Key takeaways

The new interim final rule imposes new global licensing requirements for ECCNs 3A090.a, 4A090.a, and corresponding .z items; controls for closed AI model weights; updated data center validated end-user authorizations; revisions to License Exceptions NAC and ACA; and three new license exceptions.

Baseline security obligations for validated end user authorizations are effective January 15, 2026.

Comments on the interim final rule will be accepted until May 15, 2025.

The Department of Commerce’s Bureau of Industry and Security has issued an interim final rule expanding the Export Administration Regulation’s controls on the export, reexport, and in-country transfer of advanced integrated circuits and established new worldwide controls on advanced model weights used to construct certain advanced artificial intelligence models. The new interim final rule aims to increase scrutiny over global transactions involving advanced integrated circuits and closed model weights. The changes create a strictly regulated global ecosystem for the diffusion and use of artificial intelligence model weights and advanced integrated circuits, with the Bureau of Industry and Security closely monitoring locations, end users, and end uses.

On January 13, 2025, the Department of Commerce’s Bureau of Industry and Security (BIS) published an interim final rule (IFR) revising the Export Administration Regulation’s (EAR) controls on advanced integrated circuits (ICs) and closed-weight dual-use artificial intelligence (AI) models. The IFR became effective January 13, 2025, but compliance will not be required until May 15, 2025. Paragraphs 14, 15, 18 of supplement 10 to Part 748, which set out baseline security obligations for validated end user (VEU) authorizations, take delayed effect until January 15, 2026. There is also a savings clause for shipments that, as a result of the IFR, have been removed from eligibility for a License Exception or export, reexport, or in-country transfer without a license (NLR). Such shipments may proceed to destinations under previous eligibility, provided the items are en route aboard a carrier to a port of export, reexport or transfer (in-country) on May 15, 2025 and the export, reexport, or in-country transfer is completed no later than June 14, 2025.

Chapter 1

Key changes

The rule expands on BIS’ controls on exports, reexports, and in-country transfers of advanced ICs and items incorporating such chips, specified in ECCNs 3A090.a, 4A090.a, and corresponding .z items (collectively, “3A090.a Advanced Computing Items”), to now impose a worldwide license requirement on such 3A090.a Advanced Computing Items. The IFR also creates a new worldwide licensing requirement for closed-weight AI models, on “”parameters” for an artificial intelligence model trained utilizing 1026 or more “operations”” (new ECCN 4E091, collectively, “AI Model Weights”). Specifically, the IFR revises the Regional Stability (RS) controls in § 742.6 of the EAR to include a licensing requirement for AI Model Weights classified in ECCN 4E091 as well as Advanced Computing Items under ECCNs 3A090.a, 4A090.a, and corresponding .z items exported, reeexported, or transferred to any destination worldwide.

To alleviate the supply chain and business disruptions with allies and other U.S. business partners the IFR establishes three new license exceptions. These can be summarized as follows:

• License Exception Artificial Intelligence Authorization (AIA) authorizes exports, reexports and transfers (in-country) of 3A090.a Advanced Computing Items and associated software and technology, including AI Model Weights classified in ECCN 4E091, to entities in new paragraph (a) of Supp. 5 to Part 740 of the EAR, unless the entity, or its parent company, is headquartered outside of paragraph (a) to Supp. 5.
  • New paragraph (a) to Supp. 5 identifies the following eligible destinations: Belgium; Canada; Denmark; Finland; France; Germany; Ireland; Italy; Japan; Netherlands; New Zealand; Norway; Republic of Korea; Spain; Sweden; Taiwan; United Kingdom; United States
  • For certain transactions a certification from the ultimate consignee must be obtained, with the certification specifically noting the ultimate consignee’s commitment to refrain from any transfers outside of a paragraph (a) destination, including through the provision of Infrastructure-as-a-Service (“IaaS”) access.
  • Where the cumulative Total Processing Performance (“TPP”) of the Advanced Computing Items intended for the shipment exceeds 253,000,000, the certification must be provided to BIS prior to the initial export, reexport or transfer (in-country).
• License Exception Advanced Compute Manufacturing (ACM) authorizes export, reexport, and in-country transfer to a private sector end user where the ultimate end use is “development,” “production” or storage (in a warehouse or other similar facility), prior to delivery to the ultimate end user, of Advanced Computing Items that are ultimately destined to customers outside of Macau or Country Group D:5 (or an entity headquartered in, or whose ultimate parent company is headquartered in, Macau or Country Group D:5 ).
• License Exception Low Processing Performance (LPP) authorizes the export and reexport of up to 26,900,000 cumulative TPP of certain 3A090.a Advanced Computing Items per year to a single ultimate consignee so long as: (i) the ultimate consignee is not located in Country Group D:5 or Macau; or (ii) the ultimate consignee is not headquartered in, and its parent company is not headquartered in, Country Group D:5 or Macau.
  • The eligible commodities are those under the following ECCNs: 3A001.z.1.a, z.2.a, z.3.a, z.4.a; 3A090.a; 4A003.z.1.a, z.2.a; 4A004.z.1; 4A005.z.1; 4A090.a; 5A004.z.1.a, z.2.a; and 5A992.z.1.
  • The ultimate consignee must provide a certification, consistent with the terms set forth in § 740.29(f), prior to use of the license exception. This certification must be provided to BIS within 30 days of the date on which the export or reexport takes place.
  • Ultimate consignees must notify BIS whenever they have reached that maximum allowable TPP under this license exception in a calendar year.
  • Any shipments involving aggregate TPP of 3,200,000 or more must submit a notification to BIS prior to the export or reexport.

The IFR also revises Data Center Validated End-User (DC VEU) authorizations, which permit certain exports, reexports, and in-country transfers of regulated items without licenses where entities comply with additional obligations. The IFR distinguishes two types of DC VEU authorizations: universal VEU (UVEU) authorizations for companies headquartered in locations listed under paragraph (a) of Supplement no. 5 to Part 740;¹ and national VEU (NVEU) authorizations for companies headquartered in other destinations aside from Macau and Country Group D:5 locations. UVEU authorizations permit the building of new data centers in most of the world allowing the UVEU entity to receive 3A090.a Advanced Computing Items to any location in the world, outside of Macau or Country Group D:5, provided the Company has certified to the compliance obligations in paragraphs 14, 15 and 18 of Supp. 10 to Part 748 and the location has been included as an authorized facility within the scope of its authorization. NVEU authorizations allow data center operators to receive exports and reexports of 3A090.a Advanced Computing Items in a specific country outside of Macau or a Country D:5 destination, as specified in their NVEU authorization, provided the Company has certified to the compliance obligations in paragraphs 14, 15 and 18 of Supp. 10 to Part 748, among other potential conditions.

Chapter 2

Additional information on key changes

• Revisions to Regional Stability (RS) controls and license requirements: The IFR revises the EAR’s RS controls in § 742.6. It creates distinct country scopes for license requirements for ICs and computers and components depending on their processing density and performance.
  • Worldwide license requirement: The IFR establishes a new global license requirement for ECCNs 3A090.a, 4A090.a, and corresponding .z items in § 742.6(a)(6)(iii)(A), as well as ECCN 4E091 AI model weights in new § 742.6(a)(13).
    • This change makes License Exception GBS unavailable for 3A001.z.1.a items, because they will be subject to a worldwide license requirement imposed for other than national security reasons.
    • This includes certain foreign-produced Advanced Computing Items subject to the EAR pursuant to the Advanced Computing Foreign-Direct Product (FDP) rule (§ 734.9(h)) as well as foreign-produced AI Model Weights specified in ECCN 4E091 subject to the EAR pursuant to the AI Model Weights FDP Rule (§ 734.9(l)).
    • License applications for Advanced Computing Items must be accompanied by a purchase order or equivalent firm contractual agreement reflecting the volume that the applicant seeks to export, reexport, or transfer (in-country).
  • Limited license requirement: The IFR retains the existing licensing controls for 3A090.b and 4A090.b items, which have lower processing performance or performance density than those under 3A090.a and 4A090.b. Consistent with current provisions in the EAR, the IFR only requires licenses for 3A090.b, 4A090.b, and corresponding .z items to or within destinations in Country Groups D:1, D:4, and D:5, excluding Country Group A:5 or A:6 destinations (§ 742.6(a)(6)(iii)(B)).
    • License Exception GBS is still available for 3A001.z.1.b items for destinations in Country Group B that are not also listed in Country Groups D:1, D:4, or D:5.
  • TPP allocations for applications: The IFR caps the aggregate computational performance of Advanced Computing Items that can be exported, reexported, or transferred to a country. From 2025 to 2027, countries will be subject to a cumulative maximum installed based allocation of 790,000,000 TPP. After country allocations are met, additional applications for exports or reexports to that destination are reviewed under a policy of denial.
    • Where a destination government provides proper national security assurances, TPP allocations may be increased up to 100% for a given destination. The destination may be added to paragraph (b) to Supplement no. 5 of Part 740.
  • Updated license review policy: The IFR revises the license review policies in § 742.6(b)(10) and (14) with the following presumptions:
    • Presumption of denial for license applications for exports, reexports, or transfers (in-country) to or within Macau, destinations in Country Group D:5, or entities (or entities with parents) headquartered therein.
    • Presumption of denial for applications to export, reexport, or in-country transfers of certain AI model weights classified under ECCN 4E091 for end users headquartered, or with an ultimate parent headquartered, outside paragraph (a) to Supplement no. 5 of Part 740 destinations. § 742.6(b)(14).
    • Presumption of approval for license applications for exports, reexports, or transfers (in-country) to or within destinations listed in paragraph (a) of Supplement no. 5 to Part 740.
    • Presumption of approval for license applications up to the country allocations TPP for 3A090.a, 4A090.a, and corresponding z. items for end users headquartered, or with ultimate parents headquartered, outside of destinations listed in paragraphs (a) or (b) of supplement no. 5 to Part 740, Macau, or Country Group D:5. When country allocations are met, licenses will be reviewed under a presumption of denial.

• AI Model Weights: New controls, License Exception AIA, and Red Flag 28 Guidance
  • Technology and RS controls: The IFR adds new ECCN 4E091 for closed-weight AI models trained on more than 1026 computational operations. To determine if an AI model is excluded from ECCN 4E091, an exporter may either self-classify its model or obtain guidance from BIS.
    • As noted above, § 742.6(a)(13) requires a license application for the export, reexport, and in-country transfer of ECCN 4E091 model weights. § 742.6(b)(14) establishes a presumption of denial to license applications outside of paragraph (a) to Supplement no. 5 of Part 740 locations.
    • Consistent with BIS’ policy on “published” software and technology the IFR does not impose controls on publicly available open-weight models.
    • The IFR does not establish a license requirement for the export, reexport, or transfer (in-country) of closed-weight model weights that are less powerful than the most powerful open-weight model.
  • New License Exception AIA: As detailed further below, the IFR creates a new License Exception AIA authorizing the export or reexport of model weights to certain end users in specified destinations in § 740.27.
  • New Red Flag 28 Guidance: The IFR adds, in Supplement no. 3 to Part 732 (BIS’s ‘‘Know Your Customer’’ Guidance and Red Flags), new Red Flag 28. This guidance specifies that where a U.S. subsidiary of an entity headquartered in destinations other than those listed in paragraph (a) of Supplement no. 5 to Part 740 provides IaaS offerings to train an AI model that falls within ECCN 4E091, it raises a red flag that the model weights may be exported without requisite authorization. In such cases, the IaaS provider should inquire if the customer plans to export the model and, if so, apply for a license or inform the customer of their obligation to do so before the export.

• New AI Model Weights FDP Rule: The IFR adds a new FDP rule for foreign-produced AI Model Weights at § 734.9(l). The foreign-produced items captured by this FDP rule are AI Model Weights meeting the specifications in ECCN 4E091 that are produced by a complete plant or ‘major component’ of a plant that is subject to the EAR and specified in ECCNs 3A001.z, 3A090, 4A003.z, 4A004.z, 4A005.z, 4A090, 5A002.z, 5A004.z, or 5A992.z.
  • The use of ICs, servers and other equipment subject to the EAR and captured within the Advanced Computing Item ECCNs would implicate this FDP rule as BIS has made clear that these items would be considered a ‘major component’ of a plant.

• Expanded destination scope under Advanced Computing FDP Rule: The IFR replaces references to country groups in § 734.9(h)(2)(ii) with “worldwide”. A foreign-produced item now meets the destination scope of FDP rules where there is “knowledge” that it is destined worldwide or will be incorporated into any part, component, computer, or equipment not designated EAR99 to any global destination.

• Revisions to License Exceptions NAC and ACA:
  • Expanded destination scope for License Exception ACA: The IFR expands License Exception ACA, which covers items classified under ECCN 3A090, 4A090, and corresponding .z items (except for items within 3A090.a that are designed or marketed for use in a data center), to authorize exports, reexports or transfers (in-country) worldwide (except Macau, a destination in Country Group D:5, or an entity headquartered in, or with an ultimate parent headquartered there).
  • § 740.8(c): Additions to NAC prior notification procedures: The IFR amends NAC notification procedures, requiring additional information in the NAC submission. In addition to providing information about item TPP, performance density, and data sheets or documentation showing how the item is designed and marketed, the IFR requires:
    • (iv) All NAC and license approvals to the end-user in the past 12 months under ECCN 3A090, 4A090, 3A001.z, 4A003.z, 4A004.z, 4A005.z, 5A002.z, 5A004.z, 5A992.z, 5D002.z, or 5D992.z (except items designed or marketed for use in a data center and meeting the parameters of 3A090.a);
    • (v) Memory bandwidth of the items; and
    • (vi) Whether the items are destined for use in a computing cluster, and if so:
      • (i) The computing power of the computing cluster (aggregate TPP); and
      • (ii) Whether the cluster will be (a) exclusively used internally by a company headquartered in the U.S. or a Country Group A:5 or A:6 destination, or (b) used by any other companies not headquartered in A:5 or A:6, or by external parties such as through cloud services.

• New License Exceptions: AIA, ACM, LPP: The IFR adds three new license exceptions applicable to advance compute ICs.
  • § 740.27 License Exception: Artificial Intelligence Authorization (AIA): The new License Exception AIA creates an exception for transactions involving certain end users in certain low-risk destinations. It authorizes the export, reexport, or in-country transfer of eligible Advanced Computing Items to entities in destinations listed in paragraph (a) of Supplement no. 5 to Part 740, unless the entity (or its parent company) is headquartered outside such a destination.
    • Paragraph (a) in Supp. 5 to Part 740 identifies the eligible destinations as: Belgium; Canada; Denmark; Finland; France; Germany; Ireland; Italy; Japan; Netherlands; New Zealand; Norway; Republic of Korea; Spain; Sweden; Taiwan; United Kingdom; United States
    • AI model weights specified in ECCN 4E091 are eligible. AI model weights require an additional authorization: they must be stored in a facility compliant with baseline security obligations under Supplement 10, Part 748.
    • Requirements prior to use of exception: To use License Exception AIA, exporters, reexporters, or transferors must first furnish the ECCN of each item to the ultimate consignee and obtain a certification stating that the consignee:
      • (i) Is aware the items will be shipped pursuant to License Exception AIA;
      • (ii) Will not export, reexport, or transfer (in-country) the items received to any end use or end user prohibited by Part 744;
      • (iii) Agrees items received won’t be used to provide Infrastructure-as-a-Service (IaaS) access for training AI models specified in ECCN 4E091 for entities (or entities with parent companies) headquartered or located outside a paragraph (a) of Supplement no. 5 to Part 740 destination without prior BIS authorization; and
      • (iv) Agrees items received won’t be exported, reexported, or transferred in-country to entities (or entities with parent companies) headquartered or located outside of paragraph(a) of supplement no. 5 to Part 740 destination without prior BIS authorization.
    • For certain large orders with a cumulative total processing performance (TPP) of 253,000,000 to one ultimate consignee, the exporter, reexporter, or transferor must provide the certification to BIS. The exporter, reexporter, or transferor must submit the certification to [email protected] with the subject line “AIA Certification.”
    • The exporter, reexporter or in-country transferor must notify the ultimate consignee in writing of each shipment made under License Exception AIA.
  • § 740.28 License Exception: Advanced Compute Manufacturing (ACM): Where the ultimate end use is “development,” “production,” or “storage” of Advanced Computing Items, the new License Exception ACM authorizes exports, reexports, and in-country transfers to a private sector end user located in a destination outside of Macau or Country Group D:5, provided the private sector end user is also not headquartered in, and its parent company is not headquartered in, Macau or a Country Group D:5 destination.
    • License Exception ACM is strictly limited to “development,” “production,” or “storage” of eligible items. It may not be used for other activities, like training an AI model.
    • The items must ultimately be destined to customers outside of Macau or Country Group D:5.
    • Accounting obligations: For each facility, exporters, reexporters, and transferors must maintain a system of distribution that accounts for the number of controlled items transferred to and out of the facility. Records must be updated at least every 6 months.
  • § 740.29 License Exception: Low Processing Performance (LPP): The IFR authorizes the export and reexport of Advanced Computing Items up to 26,900,000 cumulative TPP per year to a single ultimate consignee. License Exception LPP does not apply for destinations or end users in Macau or Country Group D:5 destinations.
    • This exception does not authorize in-country transfers, nor does it authorize the export or reexport to any end use or user prohibited under Part 744.
    • The TPP limit applies to cumulative shipments to any one ultimate consignee, even if made by multiple exporters or reexporters or intermediate consignees. It does not restrict the number of shipments or exporters and reexporters.
    • Reporting obligations: Where they export a shipment with an aggregate of more than 3,200,00 TPP to a single consignee, exporters and reexporters must notify BIS via [email protected] with the subject line “LPP Shipment”.
    • Requirements prior to use of exception: To use License Exception LPP, exporters, reexporters, or transferors must first obtain a certification that the consignee:
      • (i) Is aware the items will be shipped pursuant to License Exception LPP;
      • (ii) Will not export, reexport, or transfer the items to any end use or end user prohibited by Part 744;
      • (iii) Certifies that they have not received a cumulative TPP of 26,900,000 of applicable ECCNs in the relevant calendar year under the exception.

The exporter or reexporter must provide this certificate to BIS within 30 days of the date on which the export or reexport of eligible items occurs. It must notify BIS by email with the subject line “LPP TPP Limit Reached.”

• Revisions and Expansions to DC VEU Authorization: The IFR builds on September and October 2024 DC VEU rule updates. It bifurcates DC VEU authorizations into (a) universal VEU (UVEU) authorization available to companies (or companies with parents) headquartered in paragraph (a) of Supplement no. 5 to Part 740 locations; and (2) national VEU (NVEU) authorizations for companies (or companies with parents) headquartered in other destinations (aside from Macau and Country Group D:5 locations).
  • UVEU Authorization: Data centers that own their advanced computing capacity can apply for a single authorization that allows a UVEU to build data centers anywhere in the world except Macau or Country Group D:5 destinations, so long as the UVEU follows the Supplement No. 10 of Part 748 VEU authorization guidelines. Approved applicants will be listed in the EAR with all authorized data center addresses.
    • If the operator of Advanced Computing Items is different from the owner of the Advanced Computing Items, the operator must itself have a UVEU Authorization.
    • UVEUs must update BIS as they bring new data centers online. It must notify BIS 180 days prior to any exports, reexports, or in-country transfers to the new data center.
    • UVEUs headquartered in a country listed in paragraph (a) to Supplement no. 5 to Part 740 cannot transfer or install more than 25% of its total AI computing power (including subsidiary and parent entities) to locations outside those listed in Supplement No. 5 Paragraph to Part 740. It also cannot transfer or install more than 7% of its total AI computing power in a single country outside the list.
    • UVEUs headquartered in the U.S. cannot transfer or install more than 50% of its total AI computing power outside of the U.S.
  • NVEU Authorization: This authorization permits NVEU locations to receive exports and reexports of Advanced Computing Items to a specific country outside of Macau or Country Group D:5.
    • A per-company, per-country installed base allocation of TPP applies for all NVEUs. Each NVEU in a given country is subject to the quarterly allocations set forth in § 748.15 (e.g., 633,000,000 TPP for 2025 Q1).
  • Applicants: The IFR clarifies that DC VEU applications should be submitted by the party with ownership of the Advanced Computing ITems. The owner must also certify that it will follow baseline security measures for VEUs (Supplement No. 10 to Part 748, paras. 14, 15, and 18) by January 15, 2026, or otherwise notify BIS of other entities involved in its operations and provide signed certifications from them. If the operator of Advanced Computing Items is different from the owner of advanced compute, both the owner and operator must have a VEU authorization.
  • New VEU compliance obligations: BIS adds Supplement No. 10 to Part 748 of the EAR, which adds vetting, recordkeeping, audit, reporting, certification, and security requirements, as well as export restrictions and acceptable use policies. Key obligations:
    • VEUs, along with all subsidiary and parent entities, must meet ownership standards to ensure no foreign ownership, control, or influence factors related to Macau or Country Group D:5 locations.
    • VEUs (including subsidiaries and parents) may not, without BIS authorization, train an AI model specified in ECCN 4E091 for an entity headquartered outside paragraph (a) of Supplement No. 5 to Part 740.
    • VEUs must report facility-specific chip accounting (including for parents and subsidiaries) semi-annually (February 1 and August 1) for interagency review.
    • VEUs may not train an advanced AI model or store ECCN 4E091 model weights outside of paragraph (a) of Supplement no. 5 to Part 740 locations or ownership, headquarters, or operations from those locations.
    • VEUs must obtain BIS authorization before transferring certain chips, assemblies, or computers to certain high-risk locations and end users. They must report intra-company chips transfers between countries using UVEU authorization 60 days in advance.
    • VEUs must vet themselves (and subsidiaries and parent entities) for any ties to military and military intelligence end users, or to entities in Macau or Country Group D:5. Ties include research and development agreements.
    • VEUs must comply with new security obligations for software and network cybersecurity; supply chain transit, sanitization, and disposal; personnel vetting; and chip controls under FedRAMP High and other regulations.
    • VEUs must demonstrate that they have eliminated supply chain dependencies on certain advanced semiconductors and other equipment.

Chapter 3

Next steps

Companies involved in the export, reexport, or in-country transfer of advanced computing ICs, AI models, and data center operations should assess the impact of the new rule on their business. In particular, they should be mindful of the following:

• Entities exporting, reexporting, or transferring (in-country) closed-weight AI models under ECCN 4E091 and/or ECCNs 3A090.a, 4A090.a, and corresponding .z items should assess the applicability of new license requirements to their activities.
• Entities engaged in relevant activities should reevaluate whether they qualify for License Exception ACA and for new License Exceptions AIA, ACM, LPP. If so, they should develop processes to comply with additional obligations under corresponding exceptions.
• Entities relying on License Exception NAC should verify compliance with new information obligations to BIS.
• Entities should ensure internal process controls that prevent outbound transfer of covered items without compliance.
• Data center operators should assess whether they qualify for UVEU or NVEU authorizations.
• VEUs should develop processes to comply with new vetting, recordkeeping, audit, reporting, certification, and security obligations.