Export control compliance vacuum persists: Trump's new rules delayed, global data center siting under pressure

The regulatory landscape governing AI and data centers has undergone significant transformation in 2026. As AI has reshaped global geopolitical competition, policymakers worldwide have struggled to balance the technology's strategic benefits against national security risks. Washington now faces the central challenge of fostering U.S. AI leadership while preventing malignant applications that could harm American interests.

While bipartisan consensus exists on controlling exports of strategic technologies—particularly to China—the Trump administration's approach reflects an explicit trade-off between national security and maintaining dominant global market share in AI. Since announcing that the January 2025 AI Diffusion Rule would not be enforced, the administration has moved to increase GPU availability to U.S. partners. The earliest signal came in late May 2025, when the United States negotiated semiconductor export deals with the UAE and Saudi Arabia, permitting significant sales of advanced American chips despite longstanding security concerns. These agreements included strict security protocols and reporting requirements for designated end users.

In July 2025, the White House released America's AI Action Plan—a comprehensive strategy combining offensive and defensive measures to win the global AI competition. An accompanying executive order led to the American AI Exports Program, designed to boost exports of the full American AI stack. In December 2025, the administration departed further from previous policy by approving exports of certain advanced U.S.-origin chips to mainland China customers.

Amid reports that diverted and smuggled American semiconductors may be accelerating China's AI development, broad bipartisan Congressional support has emerged for stricter export controls. In 2026, the House Foreign Affairs Committee passed three major measures with overwhelming support: the AI Overwatch Act (codifying semiconductor export controls), the Chip Security Act (requiring location tracking mechanisms for exported advanced semiconductors), and the MATCH Act (requiring allies to adopt U.S. controls on semiconductor manufacturing equipment or face extraterritorial restrictions). Companion versions of each bill were incorporated into the Senate's annual defense authorization through a manager's amendment.

Data center operators hosting GPU servers now face substantial export control compliance challenges amid this regulatory uncertainty. The current framework—with the Trump administration promising new restrictions to replace the unenforced January 2025 rule—creates an interim period where best practices remain unclear. A robust foundation of export control compliance, supply chain relationships, and contract protections may help companies adapt to future regulatory changes.

GPUs have become essential infrastructure components for data centers, delivering the parallel processing power required for AI model training and inference at scale. Their strategic importance has prompted significant U.S. government scrutiny. The Biden administration's January 2025 AI Diffusion Rule imposed comprehensive restrictions on GPU exports and use. The Trump administration has signaled it will continue and potentially tighten these restrictions through new rules not yet released as of this analysis, creating regulatory ambiguity for the sector.

Historically, data center operators that merely hosted tenant GPU servers assumed U.S. export controls posed minimal compliance risk. This assumption is no longer viable. Export controls apply to the items themselves—meaning even non-U.S. operators face potential liability under the Export Administration Regulations (EAR) if restricted GPUs, controlled technology, or sanctioned end users are present in their facilities, whether directly or indirectly through tenants or sub-tenants. As regulators intensify focus on downstream use and custody of advanced computing hardware, data center operators must demonstrate robust compliance frameworks, including knowledge of hosted GPUs, ownership structures, access controls, and intended uses.

Current U.S. export controls regulate physical GPU export from the United States and re-export from third countries. The January 2025 AI Diffusion Rule and successor regulations may also control post-delivery GPU use for specific AI applications. Under the EAR administered by the Bureau of Industry and Security (BIS), controls operate through multiple mechanisms: export control classification numbers (ECCNs) applied to specific goods, software, and technology based on destination country, recipient nationality, and temporary custodian nationality; and end-user-based restrictions targeting entities listed on the BIS Entity List.

Most GPUs are currently classified under ECCNs 3A090 and 3A991, each carrying varying license requirements. Related computers and equipment fall under ECCNs 4A090 and 5A002, requiring case-by-case fact-specific analysis potentially involving BIS notifications or certifications. If a license is required and no exceptions apply, U.S. exporters or third-country re-exporters may petition BIS for approval. BIS review examines all parties involved and assesses diversion risk to China or application to advanced AI or military capabilities development.

It is illegal under the EAR—applicable to both U.S. and non-U.S. persons and entities—to proceed with transactions known to violate export controls. Data center operators purchasing GPUs must conduct due diligence on the entire chain of custody and verify that appropriate export licenses were obtained.

Export control and economic sanctions violations carry strict liability, regardless of knowledge or intent, though enforcement agencies treat knowledge and intent as aggravating factors when assessing penalties. Civil monetary penalties can reach approximately $370,000 per violation or twice the transaction value, whichever is greater. Criminal prosecution carries potential penalties up to $1 million and up to 20 years imprisonment for individuals. In egregious cases, BIS and the Office of Foreign Assets Control (OFAC) make criminal referrals to the Department of Justice.