Export Controls and Economic Sanctions
For AI companies, the first barrier to going global is not market access — it is whether the item may leave at all. A GPU model number or a transfer of model weights can each constitute a controlled export.
The first gate is not market access — it is whether the item can leave
Most AI companies approach global expansion as “selling the product abroad” and start with the destination country’s market entry rules. In practice the earlier blocker is usually different: whether what you hold can lawfully be exported, and whether it can be sold to this particular customer.
Two regimes apply at the same time. On the Chinese side, the Export Control Law and the Regulations on the Export Control of Dual-Use Items govern transfers of controlled items and technology from China to abroad — including technical materials, source code and model parameters. On the US side, the Export Administration Regulations and OFAC sanctions lists govern US-origin items, foreign products incorporating more than a threshold of US technology, and dealings with listed parties — even where the transaction occurs entirely outside the United States, if US items or US persons are involved.
What makes AI distinctive is that compute hardware and model capability sit on both lists at once. High-end GPUs are controlled items; whether trained model weights amount to a “technology export” is already being discussed in practice; and cross-border cloud access turns an export of goods into a flow of data.
What we do
- Item identification and classification: determine whether hardware, software or technology is controlled, and under which classification
- List screening: counterparties, shareholders and end users against entity, unverified and OFAC lists
- End-use and end-user review: customer due diligence, military end-use red flags, high-risk transshipment routes
- Licensing path: whether a licence or licence exception applies, and preparation of the application
- Internal Compliance Programme (ICP): policy, training, record-keeping and audit
- Transshipment and re-export risk: compliance boundaries for Southeast Asia and Middle East routing, distributor and agent controls
Typical situations
Situation 1: Purchased compute is listed and supply is suspended
The company buys training GPUs through an offshore channel. At renewal the supplier asks for an end-use statement and deployment location. No asset register exists, so the company cannot show where the equipment is installed or who operates it, and supply is paused.
Our approach: build a hardware register (model, serial number, location, operator), confirm the control status by model, and prepare end-use statements and commitments that can be reused.
Situation 2: Model weights sent to an overseas client treated as a technology export
For a localised deployment, the company transfers model weights and inference code to the client’s server in Singapore without any export control assessment. It later emerges the model touches a controlled technology path.
Our approach: classify the technology before cross-border delivery, distinguish “providing a service” from “transferring technology”, and where delivery is needed use onshore inference with offshore access, or a licensed delivery route.
Situation 3: Distributor transships and the manufacturer is pursued
Product sold through a Southeast Asian distributor ends up in a sanctioned region. The manufacturer claims ignorance but cannot produce distributor due diligence or flow monitoring records.
Our approach: embed compliance clauses in distribution agreements (end-user undertakings, no re-export, audit and termination rights), run spot checks on destination flows, and retain diligence and training records.
Process and deliverables
| Stage | Work | Deliverables |
|---|---|---|
| 1 | Product and technology inventory, classification | Item register + control status memo |
| 2 | Customer and supply chain screening | Screening report + high-risk customer list |
| 3 | Compliance programme design | ICP + approval workflow + declaration templates |
| 4 | Licence application or restructuring | Application pack + delivery route plan |
| Ongoing | List monitoring, training, audit | Change alerts + annual compliance audit |
Frequently asked
We provide software as a service — does export control still apply? Yes. Software and technology are controlled items; providing source code, model weights or technical documentation across borders can constitute an export. The test is the nature of the item and the recipient’s location, not the delivery form.
The customer and the transaction are both in a third country — does Chinese law still reach it? Chinese controls focus on transfer from China to abroad. Once an item has lawfully left, onward transfer is principally governed by the destination’s law; but involvement of PRC persons may still create exposure.
Is there any way off the entity list? Removal can be applied for, and licence exceptions or restructuring may be available. Timelines are long and outcomes uncertain, so supply chain alternatives should be prepared in advance.
Does a compliance programme actually help? In enforcement, an effective programme is a significant mitigating factor. For AI companies it also evidences controllability to investors, customers and enterprise procurement teams.
Legal basis
- Export Control Law; Regulations on the Export Control of Dual-Use Items
- Regulations on the Administration of Technology Import and Export; Catalogue of Technologies Prohibited or Restricted from Export
- US Export Administration Regulations, Entity List and Unverified List
- OFAC sanctions lists and the 50 percent rule
- Data Security Law and PIPL provisions interfacing with cross-border data transfer