When a Chatbot Becomes an Export: AI Model Controls

Why does the form of an AI export control matter?

A chatbot feels like a conversation. Legally, it can also be a shipment.

That is the uncomfortable idea behind a recent piece in The Regulatory Review, "When a Chatbot Becomes an Export", which argues that applying export controls to AI models calls for public rulemaking rather than undisclosed directives. This post takes that argument seriously, adds context the headline version leaves out, and sets out what it means for anyone who builds, buys, or depends on AI systems that cross a border.

A note on sourcing: the Regulatory Review piece is the source for the argument that AI export controls should go through public rulemaking. The description of how U.S. export controls operate comes from the public regulations cited below. Statements of opinion are this site's own and are marked as such.

Why would a language model count as an export at all?

The U.S. export control system was built for things you could put in a crate: engines, sensors, machine tools, chips. Over time it expanded to cover software and technology, meaning information that can move by email or download. The Export Control Reform Act of 2018 (50 U.S.C. 4801 et seq.) is the statutory base, and the Commerce Department's Bureau of Industry and Security (BIS) administers the Export Administration Regulations (EAR) at 15 CFR Parts 730 to 774.

Once software and technology are in scope, the leap to a trained AI model is shorter than it sounds. A model is, at bottom, a very large file of numbers (the weights) plus code that runs it. Copy the file to a server in another country, or hand it to a foreign national, and you have moved controlled technology in the same way an engineer would by emailing a design. Give a foreign user access to a hosted model through an API, and the question gets blurrier: is the thing being exported the model, the output, or only a service?

That blurriness is where the trouble starts. Most of us think of an export as a thing leaving a place. An AI model is more like a recipe that can be copied a million times without leaving anyone's kitchen, and the law has not settled how to count that.

What did the last attempt at AI model controls look like?

The most concrete public effort so far was the "Framework for Artificial Intelligence Diffusion" interim final rule, published in the Federal Register on January 15, 2025 at 90 Fed. Reg. 4544 (the text can be checked by that citation at federalregister.gov). It created a new export control classification, ECCN 4E091, covering the weights of certain advanced closed models, with a threshold tied to training compute of more than 10^26 operations. It also tiered countries by the level of access they would get to advanced chips.

On May 13, 2025, BIS announced that it would rescind the rule, that it would not enforce it, and that it intended to issue a replacement rule in the future. The announcement appears among BIS's press releases at bis.gov; check the original notice for its exact wording. So the one time the government wrote down, in a public regulation, exactly how a model could become a controlled export, the rule did not last. Whatever you think of its merits, it had a clear virtue: you could read it, argue with it, and comment on it.

That history sets up the real question. If the formal rule is gone and AI models remain strategically valuable, what fills the space where a rule used to be? The claims in this post about the diffusion rule's status are limited to what BIS announced in May 2025. This post has not confirmed whether a replacement has been published since then, so readers who need the current position should check the Federal Register and BIS's rules page, or ask counsel.

What is wrong with undisclosed directives?

The source article's concern is that the space gets filled with private communication: letters to individual companies, informal guidance, and requirements that the public learns about only secondhand. The government has real tools for this. Under the EAR, BIS can notify a specific exporter that a license is required for an item or destination that would otherwise not need one, which the regulations handle through "is informed" notices. One example is 15 CFR 744.21(b), which lets BIS inform a party that a license is required for items subject to the EAR, including software and technology, in connection with certain military end uses. Other sections of Part 744 contain their own, narrower "is informed" provisions. Those notices go to the company, not the world.

A well-known example from the hardware side came in April 2025, when Nvidia disclosed in a Form 8-K securities filing (filed on April 15, 2025, and searchable by company and date on SEC EDGAR) that the U.S. government had told it a license would be required to export its H20 chips to China. The public learned of the requirement because a publicly traded company had a duty to tell its investors. A private company with no such duty, or a startup shipping a model, might never say a word.

There is a legal wrinkle that explains why this is even possible. Section 1762 of ECRA (50 U.S.C. 4821(a)) says that functions exercised under the statute are not subject to the Administrative Procedure Act's rulemaking provisions, including the notice-and-comment requirements of 5 U.S.C. 553. In plain terms, Congress did not require BIS to ask the public before it sets export rules. That is a deliberate choice, made because export controls touch national security and speed sometimes matters.

But "not required" is not the same as "wise." The argument for public rulemaking is that this is a choice BIS can make, and that for AI models in particular it should make it.

Why does AI make the case for public rulemaking stronger?

There are at least four reasons, and they stack on each other:

• Definitions: it is unsettled what counts as the controlled item.
• Scale: controls could reach universities, open-source developers, and small firms.
• Legitimacy: risk and openness judgments gain legitimacy when made in public.
• Compliance: a rule nobody can read is a rule nobody can follow.

The first is definitional. With a machine tool, everyone knows what is being shipped. With a model, we are still arguing about what counts. Is a fine-tuned open model the same item as its base? Is a model that scores above some benchmark controlled even if it was trained on modest hardware? Those are questions where comment from engineers, researchers, and lawyers would improve the answer, and where a secret answer would be hard to get right.

The second is scale of impact. Export controls on aircraft parts affect a small, specialized industry that already has compliance staff. Controls on AI models can reach universities, open-source developers, small software companies, and any business that embeds a model in a product it sells abroad. A rule that broad deserves the kind of vetting the public process provides.

The third is that these decisions are not purely technical. Deciding which models are too capable to share is a judgment about risk, competitiveness, and openness, and in my view judgments like that gain legitimacy when they are made where people can see them. I have written elsewhere about how regulatory capture shapes AI governance, and secrecy tends to make capture easier, not harder. When rules are written behind closed doors, the parties with the best access to the room are usually the largest incumbents.

The fourth is that a rule nobody can read is a rule nobody can follow. Companies want to comply. A private directive to one firm leaves its competitors guessing whether the same limit applies to them, and it leaves foreign partners unsure whether to trust a supplier who might be told to stop shipping tomorrow.

How do the two approaches compare?

The table makes one thing plain, which is that speed is the only column where the directive clearly wins. Everything else, from predictability to accountability, favors writing the rule down.

Is there a fair case for the other side?

There is, and I think it deserves a straight hearing. National security officials worry, reasonably, that announcing a control gives adversaries a roadmap and gives exporters time to rush shipments out before it takes effect. Publishing a threshold such as a training-compute number can also invite developers to engineer just under it. A directive to a single company avoids those problems for a moment.

Even so, those concerns argue for how a rule is designed and timed, not for whether it should exist in public. BIS already uses interim final rules, which take effect immediately and take comments afterward. That gives the government speed and gives the public a record. The January 2025 diffusion rule was itself issued in that form.

I also think the roadmap worry is weaker for AI than for, say, a weapons component. The capabilities of frontier models are widely discussed, and the hardware that trains them is the real chokepoint. A transparent rule about models would add little to what a determined adversary already knows, while the cost of secrecy lands on honest companies who just want to know where the line is.

What does this mean for businesses that build or use AI?

If you ship software, host a model, or rely on a vendor who does, the practical implications are more immediate than the policy debate suggests.

You may have export exposure you have not looked at. Start with three steps: inventory where model weights, code, and technical data are stored and who can access them; classify them under the Commerce Control List with counsel; and review foreign-national access, since releasing controlled technology to a foreign person in the U.S. is treated as a "deemed export" (15 CFR 734.13(a)(2)). If your product includes a model that is later covered by a control, then sharing weights with a foreign contractor, hosting a model for international customers, or giving a foreign national on your team access to certain technology could each become a regulated act. Whether that happens depends on how the controls are written, which is exactly why the form of the rulemaking matters.

Vendor risk is shared risk. If a model provider receives a private directive and has to cut off a country or a customer class, you may find out when your service changes. Reasonable due diligence questions for a vendor include: Has the vendor classified its models and software under the EAR? Does it screen customers and destinations? Has it received any license requirement or "is informed" notice affecting the service? What is its plan if it must cut off a country?

Opaque rules favor the large. A company with a Washington presence and a trade counsel on retainer hears about informal guidance early. A smaller firm hears about it late or never. That asymmetry is a competitive issue, not only a legal one.

The safest posture, in my view, is to treat the current gap as unstable. As of its May 2025 announcement, BIS said it would not enforce the diffusion rule, and the underlying authority remained intact. Check whether that position has changed, since the strategic interest has not faded. Planning as though some form of control will return, possibly with little warning, costs less than being surprised.

What should a good public rule for AI models contain?

I do not think anyone has the perfect design, but a few features seem worth wanting.

• A clear definition of what is controlled, separating model weights, hosted access, and outputs, since they raise different risks.
• A stated rationale, so people can judge whether the control matches the concern it addresses.
• A defined path for researchers and open-source contributors, because the line between publishing a paper and exporting technology is already a long-running sore spot in the EAR.
• A review date, so thresholds set in one year do not quietly harden into permanent law while the technology changes.

None of that is possible to design well in secret. It is the kind of work that benefits from people disagreeing in public.

What does process change about the outcome?

For the wider cross-border tension, see this piece on regulating artificial intelligence across borders. Process matters to the outcome. A control that emerges from public debate will probably be narrower, better defined, and easier to defend internationally. A control that emerges from private letters may be tougher in the short run, but it leaves everyone, including allies, guessing about the rules of a technology they increasingly share.

The test of AI export governance is not only whether the rules are strong, but whether they are written where others can read them. A chatbot becoming an export is a small phrase for a large shift, and the decision about how to govern it is one the public ought to be able to watch.

Last updated: 2026-10-17

Frequently Asked Questions

Can an AI model be subject to U.S. export controls?

Yes, in principle. The Export Administration Regulations (15 CFR Parts 730 to 774) cover software and technology as well as physical goods, and a trained model is a file of weights plus code. The January 2025 AI Diffusion rule created ECCN 4E091 for certain advanced model weights, though BIS announced in May 2025 that it would rescind that rule.

Does BIS have to use notice-and-comment rulemaking for export controls?

No. Under the Export Control Reform Act, 50 U.S.C. 4821(a), functions exercised under the statute are exempt from the Administrative Procedure Act provisions that include notice-and-comment rulemaking at 5 U.S.C. 553. BIS may still choose to use public rulemaking, including interim final rules that take comments after taking effect.

What is an undisclosed export control directive?

It is a requirement communicated privately to a specific company, such as a notice that a license is now required for an item or destination, rather than a rule published for everyone. The public usually learns about these only if the company discloses them, as Nvidia did in a securities filing about H20 chips in April 2025.

Why do critics prefer public rulemaking for AI model controls?

Public rules are visible to all competitors, open to expert comment, easier to challenge, and more predictable. For AI models, where definitions are unsettled and the affected parties include startups, universities, and open-source developers, a public process is more likely to produce a workable and evenly applied rule.

What should companies do now about AI export risk?

Map where model weights, hosted access, and technical know-how cross borders or reach foreign nationals, ask AI vendors how they track export obligations, and plan for the possibility that new controls could arrive with little notice, since the underlying legal authority remains in place.