US Issues First Unilateral Export Control on Artificial Intelligence Software

[1] This software now requires a BIS authorization to be exported or reexported to all countries except for Canada. Companies that develop or use artificial intelligence (AI) to solve geospatial problems or in geospatial applications need to review the rule closely.

Non-US companies that seek to acquire or otherwise invest in US companies involved in such software may need to request US government national security reviews of their proposed transactions by the Committee on Foreign Investment in the United States (CFIUS).

1. How did BIS impose these new controls?

In an interim final rule effective Monday, January 6, 2020, BIS imposed export controls on certain AI described below. Comments must be received by March 6, 2020, but the controls begin immediately. BIS added the newly controlled item, certain software specially designed to automate the analysis of geospatial imagery in the 0Y521 Series, which was created in 2012 at the onset of Export Control Reform (ECR) (see our previous alert).

2. What Software is Controlled?

The new item, controlled under Export Control Classification Number (ECCN) 0D521, is software specially designed to automate the analysis of geospatial imagery. The software is controlled for regional stability, meaning an authorization will be required for export to any country other than Canada. Additionally, the only applicable license exception at this time is for exports, reexports, and transfers (in-country) made by or consigned to a department or agency of the US Government (License Exception GOV, section 740.11(b)(2)(ii)).

The AI used for analysis of geospatial imagery is only controlled if it meets certain technical specifications. It must be geospatial imagery software specially designed for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds, and must meet ALL of the following criteria:

1. Provides a graphical user interface that enables the user to identify objects (e.g., vehicles, houses, etc.) from within geospatial imagery and point clouds to extract positive and negative samples of an object of interest;
2. Reduces pixel variation by performing scale, color, and rotational normalization on the positive samples;
3. Trains a Deep Convolutional Neural Network to detect the object of interest from the positive and negative samples; and
4. Identifies objects in geospatial imagery using the trained Deep Convolutional Neural Network by matching the rotational pattern from the positive samples with the rotational pattern of objects in the geospatial imagery.

Technical Note: A point cloud is a collection of data points defined by a given coordinate system. A point cloud is also known as a digital surface model.

3. Help! I am an exporter. What does this mean for me?

What happens if you have already exported/reexported/transferred the newly controlled software?

• If software now controlled by 0D521 was exported/reexported/transferred in-country before January 6, 2020, there is no violation.
• Any further exports/reexports/transfers will require an authorization. BIS will review license applications on a case-by-case basis.
• An ounce of prevention is worth a pound of cure, so please be sure to heed these two warnings:
  • Warning #1! Software travels fast and often reexports, and transfers are frequent. Exporters should pause any further exports/reexports/transfers for the time being and should notify non-US affiliates or non-US customers or suppliers that already have the now-controlled software. Their further export activities may also trigger violations.
  • Warning #2! Be careful with software updates! While some software updates may be permissible under certain license exceptions, the only license exception currently applicable to the new controls is GOV. It’s quite likely you will need a license even to provide any updates.
• What if the software you’ve developed is fundamental research?
  • Fundamental research is not subject to the EAR, and therefore AI now classified as 0D521 will not be subject to the EAR if it is, in fact, fundamental research. Note the definition of fundamental research is somewhat complicated.
• Should I get a commodity classification determination on software now subject to 0D521?
  • You should first try to self-classify your software and document the reasons. There is no harm in pursuing a commodity classification determination (CCATS) if you are not sure whether your software is subject to the new control. However, it will likely take some time for BIS to sort out comments and any further clarification to the technical specifications, so the timeline for obtaining a CCATS may be long.

4. What impact will this have on CFIUS jurisdiction?

Another implication of the new control is that this software is now a “critical technology” under CFIUS regulations, which may subject related transactions to additional scrutiny by CFIUS, as well as require mandatory filings in certain situations. Although CFIUS has long considered many items on the Commerce Control List (CCL) and US Munitions List to be critical technologies, the Foreign Investment Risk Review Modernization Act (FIRRMA), enacted in August 2018, expanded the types of transactions subject to CFIUS review and operationalized this list of critical technologies as one specific element of CFIUS’s jurisdictional test for non-passive, non-controlling minority investments.

Further, FIRRMA is the impetus for the new control: as a legislative sidekick to FIRRMA, Section 1758 of the Export Control Reform Act (ECRA) mandated that BIS expand controls to include “emerging” and “foundational” technologies that are essential to US national security. In November 2018, BIS issued an Advance Notice of Proposed Rulemaking (ANPRM) asking for public input on possible emerging technologies to be controlled and including both AI and positioning technologies on its list of 14 general areas that BIS may control. BIS received over 200 comments across industry and academia on the proposed technologies. However, BIS has not taken much action on emerging technologies since the ANPRM, except, arguably, the implementation of controls on five emerging technologies pursuant to the Wassenaar Arrangement, drafted before ECRA’s enactment.

This new control may come as an unwelcome surprise to US companies that are involved with this specific type of AI, especially those that intended to raise future capital from a foreign source. These companies are well served by consulting CFIUS counsel on the impacts of this new development on any upcoming transactions. Also, in the next several weeks, CFIUS is expected to finalize and publish its comprehensive regulations implementing FIRRMA, which must be in effect by February 13, 2020. It is unclear whether and to what extent those regulations might continue to mandate CFIUS filings for technology deals, as has been the case for the past year under CFIUS’s critical technologies pilot program.

It is clear, however, that by adding software designed to automate the analysis of geospatial imagery to the CCL, BIS has expanded the list of critical technologies and slightly widened the purview of CFIUS.

5. How will interested stakeholders react to this rule?

Industry and academia will likely raise several issues related to the interim final rule. We expect possible comments to address topics such as:

• Additional license exceptions
  • Allow authorization for the use of License Exception TSU (15 CFR §740.13(c)) for updates to software already transferred.
• Permit ongoing deemed exports for non-US persons in the United States that already have access to the software (and may be responsible for developing the software)
• And, for your engineers, a request for clarification on technical aspects of the ECCN
  • How many Convolutional Neural Network layers are required for a “Deep” Convolutional Neural Network?
  • Does a Convolutional Neural Network that is trained to identify a single type of object, but a plurality of times, fall into this ECCN?

6. How can I submit comments?

BIS must receive your comments by March 6, 2020. You may submit comments through either of the following:

• Federal eRulemaking Portal: The identification number for this rulemaking is BIS-2019-0031.
• By mail or delivery to: Regulatory Policy Division, Bureau of Industry and Security, US Department of Commerce, Room 2099B, 14th Street and Pennsylvania Avenue NW, Washington, DC 20230. Refer to RIN 0694-AH89.

If you do file comments, you should assume that your full comments will be available to the public as well as to other government agencies. As such, do not include any proprietary or other sensitive data that you do not want to become publicly available! Of course, the Arent Fox team is available to advise and assist you with drafting comments and tailoring them to address your specific concerns.

[1] BIS controlled five emerging technologies last May, but as a multilateral export control in relation to the Wassenaar Agreement.