New AI export controls have leaked. Here’s what you need to know.

The new rules are squarely focused on the frontier

Update Jan 13, 2025: The rule has now been published, and is available here. The rest of this article has not been updated.

Joe Biden leaves office in just ten days — but in the meantime, his administration is reportedly trying to push through two final executive orders on AI. One will reportedly aim to accelerate the buildout of AI infrastructure in the US. The other, which would impose new export controls on advanced AI chips and model weights, has now been leaked by Inside AI Policy.

Here’s what you need to know about it.

Two important caveats, first. One: the leaked draft is dated December 10, and details — especially specific numbers — may have meaningfully changed since then. Two: this is a very complicated document and there’s a chance I’ve made mistakes interpreting it — please email me if I have and I’ll endeavour to correct it!

A focus on frontier models

The new rule, expected to be published in the next few days, is squarely focused on reducing China and other US adversaries’ access to “the most advanced” AI models, the draft says.

“This strategy aims to ensure that only a select group of foreign entities and destinations will have access to the model weights of the most advanced US AI models or to the large clusters of advanced US [chips] necessary to train those models,” the draft reads.

The focus on the most advanced models, the draft says, is due to the significant risks such models could pose.

“Technical experts from across the US government agree that the next generation of models—i.e., those trained on 10^26 computational operations—will significantly reduce the barriers to enabling activities that threaten US national security and foreign policy,” the document says, specifically raising concerns that models may “enable advanced military and intelligence applications” and “lower the barriers to entry for non-experts to develop weapons of mass destruction.

Three tiers of countries

The draft rule builds on recent efforts by the US government to better control the supply of AI chips in countries like the UAE, with the US worried that such chips might eventually get into the hands of China.

It creates a new, three tier system. Countries such as the UK, most other European countries, Japan, and the US itself don’t have any strict restrictions on them (I’ll refer to these countries as Tier 1). Countries such as China and Russia, which I’ll call Tier 3, continue to be blocked from receiving the most advanced chips (and now model weights — more on that in a minute).

The big change targets every other country. Exports to countries such as Singapore and Israel now require a license — putting them in the same category, which I’ll call Tier 2, as countries like the UAE and Saudi Arabia. And by default, there will now be a cap on the amount of computing power that can be exported to all such countries.

In 2025, the draft lists that cap as 507,000,000 in total processing power (TPP), rising to 1,020,000,000 by 2027. For comparison, CSET estimates that an Nvidia H100 has a TPP of 15,832, so the maximum-sized cluster a country could build this year is of about 32,000 H100s.

However, the US will allow those limits to be circumvented under the “validated end user” (VEU) authorisation program, which allows companies to build clusters in Tier 2 countries. To qualify, data centres will need to meet stringent security requirements, including compliance with FedRAMP High standards, which requires annual third-party security audits. But if they do comply, companies will be able to build larger clusters: according to the draft, clusters of up to 633,000,000 TPP in Q1 of 2025, rising to 5,064,000,000 TPP in Q1 of 2027 — the equivalent of a 320,000 H100 cluster.

Even these thresholds are expected to lag the frontier by a year. The new rule is explicit about this: “advanced IC clusters authorized through the VEU Authorization will be at a maximum size that is approximately 12 months, or one generation, behind the size of the largest clusters BIS expects to be built to train the most advanced AI models”. The aim is clear: the most advanced AI training clusters must be built in the US or another Tier 1 country.

The ratios are worth noting. Current frontier models are estimated to have been trained on clusters equivalent in size to around 20,000 H100s, and the forthcoming generation of models are thought to be being trained on clusters of around 100,000 H100s — the size of xAI’s new Memphis cluster. According to the draft numbers (which, again, may change), Tier 2 countries will be allowed to build a cluster of up to 32,000 H100s in 2025. VEUs, meanwhile, can build clusters of about 40,000 H100s in Tier 2 countries.

(One interesting implication here is that BIS expects the size of the largest AI training clusters to roughly triple each year between now and 2027. Epoch AI estimates that training compute has been increasing by 4.5x each year since 2010.)

Computing power must be concentrated in the US and close allies

The rule says that entities in Tier 1 countries seeking VEU status “cannot transfer more than 25% of [their] total AI computing power … to locations outside of [Tier 1] countries”, and “cannot transfer more than 10% of [their] total AI computing power … to any single country outside of [Tier 1]”.

Additionally, US entities seeking VEU status “cannot transfer more than 50% of its total AI computing power outside of the United States”.

The implication is clear: though companies can build advanced clusters in Tier 2 countries, the bulk of their infrastructure must be built in Tier 1 countries — and, for American companies, specifically in the US.

Export controls on the most advanced model weights

The other big change is that export controls will now be imposed on the most advanced model weights. “BIS is requiring a license to export, reexport, or transfer (in-country) the model weights of any closed-weight AI model—i.e., a model with weights that are not publicly available—that has been trained on more than 10^26 computational operations,” the draft reads.

As the rule notes, no such model is currently thought to exist, so the rule is targeted squarely at the next generation of AI models, which BIS expects “will significantly reduce the barriers to enabling activities that threaten US national security and foreign policy”.

The rule seems mostly aimed at forcing companies to store their model weights in secure facilities. If companies want to export their weights abroad, the receiving data centre must meet the same strict security requirements as the VEU data centre requirements listed above, including meeting FedRAMP High standards. And the rule applies to not just US-made models, but also foreign models made using US technology — in essence meaning any model trained anywhere.

Notably, the rule does not apply to open-weight models (whose distribution, of course, could not be controlled even if BIS wanted to). The rule notes that “the most advanced open-weight models are currently less powerful than the most advanced closed-weight models” and that “the economic and social benefits of allowing the model weights of open-weight models to be published without a license currently outweigh the risks posed by those models”.

The rule also automatically raises the 10^26 threshold to keep up with AI progress: “BIS will also not require a license for the export, reexport, or transfer (in-country) of the model weights of closed models that are less powerful than the most powerful open-weight model.”

Many tech companies aren’t happy with the rule — but some of their arguments make no sense

The leaked rule has been circulating for a while, and in the past couple weeks the tech industry has mounted a campaign to kill it. But many of their claims are suspect.

Stephen Ezell of the Information Technology Innovation Foundation said that “placing caps on U.S. exports of AI GPUs will limit market opportunities for US companies while providing an open door for foreign suppliers of AI chips—and Chinese AI chipmakers such as Biren are increasingly competitive in this field—to swoop in and take market share”. Companies such as Nvidia and Oracle have raised similar concerns about the new rule pushing foreign countries into using Chinese AI chips.

But given that Chinese chip technology significantly lags that of the US, such an effect seems unlikely. As Konstantin Pilz has noted, none of the top 50 leading AI compute clusters use Chinese AI chips. Lennart Heim backs that up, saying “I still don’t see Chinese AI chips (like Huawei Ascends) being used much globally — or even within China”.

The reason is twofold: thanks to longstanding export controls on semiconductor manufacturing equipment and design tools, Chinese AI chips are significantly worse than leading US AI chips. And for the same reason, China can’t produce enough of any chips it does make: as Matt Pottinger told the New York Times, “Huawei is struggling to make enough advanced chips to train AI models within China, much less export chips”. That could change, of course, but China has been trying to solve this problem for many years, without much luck.

Not all the criticisms are unfair. The new rule would impose significant compliance costs on data centre operators: requiring compliance with FedRAMP High standards is expected to be particularly burdensome. But in a world where AI model weights are the most important thing in the world and well worth stealing — a world we might soon be entering — perhaps those compliance costs are worth paying.