Whether a GPU or ASIC SKU needs an export licence does not follow from its product name. It is a classification based on the SKU’s technical parameters, the destination, the end user and the end use. That makes it a check you run per SKU and per jurisdiction. We think the right place for it is the shortlisting gate where candidates are already reviewed for IP rating, MIL-STD-810 shock and vibration, and extended temperature range. Control thresholds and lists are revised regularly, so the check has to be run again whenever a list, a SKU revision or a destination changes. A file written on the day the shortlist was drawn up does not stay valid.
Which goods need an export licence, and where do GPUs and AI accelerators fall?
The US Export Administration Regulations (EAR) control “dual-use” items: goods with civilian uses that may also have military or other strategic applications. Items on the Commerce Control List are assigned an Export Control Classification Number (ECCN). The ECCN’s category and product group describe what the item is, and its remaining digits relate to the item’s specifications. An item can also be subject to the EAR without being listed, in which case it is designated EAR99.
In its May 2025 counter-diversion guidance, BIS says advanced computing ICs and the commodities containing them include ECCNs 3A090.a and 4A090.a, plus .z items in Categories 3, 4 and 5, such as servers classified as 5A992.z. These chips have been under BIS export restrictions since October 2022. The controls also cover commodities that contain these ICs, such as servers classified as 5A992.z, so the appliance built around the chip has to be classified too.
Classification under 3A090 turns on Total Processing Performance (TPP). A 2026 summary on the ComputeLaw blog explains it: the EAR defines TPP as 2 × MacTOPS × the bit length of the operation, summed across all processing units on the IC. 3A090.a catches an IC with a TPP of 4,800 or more, or a TPP of 1,600 or more combined with a performance density of 5.92 or more. The EU’s Annex I list also controls items by technical parameters, not product names, so a GPU card or accelerator module can fall inside or outside an entry depending on what its chips can do. This does not make every AI server a controlled item. BIS itself notes that most exports do not need a licence, and that deciding whether one does is the exporter’s responsibility.
Sorting candidate GPU SKUs into clear, licensable and presumed-denied
BIS’s export compliance guidelines set out the sequence: settle jurisdiction, confirm the ECCN by comparing the item’s technical specifications with the list, look up the destination in the EAR Country Chart, then check whether a licence exception in EAR Part 740 applies. A licence exception is an authorisation that allows an export, under stated conditions, that would otherwise need a licence. BIS suggests a decision tree with three outcomes: licence required, licence exception eligible, or no licence required. For advanced computing ICs, purchasers in Country Groups D:1, D:4 or D:5 (unless also in A:5 or A:6) are in destinations that need a licence.
The January 2026 rule shows why “licence required” is not one single outcome. For exports from the United States to China or Macau of advanced computing commodities with a TPP below 21,000 and total DRAM bandwidth below 6,500 GB/s (the rule names the NVIDIA H200 and AMD MI325X as examples), applicants who meet certain conditions move from a presumption of denial to case-by-case review. Those conditions include certifications on US supply and foundry capacity, the recipient’s security procedures, and independent third-party testing in the United States to verify the performance specifications. The testing lab must be headquartered in the US, must have no stake in the transaction, and must be able to confirm the TPP, total DRAM bandwidth, interconnect bandwidth and co-packaged DRAM capacity. The BIS press release describes the same policy.
So a shortlist needs at least four labels, not two: clear, licence exception, licence with a realistic review path, and presumption of denial. Getting there takes the parameters the rules define, not product names. “Total DRAM bandwidth”, for example, is defined as aggregate bandwidth to all DRAM, covering both HBM and GDDR. A throughput benchmark tells you nothing about which of those labels applies. Self-classification is allowed, but if the classification is wrong the exporter is liable for any resulting violation. If you cannot classify an item yourself, you can ask BIS to classify it formally.
Does an ASIC alternative carry re-export restrictions once it is integrated into our product?
Controls follow technical parameters, not whether the chip is a GPU or an ASIC. When the US government imposed a licence requirement on NVIDIA’s H20 in April 2025, it also covered “any other circuits achieving the H20’s memory bandwidth, interconnect bandwidth, or combination thereof”, which is a test of parameters, not brand or architecture. An ASIC that reaches a controlled level of performance is classified on those numbers, like any GPU. The controls also cover commodities that contain the IC, so building the accelerator into your appliance does not take it outside them.
Re-export did not get the January 2026 relaxation. Under the January 2026 rule, re-exports (including exports from abroad) and in-country transfers of these commodities to Macau or a D:5 destination stay under a presumption of denial. Location is not the only test. BIS guidance says a licence is required to export advanced computing items to entities headquartered in D:5 or Macau, or whose ultimate parent is, even when the entity itself sits outside those destinations. US jurisdiction can also reach a non-US chip: under the Advanced Computing Foreign Direct Product Rule, a foreign-made chip that meets the 3A090 or 4A090 parameters and is the direct product of specified US software or technology is subject to the EAR.
Two obligations matter in particular for anyone reselling or hosting hardware. BIS advises telling customers up front that the items are subject to the EAR and would need a licence for D:1, D:4 or D:5 destinations. It also flags that supplying advanced ICs to an Infrastructure-as-a-Service provider can trigger a licence requirement where the supplier knows the provider will train models for parties headquartered in D:5 or Macau.
How often are export-control thresholds revised, and does each SKU need a recurring re-check?
BIS revises them periodically, so a one-time classification is not enough. BIS describes its advanced-computing restrictions as updated several times since October 2022. In April 2025 NVIDIA disclosed a new licence requirement on the H20 for China and D:5 destinations, and five days later was told it would apply “for the indefinite future”. AMD disclosed the same kind of new requirement for its MI308 products on 15 April 2025. The January 2026 rule then changed review policy again.
The EU list moves on a regular cycle. Annex I of the Dual-Use Regulation is typically amended at least once a year through a Delegated Act. The update adopted on 14 September 2026 adds advanced computing ICs and electronic assemblies incorporating digital processing units. It enters into force on publication in the Official Journal after a two-month scrutiny period, and as of 22 September 2026 it was not yet in force, although advanced computing controls added in 2025 already applied.
The structural risk is drift. BIS periodically revises the performance parameters behind semiconductor ECCNs, so a chip that was under the threshold when classified can cross it, and any program that treats an ECCN determination as permanent is exposed. In practice, we would tie the re-check to four triggers, not a calendar alone: a control-list update in any jurisdiction you ship to, a new SKU revision or firmware change that moves the parameters, a new destination, and a new customer or end use.
Running the licensing check in the same gate as ruggedisation certification
The case for merging them is our engineering judgement. Both are expensive to find out late. Spending shock, vibration and thermal test budget on a board that cannot legally ship to the target market wastes that budget. The environmental side of the gate, with its test procedures and documentation, is covered in certifying edge GPU appliances for harsh-environment deployment. The table below shows how the licensing questions sit next to it.
One gate, two sets of questions per SKU
| Gate step | Ruggedisation question | Export-licensing question |
|---|---|---|
| Fix the exact SKU | Which board, enclosure and cooling variant is under test? | Which IC is inside, and what is its ECCN (or EAR99) and EU Annex I entry? |
| Collect evidence | IP rating, MIL-STD-810 test results, rated temperature range | TPP, total DRAM bandwidth, interconnect bandwidth, co-packaged DRAM capacity |
| Bind to context | Installation environment and duty cycle | Destination, end user and end use |
| Record an outcome | Pass, conditional, fail | No licence, licence exception, licence required, presumption of denial |
| Re-open when | Hardware revision or new environment | List update, spec change, new destination or customer |
The licensing column also has an equivalent of a “conditional pass”. BIS asks exporters to have a way to stop, hold and release questionable transactions, with named authority to release or block them. A SKU waiting on a licence decision belongs in that held state, not on the approved list. BIS also recommends screening every party against the proscribed-party lists when an order comes in and again before export. We would screen at two points in the gate: once at shortlisting and once at purchase.
Once a SKU has cleared both halves of the gate, getting the workload to run well on that hardware is a separate job, the territory of GPU performance engineering.
An export control compliance checklist for each shortlisted SKU
The gate’s records should let someone outside engineering see why each SKU was approved, and on what basis. The EAR, ITAR and OFAC all require records of exports, re-exports and related activity. Cornell’s export compliance manual says EAR records are generally kept for five years from the project’s end date, and longer if BIS asks for them to be retained. The EU’s compliance guidance also covers record-keeping and registers. Per SKU, the file should hold:
- The item list with its ECCNs, which BIS’s guidance names as a documentation field.
- The technical parameters used to classify it, kept current as the specifications change.
- The classification outcome under each regime, EU and US, as one does not settle the other.
- The end-user certification, naming all transaction parties and the intended end use.
- Restricted-party screening results at intake and before export.
- The ruggedisation result for the same SKU revision, so both halves of the gate point at one item.
The gate also needs a named owner. BIS calls senior management commitment the most important factor in an export compliance program and advises written procedures covering jurisdiction, classification, licensing and screening.
EU and US clearances do not settle each other
An AI server leaving Germany or the Netherlands can fall under two regimes at once. The EU list governs the export from the Union, while the EAR can apply independently to US-origin items. An EU authorisation, or a finding that none is needed, does not settle the US position, and the reverse holds too. For exporters established in the EU, authorisations are granted by the Member State where they are resident or established. A shortlist serving several markets therefore needs a classification per regime, not one combined verdict.
The final determination needs expert review, such as by export-control counsel. The engineering team’s job is to make sure counsel gets accurate parameters and a clean record. The stakes are real: ComputeLaw’s 2026 summary puts the maximum administrative civil penalty at the greater of $374,474 per violation or twice the transaction value. BIS takes the existence and quality of a compliance program into account when it decides how to respond to a violation. In our view, the gate’s real value is less the first classification than what happens six months later, when a delegated act or a revised rule moves one SKU from clear to licensable while it is already certified, stocked and promised to a customer.
FAQ
What are the Export Administration Regulations?
The EAR are the Department of Commerce rules, at 15 CFR Parts 730-774, that govern exports of dual-use items. The Bureau of Industry and Security (BIS) is responsible for enforcing them.
What does export licensing mean?
An export licence is a written authorisation from the relevant authority, such as BIS, OFAC or DDTC, setting the terms under which a controlled export, re-export or transfer may take place.
What is an example of a dual-use item?
Cornell’s export compliance manual lists laboratory equipment such as centrifuges and analysers, and fabrication equipment such as milling machines and electronics etching equipment, as everyday examples of dual-use items.
