BIS Issues New Framework for AI Diffusion
Summary
On January 13, 2025, the Bureau of Industry and Security (BIS) published a Framework for Artificial Intelligence Diffusion that revises the Export Administration Regulations’ (EAR) controls on advanced computing integrated circuits (ICs) and adds a new control on artificial intelligence (AI) model weights for certain advanced closed-weight AI models. This framework seeks to control the spread of advanced AI technology in a manner that promotes its potential economic and social benefits, while also protecting U.S. national security and foreign policy interests. The rule requires compliance starting 120 days after the rule is published in the Federal Register—which is expected on January 15, setting a May 15, 2025 compliance date.
The framework is built on a three-part strategy: (1) imposing a global licensing requirement on advanced computing ICs and model weights of the most advanced AI models to any end user in any destination; (2) providing licensing exceptions for destinations, end users and advanced compute IC quantities that pose a comparatively low risk of diversion or misuse and (3) imposing security conditions in destinations outside the United States that pose heightened risks where advanced models are stored and large IC clusters are built.
In summary, the framework implements this three-part strategy by:
- Adding a control for AI model weights in the most advanced closed-weight AI models under new Export Control Classification Number (ECCN) 4E091 (open-weight models whose model weights are freely available to the public are not controlled)
- Expanding the license requirements and revising the review policy for ECCNs 3A090.a, 4A090.a, and corresponding .z items
- Expanding the country's scope of the License Exception Advanced Computing Authorized (ACA);
- Adding new License Exceptions Artificial Intelligence Authorization (AIA), Advanced Compute Manufacturing (ACM) and Low Processing Performance (LPP) that apply to advanced computing ICs, AI model weights and related items
- Adding new red flag guidance related to AI model weights
- Bifurcating the Data Center Validated End-User Authorization into Universal and National Validated End-User Authorizations and adding obligations for Data Center VEU applicants
- Updating the License Exception Notified Advanced Computing (NAC) notification procedures
- Expanding the destination scope of the advanced computing foreign direct product (FDP) rule to align with new licensing requirements and adding a new FDP rule for the AI model weights in ECCN 4E091.
