AI Hardware Provenance and Export Control Compliance

Key steps

• Define AI-relevant hardware in scope: GPUs used for model training or inference, specialized AI accelerators, high-performance networking used in AI compute clusters, and edge AI hardware with sensitive deployment contexts.

• Establish a hardware procurement screening workflow:

  1. Before procurement, identify the Export Control Classification Number (ECCN) for the hardware.
  2. Check the product against US Bureau of Industry and Security (BIS) Entity List, Denied Persons List, and Unverified List.
  3. Check against EU dual-use export control list if the organization is based in or ships to the EU.
  4. Screen end-use and end-user against prohibited uses (weapons of mass destruction, military end-use in controlled jurisdictions).
  5. Document the screening outcome and retain records for at least 5 years.

• Maintain a hardware provenance registry:

  • For each major AI compute asset, record: manufacturer, country of manufacture, supply chain intermediaries, acquisition date, and export control classification.
  • For cloud compute: obtain attestation from the cloud provider on data center geography and hardware origin where required by regulation.

• Monitor export control list updates (BIS typically updates quarterly). Re-screen existing inventory when major list changes occur.

• Include contractual AI hardware provenance clauses in vendor agreements for significant compute infrastructure purchases.

Current regulatory context

• US Export Administration Regulations restrict export of advanced GPUs (above certain FLOP thresholds) to certain jurisdictions. The specific thresholds and jurisdiction lists change; monitor BIS updates.
• Oxford Martin AI Governance Institute research has highlighted semiconductor supply chain provenance as a frontier AI safety concern that is transitioning from voluntary to regulatory scrutiny.