Licensing Implications of May 31, 2026 BIS Guidance on Non-Enforcement of the AI Diffusion Rule

In May 31, 2026 guidance, BIS clarified that its non-enforcement of the AI Diffusion Rule is not total.

Key points:

1. In general, BIS appears to continue to abide by its policy not to enforce the January 2025 Framework for AI Diffusion (the “AI Diffusion Rule”).
2. Moreover, it continues to apply the export control framework that existed just prior to the implementation of that rule.
3. However, because the AI Diffusion Rule reorganized several preexisting semiconductor-related restrictions—shuffling them between EAR provisions—there are some provisions that will appear to have been created by the AI Diffusion Rule that were actually created in a less expansive form earlier.
4. BIS is specifically clarifying that its non-enforcement policy does not extend to one new provision that is based on one of these pre-existing provisions.
5. It is important to note that under this guidance BIS is enforcing the post-AI Diffusion Rule version of the restriction, which is more expansive than the prior version. However, it is limiting that enforcement to cases involving specific end users. BIS is not just turning back the clock and looking at the pre-AI Diffusion version of the provision, even if the existence of a pre-AI Diffusion rule version of the provision is the rationale for permitting an expanded enforcement policy now.
6. In the specific example BIS provided, BIS explains that an end-user restriction that was previously implemented in November 17, 2023 in 15 C.F.R. § 744.23(a)(3) (via the October 2023 semiconductor rule) was “transferred” and expanded through the AI Diffusion Rule, finding a new home in § 742.6(a)(6)(iii)(A) of the EAR as a regional stability control. (Note that the end-user restriction remained in Part 744.23(a)(3) post-AI Diffusion Rule, but it no longer covered all subparagraphs of the same ECCNs—and specifically no longer controlled the .a subparagraphs at issue in this guidance.)
7. BIS now is “clarifying” that it will be enforcing § 742.6(a)(6)(iii)(A) (the version of the restriction from the AI Diffusion Rule)—not the pre-AI Diffusion Rule § 744.23(a)(3)—but only where the end-user is an entity “headquartered in, or whose ultimate parent company is headquartered in, Country Group D:5 or Macau.”
8. There is one effect of this choice that is immediately clear from the enforcement guidance: Covered items are now licensable “to Country Group D:5 and Macau-headquartered entities located outside of destinations that were subject to a license requirement prior to the AI Diffusion Rule” (that is, these items are now restricted to covered end users located anywhere in the world, rather than simply to covered end users in D:1, D:4, or D:5 countries that are not also listed in A:5 or A:6). (Emphasis added.)
9. This choice may, however, have significant knock-on consequences for parties seeking to ship covered items. To see these consequences, let’s compare the provisions:
   1. Before the AI Diffusion Rule, § 744.23(a)(3) restricted in (a)(3)(i) the export, reexport, and in-country transfer of 3A001.z, 3A090, 4A003.z, 4A004.z, 4A005.z, 4A090, 5A002.z, 5A004.z, 5A992.z, 5D002.z, or 5D992.z items when the exporter has knowledge that the recipient entity is headquartered in, or has an ultimate parent company is headquartered in, either Macau or D:5—but only where the specific recipient entity is also located in D:1, D:4, or D:5 (and not also listed in A:5 or A:6). (744.23(a)(3)(ii) also restricted the worldwide export of ECCN 3E001 (for 3A090) ‘‘technology’’ to ‘‘produce’’ commodities or software specified in ECCN 3A001.z, 3A090, 4A003.z, 4A004.z, 4A005.z, 4A090, 5A002.z, 5A004.z, or 5A992.z to the same end users located in the same countries.)
   2. In contrast, the AI Diffusion Rule’s § 742.6(a)(6)(A) imposes a worldwide license requirement on the export, reexport, or transfer of ECCNs “3A001.z.1.a, z.2.a, z.3.a, z.4.a; a; 3D001 (for “software” for commodities controlled by 3A001.z.1.a, z.2.a, z.3.a, z.4.a, or 3A090.a); 3E001 (for “technology” for commodities controlled by 3A001.z.1.a, z.2.a, z.3.a, z.4.a, or 3A090.a); 4A003.z.1.a, z.2.a; 4A004.z.1; 4A005.z.1; 4A090.a; 4D001 (for “software” for commodities controlled by 4A003.z.1.a, z.2.a, 4A004.z.1, and 4A005.z.1); 4D090 (for “software” for commodities controlled by 4A090.a); 4E001 (for commodities controlled by 4A003.z.1.a, z.2.a, 4A004.z.1, 4A005.z.1, 4A090.a or “software” specified by 4D001 (for 4A003.z.1.a, z.2.a, 4A004.z.1, or 4A005.z.1), or 4D090 (for “software” for commodities controlled by 4A090.a)); 5A002.z.1.a, z.2.a, z.3.a, z.4.a, z.5.a; 5A004.z.1.a, z.2.a; 5A992.z.1; 5D002.z.1.a, z.2.a, z.3.a, z.4.a, z.5.a, z.6.a, z.7.a, z.8.a, and z.9.a; 5D992.z.1; 5E002 (for “technology” for commodities controlled by 5A002.z.1.a, z.2.a, z.3.a, z.4.a, z.5.a or 5A004.z.1.a, z.2.a or “software” specified by 5D002 (for 5A002.z.1.a, z.2.a, z.3.a, z.4.a, z.5.a or 5A004.z.1.a, z.2.a commodities)); or 5E992 (for “technology” for commodities controlled by 5A992.z.1 or “software” controlled by 5D992.z.1.)”
10. Dense, I know. Let’s map the differences:
    1. First, the gimme. The post-AI Diffusion Rule § 742.6(a)(6)(iii)(A) imposes a worldwide licensing requirement, regardless of end user, on listed commodities. In contrast, the pre-AI Diffusion Rule § 744.23(a)(3) applies to Macau and D:5 headquartered entities (or entities with ultimate parent companies headquartered in Macau or D:5) themselves located in D:1, D:4, D:5 countries that are not also listed in A:5 or A:6. In enacting this enforcement policy change, BIS is expressly expanding enforcement for .a and related .z ECCNs to all destinations in the world when one of these end users are present.
    2. Other differences may affect exporters’ compliance obligations under the new enforcement standard, but BIS did not comment on these explicitly:
       1. Knowledge standard. While under the pre-AI Diffusion Rule § 744.23(a)(3) you must have knowledge of your counterparty’s connection to Macau or D:5 for the restriction to kick in, under the post-AI Diffusion Rule, knowledge is not required. Presumably, in invoking the post-AI Diffusion Rule standard, BIS is eliminating the knowledge requirement.
       2. License review policy. BIS states in its May 31, 2026 guidance that exporters “should continue to seek BIS licenses for such transactions.” Will BIS will use the post-AI Diffusion Rule’s licensing review policy for these items to assess license applications? Under that policy, end users in Macau and D:5 countries (or entities headquartered in, or with an ultimate parent headquartered in, either location) are subject to a case-by-case licensing policy for certain chips with lower processing power and a presumption of denial for anything else.  This would actually be more beneficial to exporters than the licensing review policy under the pre-AI Diffusion Rule’s § 744.23(a)(3) (or even under the pre-AI Diffusion Rule version of § 742.6(a)(6)(iii)), which has an across-the-board presumption of denial for exports to Macau or D:5 countries, or to any entity headquartered in, or with an ultimate parent headquartered in, the same.
       3. Covered ECCNs. The post-AI Diffusion Rule’s § 742.6(a)(6)(iii)(A) captures certain software and technology related to
          “.a” advanced computing commodities that are not captured by the pre-AI Diffusion Rule § 744.23(a)(3): Items in ECCN 3D001, 4D001, 4D090, 4E001, and 5E002. Are exports of those ECCNs also covered by this enforcement policy? BIS’s guidance document specifically calls out 3A090.a, 4A090.a, and related .z items in describing how controls have changed over time, but when describing the scope of its current enforcement policy it more generally refers to “‘.a’ advanced computing items.” As you know, “items” is a term of art in the EAR that definitionally could include software or technology, in addition to commodities. However, only the physical commodities covered by this rule have .a suffixes—which could be a clue as to BIS’s intent.
       4. License exceptions. Under the pre-AI Diffusion Rule’s § 744.23(a)(3), covered items were eligible for the following license exceptions, as documented in contemporaneous 740.2(a)(9)(ii):TMP, NAC, RPL, GOV, and TSU. Under the post-AI Diffusion Rule’s § 742.6(a)(6)(iii)(A), these items were also eligible for newer license exceptions ACA, HBM, and AIA (as described in the AI Diffusion Rule’s updated § 740.2(a)(9)(ii)), but they became ineligible for GBS or LVS—a change made in their post-AI Diffusion Rule CCL entries. The limitation on GBS and LVS was necessary because of the worldwide nature of the post-AI Diffusion Rule’s § 742.6(a)(6)(iii)(A) control—which would now consistently require a license application for shipments to Country Group B countries. BIS says in its May 31, 2026 guidance document that license exceptions referenced in § 740.2(a)(9)(ii) remain available for these transactions, but this still leave questions:
          1. Is BIS looking at the pre- or post-AI Diffusion Rule version of this provision? That is, will it allow use of license exceptions ACA, HBM, and AIA? We would anticipate that license exception AIA, which was created by the AI Diffusion Rule, would not apply because it is specific to the AI Diffusion Rule’s new 4E091—but license exceptions HBM and ACA, created in pre-AI Diffusion Rule rulemaking ( 5, 2024 and Apr. 4, 2024, respectively), could be available.
          2. Will BIS permit use of GBS or LVS (since it has not said it is enforcing the post-AI Diffusion Rule CCL entries for affected items) when shipping to a Country Group B destination?

In summary, it seems possible that BIS’s new enforcement policy restricts items and license exceptions beyond those it has clearly articulated—and we simply do not know for certain what is covered on the current framing.

One silver lining: Though this restriction was designed (even from its origin in Part 744) to restrict shipments to “PRC-headquartered cloud or data server providers” located outside of the PRC, BIS notes in this guidance that “bona fide operators of data centers who are otherwise engaged in activities consistent with the EAR are not required to cease the ongoing use, storage, disposal, or servicing of advanced computing items because of this guidance, until further notice from BIS.”