US BIS creates Data Center Validated End User (VEU) Authorization for advanced-AI chip exports

Mechanism

The rule creates two new VEU sub-authorizations under 15 CFR 748.15:

• Validated End User (Data Center) — pre-cleared data-center

operators that may receive advanced computing ICs, related software/technology, and supporting items license-free for their own use.

• Approved End User (Data Center) — third-party customers that

may use compute capacity at a VEU-authorized data center.

Applicants submit a detailed security plan, ownership disclosures, end-use commitments, and accept ongoing reporting and on-site review obligations. Applications are vetted under a multi-agency End-User Review Committee (ERC) process. The rule explicitly excludes Country Group D:5 destinations (China, Russia, Iran, Belarus, Venezuela, plus the rest of the arms-embargoed set) — making this a trusted-third- country channel rather than a global liberalization.

Downstream implications

• Provides a legal license-free pathway for NVDA / AMD / AVGO

advanced-AI accelerators (covered by the Oct 2022 / Oct 2023 ACS export controls) to flow to UAE, Saudi, Qatar, and other Gulf / MENA / Central Asian data centers — without each shipment needing an individual export license.

• Complements the AI Diffusion Framework (2025-01-13) and the

subsequent revocation/refinement of country-tier caps: VEU is the positive-list mechanism for chip flows where AI Diffusion was the country-tier mechanism.

• Operationally, it is the legal scaffolding behind the 2025

Microsoft-G42 (UAE) and Saudi Humain / Aramco data-center agreements, which require pre-cleared advanced-IC supply.

• Severity rated 3 (not 4): this is a license-pathway easement

not a new restriction. It widens trusted-flow channels while keeping the D:5 perimeter intact.

Open questions

• How many entities have been approved as Data Center VEUs as of

the 2026-05 cut? (BIS does not publish a complete public list.)

• Interaction with the 2025 AI Diffusion rescission and the

subsequent country-by-country framework — does VEU now substitute for the abandoned Tier-1/2/3 mechanism, or is it complementary?

• Reporting cadence and audit findings for the first cohort of

Data Center VEU approvals.