AI chip export controls explained: US rules and who can get GPUs

The United States controls exports of its most advanced AI chips through licence rules run by the Commerce Department's Bureau of Industry and Security (BIS). Whether a country, or a company in it, can buy those chips depends on where it is, who owns it and what BIS has approved. The rules changed several times between 2023 and July 2026.

This guide is built from official US government documents as of 19 October 2026: BIS guidance, press releases, a final rule and Federal Register records. Where a document's detail is not covered, it says so. It covers US rules only, it is general information and not legal advice, and anyone shipping or buying controlled chips should rely on counsel and the current regulation.

Key numbers at a glance

• 17 November 2023: the end-user licence requirement for advanced computing items going to entities headquartered in Country Group D:5 or Macau was first introduced, according to BIS guidance of 31 May 2026 (the October 2023 BIS press release gave 16 November 2023 as the chip rule's effective date).
• 15 January 2025: BIS published the "Framework for Artificial Intelligence Diffusion" interim final rule, 90 FR 4544 (Federal Register).
• 13 May 2025: BIS announced it would rescind the AI Diffusion Rule, two days before its compliance requirements were due on 15 May 2025, and said a replacement rule would follow (BIS press release, 13 May 2025).
• May 2025: US and UAE signed an Artificial Intelligence Cooperation framework (BIS press release, 10 July 2026).
• 15 January 2026: BIS published a rule, 91 FR 1684, moving licence review for certain chips to China and Macau from "presumption of denial" to "case-by-case" (Federal Register).
• 31 May 2026: BIS issued guidance that the 2023 headquarters-based licence requirement is still enforced. FAQ updated 17 June 2026.
• 10 July 2026: BIS announced it would move the UAE from Country Groups D:3 and D:4 to A:5 and approve the UAE Government and certain companies to receive advanced computing items license-free.
• 14 July 2026: the UAE final rule was published in the Federal Register as document 2026-14132 (91 FR 43034), effective 10 July 2026.
• 7 April 2026: BIS extended the timeline for "Approved IC Designer" applications to 31 December 2026 (BIS home page).
• Product categories named: Export Control Classification Numbers 3A090 and 4A090, plus related ".z" items such as 5A002.z.1.a.
• Chip ceiling for case-by-case review to China and Macau (January 2026 rule): total processing performance (TPP) below 21,000 and total DRAM bandwidth below 6,500 GB/s, with the Nvidia H200 and AMD MI325X named as examples.
• Shipment cap (same rule): exports to China and Macau no more than 50 percent of the aggregate TPP shipped to US customers for the same product.

The basic idea: a licence, not a ban

The Export Administration Regulations (EAR) are the US rules for exporting items with possible military use. Each controlled item has an Export Control Classification Number (ECCN). Two matter here: 3A090 covers advanced integrated circuits (the chips), and 4A090 covers computers that contain them. Related ".z" paragraph items include networking gear that contains such chips.

A licence requirement means an exporter must ask BIS for permission before shipping to certain destinations or users. It is not an outright ban. BIS can approve, deny or approve with conditions. A licence exception is a pre-approved route that lets some shipments go without an individual licence.

Chips are controlled for a reason that has little to do with the shipping lane: the same hardware that trains a chatbot can train systems with military uses. The rules are therefore written around who the buyer is and where the machines will sit.

How the rules developed

The sequence below follows the official documents in date order.

2023: controls by who owns the buyer. The BIS guidance of 31 May 2026 explains that on 17 November 2023, BIS introduced a licence requirement for advanced computing items going to entities headquartered in Country Group D:5 or Macau, or whose ultimate parent company is headquartered there, even if the entity sits somewhere else. Country Group D:5 is a list in the EAR (supplement no. 1 to part 740). The effect: moving a data centre to a third country does not remove the requirement if the owner or its parent is headquartered in a listed place.

2024: data centre authorisations and other changes. The Federal Register lists a 2 October 2024 document titled "Expansion of Validated End User Authorization: Data Center Validated End User Authorization" and a 5 December 2024 document on the foreign-produced direct product rule for advanced computing. Their detail is not covered in this guide. BIS's home page also lists a 16 January 2025 rule titled "Implementation of Additional Due Diligence Measures for Advanced Computing Integrated Circuits", which set up a route for "authorized IC designers" to overcome certain licence presumptions; on 7 April 2026 BIS extended the timeline for those applications to 31 December 2026.

January 2025: the AI Diffusion Rule. The Federal Register summary says this interim final rule revised controls on advanced computing chips, added a control on model weights for certain advanced closed-weight AI models, added licence exceptions, and updated the Data Center Validated End User authorization to ease exports to destinations that do not raise national security or foreign policy concerns. BIS described the changes as meant to build secure ecosystems for the responsible diffusion and use of AI. It moved the 2023 requirement for the most advanced chips into a new worldwide licence requirement. The rule sorted countries into tiers, and BIS later said it would have downgraded dozens of countries to "second-tier status".

May 2025: rescission announced. On 13 May 2025, BIS announced it was rescinding the AI Diffusion Rule, whose compliance requirements were due to take effect on 15 May 2025. Under Secretary Jeffrey Kessler told BIS enforcement officials not to enforce it. BIS said it planned to publish a regulation formalizing the rescission and "will issue a replacement rule in the future", without a date. The same announcement carried guidance warning about the risks of using certain Chinese advanced chips, including specific Huawei Ascend models, about letting US chips be used to train or run Chinese AI models, and about diversion tactics. As of 19 October 2026, BIS has not announced a replacement rule on its home page.

January 2026: China and Macau. The rule titled "Revision to License Review Policy for Advanced Computing Commodities" changed BIS review policy for certain semiconductor exports to China and Macau from a presumption of denial to case-by-case review. The rule text sets a ceiling: a TPP below 21,000 and total DRAM bandwidth below 6,500 GB/s, naming the Nvidia H200 and AMD MI325X as examples. TPP, or total processing performance, is BIS's measure of how much arithmetic a chip can do; DRAM bandwidth is how fast it moves data to and from memory. Chips under that ceiling qualify only if they are commercially available in the US and the exporter certifies several conditions:

• Enough US supply that no US customer order is delayed, and no diversion of foundry capacity from US customers.
• Aggregate exports to China and Macau of no more than 50 percent of the aggregate TPP shipped to US customers for the same product.
• Know your customer procedures at the buyer to block unauthorized remote access, plus a list of any cloud customers located in, or with parents headquartered in, Belarus, China, Cuba, Iran, Macau, North Korea, Russia or Venezuela.
• Review of every shipment, before export, by a qualified third-party testing lab headquartered in the United States with no stake in the exporter or buyer.

The rule keeps a presumption of denial for exports to entities headquartered in Macau or Country Group D:5 when they are located elsewhere. A case-by-case review is not an approval, and BIS has not published how many licences it has granted. The timeline of each China rule from 2022 onward is set out in US AI chip export controls on China.

May and June 2026: the headquarters rule still applies. BIS received questions about whether the 2023 rule was still enforced for entities located outside previously licensed destinations. Its guidance of 31 May 2026 says yes: a licence is required for these items to any destination outside the United States when they are for entities headquartered in, or whose ultimate parent is headquartered in, Country Group D:5 or Macau. The non-enforcement policy applies only to the extent the items are not for such entities. An FAQ updated 17 June 2026 clarifies the guidance covers the 3A090.a chips and all other advanced computing items containing them, including 4A090.a and related ".z" items. The guidance also says bona fide data centre operators who are otherwise engaged in activities consistent with the EAR are not required to stop ongoing use, storage, disposal or servicing of such items because of the guidance, until further notice.

July 2026: the UAE. BIS's press release of 10 July 2026 says the UAE will move out of Country Groups D:3 and D:4 into A:5. The UAE Government and approved commercial entities become eligible for license-free exports under Strategic Trade Authorization for a list of items, and Commerce is approving the UAE Government and certain companies to receive advanced computing items in the UAE license-free, including chips and servers. BIS ties this to the US-UAE AI Cooperation framework signed in May 2025 and says the UAE reaffirmed its investment commitments, including matching investments in US digital infrastructure. It cites the UAE's status as a US Major Defense Partner and its "commitment to preventing the diversion and misuse of sensitive U.S. technology." The Federal Register final rule was published on 14 July 2026 (91 FR 43034) and states that it took effect on 10 July 2026, the day of the announcement. It amends parts 740, 742 and 774 of the EAR. The press release does not state the criteria used to approve individual companies.

What this means for where labs build

Four practical consequences follow from the documents above.

1. Ownership matters as much as location. The 2023 headquarters-based requirement means a lab or cloud with a parent in a listed place cannot sidestep the rule by building in a third country. Whether a given owner needs a licence at a given site depends on the rule text and any approvals, which this post does not attempt to resolve.

2. A country can move. The UAE changed category in July 2026. A site plan that assumed the earlier status would have needed a licence route, and one made in July 2026 may not.

3. Approvals can be entity-specific. The UAE release says approved companies, not all companies, get the license-free treatment, and it does not list the criteria. A country-level upgrade does not automatically cover every buyer.

4. Data centre operators are given some continuity. BIS says bona fide operators need not stop ongoing use because of the May 2026 guidance, until further notice. That language protects installed capacity but is explicitly temporary.

The compute commitment explainers show the chip mix of each lab: Anthropic's compute spending, OpenAI's 26 gigawatts and the chip market overview. Export rules are one reason labs spread across several chip platforms and several countries. The wider site-choice question is in why labs pick one country over another.

Common misunderstandings

• "Chips are banned in X." Controls are licence requirements with different review policies by destination and user. A destination can be licensable but approved for specific buyers.
• "Third-country data centres avoid the rules." The headquarters-based requirement says otherwise for owners with a parent in Country Group D:5 or Macau.
• "The AI Diffusion Rule is the law today." The rule was published in January 2025, and BIS announced its rescission in May 2025, told enforcement staff not to enforce it, and promised a replacement. Check the Federal Register for the formal rescission and any replacement before relying on either.
• "A country upgrade means free shipping for everyone." The July 2026 UAE release lists approved entities, not all entities.
• "Software and model weights are never controlled." The January 2025 rule added a control on certain closed model weights, and that rule has since been announced as rescinded. Separately, the January 2026 China rule requires cloud buyers not to pass model weights trained on the licensed chips to undisclosed users.

What is firm and what is uncertain

Firm, because the official texts state it:

• The headquarters based licence requirement for Country Group D:5 and Macau entities, as restated on 31 May 2026 and clarified in the 17 June 2026 FAQ.
• The ceiling and conditions of the January 2026 China rule.
• The May 2025 rescission announcement and its promise of a replacement.
• The UAE's move to Country Group A:5, effective 10 July 2026.

Uncertain or not covered here:

• Whether a formal replacement for the AI Diffusion Rule has been issued.
• How many licences have been granted under the January 2026 policy. BIS has not published figures.
• The criteria for approving individual UAE companies.
• Arrangements for Saudi Arabia or other countries, which this guide does not cover.
• Rules of other governments, including export or import controls in China, the Netherlands, Japan or the EU.
• Individual exporters' licence conditions, so no claims are made about approvals actually granted.

What to watch next

• The Federal Register notices and BIS guidance pages, which are where changes appear first.
• Whether other countries follow the UAE's reclassification.
• The unresolved date for ending the data centre operators' continuity language.
• Whether the case-by-case policy for China and Macau produces published approvals.
• The 31 December 2026 deadline for Approved IC Designer applications, which BIS extended on 7 April 2026.
• A replacement for the AI Diffusion Rule, which BIS promised in May 2025.

If you want to know what software and AI components your own systems depend on, Safeguard offers SBOM and dependency scanning, with a free scan at https://gold.safeguard.sh/scan.

Quick check

Sources

• Guidance Regarding Enforcement of License Requirements for Advanced Computing Items for Entities Headquartered in Country Group D:5 and Macau, BIS, 31 May 2026.
• FAQ on the May 2026 guidance, BIS, updated 17 June 2026.
• Department of Commerce eases export controls for UAE, BIS, 10 July 2026.
• Enhanced Favorable Treatment for the United Arab Emirates Under the Export Administration Regulations, Federal Register record, 14 July 2026.
• Revision to License Review Policy for Advanced Computing Commodities, Federal Register record, 15 January 2026.
• Revision to License Review Policy for Advanced Computing Commodities, public inspection copy of rule 2026-00789, BIS, January 2026.
• Framework for Artificial Intelligence Diffusion, Federal Register record, 15 January 2025.
• Department of Commerce announces rescission of the AI Diffusion Rule, BIS, 13 May 2025.
• Bureau of Industry and Security home page, as of 19 October 2026.

Last reviewed: 19 October 2026.