BIS Rescission of the Biden Administration’s AI Diffusion Framework

Executive Summary

On May 13, 2025, the U.S. Commerce Department initiated a rescission of the “Framework for Artificial Intelligence Diffusion” or “AI Diffusion Rule,” an interim final rule issued by the Biden administration on January 13, 2025. The accompanying press release noted that Under Secretary of Commerce for Industry and Security Jeffrey Kessler had instructed Bureau of Industry and Security (BIS) enforcement officials not to enforce the Biden administration’s AI Diffusion Rule, which otherwise was scheduled to take effect on May 15, 2025.

The press release also noted plans to publish a Federal Register notice formalizing the rescission, with a replacement rule to come. Since the AI Diffusion Rule is now being rescinded, rules that were in place prior to the AI Diffusion Rule remain in effect. It is unclear at this stage, however, whether new BIS rulemaking will impose additional license requirements beyond those that existed before the AI Diffusion Rule was announced.

At the same time that it announced the rescission of the AI Diffusion Rule, BIS announced three actions to strengthen export controls with respect to AI-related integrated circuits (ICs):

1. BIS Policy Statement on Controls that May Apply to Advanced Computing Integrated Circuits and Other Commodities Used to Train AI Models (“AI Model Training Policy Statement”);
2. Guidance on Application of General Prohibition 10 (GP10) to People’s Republic of China (PRC) Advanced-Computing Integrated Circuits (ICs) (“GP10 Guidance”); and
3. Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits (“Diversion Guidance”)

We discuss each of these developments in further detail below.

Background

On January 13, 2025, BIS published the AI Diffusion Rule, which controlled certain AI-related high-performance advanced computing ICs; the assemblies/servers containing such ICs; as well as certain closed-source AI Model weights (under new Export Control Classification Number or “ECCN” 4E091).

The AI Diffusion Rule, under the Export Administration Regulations (EAR), established a worldwide license requirement for the above-mentioned ICs and assemblies/servers, whereby, prima facie, all exports, reexports or in-country transfers of any of these items to any global location or end user would require a license from BIS prior to their export, reexport or in-country transfer. The AI Diffusion Rule also separated jurisdictions across the world into three tiers, with certain “Tier 1” jurisdictions being able to obtain increased access to such ICs; Tier 2 jurisdictions having lower levels of access; and Tier 3 jurisdictions being restricted from such access. 

Rule Currently in Effect

Prior to the AI Diffusion Rule, BIS initiated a series of rulemakings from October 2022 to April 2024 which, in effect, restricted exports, reexports, and in-country transfers of such advanced ICs and assemblies/servers to: (i) China (including the special administrative regions of Hong Kong and Macao); (ii) certain Country Group D:1, D:4, and D:5 jurisdictions (where Country Group D:5 is essentially is a compilation of arms-embargoed countries, including China); as well as (iii) certain companies headquartered in or which have an ultimate parent company in the relevant universe of restricted countries, including China. Exports to users in any of these categories required a license from BIS, but with a general licensing policy of presumption of denial.

Given the rescission of the AI Diffusion Rule, rules that were in place prior to the AI Diffusion Rule’s publication would now continue to apply. This means that the above-mentioned restrictions remain in effect. Specifically, BIS will still require a license for any export, reexport, and in-country transfer to or involving China; D:1, D:4, and D:5 jurisdictions; or to companies headquartered in or which have their ultimate parent companies located in the relevant universe of restricted countries, including China; and that those licenses are subject to a presumption of denial. However, BIS has also indicated that it will issue a new rule to formalize the rescission of and replace the AI Diffusion Rule. It remains unclear at the moment whether that forthcoming BIS rulemaking will impose different or expanded license requirements from the pre-AI Diffusion Rule regime, or even when any such replacement rulemaking will be promulgated.

AI Model Training Policy Statement

In alignment with the AI Diffusion Rule’s rescission, BIS issued the “BIS Policy Statement on Controls that May Apply to Advanced Computing Integrated Circuits and Other Commodities Used to Train AI Models.” Here, BIS determined that access to certain advanced compute ICs and related commodities, which are then used to “train” AI models, have the potential to enable military-intelligence and weapons of mass destruction (WMD) end uses or end users in D:5 countries, most notably China (including Hong Kong and Macao). “Training” is specifically defined as involving “feeding large quantities of data into the model while using optimization algorithms to evaluate the quality of the program's outputs and improve its performance.” Under this Policy Statement, advanced computing ICs and related commodities specifically include items classified under ECCN 3A090.a, 4A090.a and .z items in Categories 3, 4 and 5, and such servers classified as ECCN 5A992.z.

Given the above, the following activities may trigger a license requirement under the EAR’s “catch-all” controls, when there is “knowledge” that the AI model will be used for WMD or military-intelligence end use or end users:

• Exports, reexports or transfers (in-country) of advanced computing ICs and commodities to any party, such as foreign Infrastructure-as-a-Service (IaaS) providers (e.g., data center providers), when the exporter, reexporter or transferor has “knowledge” that the IaaS provider will use these items to conduct training of AI models for or on behalf of parties headquartered in China (including Hong Kong and Macao), as well as other D:5 jurisdictions.
• Transfers (in-country), defined as a change in end use or end user, of advanced computing ICs and commodities subject to the EAR that are already in the possession of parties such as IaaS providers, if there is “knowledge” that the items will be used by the transferee to train AI models for or on behalf of parties headquartered in China (including Hong Kong and Macao), as well as other D:5 jurisdictions.
• Circumstances where a “U.S. person” provides any “support” or performs any contract, service or employment, with “knowledge” that such activity will be used for or may assist the training of AI models for or on behalf of parties headquartered in China (including Hong Kong and Macao), as well as other D:5 jurisdictions.

It is important to underscore that “knowledge” is broadly defined under the EAR to include not only positive knowledge that circumstances exist or is substantially certain to occur, but also “an awareness of a high probability of [circumstances’] existence or future existence” (emphasis added). Therefore, constructive knowledge or willful blindness of likely violations may trigger liability. Parties that do not obtain prior authorization to engage in such transactions may be subject to BIS enforcement if an EAR violation occurs. Further, BIS warns that foreign parties training AI models that could be used to support WMD or military-intelligence end uses for or on behalf of PRC companies may be added to the Entity List, even where no violation of the EAR occurs. 

GP10 Guidance

In alignment with the AI Diffusion Rule’s rescission, BIS also issued the "Guidance on Application of General Prohibition 10 (GP10) to People’s Republic of China (PRC) Advanced-Computing Integrated Circuits (ICs)," which alerts industry to the risks of using PRC advanced-computing ICs, including specific Huawei Ascend chips. Relatedly, recent media reports have described Huawei as delivering AI chip “clusters” to various customers, which clusters Huawei has claimed outperform comparable products from Nvidia on crucial metrics such as total compute and memory.

As background, General Prohibition 10 under the EAR prohibits proceeding with a transaction with knowledge that an EAR violation has occurred or is about to occur. Specifically, parties are not allowed to participate in a broad category of activities (e.g., to sell, transfer, export, reexport, finance, order, buy, remove, conceal, store, use, loan, dispose of, transport, forward or otherwise service) with respect to any item subject to the EAR if they have knowledge that an EAR violation has occurred with respect to the item. 

The GP10 Guidance aims to alert industry to the risks of using PRC advanced-computing ICs — specifically ICs that meet ECCN 3A090 control parameters and that are produced by PRC Companies (hereafter, “PRC 3A090 ICs”) — that are considered to have been developed or produced in violation of U.S. controls. A non-exhaustive list of PRC 3A090 ICs that have been presumed to be subject to such restrictions include Huawei Ascend 910B, 910C and 910D. (Note that this list is subject to updates.)

BIS explains that PRC 3A090 ICs may have been produced, purchased, or ordered by Entity List designees that have additional Footnote 1 or Footnote 4 designations, thereby subjecting such entities to increased restrictions, or such Footnote 1/4 designees were parties to the transaction. BIS considers it likely that BIS licenses were required (but never applied for) with respect to various activities involved with the production of PRC 3A090 ICs. Therefore, any party that now uses such ICs is on notice that such use may trigger General Prohibition 10 under the EAR.

BIS reiterated in the guidance that engaging in General Prohibition 10 activities, including the use of PRC 3A090 ICs, without requisite authorization from BIS could result in enforcement action. If a party intends to take any action with respect to a PRC 3A090 IC without authorization from BIS, that party should confirm with its supplier that authorization exists for the export, reexport or transfer (in-country) of such ICs and their production technology.¹

Diversion Guidance

Finally, BIS also issued the “Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits.” In response to diversion schemes in the shipment of advanced computing ICs, BIS has now prepared: 11 new transactional and behavioral red flags, seven new recommended due diligence items and further due diligence best practices. These are in addition to the EAR’s existing list of “KYC” and Red Flags guidance.

New red flags include: (1) customers not receiving advanced ICs prior to the October 2022 rulemaking and only making orders after that date or significantly increasing their orders after; (2) not supplying ultimate delivery addresses or supplying residential addresses as shipment locations, without further identification of where advanced ICs would be used; (3) customers with little online presence; and (4) differences between English and non-English versions of customer websites.

Some of the additional due diligence steps now recommended by BIS include evaluating a customer’s ownership structure to determine if parties are headquartered or have an ultimate parent headquartered in China (including Hong Kong and Macao), or any other D:5 jurisdictions; evaluating whether the customer’s line of business is consistent with the ordered items; and notifying all potential customers of BIS license requirements.

The full list of additional transactional red flags and recommended due diligence practices is available here.

Conclusion

The Biden administration’s AI Diffusion Rule aimed to divide the world into three broad tiers, with differing restrictions on each tier’s access to advanced ICs and corresponding computing power. While any Trump administration replacement rulemaking is likely to continue targeting China, there is speculation that the rescission will now provide opportunity for bilateral government-by-government discussions, whereby each jurisdiction will be able to negotiate their own advanced IC access. Notwithstanding, there is still considerable uncertainty around the content of any replacement rule. Given that BIS’s rescission announcement was accompanied by three enforcement-related guidance documents (i.e., on the training of AI models for WMD and military-intelligence end use, use of PRC 3A090 ICs and advanced IC diversion red flags), companies should continue to monitor developments and prioritize compliance with export controls.

^{1. BIS has stated it will not pursue enforcement against parties that obtain a PRC 3A090 IC solely for technical analysis or evaluation (such as destructive testing) purely to determine the technical capabilities of the individual IC. ↩}