globalbarry.
PUBLIC-SOURCE RESEARCHStart Free
GLOBAL BARRY RESEARCH

Semiconductor Export Controls: BIS Rules and Company Disclosures Explained

A plain-language breakdown of U.S. semiconductor export control rules from BIS and how public companies are disclosing related risks in SEC filings.

By Global Barry Research8 min read

  • export controls
  • semiconductors
  • BIS
  • SEC filings
  • China
  • national security

How to read this post: statements linked to a source are FACT as reported by that source; passages marked “AI analysis (labeled)” are ANALYSIS (interpretation, not disclosure); the final section lists what remains UNKNOWN. This article was researched and drafted with AI from the public sources listed below on 2026-10-06, and automatically checked so that every link, number and quote traces to those sources.

A Layered Regulatory Framework Built Since 2022

The modern U.S. semiconductor export control regime traces its origins to October 2022. According to the Bureau of Industry and Security (BIS), the agency released an interim final rule on October 7, 2022, titled "Implementation of Additional Export Controls: Certain Advanced Computing and Semiconductor Manufacturing Items; Supercomputer and Semiconductor End Use," which amended the Export Administration Regulations (EAR) to implement controls on advanced computing integrated circuits (ICs), computer commodities that contain such ICs, and certain semiconductor manufacturing items (opens in a new tab).

BIS announced (opens in a new tab) that these actions were taken under the authority of the Export Control Reform Act of 2018 and its implementing regulations, the EAR, which give the agency tools to control the export of U.S.-origin and certain foreign-produced commodities, software, and technology, as well as specific activities of U.S. persons, for national security and foreign policy reasons.

The controls were not static. According to reporting by Sidley Austin's Data Matters blog, on January 15, 2025, BIS published updated export controls on advanced computing items (opens in a new tab) — including advanced integrated circuits and related equipment, software, and technology — and, for the first time, controls on artificial intelligence (AI) model weights under the EAR. That reporting notes the new regulations took effect on January 13, 2025, though compliance was not required until May 15, 2025.

The Military-Civil Fusion Rationale

BIS has been explicit about the policy reasoning underpinning these controls. In its 2023 semiconductor manufacturing items rule, the agency stated that "the U.S. Government has frequently and consistently raised its concerns about China's military modernization, particularly in light of China's Military-Civil Fusion (MCF) strategy, which deliberately blurs the lines between commercial sectors and military programs, and the ability of China's government to demand information and assistance from companies," according to the Federal Register (opens in a new tab).

The same rule notes that BIS's "focus is on the development and production of advanced-node ICs, given their national security implications and China's well-documented MCF policy," while also acknowledging the agency's intent to "implement effective and focused controls that do not diminish U.S. technology leadership."

Macau has been treated alongside China in these rules. The Federal Register explains that BIS "imposed the same controls implemented on China in the October 7 IFR to Macau because of Macau's position as a Special Administrative Region of China and the potential risk of diversion of items subject to the EAR from Macau to China."

A 2026 Policy Shift: From Denial to Case-by-Case Review

In January 2026, BIS introduced a notable adjustment to its posture. The Federal Register published a rule revising the license review policy for exports of certain semiconductors to China and Macau — changing it from a presumption of denial to a case-by-case review (opens in a new tab).

The rule specifies that this case-by-case policy applies to commodities with a TPP less than 21,000 and a "total DRAM bandwidth" less than 6,500 GB/s — citing the NVIDIA H200 and AMD MI325X as examples — when destined to end-users in China or Macau, provided certain conditions are met. Those conditions, as described in the Federal Register, require that: sufficient supply of the product exists in the United States; production for export to China will not divert global foundry capacity for similar or more advanced products for U.S. end users; the recipient has demonstrated sufficient security procedures; and the item undergoes independent, third-party testing in the United States to verify its performance specifications.

Importantly, the presumption of denial is retained in specific circumstances. The Federal Register states that for reexports and in-country transfers of AI commodities destined to Macau or Country Group D:5 destinations, "the licensing policy remains a presumption of denial." Similarly, exports to entities headquartered or with a parent company headquartered in Macau or a Country Group D:5 destination — including end-users located outside those destinations — also face a presumption of denial.

AI analysis (labeled): The shift from a blanket presumption of denial to a conditional case-by-case review for certain chips could reflect an attempt to balance national security objectives with commercial considerations, though the retained presumption of denial for reexports and certain entity types may limit the practical scope of this change.

How Companies Are Disclosing These Risks

Publicly traded companies subject to these controls are required to disclose material regulatory risks in their SEC filings. One company's 2025 annual report filed with the SEC describes the evolving landscape in detail. The filing states that "since October 2022, the United States government has taken steps to restrict the export of certain advanced semiconductor products and technology to the People's Republic of China and/or certain companies located in China due to national security and human rights concerns," and lists a series of regulatory expansions through 2024, including additional controls on high-bandwidth memory commodities in April 2024 and an expansion of the Foreign Direct Product Rule in December 2024, according to the SEC filing (opens in a new tab).

The same filing notes that proposed regulations further expanding the controls to impose a worldwide licensing requirement on certain ICs and computing resources used for training of AI models were issued with a scheduled compliance date of May 15, 2025, but were subsequently rescinded. The company states it expects "that a revised version of these controls will be issued in the future."

The filing also discloses that the company "regularly monitor[s] changes to applicable export control regulations to assess the impact to our business" and that, as of the filing date, "none of our material customers located in China has been added to the Entity List or other restricted party list."

AI analysis (labeled): SEC risk factor disclosures of this nature may reflect genuine operational exposure to regulatory change, but they are also standard practice for companies with significant international revenue. The specificity of the disclosures — naming particular rule dates and product categories — could indicate active compliance monitoring rather than boilerplate language.

Compliance Obligations for Industry

Beyond licensing, companies operating in the semiconductor supply chain face a range of compliance obligations. According to Torres Trade Law, semiconductor companies are subject to strict export controls under the EAR, "especially regarding advanced computing chips, manufacturing equipment, supercomputing applications, China, and other sensitive destinations," and U.S. Customs and Border Protection may coordinate with BIS to verify licensing and detect potential circumvention of technology-transfer restrictions, as described on the Torres Trade Law website (opens in a new tab).

That same source notes that semiconductor-related items may require an export license if they are "specifically controlled under the EAR, destined for a restricted country, intended for a prohibited end use, or going to a restricted end user," and cautions that "a company should not assume that a semiconductor product is uncontrolled simply because it is commercial or sold globally."

The January 2025 rules also introduced new requirements specifically for foundries and packaging companies. According to Sidley Austin's Data Matters reporting, the companion rule published January 16, 2025 expands licensing requirements for foundries and packaging companies seeking to export advanced computing equipment when non-approved or non-authorized IC designers or OSAT companies are involved, and published initial lists of approved companies while providing instructions for others to apply, as described in the Data Matters blog (opens in a new tab).

AI analysis (labeled): The expansion of controls to foundries and packaging companies — not just chip designers — may signal a broadening of the regulatory perimeter to address diversion risks earlier in the supply chain, though the practical compliance burden on smaller suppliers remains difficult to assess from public sources alone.

What the sources do not establish

  • Whether the January 2026 case-by-case review policy has resulted in any licenses being granted or denied, and on what grounds.
  • The full list of chip models and specifications that fall within or outside the revised thresholds beyond the examples cited in the Federal Register.
  • How BIS defines or operationalizes "sufficient security procedures" for recipient entities seeking case-by-case review.
  • The extent to which allied countries have adopted equivalent or coordinated controls, and whether gaps in multilateral alignment affect enforcement effectiveness.
  • The specific compliance costs incurred by individual companies as a result of these rules.
  • Whether the rescinded AI model weight regulations will be reissued, and in what form.
  • How the Entity List additions referenced in company SEC filings have affected specific business relationships or supply chains.
  • The identity of the company whose 2025 annual report is cited, as the SEC filing excerpt does not name the company in the retrieved text.

Sources

EVIDENCE BEFORE OPINION

Trace company exposure to its public sources.

Company intelligence, exposure analysis and a citation-first Research Copilot — every conclusion tied to its source.

Start Free

More research