The U.S. Bureau of Industry and Security (BIS) has shut down a legal ambiguity that allowed advanced AI chips to reach companies headquartered in embargoed countries, even when those companies operated outside those jurisdictions. Effective June 1, any transaction involving a firm whose parent or headquarters is in a D:5 country (including China, Russia, Iran, and North Korea) or Macao now requires a separate license—regardless of where the subsidiary or branch is physically located.

This clarification resolves confusion that emerged after the Trump administration declined to enforce the Biden-era three-tier AI chip export framework, which was never formally rescinded. BIS confirmed that the November 2023 licensing requirement for advanced computing products remains in effect for all entities registered in those embargoed nations. The practical impact on data center operators is minimal: legitimate operators already compliant with Export Administration Regulations (EAR) can continue using, storing, and maintaining existing hardware without interruption.

For engineering teams, this introduces a new compliance surface. Any supply chain or procurement pipeline that interacts with entities having a D:5 parent company—even if the local office is in Singapore, Dubai, or London—now triggers a licensing review. This shifts the burden from geography-based controls to corporate structure-based controls, requiring updated vendor due diligence and contract clauses. The rule also implies that cloud providers and colocation facilities must audit their customer base for beneficial ownership in embargoed states.

The takeaway: treat your vendor and customer lists as code. If you haven't already, add a field for ultimate parent jurisdiction to your procurement database. This loophole closure is a reminder that export controls are moving from simple zip-code checks to entity-level graph analysis.

Source: RIA Novosti