Individual goods chosen for export by US companies are governed either by the Department of State (ITAR) or the Department of Commerce, never both. Companies that export licensed goods (and information) must therefore potentially navigate two different systems for export, one more stringent than the other.
The Export Control Reform Act of 2018 sought to build a bigger wall around fewer products while simplifying export for many others whose “dual usedness” was deemed less of a concern to national security. Dual use means the goods are for consumer/industry use and ALSO applicable for military use. This shift in governance strategy made many goods much simpler to export by moving them from the Department of State’s control to the Department of Commerce’s purview. In some instances, an additional effect also moved classification from “need to license” to “can use a license exception,” which is a simpler process available to many Department of Commerce regulated goods. Simpler by far.
Rapid technology change since the Export Control Reform Act necessitates review and some further and more restrictive changes. Here are technology areas to watch for newer and future impact and planning to the international supply chain for those goods (and deemed exports) originating from the US.
Refer to Section 1758 of the Export Control Reform Act and its language attempting to address authorization of exports of (then) future technology. New controls, new reasons.
Semiconductors
Where are semiconductors governed? That’s a tricky question. For many, even advanced semiconductors, the answer is the US Department of Commerce’s ECCN (Export Control Classification Number). The Advanced Computing Chips Rule of late 2023 targeted “advanced semiconductors” and their manufacturing equipment with a goal of restricting access of these goods by licensing shipments to recipients in countries deemed of national concern. Specifically named ECCN classifications were 3A090, regarding integrated circuits, and 4A090, items that use these circuits.
After noting ECCNs assigned at time of classification of goods, the shipment licensing process also considers the shipment country of the intended recipient in controls put in place to determine whether a license is required. Additionally – adding complexity to compliance – The Advanced Computing Chips Rule requires that parent companies of the Ultimate Consignees (recipients) of these products not be located in a list of countries controlled by a separate list of countries, some of which overlap.
Lesser but still advanced semiconductors might fall into classifications that avoid the need for an export license. A newer license exception with the code of NAC would apply here after the US government affirms whether a particular export is eligible for the less stringent compliance activity of shipping using that license exception. Determination requires time and money, both of which translate to cost.
ITAR (Department of State) lists several countries that say no to exports of this kind, so when shipping, companies should first check country, then goods, and then country again relevant to those goods.
Quantum Computing, Caution, Cybersecurity, and International Concerns
In 2024, the US government tightened export control designation regarding quantum computing as well, naming a Chinese company specialized in the technology. QuantumCTek Co, Ltd.
Many other names are listed as aliases for this company, and the Entity List features them all for stated reasons of concern regarding national security.
Sanctions and reasons for them based on perceived future capabilities of a nation state and its companies – well, that’s not an exact science.
Other countries’ actions regarding nascent quantum computing capabilities echo the US sentiment regarding quantum computing. Law-making citizens are often not technology experts, so the resulting language is vague at best. With much to do with theory, emerging capabilities, and stated cybersecurity concerns, governments are planning as a form of perceived action-taking. Follow the Wassenaar Agreement countries and their stances regarding qubits and a limit of 34 qubits.
Double-edged sword? Could be unintended consequences, as the pace of change may find this potentially arbitrary qubit number to be limiting regarding research and advancement much sooner than anticipated.
AI…and AI
There’s a proposed amendment to the Export Control Reform Act specific to Artificial Intelligence called ENFORCE, Enhancing National Frameworks for Overseas Restriction of Critical Exports.
It’s a tightening of some of what was loosened in the Export Control Reform Act, somewhat vaguely, all in the name of national security.
A key language phrase as to targeted AI capabilities: “exhibits, or could foreseeably be modified to exhibit, capabilities in the form of high levels of performance at tasks that pose a serious risk to the national security and foreign policy…”
Later language addresses LLMs (large language models) by virtue of their ability to simplify access to deeply technical capabilities, presumably via prompting initiated by non-experts in the areas of weapon development and cybersecurity vulnerability exploits.
Thinking Forward
Gaps between intention and compliance-mandated actions may hamper efforts to achieve goals built on those intentions. Governance actions to ensure compliance by SMBs who export are likely to increase, increasing costs of maintaining and growing export programs where they touch or feature emerging technologies.
Governments are monoliths, and emerging technology is a nimble beast. Efforts to control innovation are implemented often after the innovation is beyond the intended control (see the AI section).
Do initiatives like the Export Control Reform Act even fit in the emerging technology realm? Should we “fail open” toward innovation as the guiding factor or “fail closed” toward controlling risk? Are guidelines, best practices, and frameworks more effective than mandates and enforcement and all of those associated costs?
