On January 6, 2020, the U.S. Commerce Department's Bureau of Industry and Security (BIS) released an interim final rule controlling the export of certain artificial intelligence software relating to geospatial imagery analysis (Geospatial AI software). The rule adds Geospatial AI software to the Export Administration Regulations' (EAR) Commerce Control List (CCL) and imposes a license requirement for the export, reexport (shipment from one foreign country to another foreign country), or transfer in-country (collectively "export") of the Geospatial AI software to all countries but Canada as well as for providing foreign nationals (except Canadians), including those in the United States, with access to the software's source code. This unilateral control was likely imposed by BIS in response to the Export Control Reform Act and BIS's November 2018 Advanced Notice of Public Rulemaking about the designation of emerging technologies.

What Software Is Controlled?

Consistent with BIS statements, the export control is narrowly tailored and only covers certain "software that is specially designed to automate the analysis of geospatial imagery." The controlled Geospatial AI software is limited to geospatial imagery software specially designed for training a Deep Convolutional Neural Network to automate geospatial imagery and point cloud analysis having all of the following functionalities:

• a graphical user interface that enables the user to identify objects to extract positive and negative samples of an object of interest;
• perform scale, color, and rotational normalization on positive sample resulting in a reduction of pixel variation;
• training a Deep Convolutional Neural Network to detect an object of interest from samples; and
• identifying objects using the Deep Convolutional Neural Network through a matching of rotational patterns.

If one of the above criteria is not met, then the software or source code is likely not classified under ECCN 0D521 and a license may not be required for its export. However, if a company has separate pieces of software that when combined meet the criteria for Geospatial AI software, then those pieces when working together would likely be classified under ECCN 0D521 and the underlying source code could be controlled under ECCN 0D521.

What Does the Control Mean?

Exports

As noted above, a BIS license is now required for export of the software and source code to all countries, except Canada, and a license is also required for the export or release of the source code to all foreign nationals, except Canadian nationals, whether they are in the United States or abroad. Currently, the only license exception available for exports of the software and source code is license exception GOV. License exception GOV primarily authorizes certain exports to agencies and personnel of the U.S. government, agencies of cooperating governments, and NATO agencies and will only cover a small subset of exports. The CCL does not currently include a separate entry for technology related to this software.

This rule is not an overarching restriction on the export of AI software but businesses that work with Geospatial AI software should promptly take steps to ensure compliance. Companies are strongly advised to review their software to determine whether this new classification applies, document the analysis, and implement any appropriate internal controls. As deemed exports are covered, companies that have software meeting the control criteria, including source code stored in separate pieces that collectively meet the criteria of Geospatial AI software, may need to restrict access, in whole or in part, to foreign nationals, including foreign national employees on H-1B visas, until a BIS license can be obtained. Further, a license may be required prior to the sending of bug fixes, patches, updates, etc. to existing foreign customers that previously received the software without a license.

Foreign Investments: Committee on Foreign Investment in the United States (CFIUS)

This new export control may also have a significant impact on transactions involving foreign investment into any U.S. business that works with Geospatial AI software. Such investments may now trigger a mandatory CFIUS filing, noting that the export classification alone is not necessarily dispositive. Under the current CFIUS mandatory filing rules, a filing may be required for foreign investments, controlling or non-controlling, into a U.S. business that designs, develops, tests, produces, or fabricates a "critical technology" and then uses that technology in certain industries. Due to the new export classification, Geospatial AI software is now a critical technology for CFIUS purposes.

Next Steps

Companies who work with geospatial software should perform an export classification of the software and source code as soon as possible in order to determine if it is controlled under ECCN 0D521. If the software or source code is classified under ECCN 0D521, then the company must take steps to ensure that it is not exported without the necessary license, including ensuring that foreign nationals do not have access to any controlled source code until a deemed export license is obtained. Further, it is important for companies to update their policies and procedures to cover the new control and adjust expectations regarding timing for the export of this newly controlled software as obtaining a license could take three months or more.

The penalties for and enforcement of export control violations continue to increase. Thus, companies are recommended to take steps to comply with new and already existing export controls. Effective January 15, 2020, the monetary penalty for each administrative violation of the EAR, which may be imposed on a strict liability basis, will be approximately $305,000 or twice the value of the transaction, whichever is greater.

While the new classification and resulting controls were effective January 6, 2020, BIS is accepting public comments regarding the new classification and associated controls. Comments must be received by BIS by March 6, 2020.