Export Control and AI (EAR/ITAR Applied to AI…

Export Control and AI (EAR/ITAR Applied to AI Models and Systems)

Export control and AI refers to how the US Export Administration Regulations (EAR, 15 CFR Parts 730-774, administered by the Commerce Department's Bureau of Industry and Security, or BIS) and the International Traffic in Arms Regulations (ITAR, 22 CFR Parts 120-130, administered by the State Department) apply to artificial intelligence and machine learning software, trained models, model weights, training datasets, and the underlying computing hardware used in research. An AI-related item, dataset, or system is subject to export control analysis if it is US-origin, meets an EAR or ITAR jurisdictional trigger, and either physically leaves the United States, is transmitted electronically to a destination abroad, or is released ('deemed exported') to a foreign national inside the United States who is not a US citizen, lawful permanent resident, or protected individual.

ByCASRAI Editorial Board

· Last updated 23 Jul 2026

Worked examples

Is an instance

A university lab develops a machine-learning model for satellite image analysis using techniques and datasets with defense applications. Because the underlying technology may fall under an ITAR-controlled category (e.g., certain space-related or targeting technical data), the export control office reviews the project before any foreign national research assistant is given access to the source code or training data, and before results are shared with an international collaborator.

Is an instance

A PI wants to give a visiting foreign national postdoc full access to a proprietary, closed-weight large language model licensed from a US vendor, along with its training pipeline and hyperparameters. Because release of controlled technology or software source code to a foreign national physically located in the US counts as a 'deemed export' under 15 CFR 734.13 and 734.20, the export control office first confirms whether the model, code, or technical data is subject to the EAR and, if so, whether the researcher's country of most recent citizenship or permanent residency triggers a license requirement before access is granted.

Looks similar, but isn't

Not an instance

A research team publishes open-weight model weights, along with a paper describing the training methodology, on a public repository with no access restrictions and no expectation of a right to control further dissemination. Because the EAR's 'publicly available' technology and software exclusion (15 CFR 734.7-734.11) generally removes published, freely and publicly accessible information from EAR jurisdiction, ordinary participation by foreign national students and collaborators in this kind of open publication-track research does not, by itself, trigger export control review — though the underlying training compute, hardware, or a specific funding agreement's terms can still impose separate restrictions worth checking.

Export control and AI describes the application of two overlapping US export-control regimes — the Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) — to artificial intelligence and machine learning software, trained model weights, training and fine-tuning datasets, and the specialized computing hardware (GPUs, AI accelerators) used to build and run them. This is a genuinely fast-moving area of federal regulation: the specific rules governing advanced AI models have changed more than once in the past two years, so research offices should treat any specific rule described below as a starting point for verification against current BIS guidance, not a settled, permanent framework.

Why AI research raises export control questions at all

Export control law was not written with machine learning in mind, but it applies to AI work through the same general mechanisms it applies to any other controlled technology or software: an item, piece of software, or body of technical data can be ‘subject to the EAR’ (or, for defense-related work, ITAR) based on its origin, content, and destination — regardless of whether it is shipped in a box or sent as a file. For a university research office, the practical triggers that come up repeatedly with AI projects are:

Classifying the software or model itself. Research software, including AI/ML codebases, model architectures, and in some cases trained model weights, may need an Export Control Classification Number (ECCN) determination under EAR Category 3 (electronics), 4 (computers), or 5 (telecommunications and information security), depending on what the software does and what hardware it is designed to run on.
Deemed exports to foreign national researchers. Under 15 CFR 734.13 and 734.20, releasing EAR-controlled technology or source code to a foreign national physically present in the United States — for example, giving a visiting scholar or foreign national graduate student access to controlled model internals, training code, or technical documentation — is legally treated as an export to that person’s most recent country of citizenship or permanent residency, even though nothing crosses a border. This is the single most common way AI research triggers export control review, because AI labs are often staffed substantially by foreign national students and postdocs.
Controlled or dual-use training data. Datasets containing export-controlled technical data (e.g., certain defense-related, nuclear, or advanced-sensor data) used to train or fine-tune a model can carry that data’s control status into the resulting model, complicating who may access the model afterward.
Advanced computing hardware and cloud access. High-performance GPUs and AI accelerators, and in some cases cloud-based access to clusters of them, have separately been subject to their own EAR licensing requirements aimed at restricting certain countries’ access to frontier AI-capable compute, independent of any software or model-weight question.

The fundamental research exclusion still matters — but is not automatic

Much university AI research remains outside EAR/ITAR licensing requirements because it qualifies for the fundamental research exclusion (15 CFR 734.8) or the publicly available technology and software exclusion (15 CFR 734.7-734.11): research intended for open, unrestricted publication, conducted without foreign national access restrictions, and without underlying restrictions accepted in a sponsor agreement, generally falls outside EAR jurisdiction once published or freely disseminated. But this exclusion is not self-executing. It can be lost or narrowed if a sponsor’s contract imposes publication review, foreign national access restrictions, or dissemination controls — something that shows up more often in AI research than institutions initially expect, given how much AI work is funded through defense-adjacent or dual-use-sensitive programs. Export control offices generally recommend a fundamental-research and export-control screen at proposal stage, not after a foreign national researcher has already been given system access.

BIS’s AI-specific rules: an evolving picture (REPORTED, verify current status)

Beyond the general EAR/ITAR framework above, BIS has separately attempted to regulate the most advanced AI models and computing hardware directly, and this specific layer has changed significantly and quickly:

In January 2025, BIS issued an interim final rule (the ‘Framework for Artificial Intelligence Diffusion’) that would have created a new ECCN — 4E091 — specifically controlling the export of the model weights of the most advanced closed-weight AI models, alongside a tiered country-group licensing structure for advanced computing chips.
In May 2025, BIS began rescinding that rule before its effective date, stating it intended to replace it with a different approach and issuing interim compliance guidance in the meantime (including guidance flagging Huawei Ascend chips and warning of enforcement risk around using US-origin advanced computing items to train AI models for restricted parties).
As of this writing, no replacement rule with a confirmed effective date has been published. The pre-2025 baseline EAR controls on advanced computing items and dual-use software — and the deemed-export and fundamental-research rules described above — remain the operative framework in the meantime.

Given the pace of change, institutions should treat any AI-specific ECCN or country-tier detail as REPORTED and time-sensitive, and confirm current status directly against BIS’s Export Administration Regulations and published rules (bis.gov) or their institution’s export control office before relying on it for a specific research decision.

What this looks like in practice for a research office

Institutions handling AI research with potential export control exposure typically: screen incoming awards and collaborations for foreign national access restrictions or ITAR/EAR-controlled subject matter at proposal stage; route ambiguous AI software, model, or dataset questions through the ECCN determination process; put a Technology Control Plan (TCP) in place before granting a foreign national researcher access to any project found to involve controlled technology, software, or model weights; and route escalations to the institution’s Research Security Officer (RSO) or export control officer, who is typically the point of contact tracking BIS/State Department rule changes as they affect ongoing AI projects.

Related terms

Use in your systems

JATS XML <role> element

xml

<role vocab="credit"
      vocab-identifier="https://casrai.org/dictionary/"
      vocab-term="Export Control and AI (EAR/ITAR Applied to AI Models and Systems)"
      vocab-term-identifier="https://casrai.org/dictionary/term/export-control-ai" />

Schema.org DefinedTerm (JSON-LD)

json

{
  "@context": "https://schema.org",
  "@type": "DefinedTerm",
  "@id": "https://casrai.org/dictionary/term/export-control-ai",
  "name": "Export Control and AI (EAR/ITAR Applied to AI Models and Systems)",
  "identifier": "https://casrai.org/dictionary/term/export-control-ai",
  "description": "Export control and AI refers to how the US Export Administration Regulations (EAR, 15 CFR Parts 730-774, administered by the Commerce Department's Bureau of Industry and Security, or BIS) and the International Traffic in Arms Regulations (ITAR, 22 CFR Parts 120-130, administered by the State Department) apply to artificial intelligence and machine learning software, trained models, model weights, training datasets, and the underlying computing hardware used in research. An AI-related item, dataset, or system is subject to export control analysis if it is US-origin, meets an EAR or ITAR jurisdictional trigger, and either physically leaves the United States, is transmitted electronically to a destination abroad, or is released ('deemed exported') to a foreign national inside the United States who is not a US citizen, lawful permanent resident, or protected individual.",
  "inDefinedTermSet": "https://casrai.org/dictionary/domain/research-security#set",
  "url": "https://casrai.org/dictionary/term/export-control-ai",
  "sameAs": [],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": {
    "@id": "https://casrai.org/#organization"
  },
  "dateModified": "2026-07-23T08:26:44",
  "inLanguage": "en"
}