Advanced computing and AI chip controls under BIS / EAR: legal support

A semiconductor manufacturer in Europe signs a distribution agreement with a partner in a high-growth market. The chips are commercially available. The supply chain looks clean. Then a trade-compliance review flags that several products carry an Export Control Classification Number (ECCN – a classification on the US Commerce Control List that determines what licence is required, if any, for a given destination and end use). Certain destinations require a licence. The shipment pauses. The relationship is at risk. This is not a hypothetical: advanced computing and AI chip controls under BIS / EAR legal support is one of the fastest-growing areas of our practice, precisely because the rules are changing faster than most compliance programmes can track.

Advanced computing and AI chip controls under the US Bureau of Industry and Security's Export Administration Regulations (BIS / EAR) apply a performance-threshold analysis to determine whether a chip or related item requires a licence before it may be exported, re-exported, or transferred. The analysis turns on the item's classification, the destination's country-group status, and the end user's identity. As of January 2026, these controls have tightened considerably, with new thresholds, amended foreign direct product rules, and country-group reassignments altering the licence picture for a wide range of products and routes.

This page explains the legal basis for advanced computing controls, the classification and licence-determination process, the cross-border dimensions that catch exporters unawares, the risk flags that signal an urgent compliance review, and how Calder & Vance provides advanced computing and AI chip controls BIS / EAR legal advice to exporters, chip designers, distributors, and in-house teams.

What problem does this create for exporters and distributors?

A single mis-classified item can expose a company to significant civil penalties and reputational damage – and the exporter, the re-exporter, and the facilitator may all be in the frame. That is the core pain of advanced computing controls: the rules are technical, they change frequently, and the consequences of getting them wrong fall on parties who may have had no awareness that a US-origin control applied to their product or transaction at all.

The BIS / EAR apply not only to items shipped from the United States. They apply to controlled US-origin technology and software wherever it sits, and to foreign-produced items that are the direct product of controlled US technology through the Foreign Direct Product (FDP) rules – a set of provisions that extend US jurisdiction extraterritorially to items manufactured abroad using US-origin equipment or design tools. For an Asian chip designer using US electronic design automation software, the EAR may apply to the finished product even if no US component is physically embedded in it.

This is the lost-opportunity risk as much as the penalty risk. A deal stalls because nobody checked the ECCN before term sheets were signed. A distribution channel closes because a partner country's classification shifted. A technology-licensing arrangement collapses because the deemed-export analysis was never done. In our cross-border practice, we see all of these, and the common thread is that the question of control was left too late.

How does BIS / EAR classify advanced computing items?

Every item subject to the EAR has a classification. Items on the Commerce Control List (CCL – the US government's catalogue of controlled goods and technology) carry an ECCN that encodes the reason for control and the destinations and end uses that trigger a licence requirement. Items subject to the EAR but not listed on the CCL are designated EAR99 – and EAR99 is not the same as uncontrolled. An EAR99 item may still require a licence if the destination, end user, or end use is prohibited.

For advanced computing chips and related technology, classification analysis typically involves three steps. First, identify the relevant technical parameters – processing performance, total processing performance per band, and memory bandwidth, among others – and compare them to the applicable CCL entries. Second, confirm the destination country group. Third, determine whether a licence exception applies or a licence application is necessary.

Performance thresholds matter enormously here. A chip that falls just below a control threshold is classified differently from one that meets or exceeds it. The gap between a freely exportable product and a licence-required product can be a small increment of processing performance. Chip designers and distributors managing large product portfolios need a systematic classification methodology, not a transaction-by-transaction check.

The deemed export rule compounds this for technology companies. Releasing controlled technology to a foreign national inside the United States – including through remote access to servers, shared code repositories, or collaborative design sessions – constitutes an export to that person's country of nationality for EAR purposes. A multinational with engineers of diverse nationalities must run the deemed-export analysis across its internal technology flows, not just its external shipments.

How do country-group classifications and FDP rules change the analysis?

A country's position in the BIS country-group system determines which licence exceptions are available, which CCL entries trigger a licence requirement, and which licensing policy applies at the application stage. Country groups range from the most permissive tier – which includes close allies – to tiers where a presumption of denial applies to advanced computing items. A reclassification changes the analysis prospectively for all pending and future transactions.

As currently in force, verify before reliance: country-group classifications for several jurisdictions relevant to advanced semiconductor supply chains have been adjusted in recent regulatory cycles, and the licence-exception landscape has shifted with them. Exporters relying on classification determinations made before a reclassification date need to recheck their authorisation basis.

The Foreign Direct Product rules operate as a separate but intersecting layer of control. Under the EAR, a foreign-produced item can fall within US jurisdiction if it is the direct product of controlled US technology or software, and if it is destined for specified entities or destinations. The FDP analysis requires the exporter to trace the provenance of the manufacturing and design tools used to produce the item. This is genuinely complex for integrated circuit manufacturers whose design and fabrication chains span multiple jurisdictions. Our practice regularly advises on FDP analysis for advanced logic chips, high-bandwidth memory, and AI accelerators.

For EU, UK, and other non-US exporters, the FDP rules introduce a US-law dimension that sits outside their domestic regime. An EU exporter shipping a foreign-produced chip may be subject to EAR obligations it has never assessed. The interaction between the EAR and the EU's own dual-use rules – governed by the recast EU Dual-Use Regulation – creates a double-compliance obligation that requires both regimes to be mapped simultaneously. Relying on EU classification alone is not sufficient where US-origin technology is in the product's lineage.

We provide law firm for advanced computing and AI chip controls BIS / EAR support that spans both regimes, ensuring exporters understand exactly where their compliance gaps sit before a shipment departs or a technology licence is signed. For a detailed discussion of how FDP rules apply to your product, see our Foreign Direct Product rules BIS / EAR service page.

What are the cross-regime dimensions that exporters miss?

The most common gap in advanced computing compliance programmes is the failure to map US-law obligations onto non-US transactions. Three cross-border dimensions regularly surface in our practice.

Re-export controls. An item lawfully exported from the United States to Country A does not lose its EAR classification. If that item is subsequently transferred from Country A to Country B, a re-export licence may be required. The original exporter has no control over what the first buyer does with the product – but the first buyer, if it is a US person or if the item is subject to the EAR, has an independent obligation. Distributors in intermediary markets are particularly exposed here, and a well-drafted distribution agreement should address re-export compliance explicitly.

Cloud and remote access. The provision of advanced computing capability through cloud infrastructure – where foreign persons access US-origin chips via virtual machines or API calls – raises questions about whether a deemed export has occurred. BIS has indicated that this analysis is fact-specific and depends on the level of control a foreign person exercises over the underlying hardware. This is an active area of regulatory development, and compliance programmes that were designed for physical shipments need updating for cloud delivery models. Our cloud and remote access controls service addresses this in detail.

UK and EU parallel obligations. A UK exporter of dual-use items must comply with the Export Control Order under ECJU, independently of the EAR. An EU exporter must comply with the EU Dual-Use Regulation. Neither the UK nor the EU regime tracks US country-group categories precisely, so a shipment that is EAR-licensed may still require a separate UK or EU licence – or may be permitted under the UK or EU regime but require a BIS licence. Mapping all applicable regimes simultaneously is essential; assuming that one approval covers all is a structural mistake.

Switzerland, Japan, South Korea, and other technology-exporting jurisdictions maintain their own advanced-technology controls, some of which align closely with US measures and some of which diverge. In our cross-border practice, we regularly advise exporters who discover mid-transaction that they face obligations under three or more regimes simultaneously. The question is not which regime applies; usually more than one does. The question is how they interact, and which is the binding constraint.

What are the main risk flags that should trigger a legal review?

Advanced computing controls create exposure across the transaction life cycle, not only at the point of shipment. The risk flags below are the ones our team looks for when a client asks whether their current programme is adequate – and each one has, in our experience, been the origin of a real compliance problem.

• Classification conducted at product launch only. Regulatory amendments change the threshold values against which existing products are assessed. A classification correct at product launch may be incorrect after a rule change. Without a periodic reclassification cycle, a product can slide from EAR99 to licence-required without anyone in the business noticing.
• Incomplete FDP analysis. If the product was designed using US electronic design automation tools, or if the fabrication process uses US-origin semiconductor equipment, an FDP analysis is required. Many exporters perform this analysis superficially or not at all.
• No deemed-export controls for internal technology sharing. A multinational that has deployed a technology-access matrix based on seniority rather than nationality may be releasing controlled technology to foreign nationals without a licence or without confirming the applicable licence exception.
• Re-export obligations not addressed in distribution agreements. Distributors that receive no guidance on re-export restrictions – and no contractual obligation to seek EAR advice before onward sale – create a tail of liability for the original exporter.
• Entity List screening conducted only at first transaction. BIS adds parties to the Entity List on a rolling basis. A customer cleared at contract signature may appear on the Entity List before delivery. Ongoing transaction-level screening is required, not a one-time check.
• Country-group changes not monitored. Reclassification of a destination country can remove a previously available licence exception overnight. If the compliance team is not monitoring regulatory changes, they will not know until a shipment is blocked. For the latest position on specific country-group changes, see our country-group changes BIS / EAR service page.

A further risk that is often underestimated: the voluntary self-disclosure (VSD – a disclosure to BIS or OFAC of a potential violation before the regulator opens an investigation) process. BIS's enforcement guidelines treat timely, complete VSD as a significant mitigating factor. A company that discovers a classification error, pauses, and says nothing is in a materially worse position than one that moves immediately to scope the apparent violation and submit a VSD. The window between discovery and regulator contact is critical, and it narrows quickly.

What is the common myth about commercial availability and EAR controls?

The most persistent misunderstanding we encounter is the belief that a commercially available product cannot be export-controlled. The logic runs: if the item can be bought on the open market, it cannot be a controlled item. This is wrong, and acting on it is how companies get into difficulty.

Commercial availability does not determine EAR jurisdiction. What determines EAR jurisdiction is whether the item is subject to the EAR – which turns on its origin, the technology or software that produced it, or the US-origin content incorporated within it. A chip that is sold commercially in consumer electronics can carry an ECCN that requires a licence for specified destinations and end users. The EAR explicitly provides that items available commercially can be and are controlled where policy grounds justify it. For advanced computing chips, performance thresholds are the trigger: it is the technical specification of the item, not its commercial availability, that drives classification.

A related myth is that a licence exception will always be available for a commercial transaction. Licence exceptions under the EAR are item-, end-use-, and destination-specific. Eligibility cannot be assumed; it must be affirmatively determined for each transaction. An exception that applies for one destination may be unavailable for another, and an exception that applied last year may no longer apply following a country-group change or an amendment to the exception's scope.

In our experience advising exporters on advanced computing compliance, the companies most at risk are those with strong commercial teams and weak classification infrastructure. The commercial team closes deals. The compliance team, if it exists, checks names. Nobody has done the ECCN analysis. By the time someone asks the question, the product has shipped. That is the sequence we help companies interrupt.

How does Calder & Vance assist with advanced computing and AI chip controls?

We act as specialist BIS / EAR export controls specialists for exporters, chip designers, distributors, cloud-infrastructure providers, and in-house legal and compliance teams who need to manage advanced computing and AI chip controls across the full transaction life cycle. Our work is focused on practical output: a classification determination, a licence application, a restructured compliance programme, or a VSD submission. We do not offer general awareness training in place of legal advice.

Our scope of work in this area includes the following:

• Classification and ECCN determination. We assess the technical parameters of the item against the current CCL and provide a written classification opinion. Where a product portfolio requires systematic classification, we design and implement a classification methodology that the client's team can apply and maintain.
• FDP rule analysis. We trace the design and manufacturing chain of foreign-produced items to determine whether US FDP rules apply and, if so, what authorisation is required for the intended transaction.
• Licence assessment and application. We assess whether a licence exception is available and, where it is not, advise on the appropriate licence type and prepare and submit the licence application to BIS, managing the agency's queries through to determination.
• Deemed-export review. We assess a company's internal technology-access controls and identify populations of foreign nationals with access to controlled technology, advising on the licences or licence exceptions that apply.
• Compliance programme design and testing. We test the classification logic, map the ownership and control chain for Entity List screening purposes, and redesign the programme to address the specific vulnerabilities of an advanced computing business.
• Enforcement and VSD support. Where a potential violation has been identified, we scope the apparent violation, advise on whether a VSD is appropriate, and prepare the submission and penalty defence in accordance with BIS guidance.
• Multi-regime analysis. We map the EAR position alongside the applicable EU, UK, and other regime obligations, so the client receives a single, integrated analysis rather than separate national-law opinions that leave the interaction unaddressed.

In a recent matter, a technology distributor with operations across three continents discovered that a product line it had sold commercially for several years carried an ECCN requiring a licence for a subset of its customers' destinations. We scoped the apparent violation, assessed the VSD position, classified the full product portfolio, redesigned the screening and authorisation workflows, and supported the preparation of the VSD submission. The matter concluded without referral to formal enforcement proceedings. No outcome is guaranteed, but the preparation and timing of a VSD submission are the variables within a company's control, and acting promptly matters.

For a confidential review of your advanced computing export-control position, contact Calder & Vance at info@caldervance.com.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.