AI Hardware Provenance and Export Control Compliance

Key steps

• Define AI-relevant hardware in scope: GPUs used to train or run AI models, specialized AI chips (accelerators), high-speed networking that links AI computers, and AI hardware in field devices (edge AI hardware) used in sensitive settings.

• Establish a hardware procurement screening workflow:

  1. Before procurement, identify the Export Control Classification Number (ECCN) for the hardware.
  2. Check the product against US Bureau of Industry and Security (BIS) Entity List, Denied Persons List, and Unverified List.
  3. Check against EU dual-use export control list if the organization is based in or ships to the EU.
  4. Screen end-use and end-user against prohibited uses (weapons of mass destruction, military end-use in controlled jurisdictions).
  5. Document the screening outcome and retain records for at least 5 years.

• Maintain a hardware provenance registry:

  • For each major AI compute asset, record: manufacturer, country of manufacture, supply chain intermediaries, acquisition date, and export control classification.
  • For cloud compute: obtain written confirmation (attestation) from the cloud provider on data center geography and hardware origin where required by regulation.

• Monitor export control list updates (BIS typically updates quarterly). Re-screen existing inventory when major list changes occur.

• Include contractual AI hardware provenance clauses in vendor agreements for significant compute infrastructure purchases.

Current regulatory context

• US Export Administration Regulations (EAR) restrict export of advanced GPUs (above certain processing-power thresholds, measured in FLOP) to certain jurisdictions. The specific thresholds and jurisdiction lists change; monitor BIS updates.
• Oxford Martin AI Governance Institute research has highlighted semiconductor supply chain provenance as a safety concern for the most advanced AI systems that is moving from voluntary to regulatory scrutiny.