Export Control Compliance for AI Chip Startups: What EAR, ITAR, and the Entity List Mean for Your Hardware Company

If you are building an AI accelerator, an edge-computing chip, or an advanced computing product in Texas, there is a real chance your hardware is subject to U.S. export controls — and an equally real chance you do not know it yet. The Bureau of Industry and Security (BIS) has dramatically expanded the scope of export control regulations covering advanced computing and semiconductor items through a series of rulemakings beginning in October 2022 and continuing through 2025. For semiconductor and deeptech startups in the Samsung Austin ecosystem, near TI's Sherman fabs, or anywhere in Texas's growing hardware corridor, these rules create compliance obligations that start at the design stage and extend through hiring, shipping, and customer onboarding.

This guide walks through the practical compliance framework: how to determine whether your product is controlled under the Export Administration Regulations (EAR) or the International Traffic in Arms Regulations (ITAR), how to classify your chips using Export Control Classification Numbers (ECCNs), what the BIS advanced computing rules require, how Entity List screening works, what deemed export rules mean for hiring foreign-national engineers, when license exceptions apply, and what happens if you get it wrong. If you are also navigating employment IP issues common to semiconductor founders, our guide to invention assignment and employer IP risk for Texas hardware founders covers the parallel legal landscape that affects your cap table.

EAR vs. ITAR: Which Regime Applies to Your Chip?

The first question every hardware founder must answer is whether their product is subject to the EAR or ITAR. These are two fundamentally different regulatory regimes with different agencies, different classification systems, and different penalties.

The Export Administration Regulations (15 CFR Parts 730–774) are administered by BIS within the Department of Commerce. They govern "dual-use" items — products, software, and technology that have both commercial and military applications. The vast majority of AI chips, AI accelerators, advanced computing hardware, and semiconductor manufacturing equipment fall under the EAR. Items subject to the EAR are classified on the Commerce Control List (CCL) using ECCNs.

The International Traffic in Arms Regulations (22 CFR Parts 120–130) are administered by the Directorate of Defense Trade Controls (DDTC) within the Department of State. They govern defense articles and defense services appearing on the United States Munitions List (USML). ITAR applies to items specifically designed, developed, or modified for military applications. If your chip is a general-purpose AI accelerator sold to commercial data centers, it is almost certainly EAR-controlled, not ITAR-controlled. But if your product is a custom processor designed for a missile guidance system, a military drone, or a classified surveillance platform, it may be ITAR-controlled — and ITAR compliance is significantly more restrictive than EAR compliance.

The practical distinction matters because ITAR violations carry their own penalty structure and because ITAR registration with DDTC is required for any company that manufactures or exports defense articles. Most AI hardware startups will operate entirely within the EAR framework. But if your product has any military end-use — even a prototype developed under a Department of Defense contract — you need to confirm jurisdiction before assuming EAR applies. When a product could plausibly fall under either regime, you can submit a Commodity Jurisdiction request to DDTC for a formal determination.

ECCN Classification for AI Chips and Advanced Computing Items

Once you confirm your product is subject to the EAR, the next step is classification. Every item subject to the EAR is assigned either an ECCN or the designation "EAR99" (meaning the item is subject to the EAR but not specifically listed on the CCL and generally does not require a license for most destinations).

For AI hardware startups, the ECCNs that matter most are in Category 3 (Electronics) and Category 4 (Computers) of the CCL. The October 2022 BIS rules added new ECCNs specifically targeting advanced computing items. The key classifications include:

• ECCN 3A090: Advanced computing integrated circuits (ICs) that meet or exceed specific performance thresholds for "applicable processor interconnect bandwidth" and "applicable total processing performance." If your AI accelerator exceeds these thresholds, it is classified under 3A090 — and exports to China (and other destinations in Country Group D:5) require a BIS license.
• ECCN 4A090: Computers containing 3A090 ICs that meet aggregate performance thresholds. If your product is a server or system incorporating controlled AI chips, it may be classified under 4A090.
• ECCN 3B001/3B002: Semiconductor manufacturing equipment. If your startup produces fab equipment rather than chips, these classifications apply to lithography, etch, deposition, and other manufacturing tools.

BIS provides classification guidance through its "Classify Your Item" resource page. You can also submit a formal classification request (a CCATS request) through the SNAP-R system for an official BIS determination. Self-classification is permitted, but the burden of getting it right falls on you — and an incorrect classification can result in an unauthorized export.

The October 2022 BIS Rules and Subsequent Expansions

On October 7, 2022, BIS published a landmark interim final rule imposing new export controls on advanced computing and semiconductor manufacturing items destined for China. As the BIS press release explained, the rule added certain advanced computing chips and computer commodities to the CCL, established new license requirements for supercomputer and semiconductor development end-uses in the PRC, and expanded the scope of the EAR over certain foreign-produced advanced computing items through a new Foreign Direct Product (FDP) rule. Licenses for items destined to PRC entities faced a "presumption of denial."

BIS did not stop there. In October 2023, the agency issued an updated rule that expanded the controls further — tightening performance thresholds, adding new end-use restrictions, and broadening the FDP rule's reach. Then, on December 2, 2024, BIS announced another major package. According to the December 2024 BIS press release, the new rules added controls on 24 types of semiconductor manufacturing equipment, 3 types of software tools for semiconductor development, new controls on high-bandwidth memory (HBM) critical for AI training and inference, and 140 Entity List additions. The rules also established two new FDP rules and corresponding de minimis provisions to extend U.S. jurisdiction over foreign-produced items.

On May 13, 2025, the Trump Administration's BIS rescinded the Biden-era AI Diffusion Rule — a January 2025 regulation that would have imposed worldwide controls on AI chip exports and AI model weights. However, BIS simultaneously issued new guidance alerting industry to risks of using PRC advanced computing ICs (including specific Huawei Ascend chips) and warning about consequences of allowing U.S. AI chips to be used for training Chinese AI models. The underlying October 2022 and December 2024 controls on advanced computing items remain in force.

For startups, the takeaway is that BIS rules are a moving target. What was uncontrolled last year may be controlled today. You need a process for monitoring regulatory changes — not a one-time classification.

Entity List Screening Obligations

The Entity List, codified at 15 CFR Part 744, Supplement No. 4, identifies foreign persons subject to specific license requirements for items subject to the EAR. If your customer, partner, supplier, or end-user appears on the Entity List, you may need a BIS license to export, reexport, or transfer items to that party — and for many listed entities, the license review policy is a presumption of denial.

The December 2024 BIS rule added 140 entities to the Entity List, including semiconductor fabs, tool companies, and investment companies involved in advancing the PRC's military modernization. This followed earlier expansions that added dozens of entities across multiple rulemakings in 2022 through 2024. The Entity List is updated frequently, and screening must be ongoing — not a one-time check at onboarding.

Practical compliance requires screening every customer, end-user, and intermediary against the current Entity List before any export, reexport, or in-country transfer. BIS publishes the Entity List in the Federal Register and maintains it in the EAR. Several commercial screening tools automate this process, but the underlying obligation is yours — relying on a customer's self-certification that they are not on the Entity List is not sufficient if you have reason to know otherwise.

Deemed Export Rules: When Hiring Foreign-National Engineers

One of the most overlooked compliance areas for semiconductor startups is the deemed export rule. Under 15 CFR § 734.13, a "deemed export" occurs when controlled technology or source code is released to a foreign person within the United States. As BIS explains on its deemed exports page, this means that sharing controlled technology with a foreign-national employee — even in your own U.S. lab — is treated as an export to that person's most recent country of citizenship or permanent residency.

The practical implication for AI hardware startups is significant. If your company develops technology controlled under ECCN 3A090 or related entries, and you hire a foreign-national engineer from a country in Country Group D:1 or D:5 (which includes China, Russia, and many other countries), you may need a deemed export license before that engineer can access the controlled technology. This applies to source code, design documents, technical data, and even oral presentations of controlled information.

Deemed export compliance requires three steps. First, classify your technology — determine which ECCN applies to the technical data your engineers will access. Second, identify the citizenship and permanent residency status of every employee who will access controlled technology. Third, determine whether a license is required for the deemed export based on the ECCN, the destination country (the employee's country of citizenship), and any applicable license exceptions. If a license is required, you must apply through BIS's SNAP-R system before the employee accesses the controlled technology.

This is not a theoretical concern. Semiconductor and AI hardware startups in Texas routinely hire engineers from China, India, and other countries that trigger deemed export requirements. Failing to obtain a required deemed export license is an export control violation — and it is one of the most common violations BIS identifies in enforcement actions against technology companies.

License Exceptions and When You Need a License

Not every export of a controlled item requires a license. The EAR provides a set of license exceptions that authorize certain exports, reexports, and transfers without a specific BIS license. The most relevant exceptions for AI hardware startups include:

• License Exception ENC: Authorizes certain exports of encryption commodities and software. If your AI chip incorporates encryption technology, this exception may apply to some destinations.
• License Exception TSU: Technology and software — unrestricted. Authorizes certain exports of technology and source code to most destinations, subject to restrictions.
• License Exception HBM: Established in the December 2024 rule, this new exception authorizes certain exports of high-bandwidth memory items that are critical for AI training and inference.

However, license exceptions are not a blanket authorization. Each exception has specific eligibility criteria, and many are unavailable for exports to Country Group D:5 destinations (including China) or to parties on the Entity List. The October 2022 and December 2024 rules specifically restricted or eliminated license exceptions for advanced computing items destined for China. When in doubt, assume you need a license — and confirm through a classification review or advisory opinion from BIS.

If a license is required, you apply through BIS's SNAP-R system. License review timelines vary depending on the destination, the ECCN, and the end-use. For items destined to China under the advanced computing rules, the review policy is generally "presumption of denial" — meaning your application must affirmatively demonstrate why the export should be approved despite the policy.

Penalties: Criminal, Civil, and Voluntary Self-Disclosure

The consequences of export control violations are severe. According to BIS's penalties page, violations of the EAR may be subject to both criminal and administrative penalties. Criminal penalties can include up to 20 years of imprisonment and up to $1 million in fines per violation, or both. The maximum administrative monetary penalty is the greater of the current inflation-adjusted per-violation cap (roughly $374,000 as of the January 2025 adjustment) or twice the value of the transaction. BIS adjusts this figure every January, so confirm the current amount on the BIS penalties page.

Beyond monetary penalties, violators may face denial of export privileges — a death sentence for a hardware company that depends on imported components or international sales. A denial order prohibits the company (and its officers) from participating in any transaction subject to the EAR, and it is unlawful for other businesses to participate in export transactions with a denied person.

BIS also offers a Voluntary Self-Disclosure (VSD) process. If your company discovers a potential violation, submitting a VSD to BIS's Office of Export Enforcement can significantly mitigate penalties. BIS's enforcement guidelines treat voluntary disclosure as a substantial mitigating factor, and many disclosed violations are resolved with no penalty or a significantly reduced penalty. The key is that the disclosure must be truly voluntary — made before BIS has discovered the violation through its own investigation. If you discover a potential violation, do not wait. Engage counsel immediately and evaluate whether a VSD is appropriate.

Actionable Next Steps

If you are building an AI chip, AI accelerator, or advanced computing hardware company, here is what we recommend doing now:

1. Determine your regulatory jurisdiction. Confirm whether your product is EAR-controlled or ITAR-controlled. For most AI hardware startups, the EAR will apply. If your product has any military end-use, submit a Commodity Jurisdiction request to DDTC for a formal determination.
2. Classify your products and technology. Assign ECCNs to every product, component, and technology your company develops. If your chips meet the performance thresholds in ECCN 3A090 or 4A090, you are subject to the advanced computing export controls. If you are unsure, submit a classification request through SNAP-R.
3. Screen every customer and end-user against the Entity List. Implement a screening process that checks every customer, partner, and intermediary against the current Entity List before any export, reexport, or transfer. Update your screening regularly — the list changes frequently.
4. Audit your hiring practices for deemed export compliance. Identify every foreign-national employee who has access to controlled technology. Determine whether their country of citizenship triggers a deemed export license requirement. If it does, either obtain a license or restrict their access to controlled technology until a license is granted.
5. Evaluate license exceptions carefully. Do not assume a license exception applies. Review the specific criteria for each exception against your product, destination, and end-user. For exports to China and other D:5 destinations, most exceptions are unavailable for advanced computing items.
6. Build an export compliance program. BIS expects companies to have a written export compliance program. At minimum, this should include classification procedures, screening protocols, deemed export controls, recordkeeping, and training. BIS publishes guidance on what an effective program looks like.
7. Monitor regulatory changes. BIS has updated its advanced computing rules multiple times since October 2022, and further changes are likely. Assign someone in your company — or retain outside counsel — to monitor Federal Register notices and BIS announcements.
8. Engage export control counsel before your first international shipment. The cost of a pre-export compliance review is a fraction of the cost of an enforcement action. If you are shipping controlled items internationally without a compliance framework, you are operating at risk every day.

Export control compliance is not just a legal checkbox for semiconductor startups — it is a business requirement that affects who you can hire, who you can sell to, and where your products can go. The companies that build compliance into their operations from day one will be able to scale internationally without enforcement risk. The companies that ignore these rules until a customer or investor asks about them will find themselves scrambling — and potentially facing penalties that can end a startup before it truly begins. For more on the broader legal landscape for Texas hardware founders, see our guide on co-founder agreements and vesting schedules — the equity and governance infrastructure that sits alongside your compliance program.