Recently, the Biden administration announced a set of regulations targeting the diffusion of advanced AI models to countries outside the US. Since these are almost certainly the last of these regulations to come out of the Biden presidency, it seems like a reasonable time to summarise the existing controls and draw out their potential impact on AI safety.

The first round of the export controls were launched on October 7th 2022, targeting China’s access to high-end semiconductors and related equipment used for training frontier AI systems. These restrictions are often identified as the start of a ‘chip war’ in which Chinese companies have fought to decouple their semiconductor supply chains from US-allied countries, and US government agencies have progressively expanded sanctions to close loopholes which allowed Chinese actors to buy restricted equipment.

These controls are arguably the most important compute governance regulations put into effect to date and provide a useful sense of how important control of frontier AI systems is to US industrial strategy. Because of this It seems important for AI safety advocates to be careful in how they orient towards these restrictions and I have seen a lot of confused attitudes about them among people who care about AI safety. 

This post will provide a nontechnical reader a primer on the existing restrictions and the strategy behind them. In a second post I’ll put forward some thoughts about how proponents of AI safety should orient towards them.

Explaining the October 7th restrictions

On October 7th, 2022, the US Department of Commerce issued a set of export controls aimed at limiting China’s access to advanced semiconductors and equipment needed to produce them. Due to how complex the manufacturing process is, there are a very small number of firms that can produce these goods – roughly all of which are based in the US, Taiwan, the Netherlands, Japan, and South Korea. Because of this, the goal was to identify chokepoints in the global supply chain and restrict access to equipment needed for large AI training runs, but without affecting the sale of semiconductor equipment used for consumer purposes.

The controls were set by the Bureau of Industry and Security (BIS) within the Department of Commerce and restricted goods on two main bases: technical specifications and end-use requirements. 

The BIS set technical thresholds beyond which any sales to a specified list of Chinese organisations deemed a threat to US interests would be restricted. This list is called the Entity List. For example, under the Oct 2022 controls chips capable of +300 tera operations per second or an interconnect speed of +600 gigabytes per second could not be legally sold to Chinese firms. In addition to the technical specifications, goods could also be restricted based on what their intended end use within China was. Chinese firms produce or design the majority of the world’s commercial use (“legacy”) semiconductors, which these restrictions don’t aim to hinder. So, selling intellectual property related to how to produce advanced EUV lithography machines would be restricted under end-use requirements because the purchaser’s intent would be to build EUV lithography machines in China, which the BIS considers a threat to US interests.

Unlike previous restrictions levied on Chinese tech companies in the late 2010s, this policy also involved coordination with key allies with significant semiconductor-related industries, including the Netherlands, Taiwan, South Korea, and Japan, to ensure a comprehensive blockade on access to cutting-edge technologies. Diplomatically, this is a somewhat costly move, as this imposes significant loss of business for the affected firms in these countries. The willingness to pay these costs suggests a growing acknowledgment that the US views progress in AI as a significant axis of international competition.

The restrictions laid out in Oct 2022 were progressively amended in Oct 2023 and Dec 2024 to address loopholes and cover previously unsanctioned areas of high performance computing. The details of which components are covered matters a lot for how effective the controls are in practice, but all three rounds of restrictions fit within a similar strategic framework, which I think it is useful to explain.

Two key ideas underlie the restrictions:

1 - The Chokepoint Theory

The first idea is that companies based in the US or allied countries have dominant control over the most advanced parts of the global chip supply chain, so export restrictions could fully block Chinese companies from accessing these goods. This not only included access to the chips themselves but also equipment, machinery, and software required for Chinese companies to produce these chips domestically.

In broad strokes, here are the main product categories targeted in these export restrictions as well as some of the largest companies in each sector:

The majority of leading companies in these sectors are based in the US or US-allied countries. Because of this, the sanctions were an attempt to coordinate actions between all these firms to effectively shut Chinese actors out of the advanced semiconductor supply chain. Thus, even if the Chinese government heavily invested in domestic production of advanced semiconductors, the supply chains for the necessary equipment would be ‘choked off’ by coordinated action from the US and allied countries.

While preventing Chinese companies from buying AI chips themselves is likely to be significant, the restrictions on EDA tools and fab materials are an even bigger challenge. This is because there are ways to train large AI models without necessarily having the best chips physically available. For example, Chinese firms can rent access to Nvidia’s A100 chips through cloud computing providers or potentially chain together larger numbers of less powerful chips.

Two indicators for a country’s AI chip manufacturing ability are the size of their most advanced chips and how many of them they can produce. Cutting-edge chips rely on ever-smaller manufacturing processes, where even a few nanometers represent leaps in performance. While in 2023, Chinese manufacturer SMIC surprisingly unveiled a 7nm chip in Huawei’s Mate 70 phone, China’s domestic lithography machine market struggles to produce them in sufficient numbers. For comparison, TSMC started producing 7nm chips in 2018 and produces large numbers of 3nm AI chips. In 2024 Intel even received equipment aimed at the world’s first 1nm chip. While older-generation EDAs and lithography machines might offer limited workarounds, the lack of access to state-of-the-art tools is a substantial bottleneck for China's semiconductor ambitions.

2 - Small Yard, High Fence

US National Security Advisor, Jake Sullivan, described the controls as a “small yard, high fence” approach in which a small number of technologies are tightly controlled, but the rest of the industry is unaffected. This meant access to standard semiconductors used in most applications aside from frontier AI development  and certain military technologies would not be affected by the restrictions. The same was true for older generations of chip fabrication machines and design software.

When crafting restrictions, you often need to trade off between comprehensiveness, enforceability, and imposing externalities on the industries. For example, a policy of complete prohibition on selling missiles in purple crates would likely be easy to enforce, but would not be comprehensive enough to prevent the target country from acquiring missiles, since they could buy them in green crates.

I would argue that in practice the “Small Yard, High Fence” approach prioritizes avoiding externalities over enforceability and comprehensiveness. Even when setting narrowly defined technical thresholds and end-use restrictions, you leave open a host of ways companies can find legal ways to purchase the restricted goods, increasing the complexity of enforcing the restrictions. Narrowly tailored technical thresholds risk being less comprehensive, while narrow end-use restrictions increases the number of buyers who can purchase the goods – potentially enabling wider smuggling networks.

Both US and Chinese companies worked to find and exploit loopholes in the regulations, which has meant that Chinese companies have had some access to relevant technologies for the last two years. On the US side, Nvidia responded to the October 7, 2022, restrictions by introducing the H800, a chip that reduced its interconnect speed to 400 GB/s, but was otherwise very similar to their top of the line H100 chips. On the Chinese side, companies on the Entity List created a network of shell companies or built bridges between restricted fabs to unrestricted ones through which they could evade end-use restrictions.

In addition to exploiting legal loopholes, Chinese firms have built up a network with buyers outside China to re-import restricted goods into China. This further complicates the Small Yard, High Fence approach, because it requires the BIS to enforce end-use restrictions across multiple countries and across a much wider range of entities that normally would not require scrutiny from BIS.  

A snapshot of the updates to the restrictions

In Oct 2023 and Dec 2024, the BIS introduced updates to the restrictions, largely focused on closing loopholes and expanding the number of technologies covered by the restrictions. Here are the key factors in each wave of restrictions:

Oct 2022 (original)

• Chips exceeding 300 TOPS and interconnect speeds of 600 GB/s.
• Prohibited exports of EUV lithography machines and restricted advanced DUV lithography systems capable of producing chips at 16nm or below.

• Banned US persons from supporting China's semiconductor manufacturing, including servicing advanced equipment or aiding in R&D​​.

   

Oct 2023 (original)

• Adjusted the chip restrictions to be based on performance density over interconnect speeds, or chips which contravene the spirit of the original rule.
• Expanded the restrictions to cover countries which the BIS viewed as likely to illegally re-export chips to China.
• Strengthened coordination with the Netherlands and Japan on selling DUV lithography equipment to chinese firms
• Expanded the Entity List to cover more Chinese fabs and tool manufacturers.

Dec 2024 (original)

• Expanded the restrictions to cover High Bandwidth and Dynamic Random Access Memory chips (HBM and DRAM).
• Changed how the Foreign Direct Product rule could be applied to prevent countries re-exporting goods to China. 
• Significantly expanded the Entity List for fabs and tool-makers to restrict Chinese firms, particularly Huawei, from implementing new chip designs. Curiously, CXMT is excluded from the list, despite being one of the largest HBM buyers in China and Huwawei’s primary producer.
• Expanded guidance on how to prevent individuals from transferring IP about chip fabrication to organisations on the Entity List.

Jan 2025 (original press release)

• Modified the definition of restricted DRAM chips to close a commonly used loophole and encompass a much wider range of chips.
• Required broader licensing for foundries and packaging firms looking to export to companies not on a pre-specified list of trusted buyers. 
• Significantly expanded the due diligence checks a foundry needs to perform if they are exporting to a restricted country before fulfilling an order to a buyer not on the list.
• Expanded the Entity List to cover additional chip and tool design companies suspected to be Huawei shell companies.

The 2025 AI Diffusion Controls

The most recent set of controls is sufficiently different from the previous ones that it deserves its own section. The key differences are that they target the diffusion of model weights for certain closed-weight AI models in addition to semiconductor equipment, and that they set worldwide licensing rules on the number US-designed chips that can be sold to different countries. Taken together, these factors significantly influence the extent to which US AI and AI-chip technologies can be shared across the world.

Unlike the previous restrictions, these regulations don't expand limits on semiconductor technologies directly, but rather extend control to the weights of closed-weight AI models that exceed the capabilities of the best available open-weight model. Further, by using country-level blanket specifications, the rules are likely to hinder chip smuggling networks run by groups outside mainland China.

The regulations divide the world into three tiers, each of which is subject to different licensing requirements from BIS on the amount of US designed computing power they can purchase and export. Tier 1 countries include certain NATO and Five Eyes countries, as well as countries that play important roles in the global AI supply chain (e.g., Japan and South Korea). Companies headquartered in Tier 1 countries face no restrictions on the number of US-made chips or models they can purchase. If they wish to expand to non-Tier 1 countries, they need to apply for a license from BIS and follow certain security protocols to control the spread of their chips.

Tier 3 countries include most countries on which the US has imposed arms embargoes. This includes many of the US' geopolitical opponents (China, Russia, Iran, Venezuela), as well as a number of countries that are considered most likely to re-export goods to China. Tier 3 countries remain severely restricted on what chips they can purchase and are prohibited from purchasing the weights for models produced by US firms or using US chips – essentially covering all large closed-weight models.

The rest of the world, including countries like India, Singapore, Israel, and Malaysia, falls into the Tier 2 category. These countries face a cap on the amount of US-made chips (measured in total processing power) that they can purchase per year and are required to make certain security and end-use commitments (e.g., not using them for human rights violations) to ensure that their chips are not stolen or illegally re-exported. However, companies in Tier 2 countries can apply for a license from BIS to be entitled to larger processing power limits.

How do these tie together? 

The regulations demonstrate the US government's willingness to accept significant costs to ensure these controls achieve their intended effect. The economic costs of preventing some of the US’ largest firms from selling their most expensive products in China are not trivial. Further, the semiconductor industry was not exactly entirely cooperative with these policies; with Nvidia, Micron, and TSMC all having found and exploited major legal loopholes in the restrictions. Perhaps most importantly, these restrictions are sometimes hundreds of pages longer than BIS’ policies in other industries – meaning they were likely incredibly labour intensive for this key (under-resourced) department. 

Likewise, they come at a significant diplomatic cost to broader US-China relations. For instance, PRC Foreign Minister Wang Yi called them “a bewildering level of unfathomable absurdity”, Xi Xingping compared their importance to the US’ stance on Taiwanese independence, and China has sanctioned many raw materials key to the semiconductor industry in retaliation. In a context where US-China cooperation on AI governance is nominally a goal, this only makes sense if you believe restricting access to compute provides a decisive strategic advantage. Jeff Ding notes that in any world where AI does not significantly change society within ten years, these controls will simply decouple AI supply chains, antagonise China, and remove important levers for multilateral governance.

The fact that the restrictions narrowly focus on advanced AI chip technology, suggests that policymakers view AI and compute as uniquely important axises of competition.