BIS announces rescission of Biden-Era AI Diffusion Rule and issues new AI policy and guidance

On Monday, May 12, 2025, Commerce initiated a rescission of the Biden Administration’s “Framework for Artificial Intelligence (AI) Diffusion” Interim Final Rule (the AI Diffusion Rule), originally published on January 13, 2025.  The Bureau of Industry and Security (BIS) intends to publish a Federal Register Notice formalizing the rescission and addressing the issuance of a replacement rule in the near future.  In the interim, the Under Secretary of Commerce for Industry and Security, Jeffrey Kessler, instructed BIS enforcement officials to refrain from enforcing the AI Diffusion Rule.  BIS also issued the following guidance and policy statement instructing industry as to the scope of certain activities that may be subject to specific export authorization requirements following the rescission of the AI Diffusion Rule and compliance expectations: 

• Guidance on Application of General Prohibition 10 (GP 10) to People’s Republic of China (China) Advanced-Computing Integrated Circuits (ICs) (GP 10 Guidance).  This guidance indicates that all persons face compliance risks when engaging in activities involving certain Huawei GPUs and that such risks likely exist for other advanced ICs developed in China.
• Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits (Diversion Guidance).  This guidance will require companies in the advanced IC industry to update their compliance procedures to account for new red flags and due diligence requirements.  
• BIS Policy Statement on Controls that May Apply to Advanced Computing Integrated Circuits and Other Commodities Used to Train AI Models (BIS Policy Statement).  This guidance emphasizes end-use licensing requirements that could apply to a wide range of transactions when ICs may be used for or on behalf of parties headquartered in D:5 countries.

For context, the AI Diffusion Rule revised the EAR controls on advanced computing ICs and incorporated a new export control on AI model weights for certain advanced closed-weight dual-use AI models.  BIS also added new license exceptions and updated the Data Center Validated End User (VEU”) authorization to facilitate the export, reexport, and transfer (in-country) of advanced computing ICs to end users in countries that do not raise foreign policy or national security concerns.  The AI Diffusion Rule aimed to establish a highly regulated global environment for the diffusion and use of AI model weights and advanced computing ICs to mitigate risks to U.S. national security.    The AI Diffusion Rule had a compliance effective date of May 15, 2025.

BIS guidance regarding advanced computing integrated circuits

On May 13, 2025, BIS released guidance informing industry that the purchase, transfer, use or other activities specified in General Prohibition 10 in relation to Export Control Classification Number (ECCN) 3A090 ICs designed by companies located in, headquartered in, or with an ultimate parent company headquartered in China are considered a violation of GP 10 unless an export license from BIS is obtained or parties confirm with the fabricators or vendors that a license was obtained for the original production and related transfers of the chips.  This creates risks for both U.S. and non-U.S. companies.  

Specifically, the GP 10 Guidance states that the Graphics Processing Units (GPUs), or other chips that have been designed by companies located, headquartered, or with an ultimate parent company headquartered in China (collectively, “PRC 3A090 ICs”) are likely to have been developed with technology or items obtained in violation of the EAR.   BIS therefore considers  engaging in the sale, transfer, export, reexport, financing, ordering, purchase, removal, concealing, storage, use, loan, disposal of, transportation of, forwarding of, or other service of any PRC 3A090 ICs by any company as resulting in a likely violation of GP 10, which prohibits engaging in such activities with knowledge that a violation of the EAR has occurred.  The GP 10 Guidance indicates that “there is a high probability that a BIS authorization was required for the export, reexport, transfer (in-country), or export from abroad of any PRC 3A090 IC or related technology,” but there is a subset of PRC 3A090 ICs that are “presumptively subject to GP 10 restrictions.”    Engaging in transactions involving PRC 3A090 ICs without authorization from BIS can thus result in BIS enforcement actions, including substantial criminal and administrative penalties.  PRC 3A090 ICs that are presumptively subject to GP 10 restrictions include, but are not limited to, Huawei’s Ascend 910B, Ascend 910C, and Ascend 910D chips, which are specifically identified in the GP 10 Guidance.  The guidance specifically states that the list of ICs that are presumptively subject to GP 10 restrictions is “not exhaustive” so BIS may expand this list in the future.

The guidance also states that the use of ICs meeting the parameters for control under ECCN 3A090 that have been developed or produced by companies located in, headquartered in, or whose ultimate parent company is headquartered in other countries in Country Group D:5¹, including China or Macau, without BIS authorization, may also violate GP 10.   

BIS guidance preventing diversion of advanced computing ICs

Also on May 13, 2025, BIS issued industry guidance to support due diligence efforts to prevent the diversion of advanced computing ICs.    The Diversion Guidance includes a non-exhaustive list of new transactional and behavioral red flags, specific to advanced computing ICs, in addition to recommended due diligence actions to increase companies’ awareness of illegal diversion schemes involving advanced computing ICs, namely those related to the “enabl[ing] [of] military-intelligence and weapons of mass destruction (WMD) end uses.”  Examples of these red flags include the following: 

• “The customer (domestic or foreign) never received exports of advanced computing ICs and/or commodities that contain such ICs (i.e., items that meet or exceed the parameters in ECCNs 3A090.a, 4A090.a, or associated .z ECCNs such as 5A992.z) prior to October 2022. 
• The customer received exports involving advanced computing ICs and/or commodities that contain such ICs prior to October 2022, but also saw a significant increase in exports thereafter.
• A domestic or foreign customer has a residential address and provides no alternative location where the advanced computing ICs and/or commodities that contain such ICs will be used. This red flag applies only where the quantity of advanced computing ICs is inconsistent with its individual/personal use.”

Examples of the recommended due diligence actions include the following:

• “Evaluate the customer’s date of incorporation (e.g., incorporation after October 2022).
• Evaluate the customer’s ownership structure to determine if parties are headquartered or have an ultimate parent headquartered in a destination specified in Country Group D:5 (including China) or Macau. 
• Evaluate the end user and end use of the item (e.g., whether the customer’s line of business is consistent with the ordered items).
• Before engaging in business with domestic or foreign customers, notify potential customers that your items are subject to the EAR and would require a license if exported, reexported, or transferred (in-country) to or within destinations specified in Country Group D:1, D:4, or D:5 (excluding destinations also specified in A:5 or A:6).”

Companies will need to promptly take steps to update their compliance procedures to address these red flags and to confirm that their transaction-specific due diligence procedures are consistent with regulatory requirements and BIS expectations.

BIS export controls policy statement

The BIS Policy Statement, also issued on May 13, 2025, confirmed that the following types of activities may now be subject to an export authorization and trigger a license requirement under the catch-all controls of part 744 of the EAR when there is “knowledge” (including actual and constructive knowledge) that the AI model in question will be used for a WMD or military-intelligence end use-user:

• “Exports, reexports, or transfers (in-country) of advanced computing ICs and commodities subject to the EAR to any party, such as foreign Infrastructure as a Service (IaaS) providers (e.g., data center providers), when the exporter, reexporter, or transferor has ‘knowledge’ that the IaaS provider will use these items to conduct training of AI models for or on behalf of parties headquartered in D:5 countries (including China) or Macau.
• Transfers (in-country), defined as a change in end use or end user, of advanced computing ICs and commodities subject to the EAR already in the possession of parties such as IaaS providers, if there is ‘knowledge’ that the items will be used by the transferee to train AI models for or on behalf of parties headquartered in D:5 countries (including China) or Macau. 
• A ‘U.S. person’ provides any ‘support’ or performs any contract, service, or employment, when there is ‘knowledge’ such activity will be used for or may assist the training of AI models for or on behalf of parties headquartered in D:5 countries (including China) or Macau.”

Failing to acquire a license to participate in the activities listed above can lead to potential civil or criminal penalties, and “foreign parties acting contrary to U.S. national security and foreign policy interests, including by training AI models that could support WMD or military-intelligence end uses for or on behalf of parties headquartered in Country Group D:5 (including China) or Macau, may be added to the Entity List, even where no violation of the EAR occurs.”