OFAC vs Canada: Advanced computing and AI chip controls compared

A technology exporter prepares a shipment of advanced graphics processing units to a Canadian distributor. The exporter's counsel confirms the transaction clears US export controls. The Canadian buyer, however, ships a portion onward to a third-country customer. Suddenly, two regimes are simultaneously engaged – and they do not ask the same questions. Which authority governs? What does each require? And who bears liability when the rules diverge?

Advanced computing and AI chip controls under OFAC and under Canada's export-control regime share a common policy objective – restricting access to technology with strategic military and intelligence applications – but they operate through different legal instruments, different classification systems, and different thresholds. The US regime, administered principally by the Bureau of Industry and Security under the Export Administration Regulations, applies extraterritorially through the Foreign Direct Product rules (rules that bring foreign-produced items within US jurisdiction where they are the direct product of controlled US technology or software). Canada's regime, administered by Global Affairs Canada under the Export and Import Permits Act, is territorial in primary application but intersects with US controls wherever Canadian exporters handle US-origin content. A business operating across this border faces both simultaneously, and the stricter prohibition governs.

This analysis maps the two regimes criterion by criterion – classification, scope, ownership thresholds, end-use controls, extraterritorial reach, and enforcement posture – and closes with the practical risk flags that counsel encounters most often in cross-border advanced-computing transactions.

How does each regime classify advanced computing items?

Classification is the first divergence. Under the US Export Administration Regulations, an advanced computing item is assigned an Export Control Classification Number (ECCN – the numeric-alphanumeric code on the Commerce Control List that determines licence requirements and available exceptions) based on its technical parameters: processing performance, interconnect bandwidth, memory hierarchy, and precision. Items that do not appear on the Commerce Control List fall into EAR99 (the residual designation for items subject to the EAR but not controlled by a specific ECCN), but advanced processors with strategic capability characteristics will typically carry a non-EAR99 classification. The Commerce Control List is organised into ten categories and five product groups, and computing hardware and software appears primarily in Category 3 (electronics) and Category 4 (computers). Classification is the exporter's responsibility; it is not a one-time exercise.

Canada operates the Export Control List under the Export and Import Permits Act. The Export Control List incorporates the Wassenaar Arrangement's dual-use goods and technologies list, and advanced computing items controlled under Wassenaar are also controlled for Canadian export purposes. In this respect the two regimes converge at the international-arrangement level. A chip that the Wassenaar participating states have agreed to control will appear on both the US Commerce Control List and the Canadian Export Control List.

The practical divergence arrives at the margin. US controls on advanced computing have been updated at a pace that outstruns Wassenaar consensus. Performance parameters for graphics processors and AI accelerators have been tightened by BIS on a timeline that Canada's domestic list updates have not always matched in real time. A chip that clears the Canadian Export Control List at a given date may still require a US licence or be subject to a presumption of denial if it meets US-defined thresholds – particularly where the Foreign Direct Product rules bring Canadian-manufactured or Canadian-held items within US jurisdiction because of their US-content heritage.

This gap is the most common classification trap we see. An exporter who classifies by the Canadian list alone, without checking whether US-origin content triggers independent EAR jurisdiction, is leaving open a significant enforcement exposure.

What are the governing authorities and legal instruments?

The US regime for advanced computing is administered by BIS under the EAR, with authority derived from the Export Control Reform Act and, in the context of foreign-policy controls, from IEEPA. OFAC does not administer the item-classification regime itself – that is BIS's domain – but OFAC's list-based prohibitions layer on top of the EAR where a counterparty or end-user is designated. In practice, an advanced computing transaction can trigger both BIS review (for the item and its classification) and OFAC screening (for the buyer, the ultimate consignee, and all intermediate parties). The two agencies coordinate, but they operate different authorities and different consequence frameworks.

Canada's regime runs under the Export and Import Permits Act, with Global Affairs Canada (GAC) as the competent authority for export permit issuance and enforcement. For financial-sanctions overlays, the Office of the Superintendent of Financial Institutions and the RCMP have separate roles – but the export-permit function itself sits with GAC. Canada also implements UN Security Council measures directly, so where a destination is subject to UNSC controls, the Canadian prohibition is independently grounded in domestic implementing legislation rather than borrowed from a US source.

The institutional divergence matters for licence applications. A US-side BIS specific-licence application is made to a different authority, under a different procedural framework, with different interagency referral dynamics, than a Canadian export-permit application to GAC. We regularly advise clients who assume that a single application resolves both. It does not. Where both regimes apply, both application processes must run – and they have different information requirements, different timelines, and potentially different outcomes.

How do the extraterritorial reach and Foreign Direct Product rules compare?

The most significant structural asymmetry between the US and Canadian regimes is extraterritorial reach. The EAR can apply to re-exports and to foreign-produced items that are the direct product of controlled US technology or software – this is the mechanism known as the Foreign Direct Product rules. Where a Canadian manufacturer incorporates controlled US software or technology into an advanced computing product, the resulting item may itself be subject to EAR jurisdiction, regardless of the fact that it was manufactured in Canada and is being exported from Canada by a Canadian entity.

Canada's regime does not contain an equivalent extraterritorial mechanism of this scope. Canadian export controls apply to exports from Canadian territory and, in specific circumstances defined in the legislation, to re-exports by Canadian persons. Canada does not claim jurisdiction over a third-country item simply because it was produced using Canadian technology. This is a fundamental difference in regulatory philosophy: the US model follows the technology; the Canadian model, in its primary application, follows the territory and the person.

For a Canadian exporter handling US-origin chips or advanced computing hardware produced with US technology, the practical consequence is this: the exporter may require a Canadian export permit for the transaction, and simultaneously be subject to US EAR requirements as a re-exporter – even though the transaction originates and concludes entirely within Canada's trade relationship with the destination country. This dual exposure is not theoretical. It arises regularly in the context of sales to destinations where the US maintains an elevated licence requirement or a presumption of denial.

As currently in force and subject to verification, BIS has extended the Foreign Direct Product rules to cover items produced at facilities that use controlled US equipment, not only items that are the direct output of controlled US software. That extension broadens the perimeter of US jurisdiction over non-US manufactured advanced computing products and is a material consideration for Canadian manufacturers whose fabrication lines include US-origin equipment.

Where do ownership, end-use controls, and entity-list restrictions diverge?

Both regimes maintain end-user and end-use controls for advanced computing, but the structure, the listed entities, and the consequence framework differ in important ways. Under the EAR, BIS maintains the Entity List (a list of foreign persons subject to specific licence requirements because of their conduct or risk profile) and the Denied Persons List (persons with whom US exporters may not transact). A transaction with an Entity List party requires a BIS licence even if the item would otherwise be eligible for a licence exception. Military end-use and end-user restrictions add a further layer, with additional requirements for specified destinations regardless of the item's ECCN.

Canada does not maintain a domestic entity list of equivalent structure. Canadian export controls focus on the item, the destination, and the permit requirement; the end-user control framework operates primarily through permit conditions and through the implementation of UNSC-mandated measures. For destinations subject to UNSC restrictions, Canadian controls align with those measures. For destinations not subject to UNSC restrictions but subject to US BIS Entity List coverage, Canada has no independent domestic equivalent that would impose a licence requirement on the same transaction.

This divergence creates a compliance gap for Canadian exporters who screen only against Canadian lists. An entity that appears on the BIS Entity List but not on any Canadian list is not a Canadian-law problem – until the transaction involves US-origin content, in which case the EAR applies independently and the entity-list restriction bites. In our experience, the assumption that "we have no Canadian obligation for this party" too easily becomes a failure to check the US-side obligation that runs in parallel.

On the ownership question, the US rules treat entities owned 50 percent or more, directly or indirectly in the aggregate, by a blocked or listed person as themselves subject to restriction. This aggregation principle applies across OFAC's prohibitions and, under BIS guidance, to assessments of whether a foreign buyer is effectively controlled by a restricted party. Canada's framework does not apply the same mechanical ownership threshold in its export-control context. The Canadian assessment of an end-user's risk profile is more discretionary and less codified around a single numeric trigger.

How do the regimes handle deemed exports and technology transfer?

A deemed export occurs when controlled technology is released to a foreign national within the exporting country, without the item physically crossing a border – the release itself is treated as an export to that person's country of nationality. Under the EAR, deemed exports apply to controlled technology and software and are a live issue in research, development, and cloud-computing environments where advanced computing technology is accessed remotely or shared with foreign nationals on US soil.

This is not a theoretical exposure for Canadian businesses with US operations. A Canadian company running an AI development programme at a US facility, employing staff with nationalities from controlled destinations, faces deemed-export analysis for any controlled technology those staff access. The analysis covers the technology's ECCN, the destination country implied by the nationality, and the applicable licence requirements or exceptions. Remote access from outside the US to controlled technology held on US servers raises the same issue in reverse: it is a deemed re-export.

Canada's Export and Import Permits Act contains a concept of intangible technology transfer, but its scope and the conditions that trigger a permit requirement differ from the EAR's deemed-export analysis in both the triggering criteria and the nationality-of-recipient rule. Canadian compliance counsel and US compliance counsel may therefore reach different conclusions on the same set of facts. When both regimes apply, both analyses must be run, and neither replaces the other.

What does this mean in practice? A US-Canadian joint research programme on AI accelerators must map out: which technologies are shared; the nationality of personnel with access; whether the technology is EAR-controlled and, if so, at what ECCN; and whether any of those nationalities imply a destination subject to heightened US controls. That analysis belongs at the programme-design stage, not after the first personnel rotation.

What are the principal risk flags in cross-border advanced computing transactions?

Classification gaps are the most common risk flag. As noted above, the US Commerce Control List for advanced computing has moved faster than Wassenaar consensus timelines. A Canadian exporter who last verified an ECCN classification more than six months ago may be working with a stale analysis. Performance thresholds for AI accelerators have been revised, and items that previously cleared specific licence exceptions may no longer qualify. This is not a static risk: it requires a classification review at the point of each transaction, not at the point of product launch.

A second risk flag is the end-use red flag. Both regimes impose obligations on exporters who know or have reason to know that an item will be used for a prohibited purpose. Under the EAR, the "reason to know" standard is objective and is assessed by reference to the specific red flags identified in BIS guidance: the buyer is reluctant to identify end uses, the order quantity is inconsistent with the buyer's stated purpose, or the item is destined for a region with a pattern of diversion. Canada's export-permit regime similarly requires the exporter to assess the risk of diversion or misuse. A sharp change in trade flows to a neighbouring or transit jurisdiction is treated as a diversion red flag under both frameworks.

Transit and re-export risk is a third flag. A chip exported from the US to Canada for legitimate Canadian use does not require a US re-export licence for its Canadian use. But the same chip, subsequently re-exported from Canada to a third-country destination, requires an EAR analysis of whether a re-export licence is needed. The exporter who sold the chip to Canada bears no liability for the Canadian buyer's subsequent re-export – unless the US exporter had reason to know of the intended onward movement at the time of the original export. That caveat does real work. Where a buyer's purchasing pattern or contractual arrangements imply onward shipment, the original exporter's exposure survives the border crossing.

A fourth risk flag is record-keeping. Under the EAR, export records must be kept for five years. Canadian permit records carry their own retention requirement. Where both regimes apply to the same transaction, both sets of records must be maintained to each regime's standard. A compliance programme that retains only the Canadian permit documentation and discards the US-side classification records will fail an EAR audit, even if it would pass a Canadian inspection.

Finally: the myth that commercial items are uncontrolled. We encounter this regularly. The audience myth – that a commercially available chip cannot be controlled – is incorrect. Commercial availability is one factor in dual-use and export-control analysis, but it does not override an ECCN classification or a BIS-imposed licence requirement. Many of the most strategically sensitive advanced computing chips are commercially available at scale. They are also controlled, licensed, and subject to end-use restrictions. Commercial availability and legal controllability are independent questions.

What practical steps should a cross-border business take now?

The starting point is a classification audit. Every advanced computing item in the product portfolio – chip, board, module, system, and associated technology and software – should be assigned an ECCN under the EAR and a classification under the Canadian Export Control List. Where the item contains US-origin content, the Foreign Direct Product analysis should be run to determine whether Canadian-manufactured products incorporating that content are independently subject to EAR jurisdiction. This classification should be treated as a living document, not a one-time exercise.

The second step is an end-user and end-use mapping. For each principal distribution channel and customer type, the analysis should identify: whether any party is on the BIS Entity List, the OFAC SDN List, or the Canadian lists; whether the destination country implies a licence requirement or a presumption of denial under US controls; and whether any transaction pattern suggests the possibility of diversion. Where a Canadian distributor sells onward to markets that carry elevated US-control requirements, the supply contract should address the re-export obligation expressly.

Third, the deemed-export exposure should be assessed for any cross-border research, development, or cloud-computing operation. The nationality of personnel with access to controlled technology, the location of the servers on which that technology is held, and the means of access all feed the analysis. Gaps identified here should inform a correction to the access-control architecture, not simply a notation in a risk register.

Fourth, licence exceptions should be reviewed for continued eligibility. BIS licence exceptions are item-, end-use-, and destination-specific, and the conditions for many advanced computing exceptions have been revised in recent periods. An exception that applied at the time of a previous shipment may no longer be available for the same item to the same destination if either the item's classification parameters or the destination's country-group assignment has changed.

Fifth, voluntary self-disclosure protocols should be established before a potential violation is identified, not after. Voluntary self-disclosure (VSD – the practice of proactively reporting a potential violation to BIS or OFAC before the regulator discovers it) is a recognised mitigating factor under OFAC's Enforcement Guidelines. BIS has a separate VSD process with its own procedural steps. Having a pre-approved internal protocol for VSD decisions – who decides, on what timescale, with what legal privilege protections – shortens response time materially. In our cross-border practice, the businesses that handle enforcement exposure best are those that have thought through the VSD question before it becomes urgent.

The position above covers the standard analytical case. Your specific facts – the item, the destination, the ownership structure of the buyer, the content heritage of the product, and the current state of each regime's classification parameters – change the analysis, sometimes materially. An early review can preserve licensing options and compliance defences that narrow with time.

Related practices

• Advanced computing controls – BIS/EAR service – classification, licence applications, and end-use compliance for US-controlled computing items
• OFAC vs OFSI: advanced computing controls compared – regime-by-regime analysis of the UK and US positions
• Anti-circumvention: EU vs BIS/EAR – how third-country transit risk is addressed across the two regimes

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.