Photo: Artur Widak/NurPhoto via Getty Images
Just days before stepping down, the Biden administration announced two related rules aimed at tightening control over the flow of advanced AI chips and frontier AI model weights: the Interim Final Rule of the Regulatory Framework for the Responsible Diffusion of Advanced Artificial Intelligence Technology (the “AI Diffusion Rule”) and the Interim Final Rule of the Implementation of Additional Due Diligence Measures for Advanced Computing Integrated Circuits (the “Due Diligence Rule”).
At a broader level, these two rules work in tandem to reinforce the U.S. lead in AI technology by systematically closing off China’s access to advanced computing. The AI Diffusion Rule targets the diversion of advanced AI chips through third-party countries, addressing the growing risk of grey-market rerouting.
Meanwhile, the Foundry Due Diligence Rule strikes at another weak point—Chinese backdoor access through front-end chip fabricators. The recent diversion of Taiwan Semiconductor Manufacturing Company (TSMC)–produced chips to Huawei underscored how Chinese firms can exploit shell companies and intermediary design firms to evade restrictions. This rule forces fabs like TSMC to conduct further due diligence on integrated circuits (IC) design customers and outsourced semiconductor assembly and test (OSAT) partners, ensuring that export-controlled AI chips do not quietly slip into Chinese supply chains under false pretenses.
Together, these rules form a double-fronted crackdown on diversion, closing both national loopholes and industrial loopholes. This is not just about restricting chips; it is about shutting down every off-ramp China could take to get them. But tightening the rules is one thing, enforcing them is another.
Overview
The AI Diffusion Rule establishes an unprecedented global export control regime, targeting both advanced AI chips and, for the first time, closed-frontier AI model weights as controlled items. It partitions the world into three tiers based on each country’s relationship with the United States.
For Tier 2 (T2) countries, where most nations fall, a fixed allocation of around 50,000 H100-equivalent graphics processing units (GPUs) has been set, with additional access requiring stringent compliance through the Validated End User (VEU) system. T2 entities seeking significant computing resources must either partner with a T1-based Universal Validated End-User or apply for a National Validated End-User (NVEU) license, both of which come with significant oversight and security requirements.
The rule also introduces narrowly defined license exceptions for small-quantity shipments to T2 countries—roughly 1,700 H100-equivalent GPUs—which do not count toward the roughly 50,000 H100-equivalent installed base cap. For a deep dive into the rule, please see the following CSIS article.
Overview
As a supplement to the AI Diffusion Rule, the Due Diligence Rule imposes additional due diligence requirements on fabs and OSAT companies specifically for the export of advanced AI chips.
Previously, fabs faced substantial challenges in detecting customers’ misrepresentation regarding the performance capacity of their customers’ IC design and in correctly identifying them as controlled items. Now, rather than solely relying on the attestation from the fab’s IC designer customers or end users, the Bureau of Industry and Security (BIS) seeks to gain direct visibility of IC designers and OSAT companies through stringent vetting requirements prior to transactions.
The rule clarifies and expands the scope of controlled advanced AI chips on several fronts:
The Due Diligence Rule has two main purposes: (1) ensuring the correct export control classification of the exported chips and (2) gaining direct oversight of IC designers and OSAT companies.
Under the rule, fabs or OSAT companies seeking to export all applicable logic ICs must obtain attestations from reliable and authorized IC designers, fabs, or approved OSAT companies to be exempt from export license requirements.
Scope of Impact Wider than Expected
The Due Diligence Rule has broader repercussions than the industry previously expected. The rule captures not only advanced AI chips but also potential chips with other functions using 16/14 nm or below. Even if a 16/14 nm logic IC does not meet the compute performance capacity set for a controlled logic IC, its export could still be denied if the exporter cannot obtain reliable attestations for the IC’s performance capacity.
Previously, there were substantial loopholes that allowed Chinese companies to obtain export-controlled chips. Chinese companies such as Huawei could use third-party companies to purchase these chips or rent overseas data centers with legitimate access to controlled chips to train their AI models. For the former, the third-party company could either be a Chinese company not on the entity list or a non-Chinese company located overseas. Chinese third-party companies could also purchase the export-controlled chips by misrepresenting the Export Control Classification Numbers (ECCN) to the fabs. Meanwhile, non-Chinese third-party companies could purchase these chips directly, as most of them were not subject to export control licenses.
Together, the AI Diffusion Rule and the Due Diligence Rule close most of these loopholes. Now, the risk of IC designers misrepresenting ECCN classifications is greatly reduced, as chips can only be exported with attestations from reliable IC designers and OSAT companies that have passed the BIS’s prior vetting procedures. Non-Chinese companies no longer enjoy nearly unrestricted access to advanced AI chips either. The global license regime now requires stringent prior vetting requirements or a license subject to a certain compute cap for the export of large amounts of advanced AI chips to T2 countries, that is, the category that includes most countries in the world, through the VEU authorization approach or the country-specific allocation quotas approach. Even exports to T1 countries, which can use license exceptions, require the exported AI chips to be designed by an approved or authorized IC designer, providing the BIS with more visibility of the exporting fab’s customers to ensure the controlled chips are not diverted to an unwanted entity.
For data centers, the VEU authorization approach forces further decoupling from China and more visibility for the U.S. government, closing the previous loopholes where Chinese companies could rent foreign data centers to access advanced AI chips. The only remaining potential loopholes are through third-party companies in T2 countries using the small-amount exception or within the quota of country-specific allocation licenses, albeit with much smaller quantities.
Overall, the AI Diffusion Rule imposes significant compliance burdens on exporters and data center end-users of advanced AI chips. The Due Diligence Rule creates additional vetting requirements on IC designers and OSAT companies, placing the most significant compliance responsibilities on fabs. Under this rule, fabs are designated as the primary information collectors and reporting entities for their IC designer customers. They are also responsible for verifying the accounts provided by IC designers and OSAT companies regarding the performance capacities of the chips intended for export.
These requirements also place considerable demands on the BIS, the agency responsible for enforcing the complex provisions of both rules. Exporters and end-users face heightened self-reporting, record-keeping, and information disclosure obligations, even for license exception applications on a worldwide scale. Fabs, IC designers, OSAT companies, and certain end-user data centers face increased due diligence reporting requirements, all of which must be submitted to the BIS.
The following outlines specific challenges in BIS enforcement and provides a compliance roadmap for companies affected by the new rules.
The two rules set forth the ambitious goal to track the global flow of nearly every advanced AI chip and enhance visibility to nearly all entities involved in these transactions. However, it remains uncertain whether the BIS possesses the capacity to effectively enforce them.
Insufficient Monitoring and Tracking Capacity
For export of small quantities of compute to companies in T2 countries exempt from export license, a key concern is whether the BIS can effectively track the total amount of compute that any company in T2 countries has obtained.
From the rule, it seems the BIS relies heavily on self-reporting from the ultimate consignee on its available compute quota for the transaction. Can the BIS effectively monitor potential misrepresentations of data by the ultimate consignees if the BIS does not keep a record on its own? Do exporters have any due diligence duty except for obtaining the certification from the ultimate consignee? The rule also prohibits in-country transfers. How can the BIS ensure that the stated consignee is indeed the “ultimate” consignee? A potential issue may arise if an ultimate consignee, having exhausted its quota, uses another company with an available quota to purchase chips from the exporter. Exporters generally do not have visibility as to whether their customer consignee transfers their chips again.
For export of advanced AI chips to T2 countries using the traditional license application, subject to a new country-specific allocation for compute quotas, the same question about the BIS’s monitoring capacity can be raised—how can the BIS maintain an up-to-date record showing the current available quota for each specific T2 country?
Without up-to-date records, businesses face significant challenges in planning ahead. Even with correct, timely records, businesses may still struggle to engage in transactions ahead as there is no guarantee that the quota will remain available when the transaction is finalized. To mitigate this uncertainty, businesses are likely to apply to the BIS prematurely, submitting requests before the actual transaction is completed with a purchase order or agreement that is not final, simply to secure a spot within the allocated quota. The actual purchased compute power might then be subject to changes later, thus affecting the accuracy of the BIS’s real-time record.
Difficulties in Ensuring Fairness
Another potential issue is when multiple businesses submit applications to the BIS around the same time for exports to a certain T2 country, and the available quota is insufficient to accommodate all requests. How will the BIS determine allocation? How can it ensure fairness among all applicants? Such decisions would unavoidably profoundly impact market competition, causing long-term repercussions for industry.
Fabs
For fabs that manufacture logic ICs using 14/16 nm and below, they must now obtain attestations of the IC’s performance capacities from approved/authorized IC designers, OSAT companies, or the fab itself if it packages the ICs. Only ICs verified to fall outside the controlled scope are exempt from export licensing requirements. This process includes collecting the required data, conducting an additional know-your-customer vetting form for all their IC design customers, and reporting to the BIS periodically through April 13, 2026. Eligible IC designers must be located in Taiwan or a close U.S. ally (country Group A:1 or A:5) and not headquartered in China.
For exports subject to the new global export control licensing regime, fabs must determine whether the destination is a T2 country and whether any license exceptions apply—specifically, whether the end-user is a validated data center, the export qualifies as a small amount, or the shipment falls within the country’s allocation quota. If no exceptions apply, an export license is required for most advanced AI chip exports to T2 countries.
OSAT Companies
OSAT companies are encouraged to apply for approved status if they intend to continue the packaging of chips 14/16 nm or below using U.S. technologies. Failure to obtain this status risks losing the business for all these chips if the export attestations cannot otherwise be provided by approved/authorized IC designers.
Even approved OSAT companies should consider relocating their packaging operations overseas, outside of China. Reports indicate that fabs like TSMC have already halted shipments of orders packaged in Chinese facilities, even by approved OSAT companies.
When exporting chips that are subject to the new global export control licensing regime, OSAT companies must comply with the same requirements outlined for fabs.
IC Designers
IC designers of logic ICs of 14/16 nm or below using U.S. technologies should collaborate with their fabs to become an authorized IC designer as soon as possible. After April 13, 2026, they must all apply to become an approved IC designer.
For Chinese IC designers, becoming an approved or authorized IC designer is not an option. Since no Chinese OSAT companies hold approved status either, Chinese IC designers should switch to other non-Chinese approved OSAT companies to provide attestations for their products.
Data Center End-Users in T2 Countries
Data centers in T2 countries should apply to become a National Validated End-User (NVEU) to secure access to large quantities of advanced chips required for training advanced AI models.
However, the NVEU status comes at a considerable cost. The data center management in T2 countries has until January 15, 2026, to weigh factors such as the scale and compliance resources of their operations, whether the country allocation quota meets their business demands, their willingness to disclose its trade secrets to the U.S. government, the importance of their business ties with China, and perhaps most crucially, the long-term outlook for China’s leadership in AI technology. If the overall assessment suggests aligning more closely with U.S. rather than Chinese technology, pursuing NVEU authorization is likely the most strategic choice.
Export controls are inherently leaky—they are not walls, but speed bumps. They will be circumvented, and they will never be airtight. While the BIS could enhance monitoring capacity through adequate staffing, budget, and technology deployment, it is crucial to recognize the limitations of this approach—the regulatory framework will always be reactive rather than proactive. As such, the United States should be clear-eyed about its purpose—which is to degrade Chinese AI capabilities in the short term and provide a window of opportunity for the United States to extend its lead. But this window is finite, and if the United States does not capitalize on it, it risks squandering the very advantage these controls were meant to protect.
To maintain leverage over the long run, the United States should focus just as much on outpacing China technologically as it does on restricting its access. The U.S. export control regime currently leverages U.S. technological superiority to assert extraterritorial jurisdiction globally. Should this technological advantage erode, the efficacy of the export control regime would likewise diminish. Therefore, safeguarding U.S. leadership in technology should take precedence over pursuing the strictest possible export controls.
Crucially, this must be done with allies, not despite them. The AI supply chain is too globalized, too interdependent for the United States to act alone. Policies that impose additional costs—such as semiconductor tariffs on key allied manufacturers as well as reducing the size of markets for U.S. and allied companies—risk dragging down U.S. AI competitiveness, as well as that of the broader democratic bloc, at the very moment it needs to reach escape velocity.
Running faster and holding the line are not opposing imperatives; they are one and the same.
Fang-Wei Lin was formerly a legal counsel at Taiwan Semiconductor Manufacturing Company based in San Jose, California. She is a qualified attorney in California. The views expressed in this article are solely those of the author and do not reflect the opinions of any company or agency. Barath Harithas is a senior fellow with the Economics Program and the Scholl Chair in International Business at the Center for Strategic and International Studies in Washington, D.C.
