UK AI Collaboration: Export Controls & Research Security

For AI collaboration in the UK, the key rules are the Export Control Order 2008 (as amended) for goods, software and technology, and the National Security and Investment Act 2021 for certain deals. You also need to follow the Trusted Research guidance from the National Cyber Security Centre and the Centre for the Protection of National Infrastructure when working with international partners.

Background: Why AI Collaboration Is Regulated

AI is a dual-use technology, meaning it has both civilian and military applications. The UK government, like other countries, restricts the transfer of certain AI capabilities that could undermine national security or contribute to weapons development. The rules have tightened since 2023 as AI models have become more powerful, particularly for those used in cyber, autonomous systems, and chemical or biological research.

Export controls are not just about physical hardware. They cover electronic transfers, cloud access, and even providing training or technical assistance to foreign nationals. Research security rules, on the other hand, focus on protecting the integrity of UK research from undue foreign interference, espionage, or theft of intellectual property.

Export Controls: What Counts as a Controlled Item

The Export Control Order 2008 implements the EU Dual-Use Regulation (now retained as UK law) and adds UK-specific controls. For AI, the relevant categories are:

• Software – including source code, object code, and applications used for AI model training or deployment.
• Technology – technical data, blueprints, and know-how required for the development, production, or use of controlled AI.
• Goods – specialised hardware like GPUs with high aggregate processing power, though these are usually controlled under broader electronics categories.

Not all AI is controlled. The controls target specific parameters, such as processing speed, memory bandwidth, or the ability to evade detection. For example, software designed for autonomous operation of drones or military vehicles is likely controlled, while a general-purpose image recognition library may not be.

How to Determine If Your AI Collaboration Needs a Licence

You must check whether your specific AI technology falls under a controlled entry. The process is:

1. Identify the exact item, software, or technology you intend to share.
2. Review the consolidated list of controlled items (the UK Strategic Export Control Lists).
3. Assess the technical parameters, such as processing performance, algorithm capabilities, or intended use.
4. If it is controlled, apply for a licence via the Export Control Joint Unit (ECJU) online system.
5. If unsure, you can request a formal assessment or use the ECJU’s advisory service.

Even if the item is not on the list, you may need a licence if you have been told it will be used in a weapons programme, or if it could contribute to a military end-use in a country subject to an arms embargo.

Research Security: Trusted Research and National Security

For universities and research institutions, the main framework is the Trusted Research guidance, which covers how to manage international collaboration while protecting sensitive research. Key principles include:

• Know who you are working with – conduct due diligence on foreign partners and funders.
• Identify sensitive research areas – such as AI for defence, cybersecurity, or critical infrastructure.
• Use appropriate contractual protections – including intellectual property clauses and restrictions on unauthorised transfers.
• Be aware of the risks of foreign interference – including espionage, theft of research, or undue influence over publications.

The National Security and Investment Act 2021 also requires mandatory notification for certain deals in 17 sensitive sectors, including advanced materials, artificial intelligence, and data infrastructure. If your collaboration involves acquiring control of a UK AI company or certain assets, you may need to notify the government before completion.

Common Problems and Misconceptions

A common misconception is that export controls only apply to physical exports. In fact, sharing AI software via email, cloud storage, or even providing remote access to a foreign collaborator can constitute an export. Another issue is that many researchers assume academic research is exempt. While there is an exemption for basic scientific research, it only applies if the research is in the public domain and not subject to access restrictions. If you are working on proprietary AI or have agreed to keep results confidential, the exemption does not apply.

Another problem is the ‘deemed export’ rule. If you employ a foreign national in the UK and give them access to controlled technology, that can be treated as an export to their home country. This means you may need a licence even if the person never leaves the UK. Institutions often overlook this, leading to breaches.

Comparing UK Rules with Other Jurisdictions

The UK’s approach is broadly aligned with the EU and the US, but there are differences. The US has the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR), which are more prescriptive and have extraterritorial reach. The UK is more focused on end-use and end-user controls, and its list of controlled AI items is similar to the EU’s. However, the UK has been quick to update its controls to cover new AI capabilities, such as those used in autonomous systems.

For international collaboration, you must comply with the rules of all countries involved. A US partner may be restricted from sharing certain AI technology with UK researchers, even if the UK rules allow it. Always check the most restrictive applicable regime.

Costs and Practical Steps for Compliance

Applying for an export licence is free, but the process takes time – typically 20 working days for a standard licence, but it can be longer for complex cases. There is no fee for the National Security and Investment Act notification either. The main cost is the administrative burden of compliance, including training staff, maintaining records, and conducting due diligence.

To stay compliant, you should:

• Create an internal compliance programme with clear procedures for identifying controlled items.
• Train researchers and staff on export control and research security policies.
• Keep records of all transfers, including emails and cloud access logs.
• Consult the ECJU or your institution’s research office when in doubt.

Frequently Asked Questions

Do I need an export licence to share open-source AI code with a foreign collaborator?

Generally, no, if the code is already in the public domain and no restrictions are placed on its use. However, if the code is controlled under the Export Control Order, even open-source distribution may require a licence. The ‘public domain’ exemption applies only if the technology is freely available without restriction.

What is the penalty for breaching UK export controls?

Breaching export controls is a criminal offence. Penalties can include unlimited fines and up to 10 years in prison. Companies may also face civil penalties and reputational damage. The government can seize goods and revoke licences.

Does the National Security and Investment Act apply to university research collaborations?

It applies to certain acquisitions of control over entities or assets in sensitive sectors. If a foreign entity is acquiring a significant stake in a UK AI company or its intellectual property, it may trigger mandatory notification. Pure research collaborations without a change of control are usually not caught.

Can I share AI technology with a colleague in the US without a licence?

It depends on the technology and the US export rules. The US has its own controls, and the transfer may require a licence under the EAR. You should check both UK and US regulations. The UK and US have some mutual recognition agreements, but they do not eliminate the need for licences.

What is ‘basic scientific research’ and how does it affect export controls?

Basic scientific research is experimental or theoretical work conducted to gain knowledge without specific practical application. If the results are published openly and without restrictions, they are exempt from export controls. However, if the research is funded by a defence contract or has clear military applications, it may not qualify.

Related

• Emergency OT Changes: Keep Security Visibility
• How to Connect a Monoprice Subwoofer to a Receiver
• Leather vs Suede Loafers: Comfort, Care, Durability