US Export Controls and AI: What Businesses Need to Know

Understanding the Intersection of AI Regulation and Business Risk

The US government's approach to controlling exports of advanced artificial intelligence technology has become an increasingly important consideration for enterprises deploying AI tools globally. The regulatory framework governing these controls—and the practical business implications of enforcement—deserves scrutiny from any organisation integrating AI into mission-critical workflows.

This article examines the structure of US AI export controls, the legal doctrines that underpin them, the commercial risks they create for enterprises, and practical steps businesses should consider when assessing vendor risk in the AI sector.

How US Export Controls on AI Technology Work

The primary legal instrument governing US technology exports is the Export Administration Regulations (EAR), administered by the Commerce Department's Bureau of Industry and Security. These regulations restrict the transfer of sensitive technologies to foreign nationals and foreign entities—a framework that has existed for decades but has taken on new urgency in the context of advanced AI systems.

The EAR framework includes several mechanisms through which restrictions can be applied:

The Deemed Export Doctrine

One aspect of export control law that is less widely understood is the concept of a deemed export. Under this legal doctrine, sharing controlled technology with a non-US citizen inside the United States is treated identically to physically exporting that technology to a foreign country. This means that:

• An AI model shared with a non-US citizen working in a US office is legally equivalent to exporting that model to their country of origin.
• Companies employing non-US nationals must ensure those employees do not access export-controlled AI systems without specific authorisation.
• The burden of verification falls on the company deploying the technology.

This doctrine creates a compliance challenge for multinational enterprises and any organisation with international workforce composition.

Informed Letters and Regulatory Enforcement

Government agencies can issue what are known as informed letters—private written notices directing a company to cease activities that were previously legal. These letters:

• Require no prior public notice or hearing process.
• Can direct immediate compliance without opportunity for adversarial challenge.
• Are issued by executive branch agencies without judicial process.
• Create immediate compliance obligations, often with very tight deadlines.

The criteria for issuing such directives can be broad. Agencies may cite concerns about potential dual-use applications—technologies that have civilian purposes but could theoretically be repurposed for defence or intelligence applications.

The Commercial and Operational Impact of Export Controls on AI Deployment

Access Restrictions and Global Operations

When export controls are applied to specific AI models or systems, the practical consequences for enterprises can be severe:

Global customer impact: Organisations that have negotiated global access agreements for AI tools across multiple regions may find those agreements voided by government action. This creates immediate disruption to international operations, particularly in financial services, technology, and regulated industries where data governance and continuity are critical.

Workforce access restrictions: Companies employing non-US citizens cannot provide those employees access to export-controlled AI tools without specific government authorisation. This creates operational friction and potential liability exposure.

Contractual continuity risk: Most enterprise AI agreements were drafted without accounting for regulatory shutdowns. Force majeure and continuity clauses typically do not address government-mandated access restrictions, creating ambiguity about liability and responsibility during regulatory actions.

The Compliance Cost Problem

When export controls are applied to an AI system:

• The affected company bears 100% of the compliance cost, including lost revenue, broken contracts, and reputational damage.
• There is no government compensation or liability for the commercial damage caused by the regulatory action.
• There is no advance notice requirement. Under current law, compliance timelines can be measured in hours rather than weeks or months.
• The standards for triggering restrictions can be broad enough to encompass most capable AI systems, creating ongoing uncertainty.

Export Controls and Product Development: The Security Trade-Off

A key tension in AI export control policy is the relationship between offensive and defensive capability.

Companies developing AI systems for cybersecurity applications often invest heavily in safety measures to limit the potential for those systems to be misused for offensive hacking or exploitation. These measures might include:

• Red-teaming (adversarial testing) before product launch to identify potential misuse scenarios.
• Conservative design choices that limit the model's capability in certain domains.
• Explicit restrictions in terms of service against offensive use cases.
• User monitoring and prompt analysis to flag suspicious activity.

However, when a government agency restricts an AI tool based on concerns about offensive capability, those restrictions typically apply equally to defensive use—finding and fixing vulnerabilities in your own systems. This creates a security paradox:

• Offensive cyber capability requires specificity, targeting, operational context, and real-time coordination. A general-purpose AI system lacks most of these characteristics.
• Defensive capability—using AI to identify and patch vulnerabilities in your own infrastructure—is broadly beneficial for the security posture of organisations across the economy.
• Blanket restrictions that treat offensive and defensive use identically degrade the defensive security posture of every organisation that relied on the tool.

This distinction matters for enterprise risk assessment: a tool restricted based on offensive concerns may still represent a net security gain if its defensive applications are more valuable than its potential for misuse.

Infrastructure Concentration and Vendor Risk

Another structural concern created by export controls on AI relates to infrastructure concentration. Most advanced AI systems are trained and deployed using cloud infrastructure provided by a small number of US-based providers. This creates several layers of vulnerability:

Single point of regulatory control: If a government agency determines that access to a particular AI system must be restricted, that restriction can be implemented immediately through control of the underlying cloud infrastructure.

Investor-competitor dynamics: In some cases, major investors in AI companies also compete with those companies and control the infrastructure on which they operate. This creates potential conflicts of interest when those investors communicate concerns to government agencies about competitors' technology.

Geopolitical leverage: Non-US governments and enterprises have observed that US-based AI infrastructure can be subject to unilateral US government control. This observation has already influenced procurement decisions and investment priorities in other regions, particularly in Europe and Asia.

What Geopolitical Observers Have Said

International responses to US AI export controls have ranged from diplomatic critique to strategic reorientation:

• EU policymakers and regulators have expressed concern that reliance on US AI infrastructure creates operational and sovereignty risks, not merely commercial ones. This concern has contributed to increased investment in EU-based AI alternatives.
• Non-US financial services firms have begun reviewing vendor concentration risk related to US-based AI providers, with some moving toward procurement strategies that favour non-US providers.
• Technology policy experts across multiple countries have noted that the ability to implement unilateral restrictions on AI access creates asymmetric leverage that favours the US government over international competitors.

These observations do not necessarily reflect criticism of the export control framework itself, but rather recognition that the framework creates strategic leverage that can be exercised with minimal advance notice.

Practical Risk Assessment for Enterprises Using AI Tools

For any organisation that has integrated AI tools into mission-critical workflows, export control risk deserves the same analytical attention as infrastructure risk, vendor concentration risk, or cybersecurity risk.

Vendor Concentration

If a single AI provider accounts for a material share of your operational capability—particularly in functions like software development, financial analysis, or legal research—a regulatory action against that provider becomes a business continuity event for your organisation.

Mitigation approach: Maintain access to at least two AI providers capable of performing critical functions. This introduces some redundancy and complexity but reduces single-vendor regulatory risk.

Contract Review and Force Majeure Language

Most enterprise AI contracts were drafted without accounting for export control interruptions. Your legal team should:

• Review existing AI vendor agreements for force majeure language and whether that language covers government-mandated access restrictions.
• Assess whether contracts include provisions requiring the vendor to notify you in advance of regulatory actions.
• Evaluate whether contracts specify liability allocation if the vendor's product is subject to export controls.

Workforce Compliance

The deemed export doctrine means that your organisation may have compliance obligations related to employee access to AI tools, regardless of your end-user geography.

Practical step: Conduct an audit of your workforce composition (specifically, the nationality and immigration status of employees who use export-controlled AI systems) and consult with your legal team about compliance obligations.

Availability Planning

Treat AI tool availability as you would treat cloud infrastructure availability. This means:

• Documenting which AI tools perform critical functions.
• Identifying whether any single tool is irreplaceable or whether backup providers exist.
• Planning for scenarios in which your primary AI provider becomes unavailable due to regulatory action, technical failure, or other causes.

The Broader Context: AI and Regulatory Risk

Export controls are one component of the broader regulatory environment affecting AI deployment. Other areas include:

• Data protection and privacy regulations (GDPR, CCPA, and sector-specific rules).
• AI-specific governance frameworks being developed in the EU, UK, and other jurisdictions.
• Sanctions and trade compliance rules that restrict technology transfer to certain countries and entities.
• Sectoral regulations (financial services, healthcare, etc.) that impose specific requirements on AI use.

Export controls differ from these other regulatory categories in their speed of implementation and the lack of advance notice opportunity. This asymmetry creates particular operational risk for enterprises.

Key Takeaways for Business Leaders and Investors

1. Export control risk is real and material for enterprises using AI tools at scale. The regulatory framework permits restrictions to be implemented with minimal advance notice and no requirement for judicial process.

2. Vendor concentration in AI creates regulatory risk, not just commercial risk. A government action against a single AI provider can disrupt your operations if that provider is your only source for critical capability.

3. The deemed export doctrine extends compliance obligations beyond your end users to your workforce. Organisations employing non-US nationals should assess their exposure under this doctrine.

4. Export controls can create security trade-offs. A tool restricted based on offensive capability concerns may deliver net security benefits through its defensive applications. These trade-offs deserve analytical attention.

5. Infrastructure concentration creates geopolitical leverage. The fact that most AI systems run on US-based infrastructure creates asymmetric control points that non-US governments and enterprises have already begun to address through alternative investments.

None of these points argue against using AI tools. The productivity and analytical benefits are well-documented across legal, financial, technical, and other professional domains. The lesson is that as enterprises deepen their reliance on AI, they should evaluate infrastructure risk and regulatory risk with the same rigour they apply to other mission-critical technology decisions.

---

This article is for informational and educational purposes only and does not constitute financial, legal, or investment advice. Export control regulations are complex and jurisdiction-specific. Organisations should consult with qualified legal counsel specialising in trade compliance before making decisions related to export-controlled technology. This article does not provide personalised legal or financial advice.

Frequently Asked Questions

What are US AI export controls and who administers them?

US export controls on technology, including AI systems, are primarily administered by the Commerce Department's Bureau of Industry and Security under the Export Administration Regulations (EAR). These regulations restrict the transfer of sensitive technology to foreign nationals and foreign entities. The framework is designed to prevent the proliferation of technologies that could be repurposed for defence or intelligence applications. The regulatory approach to AI has evolved as AI capabilities have advanced, and export control classifications for certain AI models have become more restrictive over time.

What is the 'deemed export' doctrine and how does it affect enterprises?

The deemed export doctrine treats sharing controlled technology with a non-US citizen inside the United States as legally equivalent to exporting that technology to a foreign country. Under this doctrine, a company that shares an export-controlled AI system with a non-US citizen employee—even if that employee is working in a US office—is technically engaging in an export subject to the same licensing and compliance requirements as physical export. This creates compliance obligations for any organisation with international workforce composition that uses export-controlled AI tools. Organisations should consult with legal counsel to assess their exposure under this doctrine.

How quickly can export controls be applied to an AI system, and what notice does a company receive?

Under current regulatory procedures, an agency can issue an informed letter directing a company to cease use of a previously authorised technology with minimal advance notice. The legal standard does not require advance public notice or a judicial hearing before the directive takes effect. In practice, this means compliance timelines can range from hours to days. This creates particular operational risk for enterprises that have integrated the affected technology into mission-critical workflows. Organisations should plan for scenarios in which access to a primary AI tool becomes unavailable on short notice due to regulatory action.

What should enterprises do to assess their vulnerability to export control risk?

Enterprises should conduct a vendor concentration analysis (identifying which AI providers perform critical functions and whether alternatives exist), review AI vendor contracts for force majeure and continuity provisions, assess workforce compliance under the deemed export doctrine, and maintain access to multiple AI providers for critical functions where possible. Organisations should also consult with legal counsel specialising in trade compliance and export controls. The goal is not to avoid using AI tools—which offer significant productivity benefits—but to evaluate and manage the regulatory risk associated with reliance on specific providers and infrastructure.

How do other countries view US export controls on AI technology?

Governments outside the United States have expressed concerns that US export controls on AI create operational and strategic risks for international enterprises and governments that rely on US-based AI infrastructure. These concerns have contributed to increased investment in alternative AI infrastructure in Europe, Asia, and other regions. Policymakers in other countries have noted that the ability to unilaterally restrict access to AI technology creates asymmetric leverage for the US government. However, individual countries also maintain their own export control and technology transfer restrictions. The broader trend has been toward increased regionalization of AI infrastructure and supply chains.

Does reliance on US-based AI tools still make sense given export control risks?

Yes, for most enterprises. US-based AI providers currently lead in frontier capability across multiple domains, and the productivity benefits of deploying advanced AI tools are substantial and well-documented. Export control risk is a material consideration that should inform vendor selection and redundancy planning, but it does not eliminate the business case for AI deployment. The appropriate approach is to evaluate export control risk alongside other vendor risk factors (financial stability, security practices, data governance, etc.) and to maintain some level of redundancy in critical functions. This approach allows enterprises to benefit from leading AI tools while managing concentration risk.