US BIS: Commerce Control List Expansion — Controls on Biological Equipment 'Software' (ECCN 2D352)

Mechanism

BIS published this final rule effective immediately on October 5, 2021 (86 FR 54814, Docket BIS-2020-0024), implementing the US side of an Australia Group multilateral commitment reached at the AG Virtual Implementation Meeting of May 2021 and adopted through the AG silence procedure (no objecting member within the set window, binding on all 42 AG participating countries plus the EU).

New ECCN 2D352 (created by this rule)

ECCN 2D352 controls "software" that is: 1. Designed for nucleic acid assemblers and synthesizers described in ECCN 2B352.j (the existing AG Common Control List entry for DNA/RNA synthesizers and automated assembly equipment), AND 2. Capable of designing and building functional genetic elements from digital sequence data.

In practical terms: any software that accepts a digital DNA/RNA sequence as input and drives a physical nucleic acid synthesizer to produce the corresponding biological construct is 2D352-controlled. Prior to this rule, ECCN 2B352 captured only the physical hardware; the paired software had no CCL classification.

ECCN 2E001 amendment

The rule adds an explicit cross-reference to 2D352 in ECCN 2E001, which controls technology for the "development" of listed software. This captures foundational research and engineering know-how used to build or improve 2D352-controlled software, subject to CB Column 2 and AT Column 1 licence requirements.

Licence requirements

No licence exceptions were created or extended for 2D352 in this rule.

Multilateral framing

Because controls are AG-multilateral rather than US-unilateral, all 42 AG member states are expected to adopt equivalent controls. BIS cited this harmonisation as a "level playing field" justification — US exporters face the same controls as their foreign competitors in Australia, Canada, EU member states, Japan, South Korea, and the UK.

Downstream implications

• CFIUS mandatory filing: Under 31 CFR Part 800 (FIRRMA implementing regulations), ECCN 2D352 classifies this software as a "critical technology." Foreign investment in US companies whose principal product or service is 2D352-controlled software now triggers mandatory CFIUS notification when the investor could gain board representation, material technical access, or is a foreign government entity acquiring ≥25% voting interest.
• Deemed-export risk: Foreign nationals at US universities or research labs accessing 2D352-controlled software from a CB Column 2 country of nationality may trigger deemed-export licence requirements — a significant compliance consideration for academic institutions with international research collaborations in synthetic biology.
• Hardware–software control gap closed: The 2B352.j hardware entry had been in the CCL for years; this rule eliminates the anomaly whereby the physical synthesizer was controlled but the paired sequencing-automation software was not.
• AG harmonisation ripple: All 42 AG members are expected to adopt equivalent controls. The EU incorporated this into its Dual-Use Regulation update cycle; other AG members have enacted or are enacting equivalent national rules.

Open questions

• BIS indicated it would monitor whether AG non-members (e.g., India, which was not yet an AG member in 2021) were producing equivalent software that might undercut the control regime — India joined the AG in January 2018, so this risk was limited, but the gap between AG members and non-members remains a proliferation concern.
• Licence exception availability (e.g., ENC or STA) was not addressed in this rule; BIS may clarify in future guidance for academic/research use cases.