How to Navigate Export Controls for AI Hardware and Software

The EAR is the primary U.S. framework controlling the export of dual-use items, including advanced AI chips and software. It is administered by the Bureau of Industry and Security (BIS).

• Commerce Control List (CCL): AI hardware like NVIDIA's A100/H100 GPUs and certain training software are listed here under Export Control Classification Numbers (ECCNs).
• Foreign Direct Product Rule (FDPR): Extends controls to foreign-made items that are the direct product of U.S. technology or software, impacting global supply chains.
• Entity List: Specifies foreign companies, universities, or persons restricted from receiving U.S. exports without a license.

The EU's framework regulates the export, transit, and brokering of dual-use items within its member states. It aims to harmonize controls across Europe while allowing for national additions.

• Annex I: The EU's control list, aligned with international regimes like the Wassenaar Arrangement. It includes specific entries for "software" and "technology" for the "development" or "production" of items like intrusion software or surveillance systems.
• General Export Authorizations (GEAs): Simplify exports to certain trusted destinations, but national controls can impose stricter rules on AI items deemed critical for security.
• Due Diligence: Exporters must screen end-users and end-uses to prevent diversion to weapons of mass destruction programs.

The foundational step is classifying your AI technology. An incorrect classification can lead to illegal exports.

1. Review the CCL/Annex I: Match your item's technical parameters (e.g., chip performance in TeraFLOPS, software functionality) against the control lists.
2. Apply the Order of Review: Determine if your item is specifically listed. If not, evaluate under general categories for "software" or "technology."
3. Seek a Commodity Jurisdiction (CJ): For ambiguous items, you can formally request a classification ruling from BIS (U.S.) or your national authority.

• Example: AI training software designed to autonomously optimize chip manufacturing may be controlled under ECCN 3D006.

These rules determine when non-U.S.-origin items are still subject to U.S. controls, a critical concept for global AI hardware manufacturing.

• De Minimis Rule: If a foreign-made item contains more than a specified percentage (often 25%) of U.S.-origin controlled content by value, it may become subject to the EAR.
• Foreign Direct Product (FDP) Rules: More expansive. They control foreign-made items that are the direct product of U.S.-origin technology or software, or produced by a plant that is itself a direct product. This is how U.S. controls can apply to chips made in Taiwan or South Korea.
• Entity List FDP Rule: A specific, stringent rule that can restrict any item produced using U.S. technology from being sold to a listed entity.

The Commerce Control List (CCL) is the primary tool for classifying AI hardware and software under U.S. law. You must map your technology to an Export Control Classification Number (ECCN). For AI, key categories include:

• ECCN 3A090: Advanced computing integrated circuits (e.g., NVIDIA A100, H100).
• ECCN 3D001 & 3E001: Software and technology for the development or production of controlled chips.
• ECCN 4A003 & 4D001: Computers and software for information security.

Use the Bureau of Industry and Security (BIS) website to search the CCL and determine if your item requires a license for export to specific countries.

The EU Dual-Use Regulation maintains a harmonized list of controlled items, aligned with international regimes like the Wassenaar Arrangement. For AI, focus on:

• Category 4 - Computers: Controls on computing equipment, electronic assemblies, and related software.
• Category 5 - Telecommunications and Information Security: Covers cryptology and systems designed to defeat intrusion detection.
• General Software Note: Understand exclusions for "mass market" software and encryption.

Conduct a technology classification against the EU list. If your item is controlled, you must apply for an export license from the competent authority in your EU member state.

For U.S. exporters, these are the mandatory platforms for filing and licensing.

• Automated Export System (AES): File Electronic Export Information (EEI) for shipments. Required for most exports where a license is needed.
• Simplified Network Application Process - Redesign (SNAP-R): The online portal to submit export license applications, commodity classification requests, and license exception notifications to BIS.

Integrating these systems into your supply chain workflow is critical for compliance. Failure to file in AES can result in significant penalties.

You must screen all parties in your transaction against government lists of restricted entities. This is a core Know Your Customer (KYC) requirement.

• U.S. Consolidated Screening List (CSL): Aggregates lists from BIS, OFAC, and others.
• EU Sanctions Map: Provides details on EU restrictive measures.

Automate this screening using compliance software or APIs. A single transaction with a listed party can lead to severe penalties, even if the underlying technology is not controlled. This is a key step in designing a compliant supply chain.