entity List.

The first notice included fourteen Chinese companies and two Singaporean companies that have  been identified as supporting or contributing to the development of advanced computing integrated circuits that further China’s development of advanced weapons systems, weapons of mass destruction, and high-tech surveillance applications. They also supply Chinese public security end users and pose a risk of diversion to Huawei.

The second notice added eleven Chinese companies to the Entity List. Ten of these entities were added for their role in advancing China’s military modernization through the development and integration of advanced AI research. The eleventh entity was added for its involvement in the development of lithography technology for advanced-node fabrication facilities in China, which advances the Chinese manufacture of ICs for military end-uses.

Conclusion

These new and proposed rules cover a wide range of technology and sectors, implementing stricter controls on advanced technologies, enhancing due diligence measures, and securing vital supply chains. Companies should review the extent to which they engage with items and technology covered by these changes, and assess the extent to which their transactions pose any risk under these new rules.

Contact us if you have questions about these new developments or are interested in submitting comments on these proposed rules.