Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

On June 17, 2026, BIS announced a $36,184,680 civil penalty settlement with Robert Bosch GmbH (Stuttgart, Germany) — the largest-ever BIS enforcement penalty against a non-US company for Foreign Direct Product Rule (FDPR) violations. Between September 16, 2020 and September 26, 2024, Bosch exported approximately $72.4 million in MEMS sensor products and automotive software from abroad to Huawei Technologies and its Entity List affiliates without the required BIS license. Bosch filed a Voluntary Self-Disclosure and cooperated throughout; the DOJ issued the first-ever NSD declination under its newly established Corporate Enforcement Policy, declining criminal prosecution entirely.

The US Bureau of Industry and Security (BIS) amended the Export Administration Regulations to remove three foreign-owned semiconductor fabs operating in China — Intel Semiconductor (Dalian) Ltd, Samsung China Semiconductor Co. Ltd, and SK hynix Semiconductor (China) Ltd — from the Validated End-User (VEU) Authorizations list (15 CFR Part 748). BIS framed the VEU program as a "loophole" that previously allowed these fabs to receive most US-origin chipmaking equipment, software and technology license-free, a privilege no US-owned fab in China ever had. After the effective date, every restricted shipment to these fabs will require an individual export license, reviewed case-by-case under the existing 2022/2023 advanced- computing controls. The rule is published as Federal Register document 2025-16735 (90 FR 42321), Docket BIS-2025-0555, RIN 0694-AK32.

On 23 May 2025 the Bureau of Industry and Security notified major electronic design automation (EDA) suppliers — Cadence Design Systems, Synopsys, and Siemens EDA — by letter that a license is now required for any export, re-export, or in-country transfer of EDA software and technology classified under ECCNs 3D991 and 3E991 where a party to the transaction is located in China or is a Chinese "military end user" wherever located. BIS determined the shipments posed an unacceptable risk of diversion to Chinese military end use. The action was not published as a Federal Register rule; it surfaced publicly only through the affected companies' SEC 8-K disclosures. Synopsys suspended its FY2025 financial guidance in response. BIS rescinded the requirement effective 2 July 2025 (see amendments) amid the broader US-China trade truce, and the three vendors restored access for affected customers.

The US Bureau of Industry and Security amended the Export Administration Regulations to add 12 entities to the Entity List under the destinations of China (11) and Taiwan (1) via Final Rule 2025-05427 (90 FR 14046), companion to the larger 70-entity rule (2025-05426) published the same day. Targets fall in three clusters: (i) Beijing Academy of Artificial Intelligence and Beijing Innovation Wisdom Technology — added for acquiring US-origin items in support of China's military modernization, specifically developing large AI models and advanced computing chips for defense; (ii) the Inspur group — Inspur (Beijing) Electronic Information Industry, Inspur Electronic Information Industry, Inspur Electronic Information (Hong Kong), Inspur (HK) Electronics, Inspur Software, and Inspur Taiwan — added as subsidiaries contributing to supercomputers for military end use; and (iii) Henan Dingxin, Nettrix Information Industry, Suma Technology, and Suma-USI Electronics — added for involvement in the development of Chinese exascale supercomputers. License requirements are for all items subject to the EAR; review policy is presumption of denial for the AI cluster and policy of denial for the supercomputer clusters.

The US Bureau of Industry and Security issued a final rule on 5 September 2024 (effective 6 September 2024, published in the Federal Register on the same day as 89 FR 73285) establishing multilateral export controls on four categories of emerging technologies: (1) quantum computing items including quantum computers, related cryogenic / control / measurement systems, and certain quantum software; (2) gate-all-around field-effect transistor (GAAFET) production technology — the next-node semiconductor architecture beyond FinFET; (3) advanced additive-manufacturing equipment for metals + alloys; (4) certain biotech-related items added in a parallel rule on 12 September 2024. The rule operates without country exceptions for some categories, with multilateral coordination via Wassenaar + Australia Group + Nuclear Suppliers Group frameworks.

BIS final rule (FR Doc 2024-19132, 89 FR 68539, published 27 August 2024) expanding the Russia/Belarus-Military End User (MEU) Foreign-Direct Product (FDP) rule under the Export Administration Regulations so that it also applies to transactions involving Entity List entries posing a significant diversion risk to Russia's and Belarus's defense industry or intelligence services — the rule is renamed accordingly. The rule also imposes new export, reexport, and in-country transfer controls on software for the operation of computer numerical control (CNC) machine tools destined for Russia or Belarus, and makes corrections eliminating obsolete cross- references introduced by the BIS 25 January 2024 and 18 June 2024 Russia/Belarus final rules. Effective 27 August 2024, except amendatory instruction 11 effective 16 September 2024.

The U.S. Bureau of Industry and Security (BIS) published a final rule expanding the scope of the Iran Foreign Direct Product (FDP) rule in the Export Administration Regulations (EAR) to implement the "No Technology for Terror Act" (Public Law 118-50, Division N), signed by President Biden on April 24, 2024. The expanded rule extends EAR jurisdiction to additional foreign-produced items destined for Iran — including a broader set of items derived from U.S.-origin technology or software, or produced by plants/components that are themselves direct products of U.S.-origin technology — and requires a BIS license for their export, reexport, or in-country transfer to Iran. The rule also provides specified exclusions from the otherwise-applicable license requirements. The rule became effective on July 23, 2024 (publication July 26, 2024).

The Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) by adding three Kaspersky entities to the Entity List under End-User Review Committee (ERC) determinations — AO Kaspersky Lab (Moscow), OOO Kaspersky Group (Moscow), and Kaspersky Labs Limited (London). All three are designated for cooperation with Russian military and intelligence authorities in support of Russian government cyber-intelligence objectives. Exports, reexports, and in-country transfers of all items subject to the EAR to the three entities now require a BIS licence reviewed under a policy of presumption of denial, with no licence exceptions available. The action is paired with a same-week Commerce ICTS final determination prohibiting Kaspersky cybersecurity and anti-virus software transactions in the United States.

BIS final rule (FR Doc 2024-13148, 89 FR 51644, RIN 0694-AJ87) expanding the Export Administration Regulations' Russia and Belarus sanctions architecture. Effective 12 June 2024 (most provisions) and 16 September 2024 (the EAR99 enterprise-software paragraph at §746.8(a)(8)), the rule introduces a new licence requirement for thirteen named categories of EAR99 enterprise software (ERP, CRM, BI, SCM, EDW, CMMS, project management, PLM, BIM, CAD, CAM, ETO) destined for Russia or Belarus; permits address-only Entity List designations to capture high-diversion addresses; adds eight Hong Kong addresses to the Entity List; and refines the Russia/Belarus Industry Sector Sanctions and Foreign Direct Product (FDP) rule. Released the day before the G7 Italy summit alongside coordinated OFAC, State, and Treasury actions that together designated 300+ persons and entities.

The Bureau of Industry and Security (BIS), within the U.S. Department of Commerce, published an interim final rule (FR Doc 2024-08813) on April 30, 2024 amending the Export Administration Regulations (EAR) to restructure export controls on firearms, ammunition, parts, accessories, and related technology and software (EAR Categories 0 and 1). The rule created new Export Control Classification Numbers (ECCNs) for semi-automatic firearms, added Crime Control / Detection (CC) license requirements, narrowed license-exception eligibility, introduced a presumption of denial for many non-government end-users, and imposed a default 1-year license validity for semi-automatic firearms. Effective May 30, 2024; later rescinded (except for the new ECCNs) by FR Doc 2025-18992 on September 30, 2025.

Bureau of Industry and Security final rule (88 FR 46071, Doc 2023-15343) adding four entities to the Entity List effective July 18, 2023. Intellexa S.A. (Greece) and Intellexa Limited (Ireland) — the corporate architecture behind the "Predator" commercial spyware platform — and Cytrox Holdings Zrt. (Hungary) and Cytrox AD (North Macedonia) — the developer of the underlying spyware technology — were listed for "trafficking in cyber exploits used to gain access to information systems, thereby threatening the privacy and security of individuals and organizations worldwide." All items subject to the EAR require a license with a presumption-of-denial review policy for all four entities, effectively cutting off access to US-origin hardware, software, and technology.

BIS issued a correcting amendment to the EAR Entity List to add China Aviation Development Harbin Bearing Co., Ltd. — an AVIC subsidiary and specialist precision-bearing manufacturer — that was included in the preamble of the June 14, 2023 final rule (88 FR 38739) but inadvertently omitted from the regulatory text. The entity was designated for acquiring and attempting to acquire US-origin items in support of China's military modernization, including hypersonic weapons development, air-to-air missiles, and weapon lifecycle management using Western software. All EAR-subject items require a licence with a presumption of denial; retroactive effective date of June 16, 2023.

The Bureau of Industry and Security (BIS) amended the Commerce Control List (CCL) under the Export Administration Regulations (EAR) to implement four emerging and foundational technology decisions agreed at the December 2021 Wassenaar Arrangement Plenary meeting, pursuant to ECRA Section 1758. The rule adds new export controls on ultra-wide bandgap semiconductor substrates (gallium oxide Ga₂O₃ and diamond), ECAD software for Gate-All- Around Field-Effect Transistor (GAAFET) integrated circuit development, and Pressure Gain Combustion (PGC) technology for advanced gas turbine engines. Controls require a licence for items destined to countries listed in the NS:1 and AT:1 columns of the Commerce Country Chart; ECAD software controls (ECCN 3D006) have a delayed compliance date of October 14, 2022.

BIS finalized changes to the Export Administration Regulations (EAR) governing controls on cybersecurity items — primarily intrusion software, command-and-control platforms, and surveillance tools capable of disrupting or monitoring information systems without authorization. The final rule, effective May 26 2022, revises License Exception ACE (Authorized Cybersecurity Exports) originally established by an October 2021 interim rule and narrows end-user carve-outs for government end users in Country Group D:5 and A:6 destinations. Exports of affected ECCNs (4A005, 4D001, 4D004, 4E001, 5A001.j, 5B001, 5D001, 5E001) to Country Groups E:1 and E:2 remain prohibited; D:1 through D:5 government-end-user transactions require a license.

The Bureau of Industry and Security (BIS) extended for a second time the temporary unilateral export control on software classified as ECCN 0D521 — "software specially designed for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds" — adding a third year of control through January 6, 2023. The extension was required because COVID-19 prevented the Wassenaar Arrangement from formally convening in 2020 or holding sufficient deliberations in 2021 to consider the US multilateral control proposal submitted in 2020. Only License Exception GOV (§ 740.11(b)(2)(ii)) is available; all other exports require a specific license from BIS.

BIS published an interim final rule on October 21, 2021 establishing new Export Control Classification Numbers (ECCNs 4A005, 4D004, 4E001.c, and 5A001.j) for intrusion software systems, command-and-control platforms, and IP network surveillance tools, implementing the Wassenaar Arrangement 2017 cybersecurity decisions into the Export Administration Regulations (EAR). The rule simultaneously created License Exception ACE (Authorized Cybersecurity Exports), codified at § 740.22, to authorize exports to most destinations while imposing licence requirements — or outright prohibitions — for sales to Country Groups E:1/E:2 governments and certain D-group government end-users. Carve-outs for vulnerability disclosure and cyber-incident-response activities were included to protect legitimate security research. The effective date was subsequently delayed from January 19, 2022 to March 7, 2022 by a separate interim rule (FR 2022-00448), and the rule was finalized with revisions on May 26, 2022 (FR 2022-11282).

BIS amends the Export Administration Regulations (EAR) to implement the decision adopted at the Australia Group (AG) Virtual Implementation Meeting of May 2021, creating new ECCN 2D352 to control software designed for nucleic acid assemblers and synthesizers (ECCN 2B352.j) that is capable of designing and building functional genetic elements from digital sequence data. The rule also amends ECCN 2E001 to capture technology for the development of 2D352-controlled software. Exports to most non-allied destinations require a BIS licence under CB Column 2 and AT Column 1, and the classification of 2D352 software as a critical technology triggers mandatory CFIUS filing requirements for qualifying foreign investment.

The Bureau of Industry and Security (BIS) extended for one year the temporary unilateral export control on software classified as ECCN 0D521 — "software specially designed for training a Deep Convolutional Neural Network to automate the analysis of geospatial imagery and point clouds" — adding a second year of control through January 6, 2022. The extension was required because COVID-19 prevented the Wassenaar Arrangement from formally convening in 2020 to consider the US multilateral control proposal submitted that year. Only License Exception GOV (§ 740.11(b)(2)(ii)) is available; all other exports require a specific licence from BIS.

The Bureau of Industry and Security (BIS) amended the Export Administration Regulations (EAR) to establish new Export Control Classification Numbers (ECCNs) 0A977, 0D977, and 0E977 for water cannon systems designed for riot or crowd control, their software, and related technology. A Commerce Control List licence is now required for exports and reexports to most destinations worldwide, with NATO members and certain other close military allies exempt from the new requirement. The rule furthers US foreign policy interests by enabling human rights-based review of crowd-control equipment transfers globally.

BIS published an interim final rule on 5 October 2020 implementing multilateral export controls on six emerging technology categories agreed at the December 2019 Wassenaar Arrangement Plenary meeting, revising Commerce Control List ECCNs 2B001, 3D003, 3E004, 5A004, 5D001, and 9A004. The six technologies are: hybrid additive-manufacturing/CNC machine tools; computational lithography software for extreme-ultraviolet (EUV) mask fabrication; wafer-finishing technology for 5 nm-node production; digital forensics tools that circumvent device authentication to extract raw data; software for monitoring and analysis of communications acquired from a handover interface; and sub-orbital craft. As the first of two US implementing actions for the 2019 Wassenaar Plenary, this rule elevated nascent commercial technologies into permanent CCL classifications enforceable against all non-EAR99 destinations.

Effective 17 August 2020 (published in the Federal Register 20 August 2020, Vol. 85 No. 162, FR Doc 2020-18213), BIS implemented three simultaneous measures targeting Huawei's global supply chain. First, 38 non-U.S. affiliates of Huawei Technologies Co., Ltd. were added to the Entity List with the most restrictive license review policy (presumption of denial) and designated under footnote 1, extending the Huawei-specific Foreign-Produced Direct Product Rule (FDPR) to their operations. Second, the Temporary General License (TGL), which since May 2019 had authorized limited ongoing transactions with Huawei (network maintenance, software updates, standards participation), was allowed to expire on 13 August 2020 and replaced with a narrower authorization. Third, BIS expanded the scope of the Huawei FDPR (General Prohibition Three) to cover foreign-produced items when a footnote 1 entity is a party to any transaction or when the item will be used in the production or development of products for any footnote 1 entity, closing the design-house loophole that had allowed TSMC to supply HiSilicon/Kirin chips as long as Huawei was not the direct importer.