What is the AI Diffusion Rule and why does it matter?

The AI Diffusion Rule was a sweeping set of export controls published by the US Commerce Department's Bureau of Industry and Security in January 2025. It created a worldwide license requirement for the most advanced AI chips and introduced, for the first time, export controls on AI model weights under a new classification called ECCN 4E091. The rule organized countries into three tiers with different levels of access to US AI technology. It was rescinded in May 2025 before taking effect, but the regulatory infrastructure it established continues to shape enforcement and is expected to inform any replacement rule.

If the AI Diffusion Rule was rescinded, does that mean AI export controls are gone?

No. Rescinding the Biden-era rule removed one specific framework, but existing restrictions remain in force and enforcement is intensifying. BIS simultaneously issued new guidance documents that create compliance obligations around Chinese AI chips and model training for entities in restricted countries. Chip-level controls from 2022 and 2023 remain in place, the Entity List continues to expand, and BIS has confirmed it will publish a replacement rule. Enforcement actions and criminal prosecutions for illegal chip diversion have increased.

What does ECCN 4E091 mean for organizations using frontier AI models?

ECCN 4E091 is the export classification created for closed-weight AI models trained above a specified compute threshold. While the rule that created it was rescinded, the classification framework demonstrated that BIS has the capability and intent to treat frontier model weights as controlled dual-use items. Any replacement rule will likely revisit model-weight controls. For organizations using frontier model APIs, this means their provider's regulatory status is part of their own compliance picture. If a model's weights become subject to export controls, access restrictions could flow downstream to API users regardless of where they are in the stack.

Does my location or my users' locations affect my exposure to these rules?

Yes, significantly. The country-tier framework in the Biden rule determined how much compute and which model access different countries could receive. Even with that framework rescinded, the underlying country groupings (particularly the arms-embargoed Country Group D:5, which includes China, Russia, Iran, and North Korea) remain in force. Where your data center is located, where your end users are, and where the ultimate parent of your company is headquartered all factor into whether a given transaction requires an export license. Organizations with global user bases or distributed infrastructure should be especially attentive to where AI compute and model weights reside.

What are the practical compliance steps companies should take right now?

In the current environment, practical steps include auditing your hardware supply chain to identify which chips you are using and whether they carry export control classifications; screening your vendors, customers, and infrastructure partners against BIS restricted party lists; understanding how your AI model providers classify their models and what their own compliance posture looks like; and avoiding hardware flagged in BIS guidance as likely produced in violation of US export law, specifically including named Huawei Ascend chips. Companies should also build monitoring processes for regulatory updates, since the replacement rule could arrive with limited lead time.

What is the most likely direction for US AI export policy over the next few years?

Based on public statements and observable policy patterns, the Trump administration prefers a bilateral, country-by-country approach over a global tiered framework. A replacement rule is expected to focus on individual country agreements that grant market access in exchange for commitments on security standards and diversion prevention. Controls on AI chips to China and other adversary destinations are likely to remain strict and aggressively enforced, while allied and partner country access may be handled through negotiated deal structures. Whether the replacement rule re-introduces formal controls on AI model weights is uncertain, but the regulatory infrastructure for it already exists and the strategic rationale has not changed.

AI Policy & Safety

US AI Export Controls: What They Mean for Your AI Stack

By The Agent5 founder·July 6, 2026·How we fact-check

The US government has spent the past few years turning export controls into one of the most consequential policy levers in AI. Whether you build with frontier models or run GPU-heavy workloads, understanding how these rules work, and where they are headed, is no longer optional.

ShareX LinkedIn WhatsApp

Key takeaways

The Biden AI Diffusion Rule introduced the first-ever controls on AI model weights and worldwide chip licensing requirements, but was rescinded in May 2025 before taking effect. A replacement rule is coming.
Rescission did not mean relaxation. BIS issued enforcement guidance that creates real compliance obligations around Chinese AI chips and model training for restricted entities, and criminal prosecutions for chip diversion have increased.
The H20 chip episode shows that AI hardware controls are now a diplomatic and trade bargaining tool, not just a static technical threshold. Policies can shift within weeks.
The ECCN 4E091 framework for AI model weights established regulatory infrastructure that any replacement rule is likely to build on. Organizations using frontier model APIs should treat their provider's regulatory status as part of their own compliance picture.
Reasoning about what comes next means treating AI export controls as a continuously evolving negotiation, not a stable rule set. Build operations that can adapt quickly to licensing requirements changing.

Somewhere between the chip fab in Taiwan and the API call your application makes to a frontier model, US export control law now has an opinion. That opinion has evolved quickly, lurched between administrations, and is still very much unfinished. If you interact with advanced AI hardware or closed-weight frontier models in any professional capacity, the regulatory ground beneath you shifted significantly in 2025 and is shifting still.

The Biden AI Diffusion Framework: A Three-Tier World

On January 13, 2025, BIS published what became known as the AI Diffusion Rule, a sweeping interim final rule that represented a significant departure from more targeted controls on dual-use technologies toward a more expansive, extraterritorial US approach to AI export controls.

The rule did two major things. First, it created a first-ever worldwide license requirement for the export of the most advanced AI chips, expanding restrictions that had previously applied mainly to China and arms-embargoed destinations to every country on earth. Second, and more novel, it created a new export control classification, ECCN 4E091, for the weights of advanced closed-weight AI models. Model weights, the numerical parameters that define how an AI model processes inputs and generates outputs, had not previously been controlled under US export law. They now were.

The rule organized the world into three tiers. Nineteen countries including the US, Australia, Canada, Japan, the UK, and most of Western Europe sat in Tier 1, where chip exports remained largely unrestricted subject to certification requirements. Roughly 150 other countries fell into Tier 2, a middle category subject to a complex set of compute caps and licensing requirements. Countries in Tier 3, including China, Russia, Iran, and North Korea, faced a near-total block on advanced chip exports, continuing the existing hard line.

For Tier 2 countries, the rule introduced quantitative compute limits. Companies headquartered in Tier 1 countries were restricted from deploying more than 25 percent of their total AI compute in countries outside Tier 1 jurisdictions, and no more than seven percent in any single Tier 2 country. US-headquartered companies were also required to keep at least 50 percent of their computing capacity domestically. These ratios were designed to prevent the rapid buildup of frontier AI capabilities in countries with a moderate security risk profile.

On the model weights side, ECCN 4E091 applied to closed-weight models trained using more than 10 to the power of 26 computational operations using advanced chips already controlled under US export law. Importantly, the controls applied even when training happened entirely outside US territory, using foreign infrastructure. Open-source, publicly released model weights were explicitly excluded from the new classification.

How to Think About What Comes Next

This is where reasoning in probabilities becomes genuinely useful. The AI export control situation is not a stable rule set waiting to be learned. It is an evolving negotiation between national security interests, commercial competitiveness, diplomatic relationships, and technological realities. No one knows exactly what the replacement rule will look like or when it will arrive. But the signal pattern is clear enough to make some structured predictions.

BIS has confirmed it will issue a replacement rule. The Trump administration has signaled it prefers a country-specific approach involving bilateral negotiations rather than the tiered global framework the Biden rule created. That suggests the replacement is likely to look more like a set of individual country deals, with approved market access tied to commitments on security standards and diversion prevention, rather than a single global compute cap. Countries in the Middle East, which had been downgraded to Tier 2 under the Biden rule and received favorable treatment under Trump's bilateral approach, provide the clearest illustration of what that deal structure might look like.

The harder question is whether the replacement rule will re-introduce controls on AI model weights. The regulatory machinery for it exists. The strategic logic, keeping frontier model capabilities from adversaries, has not changed. Enforcement guidance issued in May 2025 already creates functional compliance pressure around model training for Chinese entities even without a formal weights-classification rule. A replacement rule that formalizes that pressure into binding licensing requirements for the most powerful closed-weight models is a plausible outcome, perhaps the most likely single outcome if you are making a probability-weighted prediction.

For anyone building AI products or procurement strategies, the useful frame is not to ask which specific rule applies today, but to build operations that could adapt quickly to the answer changing. That means knowing which chips are in your hardware supply chain, understanding how your AI providers classify their models, and having clarity on where your data and model weights actually reside. The organizations best positioned in this environment are the ones who treat AI compliance as a continuous monitoring task rather than a one-time legal review.

US AI Export Controls: What They Mean for Your AI Stack

What Export Controls Have to Do with AI

The Biden AI Diffusion Framework: A Three-Tier World

Why the Rule Collapsed Before It Took Effect

The Enforcement Shadow Left Behind

The Chip Whipsaw: H20, H200, and the Bargaining Table

What Model-Weight Controls Mean for AI Developers

The Enforcement Trend: More Agents, More Penalties, More Prosecution

How to Think About What Comes Next

Sources