AI Diffusion Rule Out but BIS Increases Compliance Obligations for Companies

On May 13, 2025, the Department of Commerce’s Bureau of Industry and Security (BIS) announced a recission of the Biden administration’s January 15, 2025 Artificial Intelligence Diffusion Interim Final Rule (“AI Diffusion Rule”) and a decision not to enforce the rule’s compliance requirements that were to be effective May 15, 2025. BIS concurrently issued three new guidance documents relating to integrated circuits (ICs). These actions create a new paradigm that (1) imposes additional diligence requirements on companies to ensure that sensitive AI technologies are not shared with U.S. adversaries and (2) opens up collaboration on AI with countries that otherwise would have faced limitations under the Biden-era rule. BIS announced that it intends to issue a replacement rule, but it is not clear when or what that rule will entail.

Key Takeaways for Companies

1. Going/gone but not forgotten: The AI Diffusion Rule’s framework of regulating advanced ICs by pairing broad license requirements with exceptions subject to complex and onerous compliance requirements is being set aside.
2. Restrictions remain with meaningful enhancement to diligence expectations: Controls on advanced ICs to China, Russia, and certain Middle Eastern countries in effect before the AI Diffusion Rule remain, and BIS has now informed parties that access to covered compute capabilities can be a red flag that must be resolved or for which a license is required.
3. AI model weights: Part of the AI Diffusion Rule being rescinded, BIS has not specifically addressed the status of the controls imposed on advanced AI model weights.
4. BIS asserts broad authority to regulate the use of advanced PRC chips: Based on BIS’s finding that advanced PRC-origin ICs were designed and/or produced with unauthorized access to U.S.-origin software and technology or controlled manufacturing equipment, BIS has informed all persons—in the United States and outside—that the use of these items risks violating of U.S. export controls.

Overview of Now-Rescinded AI Diffusion Rule

The AI Diffusion Rule was developed to inhibit U.S. adversaries from developing advanced AI models. It would have imposed new export controls on certain AI model weights and new restrictions on exports of advanced computing ICs used to train AI models. The rule categorized countries into three tiers, with different levels of restriction for each tier. At the time, critics argued that the AI Diffusion Rule restrictions were too broad, would fail to coalesce market interest in U.S. technology, and would weaken U.S. industry’s market position. These critics feared that in the newly created vacuum, competitors would fill the gaps and achieve the same levels of sophistication as U.S. industry. At least for now, BIS seems to have accepted this critique: the new guidance documents—explained below—narrow restrictions and focus on limiting access to advanced computing ICs for Country Group D:5 countries, including China.

Rescission of the AI Diffusion Rule does not change the other pre-existing export controls on advanced computing ICs, commodities that contain such ICs, and certain semiconductor manufacturing equipment, which have been subject to BIS export restrictions beginning in October 2022 and expanded in October 2023. These controls are aimed at restricting China’s ability to obtain critical technologies that would support military modernization.

BIS’s New Approach: Overview of Recently Released Guidance Documents

While they are not regulations, the guidance documents work together to establish new standards for knowledge of export control evasion and expectations for industry due diligence.

1. The BIS Policy Statement on Controls That May Apply to Advanced Computing Integrated Circuits and Other Commodities Used to Train AI Models (“Policy Statement”) imposes a knowledge requirement on industry—and therefore heightened due diligence expectations—that certain activities relating to AI model training in Country Group D:5 countries may trigger a license requirement.
2. The Guidance on Application of General Prohibition (GP10) to People’s Republic of China (PRC) Advanced-Computing Integrated Circuits (ICs) (“PRC IC Guidance”) confers BIS’s own knowledge onto industry regarding design and development of PRC ICs likely violating the EAR, such as certain Huawei Ascend chips.
3. The Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits (“Industry Guidance”) supports companies adapting to the new knowledge requirement by providing red flags and recommended due diligence actions.

The Policy Statement Establishes Knowledge Requirements and Heightened Due Diligence Expectations

The Policy Statement addresses the concern that U.S. adversaries could use U.S. technologies or be supported by U.S. companies, such as data centers and financial institutions, to train AI models for military-intelligence and weapons of mass destruction (WMD) end uses. The guidance is based on BIS’s determination that exports/transfers to or support of customers located or headquartered in Country Group D:5 countries have the potential to enable military-intelligence or WMD end uses or users covered under Part 744 of the EAR.

With this concern in mind, the Policy Statement imposes a knowledge requirement on exporters and U.S. persons providing “support” (e.g., contract, service, employment) and outlines the consequences of non-compliance. The “catch-all” controls in Part 744 require a license for the export, reexport, or transfer of any item and for U.S. person support for activities where there is “knowledge” that the item or support may be used for military-intelligence or WMD end uses or users. BIS is providing notice that access to advanced computing ICs or commodities subject to the EAR (classified under ECCNs 3A090.a, 4A090.a, and .z items/e.g., servers) or support for training AI models has the potential to enable military-intelligence and WMD end uses in Country Group D:5 countries (including China). A license may be required for export, reexport, or transfer of advanced computing items and support to Infrastructure-as-a-Service (IaaS) or data providers when there is “knowledge” that the item or support will be used for training of AI models for or on behalf or parties in or headquartered in D:5 countries (including China).

Put plainly, first, the exporter or U.S. person would need to assess whether the exported ICs or support provided by a U.S. person would be used to train AI models for or on behalf of a customer located or headquartered in China or other D:5 country. If so, this would be a red flag requiring further diligence and action, and, if ignored, could be sufficient for BIS to bring an enforcement action, given that there was no prior authorization in place. Second, the exporter or U.S. person would need to assess whether there is “knowledge” the AI model will be used for a military-intelligence or WMD end use or user, taking into account the previous red flag. The Policy Statement relies on the EAR definition of “knowledge”: either “positive” (i.e., affirmative) knowledge or an awareness, based on evidence (and not disregarding evidence), that a situation exists, is substantially certain to exist, or has a high probability of existence or occurrence.

BIS Warns Companies of General Prohibition 10 Triggers

The PRC IC Guidance alerts industry that PRC advanced computing ICs with performance parameters described in ECCN 3A090, including but not limited to specific Huawei Ascend chips, are presumed to be subject to General Prohibition 10 (“GP10”) restrictions because BIS believes they were designed or produced in violation of the EAR. General Prohibitions are prohibitions on certain activities that are not allowed without authorization from BIS. GP10 prohibits parties from proceeding with transactions with knowledge that a violation of the EAR has occurred or is about to occur. See 15 C.F.R. 736.2(b)(10).

Because BIS determined that the design or production of a PRC 3A090 IC likely involved one or more violations of the EAR, GP10 is presumed to apply to use of PRC 3A090 ICs. By BIS conferring this knowledge on industry through the PRC IC Guidance, persons and companies in the United States and abroad using such chips without authorization from BIS may be engaging in a GP10 activity and could receive criminal and administrative penalties. To avoid violations, companies using a PRC 3A090 IC without prior authorization from BIS should confirm that their supplier has obtained the necessary authorizations for production and transfer. The guidance makes clear, however, that BIS will not pursue enforcement actions against parties that obtain a PRC 3A090 IC for the purpose of technical assistance or evaluation to determine technical capabilities.

Red Flags and Due Diligence Guidance for Industry to Avoid Harmful IC Diversion

BIS issued the Industry Guidance, on top of existing BIS guidance documents, to assist companies in evaluating whether a party or identified activity may be connected to export control evasion. The Industry Guidance provides specific red flags that could signal export control evasion as well as due diligence questions to uncover potential evasion. While the first two guidance documents identify larger trends and knowledge requirements relating to EAR violations, the Industry Guidance provides more practical support on how to spot such conduct.

Examples of red flags that warrant additional investigation include the following scenarios:

1. A U.S. exporter of advanced computing ICs receives a request from a customer that never received such exports prior to October 2022.
2. A customer’s ultimate delivery address is unknown and you are unable to determine whether the headquarters or parent company is located in a Country Group D:5 (including China).
3. The customer is co-located with or has a similar address to one of the companies on the Consolidated Screening List.

The Industry Guidance also includes due diligence actions and best practices that companies should use for new customers and IaaS providers, regardless of location. Companies should strongly consider incorporating items from the Industry Guidance into their compliance programs, including but not limited to:

1. Evaluating customer’s ownership structure to determine if parties are headquartered or have ultimate parent headquartered in a destination specified in Country Group D:5 (including China).
2. Conducting site visits to data center customers or using independent third-party verified certified auditors.
3. Requiring detailed due diligence customer certifications or end-use statements.

BIS emphasizes that a lack of due diligence and the existence of red flags could be considered an aggravating factor in the case of enforcement actions.

Looking Forward

Some issues raised by the rescission of the AI Diffusion Rule remain unanswered. For example, there is no indication whether the AI Diffusion Rule controls on AI model weights will be abandoned or if those controls will return in another form. In the coming weeks and months, we may see a replacement rule, though BIS has indicated that it will move away from long periods of public comments and skip to Interim Final or Final Rules, shortening the time for clients to assess and adapt to the shifting landscape.

Additionally, we expect the Trump administration’s interest in supporting the global growth of the American AI industry to continue to shape IC export control policy. Several media outlets have noted the timing of the rescission coinciding with President Trump’s visit to the United Arab Emirates (UAE) and the announcement of a U.S.-UAE partnership to build a 5GW AI campus, reportedly involving the export of hundreds of thousands of advanced ICs.

Paralegal Anabelle Lubin in the Washington, D.C. office also contributed to this article.

[View source.]