Controlling AI Exports: A National Security Play

Trump & Biden Agree: AI Exports Should Be Controlled

U.S. export regulations are fundamentally about protecting national security. By controlling exports the U.S. aims to keep adversaries rogue entities and rogue persons from using American innovation to develop cyber capabilities or weapons that can be used against the U.S., allies or to generally cause harm. The U.S. also seeks to protect U.S. intellectual property from being stolen.

This is why the Trump Administration and the Biden Administration actually agree that AI capabilities need to be controlled.

Under both administrations, the Department of Commerce’s BIS took steps to control exports tied to AI, including advanced models and high-performance computing hardware.

In January 2025, the Biden administration rolled out its “Framework for Artificial Intelligence Diffusion” its plan to control the export of advanced AI technologies which was to take effect in May 2025.

Trump’s BIS team came in with a different approach – read on for the Trump approach.

Rescinding the “Framework for Artificial Intelligence Diffusion

May 15, 2025, Trump’s BIS declared in a press release that it is going to rescind the “Framework for Artificial Intelligence Diffusion” to avoid:

  • “stifling” U.S. innovation
  • “burdensome” regulatory requirements
  • straining U.S. relationships with other countries.

To date, BIS has not formally rescinded the Framework nor has it drafted regulations to control AI – but it says it will.

For now, it has provided guidance to industry on its expectations for controlling AI.

There Are Still Export Controls Related to Integrated Circuits and AI

In guidance issued in May 2025, BIS reminded us that advanced computing integrated circuits (“IC”) and commodities that contain advanced ICs which are needed to support AI are still export-controlled, even though the Biden Framework has been canned.

For example, export regulations still exist that control high-end chips, computers and related software that meet specific performance thresholds that are used or may be used for AI and machine learning. The Commerce Control List, which is the big list of all U.S. export-controlled items, items being products, software and technology, include AI related items in the sections of the list for electronics, computers, telecommunications and information security.

BIS Calls Out Certain Countries

BIS also explained that it is taking steps to strengthen export controls related to semiconductors, especially those used in AI. To that end, in a May policy statement BIS reminded industry that countries like China (including Macau), Russia, Belarus, Iran, North Korea, Syria, Cuba Venezuela, and Myanmar (Burma) are already barred from receiving U.S. defense articles and services—and may attempt to acquire advanced computing ICs for AI training in military-intelligence or for use with WMD.

Some of these countries, Iran and North Korea, for example, are also subject to near-total bans under Treasury’s OFAC sanctions, restricting U.S. entities and persons from doing almost any transaction with them at all.

In its May 2025 guidance, BIS specifically called out China and Huawei Technologies, warning that using China-origin chips, like certain Huawei ICs, may violate U.S. export laws if they were developed using U.S. technology without a U.S. export license.

For these and other high-risk countries, it is presumed that an export license for export-controlled ICs and computers used for AI will be denied.

Duty to Know

BIS’ May guidance also reminded that when doing anything such as selling, transferring, exporting, re-exporting, financing, buying, storing items related to advanced computing ICs or any export controlled items with knowledge that export-controlled items will be or may be used by end-users for WMD or military-intelligence it may violate U.S. export control regulations and possibly be a crime.

This seems simple enough but, needs to be broken down, as BIS did in its May policy statement.

Violations of export regulations to include criminal violations of export regulations occur when there is “knowledge.”

Knowledge is one of those special legal words that has a definition that goes well beyond what common sense would inform it means.

How Do You “Know”?

The definition of “knowledge” is so broad in the law that it includes when someone blinds themselves to what is likely going on so they can try to plausibly deny wrongdoing. In other words, you cannot get away with violating export control laws by claiming you did not know where the export-controlled item was going or where it ended up based on the fact that you did not check out the business partner or the transaction. Knowledge exists when someone knows or should have known that an export violation occurred or is going to occur. [Note: This idea applies to most violations of law.]

This means organizations need to conduct due diligence on their business partners and that due diligence must be detailed enough to evaluate whether the business partner may be involved in activities that violate U.S. export regulations or that would require a U.S. export license. Business partners includes everyone – customers, distributors, landlords, sales agents, subcontractors, etc. Even if due diligence reveals that a business partner is not a prohibited entity and won’t cause a U.S. business to violate U.S. export regulations its important to stay alert to the possibility of a good business gone bad. That is, when due diligence demonstrates the business partner does not have skeletons in its closet so it is likely to follow the law and is not engaged with bad acting countries, persons or businesses, you still must stay alert for facts that indicate the good business partner may be engaged in a transaction that violates or may violate U.S. export regulations (or other U.S. laws).

BIS May 2015 Guidance On Knowing

Bringing this back to AI, the May 2025 BIS guidance provides some examples of when a business or individual knows or should have known that an export violation has occurred or is going to occur:

  • Exporting to Restricted Entities Who Will Use The Export To Train AI Exporting, reexporting, or transferring advanced computing ICs and related hardware, software and technology to any party, such as data centers, knowing or having reason to know the party will use the capabilities to train AI models for or on behalf of restricted countries, entities or persons.
  • Indirect Transfers Of Controlled Items To Prohibited PartiesKnowing or having reason to know that a legitimate end-user will transfer the items to a restricted country, entity or person to use the items to train AI.
  • Providing AI Training Support To Prohibited PartiesPerforming work or providing services when there is a reason to know that the work or services will be used to train AI models for prohibited parties, even if not directly exporting hardware, software or technology to the prohibited party.
  • Using China ICs Without Adequate Due DiligenceUsing Chinese-made chips without confirming through technical analysis that the chips were designed and developed in compliance with U.S. export regulations.

What’s A U.S. Business To Do?

  1. If you are developing AI related hardware, software, tech, including chips make sure you know if what are developing is export-controlled and document your decision.
  2. If you have export-controlled items, determine if you need a license to export it. If you need a license, get one. If you don’t, document your decision. Remember exporting includes shipping product out of the U.S. but it also includes sharing verbally, visually or electronically the controlled-item even to persons, including your employees, if they are non-U.S. persons living in the U.S.
  3. Conduct due diligence on your business partners, including your customers. You are obligated to know about them and if they are a prohibited party or if there is a risk they will transfer your export-controlled items to a prohibited party.
  4. Have clear language in your contracts that there your products, software, technology cannot be transferred in violation of U.S. export and trade regulations.
  5. Even with due diligence and good contracts, stay alert to what your business partners and customers are doing with your products, technology and software.
  6. Train your people so they know what the export requirements are, what to be on the look out for and what to do if there are red flags.

My New Stories