On January 13, 2025, the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce issued an interim final rule on a Framework for Artificial Intelligence Diffusion (the "AI Diffusion Rule") aimed at expanding the existing U.S. export control framework to address the growing threat to U.S. national security and foreign policy that is presented by diffusion of advanced computing integrated circuits (or chips) and advanced artificial intelligence ("AI") models. The AI Diffusion Rule: (a) adds a new control to the Export Administration Regulations ("EAR") for advanced AI model weights, which are numerical parameters critical to advanced AI models; (b) revises existing controls on advanced computing chips; and (c) expands the scope of the validated end-user authorization for data centers.
Advanced AI Model Weights
The AI Diffusion Rule imposes a new control on, and associated licensing requirement for, the export, reexport or in-country transfer of AI model weights (classified under new Export Control Classification Number ("ECCN") 4E091) for "closed-weight AI models" (i.e., models with weights that are not published) that were trained: (a) on more than 1026 computational operations; and (b) using computing chips that are subject to U.S. export controls. The licensing requirement applies to export, re-export or in-country transfer to any end user in any destination, with exceptions for export, reexport or in-country transfer involving an end user (i) that is located in the United States or any of 18 other countries that have been determined by BIS to present low risk of diversion (Australia, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, Netherlands, New Zealand, Norway, Republic of Korea, Spain, Sweden, Taiwan and the United Kingdom; such countries, together with the United States, "LowRisk Destinations"), or (ii) that is (A) located in a country other than Macau or any U.S. arms embargoed country, as identified in Country Group D:5 of supplement no. 1 to part 740 of the EAR ("D:5 Destinations"), and (B) headquartered in, or ultimately owned by a parent company headquartered in, a Low-Risk Destination. BIS will review license applications for export, reexport or in-country transfer of covered model weights generally subject to a presumption of denial. As noted above, BIS has not extended this licensing requirement to model weights of open-weight AI models, reflecting the U.S. government's present assessment of the balance of risks and benefits of such models.
Advanced Computing Chips
The AI Diffusion Rule expands export controls on, and imposes a global licensing requirement for, the export, reexport, or in-country transfer of certain advanced computing chips classified under specific ECCNs. The new control framework reflects a three-tier system, organized based on country groups, with the most restrictive tier featuring the D:5 Destinations and Macau, and the most favored tier affording a license exception for the Low-Risk Destinations. License applications for export, reexport or in-country transfer of such advanced computing chips will be reviewed (a) for D:5 Destinations and Macau, subject to a presumption of denial, (b) for Low-Risk Destinations, where applicable, subject to a presumption of approval, and (c) for all other destinations, subject to a presumption of approval up to per-country total processing performance allocation limits.
Validated End-User ("VEU") Authorization for Data Centers
The AI Diffusion Rule expands and bifurcates the VEU Authorization feature, which streamlines the process for entities in locations subject to license requirements to receive controlled chips, subject to certain conditions. Under the new Universal VEU ("UVEU") Authorization, data center companies that are headquartered in Low-Risk Destinations and own their advanced computing capacity can obtain an authorization to build data centers in the United States and other countries (except for Macau and D:5 Destinations), subject to certain country-by-country allocation limits on the location of AI computational capacity. Separately, companies that are headquartered or located in certain other countries can apply for the new National VEU ("NVEU") Authorization, which enables the receipt of controlled chips, subject to per-company, per-country installed base allocation limits based on total processing performance for the two-year period from 2025 to 2027. In order to obtain UVEU or NVEU status, companies must certify that they will follow BIS guidelines, including with respect to compliance with specific security and reporting requirements.
Key Takeaways
The AI Diffusion Rule is the latest example of BIS's increasing efforts to regulate access to Infrastructure-as-a-Service ("IaaS") solutions and AI capabilities in furtherance of the protection and promotion of U.S. national security and foreign policy interests. Issuance of the AI Diffusion Rule during the last week of the Biden Administration may also be reflective of the general bi-partisan consensus around the sensitive nature of advanced computing technology and associated services, and there are expectations that the incoming Trump Administration will be similarly focused on expanding regulatory visibility and control in this area.
The AI Diffusion Rule requires compliance generally as of May 15, 2025, though compliance with certain VEU Authorization provisions is not required until January 15, 2026. Comments on the AI Diffusion Rule can be submitted to BIS until May 15, 2025.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
