The Commerce Department is drafting a new rule to close an export-control loophole that emerged when it rescinded a Biden-era "know-your-customer" requirement. The proposed regulation would reimpose due diligence obligations on U.S. chipmakers and distributors, requiring them to verify the end users of advanced AI accelerators and GPUs - a move aimed at preventing restricted entities, particularly those in China, from obtaining chips through shell companies or intermediary countries.
Sources familiar with the matter said the earlier rescission left a gap that allowed prohibited parties to acquire chips via resellers or third-party nations without adequate screening. The new draft is designed as a more targeted version of the prior policy, focused on high-volume transactions and specific advanced chip models rather than sweeping checks on all sales. Officials said the approach balances security needs against U.S. industry competitiveness, which had complained about heavy compliance costs.
The initial rule's revocation was seen as a concession to Silicon Valley lobbyists who cited administrative redundancy and lost overseas business. But intelligence assessments later showed that some restricted Chinese tech entities obtained advanced AI hardware through buyers in Malaysia and Mexico, prompting the reexamination.
What the new draft rule changes
The proposed regulation restores a version of the previous know-your-customer mandate, but in a narrower form. It would require U.S. companies to identify and verify end users for high-performance accelerators and GPUs, while leaving mainstream commercial sales that pose minimal risk unburdened.
For legal professionals tracking compliance obligations, the distinction matters: companies will need to build verification processes into high-risk transactions and keep records without applying uniform checks to all product sales.
Status of the rule
The draft rule is under inter-agency review at the Department of Commerce, with a formal public notice and comment period expected within weeks. The White House has not publicly commented.
Analysts caution that the rule's success depends on whether U.S. companies can compete globally while validating customer identities, especially in markets with strict data privacy laws that complicate background checks. For more context on how these rules fit the wider policy environment, consider AI Governance & Policy Training. Legal professionals dealing with export controls and AI compliance may find AI for Legal Professionals relevant to understanding how such regulatory changes are structured.
Why this matters for legal professionals
If the rule goes into effect as drafted, attorneys advising AI hardware makers, distributors, or overseas affiliates will need to adjust due diligence programs tailored to high-volume deals and advanced chips. The German, law firms and corporate counsel should watch the public comment period, as the final text may rest on how the Commerce Department defines "high-volume transactions" and which chip models trigger verification. Not all deals will be treated equally - and the legal distinction between "risky" and "standard" sales will shape compliance programs.
Your membership also unlocks:
