New BIS AI Chip Control Framework Is Good Start but Lacks Flexibility, Researcher Says
Although the Bureau of Industry and Security's new artificial intelligence export control framework published earlier this month is “promising,” it also lacks flexibility and omits some key U.S. allies, the Rand think tank said in a new report.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
The framework groups the world into roughly three categories of countries, each of which will face different export license requirements for certain advanced chips (see 2501130026), but it provides no “clear pathways” for countries to move from one group to a less restrictive one, Rand said.
“Although more structured than previous approaches, the framework’s tiered system may be too rigid,” wrote Lennart Heim, a technology and security policy researcher with the think tank.
The framework also leaves out important NATO and other allies from Tier 1 -- the group of nations that will mostly benefit from unrestricted access to certain AI technology -- such as Australia, Israel, Latvia and Estonia. Those countries are in Tier 2, meaning they will face certain license restrictions but not as strict as the ones imposed on Tier 3 nations, such as China.
“Such omissions raise questions about whether Tier 1 is drawn too narrowly and whether Tier 2 should be split further,” the report said.
The U.S. may want to consider inserting “explicit mechanisms for countries to progress between tiers,” the think tank said, including if they prove they can meet U.S. compliance and security standards. “If countries are given a set of guidelines on how they could progress between tiers, they might be more likely to cut ties with Tier 3 countries and implement necessary security controls, knowing that there is a reward for their efforts,” the report said.
Rand said the U.S. should make decisions about moving countries from Tier 2 to Tier 1 “in consultation” with other Tier 1 countries.
It also noted that even though the framework puts in place strict controls on data centers around the world, “it leaves one country mostly untouched -- the United States.” Rand said this may undercut the point of the framework’s updated validated end-user program, which requires companies to follow strict security and compliance rules for their non-U.S. data centers in order to qualify as a VEU and benefit from a separate, streamlined licensing process.
“This creates an ironic situation in which data centers located abroad under the [data center] VEU authorization may face stricter security requirements than domestic facilities where most frontier AI development actually occurs -- leaving AI infrastructure potentially more vulnerable where it matters most,” the report said.
It warned that the success of the BIS framework depends not only on the agency striking the correct export control balance, but also on BIS being able to implement the rules smoothly. “Streamlined processes and efficient program administration will likely be essential; if companies face lengthy delays or excessive bureaucratic hurdles, countries might seek alternatives to U.S. AI technology, potentially undermining the entire framework.”