In the last few days of the Biden Administration, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) issued a flurry of new, noteworthy rules targeting national security risks in the science and technology sectors, including new export controls targeting AI, semiconductor fabricators, and biotechnology as well as a rule addressing the risks posed by connected vehicles. 

With the volume of activity in the first days of the Trump Administration, it’s perhaps easy to gloss over that these Biden-era rules – some of which make sweeping changes to U.S. policy – legally are in effect. In this regard, one of the first “Presidential Actions” taken by the Trump Administration gave federal agencies discretion to issue a regulatory freeze within 60 days of the Action (by March 21, 2025) of any rules that had not taken effect. While there is some ambiguity regarding which rules may be covered by the regulatory freeze, it appears unlikely to affect BIS’s new export controls targeting AI, semiconductors, and biotechnology -- all of which are interim final rules (“IFRs”) that took immediate effect. On the other hand, the new rule on connected vehicles is a final rule but reportedly might be subject to changes and delay as it is yet to go into effect. However, the fate of all these rules ultimately lies with the Trump Administration. The IFRs all have notice of comment periods of varying length which could cause the new Administration to re-evaluate or modify the rules – or leave them as is. A brief summary of these rules as they stand to date is provided below.

AI Diffusion Rule

On January 13, 2025, BIS released its “Framework for Artificial Intelligence Diffusion.” While BIS has controlled semiconductors and a host of other hardware and technology related to the development of AI, this was BIS’ first real foray into controlling AI models. The IFR created a two-pronged framework within the Export Administration Regulations (“EAR”) to prevent U.S. adversaries from developing competing AI models. Specifically, the new rule introduces (i) new controls on certain closed-weight AI model exports and (ii) a series of rules designed to control the diffusion of large “clusters” of semiconductors necessary to train AI models. The IFR became effective on January 13, 2025, with a public comment period through May 15, 2025.

New controls on certain closed-weight AI model exports. A new export classification, ECCN 4E091, controls the “model weights” of the most advanced AI models, defined as models that are trained on 1026 computer “operations.” Model weights help determine an AI model’s outputs in response to inputs and are produced by training the AI model on vast quantities of data. BIS acknowledges that these controls are likely prospective in that it does not believe any AI models currently meet the control parameters set out in this Rule; however, the most advanced AI models may soon reach this threshold as they become more powerful. The Rule implicitly assumes that the training of AI models will not become more efficient as the models become more powerful. A dramatic recent counterexample is DeepSeek, a Chinese large language model that early reports indicate is able to compete with some of the most powerful U.S. AI models, despite claims that it was trained using only a fraction of the computing power. As a result, there is a possibility that no AI models may ever be captured by this new ECCN.

New Rules Targeting Semiconductor “Clusters.” BIS introduced a new framework of controls and global export quotas for the exports of semiconductors and computers necessary to train AI models. This new framework separates destinations into three categories: (1) low-risk destination countries specified in a new Supplement No. 5 to part 740, (2) high-risk destinations that are listed in Country Group D:5 (including China), and (3) all other countries, which are treated as medium risk. License requests for exports to low-risk locations will be subject to a presumption of approval, while license requests for exports to high-risk locations will be subject to a presumption of denial. Additionally, BIS introduced three new license exceptions, the availability of which depends largely on whether the destination is classified as a low-, medium-, or high-risk country.

The new framework also revised the Data Center Validated End-Users program, which allows certified end-users to receive a certain amount of computing power calculated on a per-company, per-country basis without a license. These new changes effectively operate as an export quota system, giving BIS the ability to cap the amount of computing power a country can receive.

For more information on the new AI-related export controls, please see our companion publication: BIS Issues Long-Awaited Export Controls on AI 

Semiconductor Fabricators Export Controls

On January 15, 2025, BIS issued an IFR designed to increase the export control compliance obligations of semiconductor fabricators. The rule is one of a series of significant chip-related controls, put in place in October 2022, October 2023, and most recently in December 2024, intended to slow China’s development of its semiconductor sector and military.¹ The rule has an effective date of January 16, 2025, a January 31, 2025, compliance date for certain obligations, and a notice and comment period that runs through March 14, 2025.

The new rule is intended to address the risk that integrated circuit (“IC”) designers may misrepresent the performance capabilities and their designs to the fabricator manufacturing the IC, preventing the fabricator from determining the correct export control classification (ECCN) and related export restrictions of the semiconductor they have manufactured. Specifically, the new rule imposed a presumption that any “applicable advanced logic integrated circuit” that a “front-end fabricator” or “outsourced semiconductor assembly and test” company seeks to export is classified under ECCN 3A090.a and subject to the same restrictions. The presumption can only be overcome if certain conditions can be met, such as if the IC designer is “approved” or “authorized.”

For more information on the new semiconductor fabricator-related export controls, please see our companion publication: BIS Issues Export Control Compliance Requirements for Semiconductor Fabricators

Biotechnology Export Controls

On January 15, 2025, BIS issued an interim final rule that amends the EAR to address concerns about the misuse of certain biotechnology equipment and technology by foreign adversaries (the “Biotech Export Control Rule”). The rule’s preamble notes that the “responsible use of biotechnology, particularly when combined with advances in artificial intelligence (AI) and data sciences, is essential to safeguard public health, agriculture and food development.” Highlighting why biotechnology is increasingly in the crosshairs of U.S. national security policy, the rule also notes that “dual-use biotechnology, particularly when coupled with AI and biological design tools, could strengthen the military capabilities of countries of concern and lower barriers to the design, deployment, and use of novel weapons.”

Effective January 16, 2025, with a notice and comment period through March 17, 2025, the Biotech Export Control Rule impacts two types of biotech products: (1) high-parameter and spectral flow cytometers and cell sorters; and (2) certain liquid chromatography mass spectrometers (LC/MS) “specially designed” for top-down proteomic analysis. According to BIS, these instruments are “highly suitable for generating large, detailed biological datasets, which can be analyzed to discover complex patterns governing the function of biological molecules, cells, and organisms” and can be used to gain asymmetric military advantage by other countries.

The Biotech Export Control Rule moves high-parameter flow cytometers and LC/MS for top-down proteomics from their current control under ECCN 3A999 into a new ECCN 3A069. Related technology for the development or production of items controlled under ECCN 3A069 is now covered under new ECCN 3E069. For controlled devices, a license will be required for all export destinations, except those in close U.S. allies (i.e., Country Group A:1). There is a presumption of denial for export license applications destined for high-risk or embargoed countries (i.e., Country Group D:1 and D:5, Macau, and Country Group E).

For more information on the new Biotech Export Control Rule, please see our companion publication: BIS Increases Export Controls on Key Biotech Equipment

Connected Vehicles Rule

On January 14, 2024, BIS released a final rule prohibiting specific imports and sales of completed connected vehicles that incorporate Vehicle Connectivity Systems (VCS) hardware and/or Automated Driving Systems (ADS) software with a sufficient nexus to China or Russia (the “Connected Vehicle Rule”). BIS had previously published a Notice of Proposed Rulemaking in September 2024 and an Advance Notice of Proposed Rulemaking in March 2024 culminating in this final rule. The final Connected Vehicle Rule imposes three restrictions on the sale or import of new connected vehicles that are passenger vehicles and less than 10,001 pounds.²

Specifically, the Connected Vehicle Rule prohibits:

• VCS hardware importers from knowingly importing VCS hardware that is designed, developed, manufactured, or supplied by persons “owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia;”
• connected vehicle manufacturers from knowingly importing or selling completed connected vehicles that incorporate VCS and/or ADS software from persons “owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia;” and
• connected vehicle manufacturers “owned by, controlled by, or subject to the jurisdiction or direction of the PRC or Russia” from knowingly selling completed connected vehicles that incorporate VCS hardware or covered software, regardless of whether such VCS hardware or covered software is designed, developed, manufactured, or supplied by persons with a sufficient nexus to the PRC or Russia.

The Connected Vehicle Rule introduces new annual reporting requirement for VCS hardware importers and connected vehicle manufacturers. Additionally, BIS has the authority to issue general or specific licenses to allow for activities prohibited by the rule.

Because the rule was issued as a final rule but is slated to come into effect on March 17, 2025, President Trump’s 60-day Regulatory Freeze Presidential Action might subject it to further changes and delay.

For more information on the new Connected Vehicles Rule, please see our companion publication: BIS Issues the Final Connected Vehicles Rule, But Trump’s Recent Presidential Action Throws Implementation into Question