On 17 October 2023, the US Department of Commerce’s Bureau of Industry and Security (BIS) issued two new Interim Final Rules (collectively, the Updated Rule) that significantly revise and expand controls under the US Export Administration Regulations, 15 C.F.R. part 730 et seq. (EAR), on semiconductor manufacturing equipment (SME), integrated circuits (semiconductors or ICs), and supercomputers. The Updated Rule revises comprehensive regulations that BIS issued last year on 7 October 2022 imposing broad new export controls relating to semiconductor and advanced supercomputing technology (the 7 October Rule), which we described in a prior alert, available here. Final versions of the two regulations were published in the Federal Register on 25 October 2023, and are available here and here.

The 7 October Rule, also issued as an Interim Final Rule, represented a significant sea change in US export control policy. Notably, the 7 October Rule introduced expanded export controls on SME, advanced ICs, and supercomputers; created new SME, advanced IC, and supercomputer end-use restrictions for items subject to the EAR; created new foreign direct product rules tied to certain entities or activities; and introduced restrictions on US person dealings related to such items anywhere in the world, even where no products subject to the EAR were involved. 

BIS issued some guidance providing interpretations of the 7 October Rule following its issuance, but follow-on amendments were expected to further clarify (and likely build on) those restrictions. The Updated Rule reflects an effort by BIS to both expand and streamline the 7 October Rule by enacting key revisions that tailor its application and close loopholes that limited its effectiveness over the year since its issuance. While the 7 October Rule was targeted primarily at exports to and operations in China (PRC) and Macau, the Updated Rule expands certain restrictions to other countries including Vietnam, the United Arab Emirates, Egypt, Oman, Qatar, Bahrain, Saudi Arabia, and more.

The Updated Rule includes several key revisions that are likely to be impactful to companies operating in this space. Most critically, the Updated Rule imposes more expansive license requirements on additional SME and ICs with lower performance parameters. In addition, over the past year, BIS observed certain PRC entities using third countries to divert or access restricted items. On this basis, BIS has expanded the geographic scope of these restrictions in order to prevent circumvention via third countries by expanding licensing requirements to cover additional destinations. 

The following is a high-level summary of the most salient changes coming out of the Updated Rule. 

FOCUS ON ARTIFICIAL INTELLIGENCE

First, the various revisions made by the Updated Rule share a common theme: BIS’s primary concern in issuing the Updated Rule is to ensure continued US technological leadership in the field of artificial intelligence (AI). Many of the technologies subject to the 7 October Rule are instrumental in training large AI models. In the intervening year, many AI companies released their technology publicly, thus demonstrating the powerful capabilities of modern AI systems, most notably with the release of large language models like ChatGPT.

The Updated Rule, BIS stated, is designed to “strengthen and improve those controls by addressing national security concerns that have come to light through open-source reporting, public comments, and the intelligence community.” Accordingly, the Updated Rule adds restrictions on technology that furthers development of advanced AI systems and closes loopholes that enabled entities with AI commercial and research ties to the PRC to circumvent prior regulations.

ADDITIONAL CONTROLS ON SME

A significant change resulting from the Updated Rule is the control of additional SME. In the Updated Rule, BIS expanded the scope of the SME export controls to capture additional tools and equipment critical to the development of certain advanced ICs, revised the Export Control Classification Numbers (ECCNs) of previously controlled SME, and expanded the SME controls to restrict exports to additional destinations. 

The controlled SME, including newly controlled items, are now captured under ECCN 3B001.a.4, c, d, f.1.b, and k to p. Newly controlled items include certain equipment and components for the most advanced IC production operations, such as extreme ultraviolet (EUV) etching and advanced deposition processing.

Items previously controlled under ECCN 3B090, which are further detailed in our alert on the 7 October Rule, have changed ECCNs to now be controlled under certain provisions of 3B001 found within 3B001.d.1–4 and 3B001.d.6–8. ECCN 3B090, which was created in the 7 October Rule. BIS also made certain changes to the exact parameters of the controls for SME initially captured by 3B090. Exporters of items previously categorized under this ECCN will therefore need to reevaluate their products under 3B001. 

All of the newly controlled items under 3B001, as well as items moved from 3B090 to 3B001, will now require a license for export, re-export, or transfer to or within all destinations in Country Group D:5 (i.e., US Arms Embargoed Countries, including the PRC) as well as Macau.

In addition, BIS has also revised existing ECCN 3B001.f.1 to add controls in 3B001.f.1.b for equipment having a light source wavelength equal to or longer than 193 nanometers (nm) meeting specified parameters and to add two paragraphs to ECCN 3B001.f.1.b.2 to capture items with either: (a) maximum dedicated chuck overlay less than or equal to 1.50 nm, or (b) greater than 1.50 nm but less than or equal to 2.4 nm. 

In a major change, items categorized under new ECCN 3B001.f.1.b.2.b will no longer be eligible for de minimis treatment under the EAR in certain circumstances. The new “0% De Minimis Rule,” as termed by BIS, specifies that there will be no de minimis level for lithography equipment or specially designed items, therefore meeting the parameters of ECCN 3B001.f.1.b.2.b when destined for use in the development or production of “advanced-node integrated circuits.” Accordingly, foreign-produced items meeting the parameters of the control will be considered “subject to the EAR” and controlled under US export control laws when containing even minimal amounts of US origin value content. However, the 0% De Minimis Rule will not apply when the country from which the foreign-made item was originally exported or re-exported controls the item under its own export controls. 

BIS also added new paragraph3B002.c to ECCN 3B002 to control inspection equipment designed for EUV mask blanks or EUV patterned masks, which will be subject to national security and regional stability (RS) controls. For all of these ECCNs, EUV has now been defined in the EAR’s standard definition section. 

Lastly, BIS added a new Temporary General License for certain exports, re-exports, or transfers to or within a country in Country Group D:5 or Macau in order to afford some leeway in adjusting to the new restrictions for companies headquartered in the United States or other destinations in Country Group A:5 or A:6. 

ADDITIONAL CONTROLS ON SEMICONDUCTORS

BIS also expanded the scope of ECCN 3A090 to capture a variety of additional ICs, with the stated purpose of controlling ICs that “could provide nearly comparable AI model training capability as those controlled” in the 7 October Rule. 

BIS expanded ECCN 3A090.a to now broadly control ICs with one or more digital processing units having either (a) a “total processing performance” of 4800 or more, or (2) a “total processing performance” of 1600 or more and a “performance density” of 5.92 or more. 

ECCN 3A090.b now controls ICs with one or more digital processing units having either (a) a “total processing performance” of 2400 or more and less than 4800, and a “performance density” of 1.6 or more and less than 5.92; or (b) a “total processing performance” of 1600 or more, and a “performance density” of 3.2 or more and less than 5.92.

Calculation of “total processing performance” and “performance density” for these purposes must be made pursuant to the Technical Notes to 3A090. 

At the same time, BIS created a carve-out in Note 2 to ECCN 3A090 from control under ECCN 3A090 for certain ICs that are not designed or marketed for use in datacenters with a “total processing performance” of less than 4800. 

Finally, while the 7 October Rule controlled items specified in other ECCNs meeting or exceeding the parameters of ECCN 3A090 or 4A090, BIS has cleaned up the language by identifying the affected ECCNs and instead creating new paragraphs in each of the relevant ECCNs for items meeting or exceeding the controlled parameters. The new controls are identified by “.z” paragraphs, and they can be found in 3A001.z, 4A003.z, 4A004.z, 4A005.z, 5A002.z, 5A004.z, 5A992.z, 5D002.z, and 5D992.z. 

BIS expanded the license requirement applicable to all items controlled under ECCN 3A090, as well as items controlled under “.z” paragraphs on the basis that they meet or exceed the relevant performance parameters. Now, pursuant to RS controls, a license will be required for any destination specified in Country Groups D:1, D:4, or D:5 that is not also specified in A:5 or A:6. By this expansion, a license will be required for export of controlled ICs to certain common trading partners, such as Vietnam, the United Arab Emirates, and Egypt. 

UPDATED LICENSE EXCEPTIONS AND LICENSE REVIEW POLICIES 

Notwithstanding the expansions to ECCN 3A090, BIS did incorporate certain more favorable license exceptions and license review policies for a subset of items and destinations subject to the new controls. 
In a major change, the Updated Rule adds a license exception, License Exception Notification Advanced Computing (NAC), to create what is essentially a notification requirement for certain exports of certain less sophisticated ICs now controlled under 3A090. License Exception NAC may be used for exports, re-exports, or transfers to or within Country Groups D:1, D:4, and D:5 of (a) ICs controlled under 3A090.b, and (b) ICs controlled under 3A090.a that are not designed or marketed for use in a data center, provided that the shipments meet a variety of criteria specified in the License Exception NAC. 

However, for exports or re-exports to Macau or destinations specified in Country Group D:5, a new mandatory 25-day advance notification process will be required to take advantage of License Exception NAC. The process will utilize the same BIS systems used to process and check the status of license applications, the Simplified Network Application Process – Redesign (SNAP-R) and the System for Tracking Export License Applications (STELA). Notifications must be filed in SNAP-R, and BIS will thereafter have a 25-day period during which to review the notification and object. Automatic notification will be provided by STELA at the end of the 25-day review period with either an “NAC Confirmation Number” that must be submitted in the Automated Export System at the time of export or notification that you cannot use License Exception NAC. 

In line with BIS’s intent to have greater visibility into exports of 3A090 products, BIS also created a favorable license application review policy for exports to newly controlled destinations. License applications for items controlled under 3A090 will now be reviewed under a presumption of approval if the items are destined to a party outside of Country Group D:5 or Macau. 

NEW END-USE RESTRICTIONS

The Updated Rule also moderately revised the supercomputer and semiconductor manufacturing end-use controls set out in 15 C.F.R. § 744.23, and it added two entirely new end-use controls. 

First, a new “Advanced Computing” end-use rule, set out in 15 C.F.R. § 744.23(a)(3)(i), states that a license will be required for the export, re-export, or transfer (in-country) to or within any destination not specified in Country Groups D:1, D:4, or D:5 (excluding those also identified in Country Groups A:5 or A:6) of items subject to the EAR and specified in ECCNs 3A001.z, 3A090, 4A003.z, 4A004.z, 4A005.z, 4A090, 5A002.z, 5A004.z, 5A992.z, 5D002.z, or 5D992.z (essentially, any items meeting the specifications of 3A090 and 4A090, including the new “z.” paragraphs added as part of the Updated Rule) when the exporter has “knowledge” that the item is destined for any entity headquartered in, or whose parent is headquartered in, Macau or a country in Country Group D:5. 

BIS framed this control as a way to prevent companies from “setting up cloud or data servers in other countries to allow these headquartered companies of concern to continue to train their AI models in ways that would be contrary to U.S. national security interests.” According to BIS, this control is “intended to target entities of concern, such as a PRC-headquartered cloud or data server provider located outside of China in a destination other than Country Groups D:1, D:4, or D:5, excluding any destination also specified in Country Groups A:5 or A:6.”

Second, BIS created a new end-use control to capture “technology” that is subject to the EAR pursuant to specified direct product rules, and specified in ECCN 3E001 (for 3A090), when that technology is developed by entities headquartered in (or whose parent is headquartered in) Macau or a country in Country Group D:5. This restriction is intended to prevent circumvention of the intent of the relevant foreign direct product rules, preventing production of advanced computing items produced with certain direct products exported from Macau or any other destination in Country Group D:5. 

On top of adding two new end-use controls, BIS made certain revisions to existing supercomputer and semiconductor manufacturing end-use controls. First, BIS reorganized the regulation to renumber the paragraphs of 15 C.F.R. § 744.23, and it expanded the country scope of each of the rules to cover not only the PRC and Macau, but all destinations in Country Group D:5. The “supercomputer” end-use rule is now set out in 15 C.F.R. § 744.23(a)(1), the “advanced-node IC” end-use rule is now set out in 15 C.F.R. § 744.23(a)(2), and the SME end-use rule is now set out in 15 C.F.R. § 744.23(a)(4). 

As part of this reorganization, BIS simplified the language of the controls by grouping the three specified advanced-node ICs outlined in the advance-node IC end-use rule into a new defined term for “advanced-node IC” in 15 C.F.R. § 772.1. BIS thereafter revised the language of the advanced-node IC end-use rule—which initially imposed restrictions on shipments destined to certain “semiconductor fabrication facilities” that fabricate advanced ICs—to more broadly apply to any facilities where “production” occurs. “Production,” according to BIS, is a term already clearly defined in the EAR and better understood than “fabrication.”  

BIS also revised the language to clarify that a facility where only development activities occur, such as purely design work, would not fall within the scope of the controls. Likewise, BIS created an exclusion to the restrictions, carving out from “production” certain “back-end” steps like assembly, testing, and packaging, which would not alter the technology level of the semiconductors. 

On the SME end-use rule, which originally restricted end uses for the development or production of SME, BIS narrowed both the product and end-use scopes. As revised, the rule’s application will be limited to items subject to the EAR and specified on the Commerce Control List that are destined for use in so-called “front-end” integrated circuit production equipment and other items specified in ECCNs in Category 3, Part B of the EAR’s Commerce Control List. As with the advanced IC fabrication end-use revisions, BIS intends to prevent the rule from restricting processes that do not change the technology level of an IC. 

BIS also included a limited exclusion for items subject to the EAR that are exported, re-exported, or transferred for use in the “development” or “production” in Macau or any destinations specified in Country Group D:5 of masks and reticles specified in 3B001.g, 3B001.h, 3B001.j, or 3B991.b.2 for fabricating ICs that are not “advanced-node integrated circuits.” However, the advanced-node IC end-use restrictions must still be reviewed and may still restrict the shipment.

REVISIONS TO US PERSONS REGULATIONS

Lastly, a groundbreaking change coming out of the 7 October Rule was the introduction of expanded controls on US person activities involving semiconductor manufacturing, advanced ICs and supercomputer activities in the PRC, which are set out in 15 C.F.R. § 744.6.

As with the end-use controls, BIS expanded the geographic scope of each of the US person restrictions to apply to Macau and destinations specified in Country Group D:5. 

In addition to making minor revisions to clarify the US person restrictions (including consistent with FAQ responses previously published by BIS), BIS also made certain revisions consistent with the changes described above to the end-use provisions relating to advanced IC production. This included adopting the same revisions to control activities of US persons involving any facilities where “production” occurs, as well as similar interpretations on the scope of the language used in this control. BIS also added the same exclusion for “back-end” production steps that do not impact the technology level of an IC. 

Finally, BIS added an exclusion from the US person restrictions on advanced IC manufacturing end uses (those set out in 15 C.F.R. § 744.6(c)(2)(i) through (iii) only) for natural “U.S. persons” employed by or working on behalf of companies headquartered in the United States or a country in Country Group A:5 or A:6 that are not also majority owned by entities headquartered in Macau or a destination in Country Group D:5. Certain additional exclusions were also added to avoid restricting servicing by US persons of items at certain legacy-node facilities. A specific review of any exclusions will be necessary before relying on these new carve-outs. 

ADDITIONAL GEOGRAPHIC SCOPE EXPANSION FOR ADVANCED COMPUTING FDPR

As is clear throughout the Updated Rule, new geographic scope revisions are extensive and intricately imposed. While most restrictions have been expanded to cover only US Arms Embargoed Countries (Country Group D:5) and Macau, other restrictions, including in particular those imposed on ICs under 3A090, apply to all of Country Groups D:1, D:4, and D:5 (with the exception of a handful of countries also identified in Country Group A: 5 or A:6). While we have noted the various expansions throughout, exporters must ensure that they carefully assess the exact geographic scope changes impacting each of their items and customers. 

On top of the various changes detailed herein, BIS also broadened the country scope of the advanced computing foreign direct product rule (Advanced Computing FDPR), which we detailed in our prior alert. The Advanced Computing FDPR will now apply to any destination specified in Country Groups D:1, D:4, or D:5, excluding destinations also specified in Country Groups A:5 or A:6. Furthermore, the country scope will apply worldwide wherever the direct product will be destined to a company headquartered in (or whose parent is headquartered in) one of these destinations. 

ENTITY LIST ADDITIONS

In conjunction with the Updated Rule, BIS added two PRC companies, Moore Threads Technology and Biren Technology, along with their various subsidiaries, to the Entity List. BIS designated the entities to the Entity List for engaging in the development of advanced computing ICs, which the US government has determined to be contrary to national security interests because of the ICs’ ability to “be used to provide [AI] capabilities to further development of weapons of mass destruction, advanced weapons systems, and high-tech surveillance applications.” The Public Inspection Notice is available here. A license is required for the export, re-export, or transfer of all items subject to the EAR to the designated entities. 

ALLUSION TO POTENTIAL FORTHCOMING CLOUD COMPUTING CONTROLS

As speculated over the last few months, BIS included a nod to potential future controls on cloud computing in the Updated Rule. Specifically, at the end of the Updated Rule, BIS included some questions on topics for further comment from the public. The very first question focused on potential control of infrastructure as a service (IaaS). BIS advised that it is seeking comments on addressing “access to ‘development’ at an infrastructure as a service (IaaS) provider by customers to develop or with the intent to develop large dual-use AI foundation models with potential capabilities of concern, such as models exceeding certain thresholds of parameter count, training compute, and/or training data.”