Department Of Commerce Proposes Rule On IaaS Product-Related Customer Identification And AI-Related Reporting Requirements - Export Controls & Trade & Investment Sanctions

Introduction

On January 29, 2024, the Department of Commerce (Commerce) proposed a rule that will generally require U.S. Infrastructure as a Service (IaaS) providers and their foreign resellers to verify the identity of their foreign customers and report on the use of their products for large artificial intelligence (AI) training (the Proposed Rule or NPRM). The Secretary of Commerce (Secretary) will have the power to grant exemptions and place specific prohibitions and conditions on customers from certain foreign jurisdictions. The new rule is in addition to current export control and trade sanctions requirements under which the U.S. expects persons subject to U.S. jurisdiction to know their customers, including both end-use and end-users.

On January 19, 2021, President Trump issued Executive Order (EO) 13984 directing the Secretary to issue regulations that would require U.S. IaaS providers to verify the identity of a foreign person obtaining an IaaS account. Then, on October 30, 2023, President Biden issued EO 14410 to broaden this reporting requirement to foreign resellers of U.S. IaaS products. EO 14410 also directs the Secretary to issue regulations that would impose expansive reporting requirements relating to AI, including U.S IaaS providers that engage in transactions with foreign persons for training a large AI model. The Proposed Rule would implement the provision of EOs 13984 and 14410, as detailed below.

Proposed Rule

The Proposed Rule requires U.S. IaaS providers to identify information about foreign customers through a Customer Identification Program (CIP) and report the implementation of the CIP to Commerce. U.S. IaaS providers are also required to ensure that their foreign resellers comply with the CIP and reporting requirements. Furthermore, the Proposed Rule would require reports on transactions involving the training of large AI models that could result in malicious cyber-enabled activities. Also, the Secretary would be empowered to prohibit U.S. IaaS product transactions with a foreign jurisdiction or person.

Customer Identification Programs

Overview of Customer Identification Program Requirements

The Proposed Rule requires each U.S. IaaS provider to maintain and implement a written CIP. A U.S. reseller may adopt its direct provider's CIP to comply with the Proposed Rule. Also, a U.S. IaaS provider must (1) ensure that foreign resellers of U.S. IaaS product(s) maintain and implement a written CIP and (2) transmit foreign reseller CIPs to Commerce within 10 calendar days of a request.

The CIP must describe procedures used to ascertain the identity of a potential customer and its beneficial owners.¹ If the procedures reveal that the potential customer and any beneficial owners are a U.S. person, no further tracking is required. However, for potential foreign customers or beneficial owners, the CIP must require the collection of their name, address, means and source of payment, email address, telephone number, and internet protocol (IP) addresses. The collected data must be then verified through documentary and/or non-documentary methods.

For situations in which verification does not allow the IaaS provider to form a reasonable belief as to the true identity of a customer or beneficial owner, the CIP must dictate when the provider (1) should not open an account; (2) grant an interim, restricted account while attempting further verification; (3) close or impose additional monitoring on the relevant account; or (4) take corrective measures for customers who could not be verified or whose information may have been compromised.

The CIP must also document recordkeeping procedures for foreign customers or beneficial owners' identifying information, verification materials, and verification-discrepancy resolution results. The records must be kept for at least two years after the closure or last access of the relevant account. Third-party access to the verification records must be prohibited except for lawful purposes. Lastly, the CIP must require customers to notify additions of beneficial owners and periodically verify the accuracy of other provided information.

Those Subject to the Requirements

CIP requirements apply to U.S. IaaS providers, which is defined as any U.S. person who is a direct provider or reseller offering any IaaS product. A U.S. person is a U.S. citizen, lawful permanent resident, entity organized under the laws of any jurisdiction in the United States, or any person located in the United States. An IaaS product provides processing, storage, networks, or other fundamental computing resources for running software. Typically, the consumer of an IaaS product only accesses the software, with the provider managing and controlling the hardware.

The Proposed Rule does not directly regulate foreign resellers of U.S. IaaS products. However, the Proposed Rule would indirectly impose the CIP requirements to foreign resellers of U.S. IaaS products by mandating that a U.S. IaaS provider working with a foreign reseller must ensure that the foreign entity maintains and implements a written CIP as specified by the Proposed Rule and submit foreign resellers' CIP to the Commerce within 10 calendar days of a request. U.S. providers must also collect all information required for annual and irregular reports regarding their foreign resellers' CIP implementation. In addition, the Proposed Rule requires a U.S. IaaS provider to take steps to close the foreign reseller account if the U.S. provider obtains evidence that its foreign reseller failed to maintain or implement a CIP or otherwise lacked good-faith efforts to prevent the use of the IaaS products for malicious cyber-enabled activities. The U.S. provider must also report suspected or actual malicious cyber-enabled activity to relevant authorities. The U.S. provider has 30 calendar days to terminate the relationship with the reseller if the reseller is known to have ignored identified issues or if continuing the relationship could increase the risk that the U.S. IaaS product is used for malicious cyber-enabled activity.

Exemptions

With limited restrictions, the Secretary may exempt a U.S. IaaS provider, specific type of account or lessee of a U.S. IaaS product, or specific foreign reseller of a U.S. IaaS product from the CIP-maintenance and CIP-reporting requirements of the Proposed Rule.

To obtain an exemption, the U.S. IaaS provider must make a written, electronic submission to the Secretary. A foreign reseller must apply for an exemption through its U.S. provider who applies on behalf of the foreign reseller. The Secretary, in consultation with other agencies, may grant an exemption based on whether the provider maintains an effective Abuse of IaaS Products Deterrence Program to identify and respond to potential malicious cyber-enabled activities, cooperation with investigations of malicious cyber-enabled activities, and participation in public-private collaborative efforts on privacy-preserving data sharing and analytics.

CIP exemptions are subject to annual notification requirements and may be revoked at any time.

CIP Certification and Reporting

U.S. IaaS providers must submit to Commerce annual CIP certification and irregular reports. The U.S. provider is also responsible for collecting and reporting all information required for annual certifications regarding its foreign reseller's CIP implementation.

The certification must attest that the IaaS provider maintains an adequate written CIP and report the following information:

Mechanisms, services, software, system, or tools used to verify the identity of the foreign customer or beneficial owner
Procedures for requiring the customer to notify ownership changes
Process for ongoing verification of the customer identification information
Mechanisms, services, software, systems, or tools used to detect malicious cyber activity
Procedures for requiring foreign reseller to maintain a CIP
Procedures for identifying a foreign customer using the IaaS to train a large AI model capable enough to be used in a malicious cyber-enabled activity
Contact information for the person responsible for managing the CIP

In addition, the IaaS provider must furnish information about the operation of its IaaS product service, including the range of service offerings, customer base in foreign jurisdictions, employee structure, detection of malicious cyber-enabled activities and large AI training runs, and reporting processes.

U.S. IaaS providers must annually update the certification forms and attest to their accuracy for itself and any foreign reseller. A U.S. IaaS provider must also submit irregular updates in case of a significant change related to its business operations, corporate structure, or CIP implementation, or a simple change in the contact information for personnel managing its own or foreign reseller's CIP.

Government Compliance Assessments

The Proposed Rule requires U.S. IaaS providers to provide their own or foreign reseller's CIP to Commerce upon 10 calendar days of the request. If Commerce notes deficiencies in the CIP, the U.S. provider must resolve identified issues within a reasonable time period and resubmit the relevant CIP for further inspection.

Commerce may also conduct discretionary compliance assessments based on its risk assessment of a CIP, U.S. IaaS provider, or any of its foreign resellers. Commerce will assess whether a U.S. IaaS product is used or likely to be used by foreign malicious cyber actors or foreign persons training a large AI model with potential capabilities that could be used in malicious cyber-enabled activities. Commerce will also analyze whether a U.S. IaaS provider has failed to submit a CIP certification or implement Commerce recommendations from a compliance assessment.

Commerce may conduct compliance assessments annually or as necessary. The assessments may result in follow-up assessments or an audit of the CIP processes and procedures. Also, Commerce may review transactions of the U.S. IaaS provider and recommend that the U.S. provider take remediation measures including mitigating risks and restricting engagement with jurisdictions or persons that the Secretary determines to be potentially harmful.

Reporting of Large AI Model Training

The Proposed Rule requires U.S. IaaS providers to report transactions by, for, or on behalf of a foreign person involving the training of a large AI model that could be used in malicious cyber-enabled activities.

A U.S. IaaS provider must file the report within 15 calendar days of a covered transaction or when the provider reseller gains knowledge that a covered transaction took place. The filing must contain the contact and payment information of the foreign person, as well as details of the AI model training run including the number of computational operations, period of operations, AI model name, and cybersecurity practices.

Also, a U.S. IaaS provider must require its foreign reseller to provide the U.S. provider with the report within 15 calendar days of the covered transaction or when the foreign reseller gained knowledge of the covered transaction. The U.S. provider must then file the foreign reseller's report within 30 calendar days of the covered transaction.

Special Measures on Foreign Jurisdictions or Foreign Persons Involved in Malicious Cyber-Enabled Activities

The Proposed Rule authorizes the Secretary, in consultation with heads of other agencies, to make a finding that (1) a foreign jurisdiction has a significant number of foreign persons offering or obtaining U.S. IaaS products for use in malicious cyber-enabled activity or (2) a foreign person has a pattern of offering or obtaining U.S. IaaS products for use in malicious cyber-enabled activities.

A special measure is imposed as soon as the Secretary issues a determination regarding a particular foreign jurisdiction or foreign person pursuant to the above authority. Such a measure would prohibit or place conditions on the opening of an account or a reseller account with any U.S. IaaS provider by (1) a foreign person located in the designated foreign jurisdiction or (2) a designated foreign person.

A special measure by the Secretary may remain effective for up to 365 calendar days, or longer if Commerce publishes a notice of extension in the Federal Register. U.S. IaaS providers need not implement a special measure until after 180 calendar days following its issuance.

Conclusion

The Proposed Rule requires not only U.S. providers and resellers of IaaS, but also their foreign resellers, to develop and maintain a CIP, submit certifications regarding the CIP, and notify Commerce about certain transactions involving large AI model training. Of note, the Proposed Rule specifically requires that U.S. IaaS providers ensure that any foreign reseller of its U.S. IaaS products maintain and implement a written CIP and submit reports on the foreign reseller's CIP. Thus, if the Proposed Rule is promulgated in its current form, U.S. IaaS providers will need to put in place procedures to hold their foreign resellers accountable for CIP-maintenance and CIP-reporting rules, as well as reporting requirements for large AI model transactions. Industry stakeholders are invited to submit comments on various aspects of the Proposed Rule, to be submitted within 90 days after the date of the NPRM.

Footnote

1. The NPRM defines beneficial owner as an individual who (1) exercises substantial control over a customer or (2) owns or controls at least 25% of the ownership interests of a customer. The Proposed Rule does not define "substantial control," and Commerce invited comments regarding the scope of the term.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.