How to manage advanced-computing export controls under BIS / EAR

A semiconductor manufacturer in Europe finalises a supply agreement for advanced graphics processing units destined for a data-centre build in a third market. The chips are commercially available. The buyer is a private company with no prior sanctions history. The compliance team clears the file. Three months later, BIS issues a notice: the shipment required a licence that was never applied for. The exposure is real, the penalty basis is substantial, and the voluntary self-disclosure window is already running.

Advanced computing and AI chip controls under BIS / EAR are among the most rapidly evolving areas of US export-control law. Items that were freely exportable under the Export Administration Regulations (EAR, the US Commerce Department's export-control rules administered by the Bureau of Industry and Security, or BIS) may today require a licence or may be subject to outright denial. The classification of a chip, the destination, the end-user, and the end-use all feed into the analysis. Commercial availability does not determine controllability – and that misunderstanding is the single most expensive mistake we see in this sector.

This guide walks through the key steps to manage advanced computing and AI chip controls under BIS / EAR: from initial classification through destination and end-user screening, licence exception review, cross-regime comparison, and escalation to counsel.

Step 1: Establish the correct Export Control Classification Number for the item

The first step in any advanced-computing export-control analysis is to determine the item's Export Control Classification Number (ECCN – a specific code on the Commerce Control List that defines the control reasons and licence requirements for an item). Without the correct ECCN, every subsequent step in the compliance sequence is unreliable.

Advanced computing items – graphics processing units, high-bandwidth memory, application-specific integrated circuits, and the software and technology that enable them – can fall across several ECCNs depending on their performance parameters. The Commerce Control List is organised into ten categories and five product groups, and high-performance computing items typically cluster in Category 3 (electronics) and Category 4 (computers). What matters is where the item's specifications land against the control list parameters.

Self-classification is permissible, but it carries the risk of error. In our experience, manufacturers frequently classify at the top-level product code without examining whether chip-level performance parameters, memory bandwidth, or interconnect speed push the item into a more restrictive classification. BIS does not accept "we relied on the manufacturer's specification sheet" as a defence where that sheet is ambiguous or out of date. A commodity-jurisdiction request or a classification request submitted to BIS is available where the correct ECCN is genuinely uncertain.

One point that compliance teams miss: if the item's ECCN is not on the Commerce Control List at all, it is designated EAR99 (the catch-all category for items subject to the EAR but not specifically listed). EAR99 items are not licence-free to all destinations – they remain subject to end-user and end-use controls, and they require a licence to sanctioned destinations. An EAR99 classification is a starting point, not a clearance.

Step 2: Map the destination, end-user, and end-use against BIS controls

Once the ECCN is confirmed, the next step is to map three variables simultaneously: where the item is going, who will receive it, and what they will do with it. These three variables interact, and a change in any one can change the licence requirement.

Destination matters because the EAR groups countries into country groups that determine both licence requirements and licence-exception eligibility. A country's classification determines whether a given ECCN requires a licence, what grounds apply, and whether any relevant exception is available. As currently in force, verify the current country-group position before relying on it – classifications are amended by regulatory action and the position for advanced-computing items has shifted more than once in recent years.

End-user matters because BIS maintains the Entity List and the Denied Persons List. Dealings with parties on either list require a licence or are prohibited outright, regardless of the item's ECCN or the destination country. The Entity List in particular has expanded significantly in the advanced-computing sector, and entities can be added without prior notice. Screening must be conducted at the time of each transaction, not once at onboarding.

End-use matters because BIS applies military end-use and end-user (MEU) restrictions to specified destinations, as currently in force, verify before reliance. Where a stated civil end-use is implausible given the buyer's sector or scale, or where a commercial data-centre buyer is acquiring chip volumes that exceed any plausible civil deployment, that is a red flag that the stated end-use should be scrutinised. BIS's guidance on red flags is a practical reference for this analysis.

A subsidiary question at this stage is whether a deemed export is involved. A deemed export occurs when controlled technology is released to a foreign person within the United States – through employment, a research collaboration, or remote access to controlled systems. For advanced-computing technology, the deemed-export risk is live for any US-based operation employing non-US nationals in roles that give them access to controlled chip design, architecture, or process technology.

Step 3: Assess licence exception availability before concluding that a licence is required

Before committing to a full licence application, determine whether any BIS licence exception covers the transaction. Licence exceptions exist under the EAR and, where applicable, can authorise a transaction without a separate application – but eligibility is strictly item-, end-use-, and destination-specific.

In the advanced-computing context, the exceptions most frequently considered are those tied to civilian end-use and country-group status. However, the conditions attached to these exceptions for high-performance items have been tightened in recent rule cycles, and an exception that applied to a prior shipment of the same product may not apply today. The correct sequence is to start from the current text of the applicable exception and work through each eligibility condition in order. If a single condition is not met, the exception is unavailable and a licence is required.

Where no exception applies, the options are: apply for a specific licence, restructure the transaction so that it falls within an exception, or decline the transaction. The decision depends on the strength of the licence case, the commercial value, and the timeline – BIS licence review for advanced computing items can run to several months, and approval is not guaranteed. In our practice, we regularly advise clients to conduct this assessment before the transaction is commercially committed, not after.

One further point: even where an exception technically applies, BIS expects exporters to maintain end-use controls – including delivery-verification, post-shipment checks, and written end-user undertakings. Using an exception without the supporting controls is a red flag in an enforcement context.

Step 4: Examine extraterritorial reach – the Foreign Direct Product rules

The EAR's reach extends beyond items that are physically US-origin. The Foreign Direct Product (FDP) rules bring certain foreign-made items within US jurisdiction where those items are the direct product of controlled US technology or software, or where they are produced by a plant or major component that is itself such a direct product.

For the advanced-computing sector, the FDP rules are highly material. The global semiconductor supply chain is deeply integrated with US equipment, software, and intellectual property. A chip designed and fabricated outside the United States may still be subject to the EAR – and may require a BIS licence before it can be exported to a specified destination or end-user – if US-origin equipment or technology was used in its production.

The FDP analysis requires the exporter to trace the production inputs, not merely the item's nominal country of origin. Where US equipment was used in wafer fabrication, or where the chip's design incorporates US-origin electronic design automation software, the FDP analysis must be conducted. BIS has expanded the scope of the FDP rules in successive rule cycles for certain categories of item; as currently in force, verify the applicable FDP rule before relying on a prior analysis. What cleared FDP review eighteen months ago may not clear today.

This is where cross-border transactions between a non-US manufacturer and a non-US buyer can nonetheless attract US jurisdiction. Neither party may have direct dealings with the United States, but the production history of the item may bring it fully within the EAR. We have acted for non-US manufacturers who were unaware of this exposure until a deal was reviewed by US counsel in the buyer's financing bank.

Step 5: Apply cross-regime checks – OFAC, EU dual-use rules, and UK controls

A transaction that clears BIS / EAR review is not automatically clear under other regimes. The advanced computing and AI chip controls analysis under BIS / EAR is a US-law question; OFAC, EU dual-use, and UK export controls are separate and parallel obligations that may catch the same transaction.

OFAC's sanctions programmes operate independently of BIS controls. A chip that does not require a BIS licence may nonetheless be the subject of an OFAC prohibition if the buyer, the jurisdiction, or an intermediate financial institution is within scope of an OFAC programme. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) can catch a buyer that passes initial name-screening. OFAC and BIS are administered by different agencies, apply different legal tests, and are not substitutes for each other.

The EU dual-use regime, as currently in force under the EU Dual-Use Regulation, imposes its own classification and licensing requirements on exports from EU member states. An exporter shipping from an EU subsidiary faces EU licensing requirements that are determined by EU classifications and EU country groupings – not by the EAR. Where the EU classification and the US classification differ, the stricter prohibition governs the exporter's conduct. The same principle applies under the UK export-control regime administered by the ECJU.

In our cross-border practice, we regularly see transactions where one regime is managed carefully and another is overlooked. A common pattern is a European group that manages EU dual-use controls for its EU entities but applies US EAR analysis to the group as a whole, on the assumption that the US analysis is the more stringent. That assumption is unreliable and should be tested for each transaction. For guidance on OFAC obligations that run alongside the BIS / EAR controls addressed here, see our advanced computing OFAC guide, and for the UAE-specific position, our UAE advanced-computing controls guide.

Step 6: Identify the risk flags that require escalation to counsel

Advanced-computing export-control compliance requires escalation to specialist counsel at certain decision points. Proceeding without counsel in the situations set out below materially increases the risk of a violation and, in an enforcement context, undermines the case for mitigation.

Escalate immediately where: the ECCN is uncertain and the item's performance parameters are at or near a control threshold; the destination is subject to MEU restrictions or is a destination for which BIS has applied enhanced scrutiny; the buyer or an upstream or downstream party appears on the Entity List or the Denied Persons List; the transaction involves a re-export or an in-country transfer rather than a direct export; or the FDP analysis is inconclusive because production-input records are incomplete.

Escalate before shipment where: a licence exception is being relied upon without prior legal review; the buyer's stated end-use is inconsistent with its known business or scale; a prior shipment under the same classification is being repeated but the regulatory position has changed since the earlier transaction; or the deal has been structured or re-routed in a way that changes the country of destination from the original commercial terms.

Escalate immediately on discovery of a potential violation. Where a shipment has occurred and compliance review reveals it may have required a licence that was not obtained, the voluntary self-disclosure (VSD – a proactive report to BIS of a potential violation before the agency initiates its own inquiry) option is available and is a recognised mitigating factor in BIS enforcement. The window for VSD is not indefinite, and the decision about whether and how to disclose requires legal advice on the specific facts. Records must be preserved from the moment a potential violation is identified. For a detailed account of how our team structures the BIS classification, licence, and compliance process, see our advanced-computing controls service page.

Is your screening programme checking for FDP exposure, not just name-matching against BIS lists? Does your classification process re-examine items when the regulatory position changes, or does it treat an ECCN as permanent? These are the questions that determine whether an advanced-computing export-control programme is genuinely effective or merely procedurally complete on paper.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.