BIS published an interim rule on January 12, 2022 delaying the effective date of its October 21, 2021 cybersecurity items interim final rule by 45 days, from January 19, 2022 to March 7, 2022. The underlying October 2021 rule establishes new Export Control Classification Numbers (ECCNs) for cybersecurity items — including intrusion software, command-and-control platforms, and surveillance tools — and introduces License Exception ACE (Authorized Cybersecurity Exports) for national security and anti-terrorism purposes. The delay was granted after twelve public comments highlighted significant compliance challenges, with BIS acknowledging the need for additional time for industry to update procedures and for BIS to issue supplemental guidance before the controls took effect.

Analyst notesShow

Mechanism

BIS published the October 21, 2021 interim final rule (FR Doc 2021-21313) establishing new Export Administration Regulations (EAR) controls on cybersecurity items — primarily covering ECCNs 4A005, 4D001, 4D004, 4E001, 5A001.j, 5B001, 5D001, and 5E001. The rule also introduced License Exception ACE (Authorized Cybersecurity Exports), permitting exports of affected items to most destinations except those subject to arms-embargo or narcotics-control restrictions.

The original rule carried a 90-day delayed effective date (to January 19, 2022) to allow for a 45-day comment period (closed December 12, 2021). Twelve commenters — predominantly industry compliance officers and trade counsel — flagged the difficulty of updating export-management systems and training programs within the original window, and requested both a delay and additional BIS guidance on classification thresholds.

BIS agreed and delayed the effective date by an additional 45 days to March 7, 2022. The underlying controls and License Exception ACE structure were unchanged by this procedural rule. The rulemaking ultimately concluded with BIS publishing the final rule on May 26, 2022 (FR Doc 2022-11282), which revised and narrowed certain ACE conditions before the controls took permanent effect.

Downstream implications

Compliance teams gained approximately six additional weeks to update export-management system

(EMS) classifications and training materials before the ACE regime activated.

The delay signalled that the cybersecurity-items control framework had significant industry

friction — a leading indicator for the revisions BIS later adopted in the May 2022 final rule (narrowing government-end-user carve-outs in Country Group D:5 / A:6 destinations).

Together with the May 2022 final rule, this delay forms the procedural history of the ACE

licensing framework that governs commercial exports of intrusion and surveillance tools to most destinations today.

Open questions

BIS did not specify in the delay notice which additional guidance documents it intended to

issue before March 7, 2022 — worth monitoring for any supplemental FAQs or advisory opinions published in the February–March 2022 window.

Sources

Primary: Federal Register Delay Notice — FR Doc 2022-00448 (govinfo.gov)

Secondary: Thompson Hine SmarTrade: BIS Delays Implementation of New Cybersecurity Export Controls (Jan 2022)

Loading…

Mechanism

Downstream implications

Compliance teams gained approximately six additional weeks to update export-management system

(EMS) classifications and training materials before the ACE regime activated.

The delay signalled that the cybersecurity-items control framework had significant industry

friction — a leading indicator for the revisions BIS later adopted in the May 2022 final rule (narrowing government-end-user carve-outs in Country Group D:5 / A:6 destinations).

Together with the May 2022 final rule, this delay forms the procedural history of the ACE

licensing framework that governs commercial exports of intrusion and surveillance tools to most destinations today.