US Export Controls on AI Chips & Cloud Computing

This guide explains how U.S. export controls restrict access to advanced AI chips and cloud computing services. You’ll learn which technologies are affected, who needs licenses, and practical steps to stay compliant or work around restrictions legally.

What You’ll Need

Your organization’s legal entity name and country of incorporation
End-user details (who will ultimately use the technology)
Product or service specifications (e.g., chip model, cloud tier)
Access to the U.S. Bureau of Industry and Security (BIS) website for current rules

Step-by-Step

Identify the technology you need. Determine if it’s a physical AI chip (like GPUs with high compute capability) or a cloud service (like IaaS with AI training capabilities).
Check the destination country. The U.S. has different restrictions for different countries. Countries like China, Russia, and Iran face the strictest limits. Use the BIS Entity List and Country Chart to see if your destination is restricted.
Determine if the technology is classified. Advanced AI chips and certain cloud services fall under Export Control Classification Numbers (ECCNs), such as 3A090 (AI chips) or 4A090 (AI software). Check the Commerce Control List (CCL) for the specific ECCN.
Assess the end-user and end-use. Even if the country isn’t restricted, you must ensure the end-user isn’t on the Entity List or Denied Persons List. Also, verify the technology won’t be used for military or nuclear purposes without a license.
Apply for a license if required. If your transaction falls under a license requirement, submit an application through the BIS Simplified Network Application Processing (SNAP-R) system. Provide full details of the product, end-user, and end-use.
For cloud computing, check the ‘deemed export’ rule. If you’re providing cloud access to a foreign national in the U.S., the same restrictions apply as if you were exporting the physical chip. Ensure you verify the individual’s nationality and visa status.
Use cloud service provider compliance tools. Major cloud providers offer geographic restrictions and compliance features. Use these to block access from restricted regions or users.
Document everything. Keep records of your due diligence, including end-user statements, export classifications, and license applications. This is required by law and helps in audits.

Common Mistakes

Assuming cloud is always exempt. Cloud services are not automatically exempt; they are treated as ‘deemed exports’ if the user is a foreign national.
Ignoring the entity list. Even if a company is in a friendly country, if it’s on the Entity List, you can’t ship to it without a license.
Using personal accounts for business. Personal cloud accounts may not have compliance features, and you could inadvertently violate export controls.
Not updating classifications. The CCL changes frequently. What was unrestricted last year may now be controlled.

Tips

Consult a qualified export compliance professional for complex transactions.
Use the BIS online training modules to understand the basics.
Set up an internal compliance program with periodic training for your team.
When in doubt, file for a license even if you think it might not be needed—it’s safer than a violation.

Troubleshooting

License application denied: Review the denial reason. You can appeal or modify your end-use/end-user and reapply.
Cloud access blocked unexpectedly: Check if your IP address is in a restricted region. Use a VPN to connect from an allowed location, but be aware that this may violate the provider’s terms.
Unclear if your chip is controlled: Contact the chip manufacturer or BIS directly with the part number to get a classification.
Your business partner is on the Entity List: You cannot proceed without a license. Consider finding an alternative partner or applying for a license with a strong justification.

Frequently Asked Questions

Are all AI chips subject to export controls?

No, only those with high performance (measured in TOPS) or that meet certain interconnect speed thresholds are controlled. Consumer-grade chips are usually exempt.

Can I use a cloud service in China if it’s US-based?

No, US cloud providers cannot offer AI training services to users in China without a license. The restrictions apply to the service, not just the physical location.

What is a ‘deemed export’?

It’s when you release controlled technology to a foreign national within the US. For example, giving a Chinese researcher access to US cloud AI services is a deemed export to China.

Do export controls apply to open-source AI models?

Generally, open-source models are not controlled, but the underlying chips or cloud services used to train or run them still are. Distribution of the model weights is usually allowed.

How do I know if my end-user is on a restricted list?

Check the BIS Consolidated Screening List, which includes the Entity List, Denied Persons List, and other restricted party lists. Search by company name or country.

What happens if I violate export controls?

Penalties can include heavy fines, loss of export privileges, and even criminal charges for individuals. It’s crucial to take compliance seriously.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →