What to Know About the New U.S. AI Diffusion Policy and Export Controls

Today, in its waning days, the Biden administration, through the Commerce Department’s Bureau of Industry and Security (BIS), released an eagerly anticipated Regulatory Framework for the Responsible Diffusion of Advanced Artificial Intelligence Technology. The policy lays out a global framework to govern the export of frontier artificial intelligence (AI) technologies from chips to AI model weights from the United States to the world. The policy builds on previous policy releases focused on limiting exports of AI technology to the People’s Republic of China (PRC) and other countries of concern like Russia. The policy is designed to achieve two goals. First, it attempts to enable U.S. companies to export and lead in key global AI markets by reducing and streamlining current bureaucratic barriers to exports. Second, the policy further controls PRC access to the most advanced U.S.-based AI technologies through regulatory changes. 

Throughout its term, the Biden administration has promoted and protected American AI leadership given the significance of AI for economic development, technology leadership, and strategic competition between the United States and the PRC. U.S. companies like OpenAI and Anthropic lead in developing AI algorithms, while NVIDIA excels in producing semiconductor chips for training these models. Frontier AI also depends on cloud computing via vast data centers, with U.S. hyperscalers—Amazon, Apple, Google, Meta, and Microsoft—leading the sector. Chinese companies such as Alibaba and Huawei follow closely behind, especially in model capabilities. 

Given the upcoming presidential transition on January 20 and industry concerns, the longevity of the policy is uncertain and may depend on whether key figures in the incoming Trump administration such as AI and Crypto Czar David Sacks view the policy more through the lens of geopolitical competition and restricting PRC access to U.S. technology or whether they view the diffusion policy as part of a regulatory framework that overly burdens and disadvantages U.S. AI companies. 

What are the Main Elements of the new AI Export Policy? 

The new Biden administration AI export control policy changes U.S. regulations in several ways that will shape the ability of American companies to export AI technologies abroad. The rule creates a global license regime for frontier AI model weights and expands the licensing regime on advanced AI chips into a worldwide control. 

First, the regulation divides countries into three groups. A small set of close allies and partners are mostly exempted from the regulatory controls on AI exports because they are trusted partners where the risk of theft and diversion to countries of concern is low. Those countries are Australia, Belgium, Canada, Denmark, Finland, France, Germany, Ireland, Italy, Japan, the Netherlands, New Zealand, Norway, Republic of Korea, Spain, Sweden, Taiwan, and the United Kingdom. Countries of concern (technically called Country Group D:5 destinations and Macau) are presumed to be ineligible from receiving advanced American AI technology. They are countries where the United States has an arms embargo, such as the PRC or Russia. All other countries fall into a middle category, including countries making substantial investments in AI such as Saudi Arabia and the United Arab Emirates. 

Second, the regulations will ensure U.S. headquartered companies keep most of their advanced AI training operations in the U.S. or within that small set of close allies and partners.  

Third, the policy enables U.S. companies to export advanced AI chips and capabilities worldwide except to countries of concern. The process will be easiest and the allowable exports highest when American companies and their partners abroad build validated secure infrastructure.  

Some chip exports will be exempt from the regulations. All countries except countries of concern will be able to import up to 1700 of the most advanced chips today, H100s, without those counting against any country-specific caps. That will satisfy the vast majority of global chip orders and so the administration argues it would remove regulatory friction that creates challenges for US companies. Exports related to supply chains will also not be controlled. 

To export more, companies headquartered in the U.S. and a small grouping of close allies and partners have to be validated within a year as Universal Validated End Users (UVEUs) by implementing security standards based on industry best practices that minimize the risk that the technology could be stolen or diverted to the PRC. UVEUs have no restrictions on the number of controlled AI chips they can export. U.S. headquartered UVEUs have to keep at least 50 percent of their AI compute base in the U.S., at least 75 percent in U.S. and close allies and partners, and have no more than 7 percent in any other individual country. The regulations therefore ensure that the largest data centers are in the most trusted locations from the perspective of the U.S. government.  

Companies headquartered anywhere else (except for countries of concern) can be validated as National Validated End Users (NVEUs) by meeting the same high security standards, meaning they can build data centers without additional authorizations within a specific country, and purchase up to 320,000 controlled advanced chips over the next two years. The chip limits are targeted at being able to train a model that is approximately twelve months, or one generation, behind the data cluster size necessary to build the most cutting-edge AI models in the world. A country without NVEU status would only be able to import up to 50,000 chips. 

Fourth, the policy also regulates cloud access to services from U.S.-headquartered companies, attempting to close what was arguably a loophole in existing regulations that allowed PRC companies such as ByteDance (the owner of popular social media app TikTok) to access U.S. AI technology legally by renting access not located in the PRC, in Southeast Asia and the Middle East. 

Fifth, given the critical importance of AI model weights in helping another country train its own models, and the potential consequences for U.S. AI leadership if frontier model weights leaked to the PRC, the regulations require companies to get licenses to export closed-weight (i.e. non-open-source) AI model weights trained on more than 10²⁶ computational operations. 

Finally, the policy does not control open-source models. Instead, state of the art open-source models will serve as the basis of future determinations regarding the scale of closed-weight models the policy regulates. Once a good open-source model exists at a certain computational level, controls on the model and weights will no longer succeed. So as open-source models improve, more powerful close-weight AI models will be available without restrictions. 

What are Industry Concerns? 

While the regulations are designed to enable U.S. companies to safely export AI technology abroad, industry has expressed concerns prior that the regulations would be too strict. Ken Glueck, Executive Vice President of Oracle, argues that the regulations will create a market opening for PRC companies in most countries, whether or not companies operating in those countries receive NVEU status. For those countries without NVEU operators, the chip export caps are so low, according to Glueck, that PRC companies like Huawei can fill in and control the market, aided by PRC subsidies the way they did for 5G a decade ago. Others argue that Huawei has struggled to produce high-performance AI chips at scale. Glueck also states that the UVEU and NVEU regulations are too burdensome and have too many reporting requirements. The Semiconductor Industry Association is concerned about such an important policy being released during a presidential transition and said there was not enough industry consultation. 

Brad Smith, President of Microsoft believes Microsoft can meet the security standards for UVEU status. He writes “we are making this technology available around the world through datacenters that meet the U.S. Government’s highest cyber and physical security standards.” Microsoft is already doing substantial work with G42, an AI company based in the United Arab Emirates. 

While there have been consultations with industry already, the regulations have a 120-day comment period, so industry will have the opportunity to formally submit concerns and suggest changes before they are finalized. This also means the Trump administration will make the final decision on implementation of the policy. 

How will the Trump Administration Shape AI Export Control Policy? 

The incoming Trump administration’s stance on frontier AI export controls is unclear. If Trump officials believe the regulations will slow the PRCs progress in AI and keep U.S. companies in the lead, they may support them to maintain U.S. leadership. However, if Trump officials focus more on industry concerns about how limits on exports create opportunities for PRC companies, they may seek to repeal or amend these provisions. Additionally, it’s uncertain how the Trump administration will view the regulations’ closure of loopholes that grant PRC companies access to AI cloud computing. They may decide to keep the cloud provisions even if they reject the other controls on chips and data centers. 

This post reflects the views of the author alone and does not represent the views of the Department of Defense, U.S. government, or any of its components.