Quantum Computing Export Controls & Deemed Exports

Quantum computing research sits at an unusual intersection of export control law: it is simultaneously some of the most fundamental, publication-driven physics and engineering research happening at US universities, and — since a September 2024 rule from the Bureau of Industry and Security (BIS) — a category of technology the US government now treats as sensitive enough to control the same way it controls semiconductor manufacturing equipment. That combination catches research-compliance offices off guard: quantum groups often assume that because their work is unclassified, university-based, and intended for publication, export control simply doesn’t apply. It can, and the rules that determine when it does are specific enough that a general “we do fundamental research” answer is not sufficient on its own.

This guide covers what changed, which items and activities are now in scope, and — the part that actually determines day-to-day lab practice — when giving a foreign national access to quantum hardware, software, or technical data counts as a deemed export requiring a license. For the general mechanics of deemed exports and the fundamental research exclusion outside the quantum-specific context, see CASRAI’s Export Control (EAR/ITAR) and International Research Collaboration and Deemed Export Screening at Lab Onboarding guides — this page assumes that baseline and focuses on what’s different for quantum.

What changed: the September 2024 BIS rule

On September 6, 2024, BIS published an interim final rule adding and revising Export Control Classification Numbers (ECCNs) on the Commerce Control List (CCL) to bring quantum computing items, along with certain semiconductor manufacturing and additive manufacturing items, under the Export Administration Regulations (EAR, 15 CFR Parts 730-774) for the first time in this level of detail. The rule was coordinated with allied governments that adopted parallel controls around the same time, which is why several of its provisions are structured around a “delayed compliance” window for allied destinations rather than taking effect uniformly on day one.

Effective date: September 6, 2024, for most provisions.
Delayed compliance date: November 5, 2024, for exports, reexports, and transfers (in-country) of certain quantum computing items to specified allied/partner destinations — giving institutions and exporters a window to prepare license applications rather than an immediate cutover.
Scope: according to industry legal summaries of the rule (Covington & Burling, Mayer Brown, and university export-control offices including Lawrence Berkeley National Laboratory’s), it revised or added roughly two dozen ECCNs spanning Commerce Control List Category 3 (electronics, including the quantum-specific 3A901/3D901/3E901 and 3A904/3B904/3C907-909 series) and Category 4 (computers, including 4A906/4D906/4E906), covering quantum computers, dilution refrigerators and other cryogenic support equipment, qubit-control electronics, related materials, and the software and technology used to develop or produce them.

The precise ECCN list and parameter thresholds move. BIS revises the CCL on its own schedule, and the exact classification of a specific instrument, control system, or software package is a fact-specific determination your institution’s export-control officer (often the “empowered official” for ITAR purposes and the equivalent point of contact for EAR — see CASRAI’s Empowered Official guide) needs to make against the current CCL text, not this page. Treat the categories above as “where to start looking,” not a substitute for a classification request.

What’s actually controlled

The rule does not control “quantum computing” as an abstract field of study — it controls specific listed items and the technology/software needed to develop or produce them. In practice, a university quantum program is most likely to encounter EAR jurisdiction on:

Quantum computers and quantum computing platforms above certain qubit-count and error-rate thresholds specified in the relevant ECCNs — most academic-scale prototype and NISQ (noisy intermediate-scale quantum) systems fall below the thresholds that trigger the strictest controls, but this must be checked against current parameters rather than assumed.
Dilution refrigerators and other cryogenic cooling equipment used to bring superconducting-qubit systems to millikelvin operating temperatures — a dual-use item with applications well outside quantum computing, now captured more specifically for quantum use.
Qubit control and readout electronics, including certain specialized signal-generation and amplification hardware.
Software and “technology” (in the EAR sense — technical data and know-how, not just source code) specifically designed for the development, production, or use of controlled quantum items.

Standard laboratory equipment, general-purpose electronics, and open-source or widely published quantum-computing software toolkits are not automatically swept in just because they’re used in a quantum lab — classification turns on the specific item’s technical parameters, not the fact that “quantum” appears in the grant title.

Deemed exports: the part that actually governs daily lab access

A deemed export occurs when controlled technology or source code is released to a foreign national inside the United States — no border crossing required. Under the EAR, “release” happens through visual inspection of controlled equipment or documents that reveals controlled technology, oral exchange of controlled technical information, or granting a foreign national access to controlled technology such that “technology” is released to them (15 CFR 734.15). For a quantum research group, the practical trigger points are the same as any other controlled-technology lab, just with quantum-specific equipment and data as the subject:

A new international graduate student or postdoc is trained on a controlled dilution refrigerator’s operating procedures, calibration routines, or control software before their access has been screened.
A visiting scholar is shown qubit-control-system schematics, firmware, or characterization data that falls under a controlled ECCN.
Controlled technical data about a quantum device’s design or fabrication process is discussed in a lab meeting, shared over email, or posted to an internal (non-public) wiki that foreign-national lab members can access.

None of this requires anything to physically leave the country. The release happens the moment a covered person can see, hear, or use the controlled information — which is why deemed export screening has to happen at onboarding, before lab access is granted, not after a problem surfaces. CASRAI’s Deemed Export Screening at Lab Onboarding checklist covers the mechanics of that screening step in detail.

Where the fundamental research exclusion does — and doesn’t — help

The EAR’s fundamental research exclusion (grounded in the National Security Decision Directive 189 policy that basic and applied research intended for open publication should generally remain unrestricted) means that “technology” released as part of fundamental research — research whose results are ordinarily published and shared broadly in the scientific community, without restriction — is not subject to the EAR’s deemed-export controls in the first place. This is why most university quantum physics research continues to operate the way it always has: publishing results, presenting at conferences, and admitting international students without needing an export license for the underlying physics.

The exclusion has real limits that quantum programs hit more often than most fields, precisely because quantum hardware development sits closer to controlled equipment than most fundamental research:

It covers research results and information, not the controlled equipment itself. The fundamental research exclusion can protect the published output of an experiment; it does not by itself authorize giving an unscreened foreign national hands-on access to a controlled dilution refrigerator’s proprietary control system or a controlled instrument’s technical manuals.
It stops applying once publication restrictions attach. A sponsor-imposed prepublication review clause, a proprietary-information nondisclosure agreement tied to industry-funded quantum hardware work, or acceptance of access/dissemination controls on a project breaks fundamental research status for that specific research — a common trigger in quantum programs that partner with industry or work under classified or controlled-but-unclassified government contracts.
It does not cover technology or software that is itself export-controlled independent of any research result — for example, controlled control-system software licensed from or developed with a commercial partner, which the university did not generate as its own fundamental research output.

Institutions that assume “we’re a university, this is fundamental research, we’re covered” without checking whether a specific quantum project actually meets the fundamental research test — publication intent, no access/dissemination restrictions, no proprietary-technology inputs from a sponsor — are the most common failure pattern research-security offices report in this space.

Foreign-national access rules: grandfathering, license exceptions, and restricted destinations

The September 2024 rule includes several provisions specifically aimed at reducing disruption to institutions and companies that already employed foreign nationals in roles touching newly controlled quantum technology:

Grandfathering for existing employees. Foreign-national employees who already had access to the newly controlled technology or software and remained employed as of the rule’s effective date generally do not need a new deemed-export license to continue that same access in their existing role. This grandfathering is narrower for certain semiconductor-manufacturing technology tied to nationals of the most sensitive destination groups — check current guidance rather than assuming grandfathering applies uniformly across every controlled category.
License exceptions for allied destinations. The rule created new license exceptions intended to let deemed exports and physical exports of quantum computing items proceed without a case-by-case license when the foreign national’s most recent country of citizenship or permanent residency is an allied or partner country with its own equivalent controls — narrowing, but not eliminating, the license requirement for nationals of those countries.
New employees and nationals of restricted destinations still generally require screening and, often, a license. A newly hired lab member — or a long-standing member moved into a new role with new access — who is a national of a country in the more restrictive country groups under the EAR is the scenario most likely to require an actual license application rather than reliance on an exception, and is exactly the case a pre-onboarding deemed-export screen is designed to catch before access is granted rather than after.

Because the specific country groupings, exception numbers, and grandfathering carve-outs are the part of this rule BIS is most likely to keep amending, treat any specific list you’re given (including this page’s description above) as a starting point to verify against the current Commerce Control List and your institution’s export-control office — not as something to rely on unchecked a year or more after publication.

Building a quantum-specific technology control plan

Most research-security offices handle newly controlled quantum items the same way they handle any other EAR/ITAR-controlled research: through a Technology Control Plan (TCP) scoped to the specific lab, equipment, and personnel involved, rather than a blanket institutional policy. For a quantum program, that typically means:

Classify before you build the plan. Get an actual ECCN classification (or a documented “no license required” / EAR99 determination) for the specific hardware, software, and technical data the lab holds, from your export-control office or a qualified classification request to BIS — not an assumption based on “quantum” appearing in the grant abstract.
Screen every new lab member before access, not after. Citizenship/permanent-residency status, restricted-party screening, and a documented deemed-export determination belong in the onboarding sequence for anyone who will touch controlled equipment, software, or technical data — see the onboarding checklist for the step-by-step version of this.
Separate the fundamental-research track from the controlled-technology track within the same project where they diverge. A quantum hardware project can have a fundamental-research physics output (publishable, open) sitting alongside a specific piece of controlled infrastructure (a sponsor-restricted control system, for instance) — the TCP needs to draw that line explicitly rather than treat the whole project as uniformly covered by the fundamental research exclusion.
Document access, not just eligibility. A TCP that lists who is authorized to access what, physically restricts controlled equipment areas, and logs training completion is what an institution produces if BIS or an internal audit asks how a specific deemed-export decision was made.
Revisit the plan when the underlying research or personnel changes — a new industry sponsor, a new controlled instrument, or a new hire from a restricted destination each independently re-triggers the classification and screening steps above.

CASRAI’s Four Pillars of Export Control Compliance guide covers how a compliance office structures this kind of program at the institutional level (policy, training, screening, and enforcement) if your institution doesn’t yet have a working TCP process to plug quantum-specific items into.

Frequently asked questions

Does deemed export law apply to a foreign postdoc using a university’s own quantum computer?

It can, depending on what the postdoc has access to. Using a quantum computer to run experiments and interpret publishable results is generally within the fundamental research exclusion. Being trained on, or given technical access to, the controlled control systems, calibration technology, or proprietary technical data behind the machine — separate from the physics results it produces — can be a deemed export requiring screening, independent of whether the research output itself will be published.

Is “we only do fundamental research” a complete answer for a quantum computing lab?

Not on its own. The fundamental research exclusion protects research results intended for open publication, but it does not automatically cover controlled equipment access, sponsor-imposed publication restrictions, or technology/software that is controlled independent of any specific research result. A quantum program should confirm the exclusion actually applies to the specific project and equipment in question rather than treating “we’re a university” as sufficient.

Do existing international lab members need a new license under the 2024 rule?

The rule includes grandfathering provisions that generally let foreign-national employees who already had access to newly controlled quantum technology, and who remained employed as of the rule’s effective date, continue that existing access without a new license — with narrower carve-outs for certain higher-sensitivity items and destination groups. New hires and new access grants are evaluated under the current rules, not the pre-2024 baseline.

Who at a university actually makes the ECCN classification call?

Typically the institution’s export-control officer or empowered official, often working with the principal investigator to characterize the specific equipment or software, and in ambiguous cases by submitting a formal classification request to BIS. It is not a determination an individual PI or lab manager should make informally, given how fact-specific and how frequently revised the relevant ECCNs are.

Quantum Computing Export Controls: Deemed Exports and Foreign-National Access Rules for University Quantum Research