From export control to architecture export: how the US chip-control regime turned a national restriction into a foreign-policy product (Oct 2022 → Nov 2025)

The trigger

On 7 October 2022 BIS issued the advanced-AI chip and equipment export controls on China — item-level restrictions on GPUs above set performance thresholds, end-use restrictions on chipmaking tools at advanced nodes (≤14/16 nm logic, ≤18 nm DRAM, ≤128-layer NAND), a US-persons rule, and a Foreign Direct Product (FDP) extension that pulled foreign-made chips incorporating US technology into scope. The conventional read at the time was "an aggressive but narrowly-targeted national security measure". Three years later, the more accurate read is that 7 October 2022 was the foundation tablet for an architecture that has since (a) closed every workaround the original rule enabled, (b) been adopted catch-all-style by a third country (Malaysia), and (c) become a compliance template that other jurisdictions implement to get bilateral chip-import authorisations from the US (UAE). The interesting question is no longer "how strict are US chip controls?" — it is "who is building US-equivalent export-control perimeter, on what timeline, and what do they get in return?"

What the structured layer shows

Three structural facts visible across this set that no individual news story carries:

(a) The ladder of legal vehicles has a pattern. Each rule in #1 → #6 addresses a workaround that the previous rule structurally enabled. The October 2022 ECCN performance-thresholds (#1) created the A800/H800 design-around path — closed by the "performance density" metric in October 2023 (#2). The post-2023 architecture still allowed Korean-made HBM (the AI training memory bottleneck) to ship to Chinese end-users — closed by the December 2024 FDP extension to SK Hynix and Samsung HBM (#3). The post-December-2024 architecture still allowed China-bound chips to be cloud-trained from third-country data centres — closed by the January 2025 country-tier framework with per-country compute caps and the new ECCN 4E091 on closed-weight model weights (#4). The post-January-2025 architecture still allowed Entity List parties to operate through unlisted 50%-owned affiliates (the well-known Huawei / SMIC / CXMT diversion-vehicle pattern) — closed by the September 2025 Affiliates Rule (#6, automatic 50% extension mirroring OFAC). Each layer is engineered to close the specific evasion the previous layer enabled. The forward question that this pattern answers: what evasion does the Affiliates Rule enable, and what does the next layer look like? The candidate vectors are visible — minority-stake passive investments (under 50%), trust / nominee structures, and contract-manufacturing relationships that don't trigger ownership rules.

(b) The architecture is now a foreign-policy product, not just a national restriction. Two pieces of evidence on the structured layer show this is no longer a US-only regime:

• Malaysia (#5) uses ECCN-mirror codes — 3U090, 3A001.u, 4U090, 4A003.u, 5A002.u, 5A004.u, 5U992.u. The u suffix is Malaysia's catch-all marker; the numeric portion is the US Commerce Control List code. Malaysia did not write its own item taxonomy. It adopted the US one with a syntactic tag. The MITI directive explicitly states that the controls "remain in force" even if the US relaxes its own rules — a structurally novel commitment for a country whose chip-trade interests would benefit from US relaxation. The reason that commitment is binding: Malaysia is the world's #6 semiconductor-export economy and the dominant ASEAN logistics-transshipment hub; the choice was between accepting a binding national perimeter that mirrors US rules, or being treated as a transshipment risk and losing inbound US-origin chip flows entirely. Malaysia chose the perimeter.

• UAE (#7) designed the Regulated Technology Environment (RTE) — a compliance framework with physical and logical access controls on authorised compute clusters, US-government audit rights, binding UAE-side export-control commitments, and chip-usage monitoring with regular BIS reporting. The Commerce Department press release explicitly positions the RTE as "a replicable governance template for other Tier 2 country-level authorisations" — i.e. a compliance product that other countries can adopt to unlock bilateral chip allocations. Saudi Arabia is the next named candidate. The RTE is the operational implementation of what the (rescinded) AI Diffusion Framework called Universal VEU — the Diffusion Framework died as a unilateral US rule, but its architecture is being rebuilt as a bilateral arrangement between the US and individual Tier-2 partners, with the partner doing the implementation work. The interesting consequence: the post-rescission framework is more extraterritorial than the pre-rescission framework — Universal VEU was a US-list, but RTE is a partner-built compliance regime that the partner is contractually obligated to enforce.

(c) The dynamic layer is now reversible — and the reversibility is itself a negotiation chip. The Affiliates Rule's one-year suspension (#6 amendment, 10 Nov 2025) is structurally novel. Entity List names stay in force; only the automatic 50%-extension perimeter is paused. This is the first time the US has explicitly broken apart the static (named-party) and dynamic (automatic-extension perimeter) layers of its export-control toolkit, and traded just the dynamic layer for a diplomatic deliverable (the post-Busan US-China understanding). Three downstream implications visible on the structured layer:

1. The dynamic layer is now a chip in bilateral negotiations. Future US-China bilateral deals can credibly trade enforcement posture for concessions without rolling back the underlying name-by-name listings — which means listings, paradoxically, become more permanent (no reason to unwind them) while perimeter rules become more transactional. 2. The forward calendar is fixed: the Affiliates Rule re-enters on 2026-11-10 by default. Industry compliance teams built ownership-tracing capability during the September–November 2025 window; that capability persists, lowering the switching cost for re-imposition. M&A diligence on China-exposed targets has to underwrite the post-suspension regime as base case. 3. The Malaysian commitment (binding "even if the US relaxes") was made before the US demonstrated it could reverse a major rule six weeks after issuance. Malaysia's binding-irrespective-of-US clause now looks prescient: it pre-empted exactly this kind of US reversal as a downside risk to allied-perimeter credibility.

What this would have told you in real time

A reader of the structured register could have made three falsifiable calls earlier than consensus:

• October 2022 → September 2025 (≈3-year horizon): The FDP extension in the original rule's text (§734.9) operates on a "any item, anywhere, if it contains US-origin technology" principle. The natural corporate-form analogue is "any entity, anywhere, if it is sufficiently owned by a listed party". The Affiliates Rule (Sep 2025) is that analogue. Calling the eventual existence of an EAR 50% rule from the October 2022 FDP language was a legible inference; calling its timing required tracking when the listing-by-name throughput would saturate against diversion-network proliferation.
• January 2025 → November 2025 (≈10-month horizon): When the AI Diffusion Framework set up Universal VEU as a firm-level pathway and named UAE / Saudi / Singapore as Tier-2 destinations explicitly targeted by the architecture, the bilateral-implementation path was already designed. Even after the May 2025 rescission, the underlying need (US wants Gulf partners to host compliant US-aligned compute; Gulf partners want chip allocations) didn't disappear. UAE-G42 RTE in November 2025 was the rebuild of Universal VEU as a bilateral product — predictable from the January framework's design, even discounted for the rescission.
• July 2025 (real time): Malaysia's adoption of US ECCN codes with a catch-all suffix was the strongest available evidence that the US chip-control architecture had crossed the threshold from "unilateral US restriction" to "exportable compliance product". A reader who priced that event correctly should have updated upward on the probability of a Saudi or Indonesian equivalent within 12 months — and on the probability that any future Chinese counter-controls would need to target the architecture (via third-country bilateral pressure on allied-perimeter countries) rather than just the US directly. The November 2025 G42 RTE confirmed the first; the second remains an open watch item.

Two pieces of standard analyst framing this case rules out:

• "Chip controls will be relaxed under Trump and the regime will dissolve" — partially true (Diffusion Rule rescinded) but the structural arc continued: Affiliates Rule issued (Sep), VEU revoked for foreign-owned China fabs (Sep), G42 bilateral concluded (Nov). The Trump-era regime is differently shaped — more bilateral, less rules-based — but not lighter in aggregate enforcement reach.
• "Allied compliance is a coalition-of-the-willing political question" — the Malaysia and UAE evidence shows the binding commitments are now structural / commercial, not political. Allies sign because the alternative is loss of inbound chip flows or denial of bilateral allocations.

Caveats and what would falsify this

• Strategic vs. tactical reversibility. This case treats the Affiliates Rule suspension as structurally novel (separating named-party from perimeter layers). A counter-reading is that the suspension was just expedient diplomatic fan-service with no architectural significance. The 2026-11-10 re-entry date is the test: if the suspension is quietly extended or formalised into permanent narrower scope, the "reversible by design" reading weakens.
• Malaysia / UAE n=2 is not yet a regime. The architecture-export thesis requires a third (most plausibly Saudi Arabia, explicitly flagged in the Commerce Department's 20 November 2025 statement). Indonesia's silence as the other major ASEAN transshipment hub is the negative-evidence signal worth watching.
• The Trilateral perimeter (Netherlands, Japan, Korea) is undercounted here. The Dutch DUV expansion (2024-09-07) and the September 2025 VEU revocation for Intel / Samsung / SK Hynix China fabs (2025-09-02) are part of the same architecture but operate on the supply-side (tooling / fab) rather than the demand-side (compute / chips) leg. A future case should treat the Trilateral perimeter as its own regime — overlapping but structurally distinct from the demand-side architecture this case maps.
• The Chinese counter-architecture is the symmetric story. MOFCOM's Ga/Ge July 2023 licensing → Dec 2024 country-targeted ban → Feb 2025 W/Te/Bi/Mo/In expansion walked a parallel ladder on critical materials. Read together with this case (covered separately in 2024-china-ga-ge-retaliation-cycle), the two architectures are converging in form (extraterritorial, perimeter-based, partner-implemented) and in negotiation-chip status. The Dec 2024 BIS package and the following-day MOFCOM ban already demonstrate that the two architectures now operate on a single bilateral clock.

Sources

• BIS press release — advanced computing + semiconductor manufacturing controls (Oct 2022)
• Federal Register 88 FR 73424 and 88 FR 73458 — October 2023 expansion
• BIS press release — Dec 2 2024 China package final and Federal Register 89 FR 96790 / 89 FR 96830
• Federal Register 90 FR 4544 — AI Diffusion Framework; BIS rescission notice (13 May 2025)
• MITI Directive No. 1/2025 (PDF) and MITI press statement
• Federal Register 90 FR 47201 — Affiliates Rule; 90 FR 50857 one-year suspension
• US Department of Commerce statement on UAE and Saudi chip exports (20 Nov 2025) and G42 press release