On May 31, 2026, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) issued guidance (May 2026 Guidance) clarifying that a BIS export license is required to export advanced computing items to entities headquartered in Country Group D:5 (which includes China) or Macau, or whose ultimate parent company is headquartered in Country Group D:5 or Macau, even if the entity receiving the items is physically located outside those jurisdictions. This BIS export license requirement was first established in November 2023 and remains fully in force, notwithstanding BIS’s May 2025 announcement that it would not enforce certain new compliance requirements introduced by the January 2025 “Framework for Artificial Intelligence Diffusion” rule (AI Diffusion Rule).
Background
In November 2023, BIS published an interim final rule regarding the export of certain advanced computing items and supercomputer and semiconductor end uses (November 2023 IFR). The November 2023 IFR imposed a license requirement on advanced computing items, including items classified under Export Control Classification Numbers (ECCNs) 3A090.a and .b, 4A090.a and .b, and related “.z” items, when destined for entities headquartered in Country Group D:5 or Macau or for entities whose ultimate parent company is headquartered in those jurisdictions. Products covered under these ECCNs include certain advanced computing integrated circuits, computers, electronic assemblies, and components containing such integrated circuits.
In January 2025, BIS moved the license requirement for some of these items to a different section of the Export Administration Regulations (EAR) as part of the AI Diffusion Rule’s broader worldwide licensing framework. See 15 C.F.R. 742.6(a)(6). The AI Diffusion Rule also expanded the regulatory regime beyond the November 2023 IFR by adding controls on certain closed-weight AI model weights and creating new destination-based licensing tiers and license exceptions for advanced computing items.
In May 2025, BIS announced that it would not enforce the AI Diffusion Rule’s new compliance requirements (the Non-Enforcement Policy). However, the Non-Enforcement Policy did not serve as a formal rescission of the AI Diffusion Rule or change any of the pre-2025 license requirements for advanced computing items, leaving the possibility of inadvertent violations due to industry-wide confusion as to how to apply the Policy. Now, one year later, BIS has clarified that the Non-Enforcement Policy did not eliminate or suspend the preexisting November 2023 IFR, which imposed a license requirement for transactions involving Country Group D:5- or Macau-headquartered entities (including those whose ultimate parents are headquartered in Country Group D:5 or Macau).
Key Takeaways
The November 2023 license requirement remains in effect. In the May 2026 Guidance, BIS stated unambiguously that a license continues to be required for exports of covered advanced computing items to any entity headquartered in Country Group D:5 or Macau, or whose ultimate parent company is headquartered there, regardless of whether the recipient is located in a third country such as Singapore, the United Arab Emirates, or Malaysia. Exporters therefore cannot rely solely on the recipient’s physical location when evaluating licensing obligations.
The AI Diffusion Rule enforcement pause is narrower than some industry participants may have assumed. BIS explained that the Non-Enforcement Policy applies only to the AI Diffusion Rule’s newer destination-based requirements and does not excuse compliance with the preexisting D:5/Macau-headquartered licensing requirements. As a result, companies that treated the Non-Enforcement Policy as a broader relaxation of controls on GPU exports should reassess whether any recent transactions implicated this still-operative requirement.
Robust ownership and control due diligence is essential. The guidance underscores that exporters must determine not only where the immediate customer is located, but also whether the customer is headquartered in Country Group D:5 or Macau or has an ultimate parent company headquartered in those jurisdictions. In practical terms, this means that screening protocols for advanced computing transactions should include procedures to identify parent ownership and headquarters information before shipment.
BIS provided a limited temporary reprieve for bona fide data center operators. BIS stated that bona fide operators of data centers already using advanced computing items, and otherwise acting consistently with the EAR, are not required to cease the ongoing use, storage, disposal, or servicing of such items, until further notice. Further guidance or regulatory changes regarding this topic may be forthcoming.
BIS’s reference to voluntary self-disclosure may signal enhanced enforcement attention. In the May 2026 Guidance, BIS specifically directed parties to the EAR’s voluntary self-disclosure provision in Section 764.5. That emphasis may indicate that BIS expects exporters to review past transactions and promptly address any potential noncompliance involving covered advanced computing items and D:5- or Macau-linked end users.
Practical Implications
This guidance reinforces the existing regulatory framework and clarifies that exporters of advanced computing items must account for the headquarters and ultimate parent of the end user – not merely the end user’s physical location or the headquarters of the immediate customer – when assessing EAR license requirements. Companies involved in exporting, reexporting, or transferring advanced computing items may wish to review recent transactions, distributor relationships, and customer onboarding procedures to confirm that they have adequately identified D:5- and Macau-linked counterparties and, where appropriate, obtained BIS authorization. Companies that identify potentially problematic historical transactions should also consider whether a voluntary self-disclosure is warranted.