AI hardware and compute going global: two-way export controls, end users and model-weight transfers

Stages (24–42 weeks, estimate)

1. 1. Stage 1 — Classifying items and technology (both directions)

   3–5 weeks

   Produce a classification conclusion, with reasoning retained, for every item of hardware, software, technology and model weights. On the US side complete ECCN classification, paying particular attention to the dedicated entries for advanced computing items and AI model weights. On the China side classify goods, technology, services and technical data under the Export Control Law and identify any data that is itself a controlled item. Classification is the foundation of everything that follows: one wrong call puts licences, screening and recordkeeping on a false premise.

   Obligations in this stage

   • Classify hardware, software, technology and model weights by ECCNU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR §§ 742.6(a)(6), (a)(13); 供应商编号见 CCL 第 774 部分附录 1 · Severity Critical
   • Classify chips, memory, software, technology and model weights by ECCN and identify licence requirementsU.S. export controls on advanced computing and AI model weights — sector application points for AI hardware · 15 CFR §742.6(a)(6), (a)(13) · Severity Critical
   • Classify every good, technology, service and item of technical data against the control listsExport Control Law · 第二条、第十二条 · Severity Critical
   • Identify data that qualifies as a controlled item and route it through export controlData Security Law · 第二十五条；《出口管制法》第二条 · Severity High

   Evidence to retain

   • · Classification register (item × ECCN × China control-list entry × basis × determiner × date)
   • · Supplier classification statements and certificates of origin
   • · Model-weight classification record (parameter scale, training compute and intended use)
   • · Technical-data inventory (design documents, process, test data) with classification conclusions

   Common blockers

   • · Adopting a supplier’s verbal classification as your own: the exporter is independently responsible for the conclusion, and the supplier’s view is only one input.
   • · Classifying hardware but not software and weights: toolchains and model weights are often the most sensitive part of the control set.
   • · Unversioned classification conclusions: entries get amended, and “we classified it back then” is not “it still holds”, so a re-check cadence is required.

2. 2. Stage 2 — Extraterritorial reach and the foreign direct product rules

   3–5 weeks

   Answer the question many companies assume does not concern them: “can a supply chain I built offshore be pulled into US controls because it used US technology or equipment?” That is exactly what the foreign direct product rules are for. Also assess how the AI model-weights entry affects cross-border weight transfers, and the current status and suspension-expiry of the affiliates-related rules — the timetable for these rules itself moves, so you need a monitoring mechanism rather than a one-off determination.

   Obligations in this stage

   • Assess how the Foreign Direct Product rules pull offshore supply chains into EAR jurisdictionU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR § 734.9(e), (h), (l) · Severity Critical
   • Track the expiry of the stay on the 50 percent affiliates ruleU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 90 FR 47201；90 FR 50857；15 CFR § 734.9(e) 生效日注记 · Severity High
   • Manage the worldwide license requirement and exception conditions for AI model weights (ECCN 4E091)U.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR §§ 742.6(a)(13)、742.6(b)(14)、740.27, 734.9(l) · Severity Critical
   • Establish licensing and access controls for cross-border movement of ECCN 4E091 model weightsU.S. export controls on advanced computing and AI model weights — sector application points for AI hardware · 15 CFR §742.6(a)(13), (b)(14) · Severity Critical

   Evidence to retain

   • · Assessment of US technology/equipment content in offshore lines and supply chains
   • · FDP applicability memorandum (each rule × conclusion × basis)
   • · Cross-border model-weight transfer register (source, destination, who has access, technical controls applied)
   • · Rule-change tracker (effective dates, suspension dates, expiry dates and owners)

   Common blockers

   • · Assuming “the whole line is offshore so we are out of scope”: extraterritorial rules look at the origin of technology and equipment, not the location of the line.
   • · Reading a suspension as a repeal: suspensions run for a defined period and revert on expiry, so plan against the reversion date.
   • · Handling model weights as “data” rather than as controlled technology: the access controls, personnel scope and recordkeeping requirements are entirely different.

3. 3. Stage 3 — End-user and end-use diligence and list screening

   4–6 weeks

   Build a screening gate that cannot be bypassed: before every shipment, screen against the Entity List and restricted end users, run end-use diligence against the “knows or has reason to know” standard, and obtain and verify end-user and end-use certificates. China’s Dual-Use Items Regulations expressly require obtaining and verifying such documents and, on discovering a risk situation, immediately stopping the export, reporting it and cooperating with verification — a mandatory duty at the moment of trigger, not something to be back-filled.

   Obligations in this stage

   • Transaction-level screening against the Entity List and restricted end usersU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR § 744.11；实体清单见第 744 部分附录 4 · Severity Critical
   • Run supercomputer and advanced-node end-use and end-user due diligence to the §744.23 knowledge standardU.S. export controls on advanced computing and AI model weights — sector application points for AI hardware · 15 CFR §744.23(a)(1)–(a)(4) · Severity Critical
   • Screen importers and end users against the control listExport Control Law · 第十八条、第二十条 · Severity Critical
   • Catch-all control: a licence is required where the exporter knows or should knowExport Control Law · 第十二条第三款 · Severity Critical
   • Obtain and verify end-user and end-use certificatesRegulations on Export Control of Dual-Use Items · 第二十三条、第二十四条、第二十六条 · Severity Critical
   • Stop exporting, report and cooperate on discovering a risk situationRegulations on Export Control of Dual-Use Items · 第二十五条、第三十五条、第三十六条 · Severity Critical

   Deliverables

   Supplier and subcontractor ESG and security due diligence questionnaire (for use as the buyer)

   Evidence to retain

   • · Per-shipment screening records (tool used, list version date, hits and reasons for clearance)
   • · End-user and end-use certificates plus verification records
   • · Red-flag indicator list and escalation procedure (the rule that halts a shipment on trigger)
   • · Records of export stoppage and reporting for suspicious circumstances
   • · Compliance undertakings from distributors and agents, with annual re-verification records

   Common blockers

   • · Screening once at onboarding: lists are updated continuously, so re-screen at every shipment and renewal and record the list version date.
   • · End-user certificates obtained through an intermediary with no way to verify them: holding a piece of paper is not diligence, and the verification itself must be documented.
   • · Consulting sales before acting on a red flag: the correct order is stop first, then assess, then decide on filing and resumption.

4. 4. Stage 4 — Licence applications, licence exceptions and conditions

   6–12 weeks

   Let classification and screening decide the route: apply for a licence, rely on a licence exception, or decline the transaction. On the US side, the licence determination and review policy for advanced computing items, and the notification, certification and reporting conditions attaching to the AI authorisation licence exception, must be designed into the deal structure up front. On the China side, obtain the export licence and export strictly within its stated scope, conditions and validity; outbound transfer of restricted-category technology additionally requires a technology export licence first. Licensing is a queued administrative process and must be scheduled on administrative, not commercial, cycles.

   Obligations in this stage

   • License determination for advanced computing itemsU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR § 742.6(a)(6)(i)-(iii)（许可要求）、§ 742.6(b)(10)（许可审查政策） · Severity Critical
   • Notification, certification and reporting when using License Exception AIAU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR § 740.27(b), (c) · Severity Medium
   • Prepare the certifications and testing conditions required by the 2026 case-by-case licence review policyU.S. export controls on advanced computing and AI model weights — sector application points for AI hardware · 91 FR 1684（FR Doc. 2026-00789）；15 CFR parts 742, 744, 748 · Severity High
   • Obtain the export licence and stay within its stated scope, conditions and validityRegulations on Export Control of Dual-Use Items · 第十四条、第十五条、第十六条、第十七条、第十八条、第二十一条 · Severity Critical
   • Obtain a technology export permit before transferring a restricted technologyTechnology export administration: the prohibited/restricted technology Catalogue and the Technology Import and Export Regulations · 《技术进出口管理条例》第三十三条至第四十三条 · Severity Critical
   • Check the prohibited and restricted technology Catalogue before any outbound technology transferTechnology export administration: the prohibited/restricted technology Catalogue and the Technology Import and Export Regulations · 《技术进出口管理条例》第二条、第三十一条至第三十三条；商务部 科技部公告2020年第38号 · Severity Critical

   Evidence to retain

   • · Licence application packages and acceptance/decision records (application and decision dates)
   • · Licence-condition compliance register (each condition × how it is met × verification evidence)
   • · Licence-exception reliance records (evidence conditions are met, notification and certification materials, filing receipts)
   • · Technology export licence application and decision, where restricted-category technology is involved
   • · Internal controls on export scope and validity to prevent out-of-scope or expired shipments

   Common blockers

   • · Treating a licence as a one-off credential: it states scope, conditions and validity, and exporting outside that scope is as serious in law as exporting without one.
   • · Relying on a licence exception without the notification and reporting: exceptions are conditional, and unmet conditions forfeit eligibility.
   • · Moving technology out through personnel carry-on or cloud access to avoid filing: deemed exports are equally controlled and far harder to explain afterwards.

5. 5. Stage 5 — Internal export compliance programme and deemed-export controls

   5–8 weeks

   Freeze all of the above into an internal compliance programme: role separation, approval flow, training, internal audit and recordkeeping (China requires export-related materials to be retained for at least 5 years; US transaction recordkeeping has its own requirements). The technical difficulty here is deemed exports: access to controlled technology and software by foreign-national employees, offshore subsidiary staff and visiting researchers must be managed as an export, and China applies its own deemed-export concept to the provision of controlled items to foreign organisations and individuals. In addition, requests from a foreign government for export-control visits or on-site verification must be reported immediately — the rule most often broken in practice by the instinct to cooperate first and ask later.

   Obligations in this stage

   • Maintain an export compliance program and transaction recordsU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR Parts 732, 734, 742, 744, 762 · Severity High
   • Manage deemed exports: foreign-national access to controlled technology and softwareU.S. Export Administration Regulations (advanced computing, AI model weights, FDP rules and the Entity List) · 15 CFR § 742.6(a)(10)(i)-(ii)、(a)(13)；§ 740.27(a) · Severity High
   • Control deemed-export scenarios where controlled items are provided to foreign personsExport Control Law · 第二条、第四十五条 · Severity Critical
   • Retain export records for at least five years and maintain an internal compliance programmeRegulations on Export Control of Dual-Use Items · 第六条、第十九条、第二十七条 · Severity High
   • Immediately report any foreign-government export-control visit or on-site inspection requestRegulations on Export Control of Dual-Use Items · 第三十八条；《数据安全法》第三十六条 · Severity Critical
   • Approval required before supplying data to foreign judicial or law-enforcement bodiesData Security Law · 第三十六条 · Severity Critical

   Evidence to retain

   • · Export compliance programme documentation (responsibility matrix and approval authority)
   • · Controlled-technology access matrix (nationality, location, scope of access, basis of authorisation)
   • · Training records and coverage (with emphasis on R&D, sales, legal and IT)
   • · Recordkeeping plan (at least 5 years on the China side; per the applicable period on the US side)
   • · Templates for receiving and escalating foreign-government visit or verification requests
   • · Internal audit reports and closed-loop remediation records

   Common blockers

   • · Managing deemed exports for postings but not for access: permissions on cloud code and model repositories are themselves an access path.
   • · Cooperating directly with a foreign enforcement or verification request: Chinese law requires prior approval from the competent authority before providing data to foreign judicial or law-enforcement bodies, and the Dual-Use Regulations require immediate reporting.
   • · Records scattered across business systems: when production is demanded, an incomplete chain has the same consequence as no records at all.

6. 6. Stage 6 — Outbound investment, corporate structure and ongoing monitoring

   3–6 weeks

   Move the compliance judgement upstream into deal structure: covered-transaction determination under the US Outbound Investment Security Program, identification of prohibited AI and chip activities, the notification deadline for notifiable transactions, and the “reasonable and diligent inquiry” needed to meet the knowledge standard; controlled foreign entities additionally require “all reasonable steps” and prevention of direction by US persons. On the China side, build technology-export compliance into outbound deal structures and share reorganisations, and track catalogue amendments. The output of this stage should flow straight into investor and customer diligence materials.

   Obligations in this stage

   • Determine whether a transaction is a covered transactionU.S. Outbound Investment Security Program · 31 CFR §§ 850.209, 850.210, 850.501 · Severity Critical
   • Identify prohibited AI and chip covered activitiesU.S. Outbound Investment Security Program · 31 CFR §§ 850.217, 850.224 · Severity Critical
   • File notification of notifiable transactions within 30 daysU.S. Outbound Investment Security Program · 31 CFR §§ 850.401-850.406 · Severity High
   • Conduct a reasonable and diligent inquiry to meet the knowledge standardU.S. Outbound Investment Security Program · 31 CFR §§ 850.104, 850.216 · Severity High
   • Take all reasonable steps for controlled foreign entities and avoid knowingly directingU.S. Outbound Investment Security Program · 31 CFR §§ 850.302, 850.303 · Severity High
   • Build technology-export compliance into outbound deal structures and monitor Catalogue adjustmentsTechnology export administration: the prohibited/restricted technology Catalogue and the Technology Import and Export Regulations · 商务部 科技部公告2020年第38号 · Severity High

   Deliverables

   Investor ESG due diligence pack (for fundraising and pre-IPO)

   Evidence to retain

   • · Ownership and control chart (traced to ultimate beneficial owners and any US-person involvement)
   • · Covered-transaction determinations and the “reasonable and diligent inquiry” workpapers
   • · Notification filings for notifiable transactions with filing dates recorded
   • · Control measures for controlled foreign entities and evidence of their execution
   • · Change tracker for the technology catalogue and control lists

   Common blockers

   • · Deferring structure questions to the financing round: discovering an unfiled covered transaction during diligence usually terminates the deal.
   • · A “reasonable and diligent inquiry” with no workpapers: any defence on the knowledge standard rests entirely on the written record of the inquiry.
   • · Tracking only the US rules and not China’s technology catalogue: catalogue amendments directly change the licensing requirement for outbound technology transfer.