May 16, 2025 – On May 13, the U.S. Bureau of Industry & Security (BIS) issued three important guidance and policy documents directed at the advanced computing integrated circuit (IC) industry, including both U.S. design or manufacturing companies and foreign providers of infrastructure as a service (IaaS) (i.e., data centers).
The guidance and policy announcements all turn on the full definition of "knowledge" under the U.S. Export Administration Regulations (EAR) that includes "an awareness of a high probability" of a violation. The key takeaways of each of the three guidance and policy documents are below.
General Prohibition 10 'High Probability' Presumption
- BIS issued a first-ever "Guidance on the application of General Prohibition
10 (GP10) to People's Republic of China (PRC)
Advanced-Computing Integrated Circuits (ICs)," emphasizing
that for certain integrated circuits made in China (PRC ICs), a
Foreign Direct Product Rule will "likely" apply because
of the use of U.S. technology or software in either the design or
production, or both, of the ICs. In other words, BIS is making
clear its view that these PRC ICs are actually the result of U.S.
technology.
- "Accordingly," BIS warns, "there is a high probability that a BIS license was required during the design and production of such" ICs.
- In addition to the design and production having a high probability of a license requirement, BIS further warns that GP10 applies not only to the purchase but also the mere "use" of any item in violation of the EAR. Accordingly, "BIS is notifying all persons and companies in the United States and abroad that engaging in GP10 activities, including use of [PRC ICs] such as those listed above, without requisite authorization from BIS could result in BIS enforcement actions which could include substantial criminal and administrative penalties, up to and including imprisonment, fines, loss of export privileges, or other restrictions."
- In practice, this means that for IaaS and data center companies seeking to comply with U.S. export controls but that have locations where such PRC ICs are being used, the ongoing use of PRC ICs would need to stop unless and until the IC supplier confirms that authorization was received from BIS or such authorization is obtained.
- Note that GP10 also impacts the financing of any transaction in violation of the EAR, as BIS warned financial institutions specifically in prior guidance on Oct. 9, 2024.
Policy Statement Regarding AI Models and Certain Catch-All Provisions (WMD and Military Intelligence)
- BIS also issued a Policy Statement warning industry, especially
applicable to operators of foreign data centers that might be
accessed by Chinese clients, "that access to advanced
computing integrated circuits (ICs) and commodities subject to the
EAR for training AI models has the potential to enable
military-intelligence and weapons of mass destruction (WMD) end
uses in" arms-embargoed (i.e., "D:5") countries
including China.
- This would trigger the WMD and military-intelligence "catch-all" provisions under the EAR, both of which turn on "knowledge," defined to include "an awareness of a high probability."
- BIS specifically identified the export, reexport or in-country transfer of such items or commodities to "any party, such as foreign Infrastructure as a Service (IaaS) providers (e.g., data center providers)" may "trigger a license requirement" when the items are used to train AI models "for or on behalf of"—think "directly or indirectly"—parties headquartered in China or other arms-embargoed countries.
- BIS warns that foreign parties "acting contrary to U.S. national security or foreign policy interests, including by training AI models that could support WMD or military-intelligence end uses" for arms-embargoed countries, may be added to the Entity List even where there is no violation of the EAR.
New 'Red Flags' and Due Diligence Guidance
- BIS also contemporaneously issued "Industry Guidance to Prevent Diversion of Advanced
Computing Integrated Circuits," in which:
- BIS reemphasized the national security basis for its controls on advanced computing ICs, stating "BIS has determined that advanced computing ICs have the potential to enable military-intelligence and weapons of mass destruction (WMD) end uses," including nuclear weapons, hypersonic missiles and cognitive electronic warfare.
- BIS identifies 11 "New Transactional and Behavioral Red
Flags," which (among others) include:
- "The ultimate delivery or installation address is unknown. You are unable to determine whether the headquarters of the customer or its ultimate parent is located in a destination specified in Country Group D:5 (including China) or Macau, or the customer refuses to disclose or provides incomplete information about the location of its headquarters or ultimate parent company."
- "The data center to which the advanced ICs and/or commodities containing such ICs are being exported does not or cannot affirm it has the infrastructure (e.g., power/energy, cooling capacity, or physical space needed to run servers containing advanced ICs) to operate the advanced computing ICs and/or commodities that contain such ICs."
- "The customer providing Infrastructure as a Service (IaaS) does not or cannot affirm that users of its services are not headquartered in the PRC, whether or not such customer is located inside or outside of China and Macau."
- BIS further identifies seven "Due Diligence" actions
"that companies should take for new customers, as well as
evaluating IaaS providers, involved with the export or use of
advanced computing ICs and/or commodities that contain such ICs
subject to the EAR," including (among others):
- "Evaluate data centers to determine whether they have the infrastructure to operate servers containing advanced ICs greater than 10 megawatts. Data centers at or above this threshold merit additional scrutiny as they may be able to provide access to a large quantity of advanced computing ICs for training AI models for or on behalf of parties headquartered in countries of concern, where such activities may support WMD or military-intelligence end uses/end users."
Outlook for US Manufacturing and Design Companies
U.S. manufacturers and design companies should anticipate that BIS is issuing the above guidance and policy to lay the groundwork for future enforcement, including under theories that leverage the "awareness of a high probability" aspect of the definition of "knowledge" under the end-use and end-user provisions.
Outlook for Non-US IaaS Providers/Data Centers
Foreign IaaS (i.e., data center) operators should anticipate, in turn, increased due diligence scrutiny from chip suppliers and that such due diligence will focus not only on suppliers' actual knowledge but also on resolving where suppliers might otherwise be concerned that the facts and circumstances could be seen, by U.S. authorities, as presenting a "high probability" of a violation of the EAR.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
