Advanced computing and AI chip controls across regimes: in practice

A technology exporter operating across the United States, the European Union, and a third-country distribution hub begins shipping advanced graphics processors to a systems integrator. The items are commercial-off-the-shelf components. The compliance team classifies them as EAR99 – the residual category for items subject to the Export Administration Regulations but not listed on the Commerce Control List. Six months later, a routine audit surfaces a different picture. The processors exceed performance thresholds that trigger a specific Export Control Classification Number. Shipments have already moved. The exporter now faces the question that defines the matter: what is the exposure, and what must happen next?

Advanced computing and AI chip controls apply across multiple regimes simultaneously – principally the US EAR administered by BIS, but also EU dual-use rules and the export-control instruments of re-export jurisdictions. A mis-classification under one regime does not confine the risk to that regime alone. Where foreign direct product rules or re-export controls apply, the same items may be subject to licence requirements in several jurisdictions at once. This case comment walks one anonymised cross-border matter from the triggering facts through the legal analysis and the steps taken to address the position.

The sections below cover the situation as it presented, the governing regimes and the tests that applied, the cross-regime interaction that complicated the analysis, the options the business considered, the route it took, and the lessons that carry across to similar businesses.

The situation as it presented

The exporter had applied an EAR99 classification to a line of processors marketed for commercial AI inference workloads. That classification rested on a product datasheet from two product generations earlier. The current generation had materially higher aggregate performance. When the compliance team mapped current specifications against the Commerce Control List, the items fell within a controlled ECCN category. The classification had been incorrect for at least two product cycles.

Distribution ran through a hub entity in a third country. From there, the systems integrator – the end-customer – had moved units to a fourth jurisdiction. Neither the hub nor the exporter had assessed whether the foreign direct product rules brought the hub's re-exports within US jurisdiction. They did. A foreign-produced item that is the direct product of controlled US technology or software is, under the EAR, subject to US jurisdiction regardless of where it is made or where it travels. The exporter's domestic US counsel confirmed the rule's reach when the matter came to light.

The EU entity in the group had separately shipped evaluation samples to a research partner. EU dual-use controls applied to a subset of those samples on account of their specifications. No licence had been obtained. That was a distinct violation, under a distinct instrument, administered by a distinct authority – but it involved the same underlying items and substantially the same corporate group.

Three separate exposure threads had to be managed in parallel. In our experience, this is the configuration that most tests an in-house compliance function: not a single incident, but a cluster of related exposures across regimes with different timelines, different disclosure mechanics, and different enforcement postures.

Which regimes applied and what each required

The core US position was that the items required a licence for export and re-export to the end destination, which fell in a country group for which a licence exception was not available in the relevant controlled category. BIS administers the EAR under the Export Control Reform Act. Classification determines the applicable licence requirements; an incorrect classification does not change those requirements retroactively – it simply means they were not met.

BIS maintains the Entity List (a list of parties for whom additional licence requirements apply) and the Denied Persons List. Neither the hub nor the end-customer appeared on either list, which narrowed but did not eliminate the exposure. The absence of a list hit meant there was no separate dealing-with-a-listed-party violation on top of the mis-classification. That distinction mattered when quantifying the overall position.

The foreign direct product rules brought the hub's re-exports within scope. A deemed export – the release of controlled technology to a foreign person inside the United States – was not at issue here, but the group's engineering team had provided remote configuration support across national borders. The question of whether that support transferred controlled technology was assessed and, on the specific facts, the analysis was defensible. Remote access to controlled technology, however, can itself constitute a deemed export, and that question must be evaluated on each set of facts.

The EU position was governed by the recast dual-use regulation that applies across the EU, which controls a defined list of goods, software, and technology. For the evaluation samples, the applicable controls required an export authorisation. No general authorisation covered the destination and end-use combination. The EU member state licensing authority was the competent body. Each member state authority has its own procedures; this mattered because the EU entity was incorporated in a jurisdiction whose authority required notification of apparent past breaches as a precondition for receiving a new application. That notification obligation ran on a short statutory window.

The interaction between regimes also turned on the re-export controls that the hub jurisdiction maintained under its own national instrument. Transit through a third country does not change an item's controlled status under the EAR, and a number of third-country regimes have adopted parallel controls for items of US origin or content. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both; they cannot be netted against each other.

The cross-border complication: why the analysis was not simply additive

The temptation in a multi-regime matter is to treat each jurisdiction's exposure as a separate column and sum the totals. That is the wrong approach. The interaction between regimes creates analytical dependencies that can change the overall risk picture in either direction – sometimes reducing it, sometimes compounding it.

In this matter, the US voluntary self-disclosure process under BIS has its own mechanics and timeline that are distinct from the EU notification process. A disclosure made to BIS does not constitute a disclosure to an EU member state authority. Conversely, a disclosure to the EU authority does not insulate the business from a BIS inquiry. Both processes had to be managed on their own terms, with their own evidentiary packages and their own factual narratives – which had to be consistent without being identical copies.

The hub jurisdiction's national authority was at an earlier stage of enforcement development than BIS or the EU authority. Its disclosure and penalty framework was less codified. In our practice, operating in a less codified environment requires more careful calibration of what a disclosure document should contain and how the authority is likely to respond, precisely because the framework offers fewer procedural anchors.

A further complication was the group's US parent. Facilitation by US persons of transactions that would be prohibited if done directly by them is itself prohibited under the EAR. The parent's involvement in the group's commercial decisions was reviewed to establish whether any facilitation exposure had accrued. This analysis was conducted separately from the export-classification question because the legal tests are different. The factual record on internal communications – specifically on who knew the classification was under review and when – was a significant focus.

One question that arose at this stage: had the group's board been informed of the classification uncertainty at any point, even in general terms? The answer affected the assessment of good faith and the strength of any voluntary self-disclosure. This is the kind of internal factual question that a compliance counsel needs to press before any external communication is prepared.

Options considered and the route taken

The business had three broad options at the point the matter was fully scoped. First, it could make a prompt voluntary self-disclosure to BIS and follow equivalent procedures in the relevant EU and hub-country jurisdictions. Second, it could commission a further internal review before making any disclosure, on the basis that the full scope of the violation was not yet sufficiently defined. Third, it could wait and assess whether the violation was likely to come to the attention of the authorities through other means before deciding.

The third option was not a viable one. A diversion red flag – in this case, a sharp change in the volume of items moving through the hub to the fourth jurisdiction over a short period – was visible in trade data that BIS and equivalent authorities monitor. The view taken was that passivity would not reduce the exposure and could worsen it materially. Voluntary self-disclosure (VSD) is a recognised mitigating factor in OFAC's enforcement framework; BIS maintains equivalent provisions, and VSD is consistently treated as a mitigating factor across the major regimes.

The second option – further internal review before disclosure – had merit in principle. A disclosure made on incomplete facts can be more damaging than one made on complete facts. The judgment was that the core facts were sufficiently established to support a credible disclosure, and that a meaningful further delay would reduce the weight of the "prompt" characteristic that mitigating provisions attach to VSD.

The route chosen was coordinated voluntary disclosure across the three jurisdictions, with the disclosures sequenced to manage the risk of inconsistent factual positions. The BIS disclosure was prepared first because the US framework is the most developed and the factual narrative it required was the most demanding. The EU member state disclosure followed, adapted to the specific procedural requirements of that authority. The hub-jurisdiction notification was prepared last, at a lower level of detail appropriate to the authority's current practice.

A licence application for the ongoing commercial relationship was prepared in parallel. Where the exporter wished to continue supplying the systems integrator, a licence application for the controlled category and the specific end-use was required. Eligibility had to be assessed against current BIS policy for the applicable country group and the particular performance tier of the items. Licence applications in this area are assessed on a case-by-case basis; the application was structured around the specific end-use representations available from the integrator and the verification measures the exporter was prepared to commit to.

What made the position worse – and what would have changed it earlier

Several factors compounded the exposure beyond what the base violation would have produced. Understanding them is the direct application of this matter's facts to your own risk assessment.

The classification had not been reviewed when the product generation changed. A classification derived from an earlier product's datasheet does not carry forward automatically to a successor product. This is not a subtle or contested point. It is a stated obligation of the EAR that the exporter is responsible for the correct classification of its own items. The myth that a commercial-off-the-shelf processor cannot be controlled is one of the most persistent misconceptions in the sector. Commercial availability does not determine controlled status. Performance thresholds, architecture, and the specific Commerce Control List category are what determine it.

The group had no systematic process for re-classifying items on a product-generation trigger. Classification reviews were conducted ad hoc, not on a defined lifecycle tied to product development milestones. In our experience, the absence of a classification-review trigger is the single most common structural failure we see in technology exporters' compliance programmes. A well-designed programme ties re-classification to the product release cycle, not to an audit finding.

The hub entity had been treated as outside the compliance programme's scope because it was a distribution-only entity. Distribution entities are not outside the EAR's reach where foreign direct product rules apply or where they are the conduit for re-export. Treating a hub as a pass-through that inherits compliance from the originating exporter is incorrect. The hub had its own obligations and its own exposure.

Earlier involvement of export-control counsel at the product-generation stage would have identified the classification question before shipments began. The cost of a classification review and a licence application at that stage is substantially lower than the cost of a multi-jurisdiction VSD process, a licence application for an established flow, and the internal review work required to scope the matter. The calculus is straightforward.

How this matter compares across regimes: divergences that mattered

The three regimes at play in this matter – the US EAR, the EU dual-use regulation, and the hub-country national instrument – share a common structural architecture: a control list, a licence requirement for items and destinations within scope, exceptions or general authorisations for defined cases, and an enforcement mechanism. The structural similarity can obscure significant operational divergences.

The US framework is the most extraterritorial in reach. Foreign direct product rules are a US construct with no direct equivalent in the EU dual-use regulation. The EU regulation controls exports from EU territory and re-exports of EU-origin goods; it does not purport to follow items on account of the technology used to produce them in the way that the FDP rules do. A jurisdiction-by-jurisdiction analysis cannot assume that the EU and US controls are co-extensive.

The penalty frameworks differ in character. The US framework operates on a per-violation basis; where multiple unlicensed shipments have occurred, each shipment may constitute a separate count. The EU framework, as transposed by member states under the applicable EU directive, generally operates on a turnover-based or fixed-scale basis for corporate penalties. The comparison is not straightforward because the transposition across member states has proceeded at different speeds and with different results. As of January 2026, transposition was still incomplete in a number of member states, and the position varied materially depending on which authority was competent.

Disclosure mechanics also diverge. The BIS voluntary self-disclosure process is well-documented and involves a specific submission to a specific part of the agency. The EU member state process varied; in the relevant jurisdiction it involved a notification to the licensing authority rather than a separate enforcement team. The hub-country process had no formal VSD mechanism; the approach taken was to make a proactive notification to the authority using the format it accepted for voluntary compliance communications.

Japan, Singapore, and Australia each maintain national export-control instruments. Where items of US origin or embodying controlled US technology move through these jurisdictions, the national controls apply in parallel. In the present matter, the hub jurisdiction's national control regime had been aligned with its principal trading partners' control lists, which meant the affected items were controlled there too. This alignment is not universal; a jurisdiction-by-jurisdiction assessment is required before assuming that a third country's controls mirror US or EU classifications.

Lessons for similar businesses

Three operational lessons emerge from this matter that apply directly to any exporter of advanced computing items across multiple jurisdictions.

The first is classification discipline on a product-generation trigger. Every time a product generation changes – whether in architecture, performance specification, or primary use case – the classification must be re-assessed from first principles against the current Commerce Control List and the EU dual-use list. The previous generation's ECCN does not carry forward. A compliance programme that does not build this re-assessment into the product release cycle has a structural gap that will eventually produce a violation. The question is not whether, but when.

The second is that distribution entities within the group are within scope. A hub or regional distributor that takes title to controlled items and re-exports them has its own obligations under the EAR's re-export rules and under whatever national instrument applies in its jurisdiction. Foreign direct product rules can extend US jurisdiction to items re-exported by the hub, regardless of where those items were manufactured. Compliance programmes must map the full distribution chain, not only the point of first export.

The third is that the cost of early engagement with export-control counsel is substantially lower than the cost of a multi-jurisdiction remediation exercise. This is not a marketing observation. It is an arithmetic one. A classification review at the product development stage, a licence application for a new commercial route, and a pre-transaction assessment of foreign direct product rule exposure each carry a defined, manageable cost. The cost of a multi-jurisdiction VSD process, a coordinated disclosure timeline, internal document review, and a retroactive licence application is a multiple of that figure. The calculus favours early engagement, and it favours it materially.

For an assessment of your classification position, your re-export exposure, or a disclosure process under BIS or an EU member state authority, contact Calder & Vance at info@caldervance.com. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes.

Related practices

• Advanced computing controls – BIS and EAR service – counsel on classification, licensing, and compliance for advanced computing items under the EAR
• Cloud and remote access controls – Australia matter – how deemed-export and remote-access questions arose in a related cross-border matter
• Advanced computing controls – BIS and EAR guide – a step-by-step guide to classification, licence requirements, and exception eligibility under the EAR

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.