The Biden administration recently unveiled a series of export controls targeting the transfer of advanced computing and semiconductor manufacturing items to the People’s Republic of China (PRC). These strategic measures are intended to combat the PRC’s use of artificial intelligence (AI) and other supercomputing methods to build technology such as hypersonic missiles, advanced surveillance systems, or other advanced weapons systems that could be used against the United States. They bolster similar restrictions introduced this time last year, closing loopholes that may have existed in the earlier regulations including resale to the PRC from other countries and sale of large quantities of less powerful, previously unsanctioned chips to amass computing power.

These export controls will have significant implications for the U.S. technology industry, trade relations with China, and global semiconductor supply chains. These rules will all be effective on or before November 16, 2023. The deadline for public comment is 60 days after these rules are put on public display.

What do the new rules entail?

The updates, which can be found in their entirety here, are issued by the U.S. Commerce Department’s Bureau of Industry and Security (BIS) and introduce critical changes to the Export Administration Regulations (EAR) to address national security and foreign policy concerns. These changes create expanded export controls that are aimed at limiting the number of high-performance semiconductor chips—and the machines that create them—sold to the PRC by American companies, as well as activities involving the "development" or "production" of advanced integrated circuits (packaged or unpackaged) in the PRC. Key changes include:

Expanded export control list. The rule expands the export control list, specifying items that are subject to more stringent export restrictions. These include:

• Advanced computing integrated circuits (ICs). The regulations impose export controls on certain advanced computing ICs, which are defined as microprocessors, microcomputers, microcontrollers, digital signal processors, field-programmable gate arrays, and coprocessors. These ICs are subject to controls based on their technical specifications, such as their processing speed, memory capacity, and gate count. The regulations further specify certain technical thresholds that trigger the new export controls for advanced computing ICs. For instance, microprocessors with a processing speed exceeding five gigaflops and arithmetic logic units with an access width of 32 bits or more are subject to controls (see § 744.17 of the EAR). 
• Computer commodities containing advanced computing ICs. The regulations also control computer commodities that contain the aforementioned advanced computing ICs. These commodities include desktop computers, laptops, tablets, smartphones, and servers (see § 742.4 of the EAR, referencing commodities specified in ECCNs 3B001.a.4, c, d, f.1.b, k to p, and 3B002.b and c). The controls apply to both complete systems and individual components, such as motherboards and graphics cards.
• Semiconductor manufacturing items. The regulations extend to certain semiconductor manufacturing items, which are defined as equipment, software, and technology used in the production of semiconductors. These items are subject to controls based on their capabilities and intended end-use. Examples of controlled semiconductor manufacturing items could include lithography equipment, etching equipment, deposition equipment, and metrology equipment (see ECCN 3B001.a-c).
• Transactions involving supercomputer and semiconductor manufacturing end-uses. The regulations expand controls on transactions involving items destined for supercomputer and semiconductor manufacturing end-uses. This means that companies exporting items for these end-uses must obtain additional licenses and comply with stricter requirements. For example, companies exporting items to supercomputer end-uses must obtain a Validated End-User (VEU) authorization from BIS (see § 743.1 of the EAR). This authorization verifies that the end-user is a legitimate entity and will not use the items for unauthorized purposes.

Among other reasons, the expansion seeks to address the following:

• Preventing “technical workarounds,” the rules add a “performance density parameter,” which restricts companies in restricted countries from purchasing a larger number of smaller datacenter AI chips that could be used together to function like a restricted chip (see ECCN 3A090.a).
• Addressing comments regarding the 2022 rules’ catchall restriction of chips “... identified elsewhere ... that meet or exceed the performance parameters,” the 2023 update creates new “.z” sections to nine Export Control Classification Numbers (ECCNs), which designate items that exceed the relevant performance parameters. One example includes “cryptographic equipment specially designed and limited for banking use or ‘money transactions’” that also exceeds the performance parameters (see ECCN 5A002.z).

However, exceptions to the licensing requirements are made for chips that do not have a “total processing performance” measured in TOPS aggregated over all processing units of 4800 or more (as calculated in ECCN 3A090.a) and that are not intended for use in datacenters (i.e., chips intended for consumer products such as smartphones).

Export licensing. Companies may now require export licenses for certain semiconductor-related transactions that previously did not require them. For example:

• Licensing requirements have been added for sale to all 22 countries to which the United States maintains an arms embargo. Such licenses may be requested but will be reviewed with a presumption of denial by the licensing body (see § 742.4(b)(1)(ii) of the EAR).
• To prevent third-party sales of U.S. technology to the PRC, restrictions have also been imposed on sales to other countries which fall into sanctions groups. Countries (besides Macau) that are not part of the most restricted group will be “reviewed under a presumption of approval license” unless there is significant risk that the items will be diverted or resold to a country in the most restricted group. (see § 742.4(b)(1)(i) of the EAR).
• To address the varying capabilities of such chips, the rule introduces a tiered system: for the most powerful chips (those with processing performance of 4800 TOPS or higher, as described above), licensing is required. For advanced chips that are less powerful but still could be used to train large-scale AI systems, license exceptions may be provided, but only with prenotification of the export to the government (under License Exemption NAC) (see § 740.8 of the EAR).
• Licensing requirements expanded to 28 existing entities on the entity list located in China that were added between 2015 and 2021 to address national security and foreign policy concerns (see Supplement no. 4 to § 744 of the EAR).

Deemed export rules. Although sales designated as deemed exports or deemed reexports (i.e., sales to a foreign national living in the United States) continue to be excluded from the licensing requirements under this rule, public comment has been requested regarding the potential business impacts if this exception were to be removed.

What is the impact on the semiconductor supply chain?

The new regulations have the potential to significantly affect the semiconductor supply chain, particularly in the following areas:

• Shortages of advanced computing ICs and related computers. The restrictions on exporting certain advanced computing ICs and related computers to the PRC could lead to shortages of these items in the region. This could affect Chinese companies that rely on these components for their products and services.
• Increased cost and time for exporting semiconductor manufacturing items. The new licensing requirements for exporting certain semiconductor manufacturing items to the PRC could increase the cost and time required to move these items across borders. This could affect the global semiconductor supply chain, potentially leading to delays and higher costs for manufacturers and consumers.
• Disruptions to global semiconductor supply chain. The overall impact of the new regulations could lead to disruptions in the global semiconductor supply chain. Companies may need to adjust their sourcing strategies, production plans, and pricing structures to adapt to the changing regulatory landscape. The disruptions could lead to fluctuations in the price and availability of semiconductors, affecting various industries that rely on these components. Companies may need to adjust their pricing strategies and inventory management practices to mitigate these risks.

The BIS even acknowledged as much in their announcement, going so far as conceding that the new controls have the potential to disrupt certain companies' activities involving China, especially in relation to their supply chains. 

What is the impact to companies in the semiconductor supply chain?

Companies in the semiconductor supply chain should, at a minimum, be aware of and be prepared to comply with the following under the new regulations:

• Licensing requirements. Companies must now obtain a license from BIS before exporting certain advanced computing ICs and related computers to the PRC. Similarly, a license is required for exporting certain semiconductor manufacturing items to the PRC.
• End-use controls. Companies must comply with the new end-use control for certain commerce control list (CCL) items destined for "supercomputers." This means that they must ensure that these items are not used in the development or production of supercomputers without proper authorization. Companies should maintain records of their due diligence efforts and export transactions to demonstrate compliance with the end-use controls. These records should include details about the items exported, the end-user, and the intended end-use.
• Foreign direct product (FDP) rules. Companies must comply with the new FDP rules related to advanced computing and "supercomputers." These rules require companies to obtain licenses for certain foreign-produced items that are the direct product of U.S.-origin technology or software.
• Effectiveness. The regulations are effective ranging from the date of publication (for additions to the entity list) to November 16 (for advanced computing chips rule) (the Expansion of Export Controls on Semiconductor Manufacturing interim rule is effective 30 days after publication). This means that companies must comply with the new requirements starting as soon as the date of publication. However, the BIS is interested in receiving feedback from the public about the items covered by the regulation and the scope of the new controls. Companies and individuals can submit comments during the designated comment period, which lasts 60 days from the date that the regulations were posted.

What should companies do to ensure compliance?

To ensure compliance with the new regulations, companies in this space should take proactive steps, including the following:

• Supply chain review. Conduct a thorough review of their supply chain to identify any potential risks associated with the new regulations. This includes identifying suppliers, manufacturers, and end-users of controlled items, as well as assessing the potential impact of any disruptions or restrictions. Companies should map their supply chain relationships, including suppliers, manufacturers, distributors, and end-users, to understand the flow of controlled items and potential compliance risks. This mapping should include both domestic and international entities.
• Legal consultation. Seek guidance from their trusted counsel to assess their specific compliance obligations under the new regulations. This includes understanding the licensing requirements, end-use controls, and FDP rules, as well as identifying any potential red flags or compliance gaps. Companies should consider conducting internal compliance training for employees involved in procurement, export, and supply chain management. This training should cover the scope of the new regulations, specific requirements, and procedures for identifying and handling controlled items.
• Compliance plan development. Develop a comprehensive compliance plan to mitigate any risks and ensure adherence to the new regulations. This plan should include clear procedures for identifying controlled items, obtaining necessary licenses, conducting due diligence on suppliers and end-users, and maintaining proper records.
• BIS updates monitoring. Regularly monitor the BIS website for updates on the regulations, including any changes to licensing requirements, end-use controls, or FDP rules. Companies should also closely track the public comment periods and other opportunities to provide feedback to BIS.

Takeaways

The new export controls underscore the Unites States’ commitment to ensuring dominance in the AI and supercomputer race. However, such commitment is not without cost, potentially leading to additional supply chain disruptions at a time when the semiconductor supply chain was just finding its footing following the pandemic. Understanding the scope of these new regulations, their potential impact on the supply chain, and the specific compliance requirements is crucial for semiconductor companies to navigate the changing regulatory landscape effectively. By taking proactive steps, such as conducting supply chain reviews, seeking legal guidance, developing compliance plans, and monitoring BIS updates, companies can ensure adherence to the new regulations and minimize any potential disruptions to their business operations.