AI-model and training-data export control

AI-model and training-data export control is an instrument family, not one general United States prohibition. It can restrict defined model weights under export law or restrict specified data transactions under data-security law. As at 29 July 2026, United States law did not control AI training datasets as a class.

Model weights

The January 2025 Framework for Artificial Intelligence Diffusion created ECCN 4E091 for certain closed-weight model weights trained using at least 10^26 computational operations, with defined exclusions. The interim final rule took effect on 13 January 2025 and set 15 May 2025 as its general compliance date. On 13 May 2025, the Bureau of Industry and Security announced universal non-enforcement and an intention to rescind the rule formally.

The distinction between codification and operation remained material. In May 2026, the Government Accountability Office found that Commerce's non-enforcement announcement was a rule for Congressional Review Act purposes. That decision did not itself remove the codified text. BIS guidance dated 31 May 2026 instead described controls under the pre-existing Export Administration Regulations, including destination and end-use restrictions. The current legal position therefore cannot be described simply as either an operating global model-control system or a completed repeal.

Training data

The Department of Justice Data Security Program took effect on 8 April 2025 and is codified at 28 CFR Part 202. Certain affirmative due-diligence and audit requirements for restricted transactions, annual reporting and rejected-transaction reporting took effect on 5 October 2025. The programme regulates specified transactions involving United States Government-related data and categories of bulk sensitive personal data with countries of concern or covered persons. It can reach data used in AI development when the regulatory definitions and transaction rules are satisfied. Data does not become covered merely because it is used to train a model.

The programme is distinct from the EAR. It addresses data security, prohibited and restricted transactions, exemptions and compliance duties. Executive Order 14110, which had directed reporting on some frontier-model development, was revoked in January 2025 by Executive Order 14148. It is not current authority.

Assessment

Weight controls seek to deny a replicable capability after training; data controls protect defined datasets and government-related information. Both face enforcement, substitution and allied-coordination problems, but digital transfer does not automatically defeat every control. Effectiveness depends on technical thresholds, covered parties, transaction routes, monitoring and available substitutes. Each legal claim requires a publication-day check because the AI Diffusion rule remains subject to rescission and replacement.

See also

Economic statecraft · AI model weights and frontier models · Export Administration Regulations (EAR) · AI-chip and compute export control · Data as strategic resource and cross-border data flows · Cloud and compute-access denial

Sources

1. United States Department of Commerce, Bureau of Industry and Security, Framework for Artificial Intelligence Diffusion, 15 January 2025.
2. United States Department of Commerce, Bureau of Industry and Security, announcement of non-enforcement and planned rescission, 13 May 2025.
3. United States Government Accountability Office, *Applicability of the Congressional Review Act to the Rescission of the Artificial Intelligence Diffusion Rule*, B-337935, 12 May 2026.
4. United States Department of Commerce, Bureau of Industry and Security, advanced-computing guidance, 31 May 2026.
5. Electronic Code of Federal Regulations, 15 CFR section 742.6 and Commerce Control List, point-in-time text current through 27 July 2026, checked 29 July 2026.
6. United States Department of Justice, Data Security Program, and Electronic Code of Federal Regulations, 28 CFR Part 202, point-in-time text current through 27 July 2026, checked 29 July 2026.
7. President of the United States, Executive Order 14148, 20 January 2025.