0x0E Understanding US' New Framework for AI Diffusion

Deciphering the new export control rules to assess their consequences for India

Ashwin Prasad presents an analysis of the U.S.'s new Framework for AI Diffusion, outlining its policy aims and assessing its significance. This post was co-authored with Satya Sahu.

---

In its waning days, the Biden-Harris administration, through the US Bureau of Industry and Security, released an Interim Final Rule (IFR) titled the Framework For Artificial Intelligence Diffusion (‘the framework’) earlier this week. The IFR is set to become law after 120 days. The framework has two stated goals: first, to ensure US leadership in the AI technology stack and infrastructure, and second, to restrict geopolitical adversaries like China from accessing the most advanced AI chips and models in order to safeguard US national security. 

The framework imposes controls through export restrictions spanning the entire AI technology stack: closed AI model weights, AI chips, and chipmaking tools. This adds to and amends existing export controls that mainly targeted the movement of advanced semiconductors and semiconductor manufacturing equipment and technologies. As is common to all such export controls, the US’ Foreign Direct Product Rules form the underlying regulatory framework that allows the US to extend its jurisdiction extra-territorially and enforce such export controls on non-US entities and allied countries. The FDP rules stretch the jurisdictional reach of US export controls, requiring licenses for a broader range of foreign-produced items developed using US-origin technologies. The objective is to prevent entities linked to geopolitical adversaries from using foreign production to circumvent the US restrictions.

Another thing to keep in mind before we delve further into the new rules: The US has historically dominated semiconductor design and now leads AI innovation. This technological edge is self-reinforcing: the most advanced AI models require cutting-edge semiconductor chips, and America's semiconductor prowess helps maintain its AI leadership. The framework reinforces the view that AI technologies and related infrastructure are the lynchpin to the US’ economic and techno-strategic future.

USA's categorisation of countries

The framework divides the world into three tiers:
Tier 1 comprises the US and 18 key allied countries. These countries are either partners closely aligned with US foreign policy goals or firmly dominant in the AI supply chain ecosystem (the Netherlands' ASML and Taiwan's TSMC are the de facto market leaders in photolithography equipment and advanced packaging techniques). Most have also instituted analogous export controls on geopolitical adversaries like China. These countries face no import restrictions and enjoy unfettered access and deployment rights for controlled AI model weights if they adhere to prescribed storage security requirements.

Tier 2 countries, the majority of the world's nations, can receive a certain number of exports through an authorisation program or individual licenses. This includes India and also other ‘swing’ countries such as Saudi Arabia and Israel. The restrictions for these countries cover two primary aspects: access to advanced chips and the minimum security thresholds their companies must meet to apply for licenses. In most ways, this framework streamlines and simplifies the manner in which companies from these countries can apply for and acquire licenses for advanced chips. However, as discussed below, the inclusion of India in this group is perplexing. Also, there are a vast number of countries clubbed together without any further differentiation. For instance, both Yemen and Israel are placed in this tier.

Tier 3 countries continue to face escalating import restrictions. This tier includes US arms-embargoed countries and consists of the usual gamut of US geopolitical adversaries such as Russia, China, North Korea, and Iran. In addition, countries like Belarus and Macau, which have been used to smuggle export-controlled items to Russia and China, also figure in this group.

Source: Semianalysis

Authorisations for Data Centre Companies

Specific authorisations have been carved out for entities in Tier 1 and 2 countries seeking to acquire or deploy advanced AI chips for use in Tier 2 countries. The framework provides two types of authorisations, mainly aimed at entities operating data centres: 'Universal Verified End User (VEU) Authorisation' and 'National VEU Authorisation'.

UVEU authorisations grant exemptions to companies headquartered in the US and allied Tier 1 countries. Companies headquartered in Tier 1 countries can field advanced AI chips in data centres located in Tier 2 countries as long as they still maintain at least 75% of their AI compute capacity within Tier 1 countries. Additionally, no single Tier 2 country can play host to more than 7% of a Tier 1 company’s global compute capacity. Companies headquartered in the US must also further ensure that 50% of their compute capacity stays within US territory. 

Companies in Tier 2 countries such as Saudi Arabia (which are key investment partners to data centre behemoths like Microsoft) needed to apply for licensing authorisations on a case-by-case basis. The UVEU system simplifies things for them. 

Data centre companies headquartered in Tier 2 countries must apply for a Data Center National VEU (NVEU) authorisation for each country where it seeks to deploy advanced AI chips. While UVEU authorisation levies limit on companies deploying compute capacity in terms of percentage ratios, NVEU companies must contend with hard caps. Each NVEU company can only 'deploy' up to 100,000 NVIDIA H100-equivalent AI chips by the end of 2025 (we are unsure if this term includes pre-existing compute capacity or only refers to prospective imports). The limits extend to 270,000 H100-equivalent chips by the end of 2026 and 320,000 by the end of 2027. To put this number into perspective, Meta alone is estimated to have 600,000 H100 GPUs by the end of 2024. In contrast, Indian hyperscaler, Yotta’s Shakti Cloud is powered by 16,000 GPUs, and the IndiaAI mission has set a target of acquiring 10,000 GPUs. 

These hard caps indicate that the US is extending its leverage over compute (the only tangible part of the AI supply chain) beyond China to Tier 2 countries. The motivation for crafting such a complex enforcement mechanism is quite obviously to plug diversion risks of controlled chips (smuggling, in other words). Evidence from the three years of the current chip export control regime has shown that once advanced chips have been physically relinquished from the control of the US or an ally, it is difficult to control their proliferation, and consequently, it is difficult to prevent their passage into adversary countries like China. As the US BIS investigates more granular avenues of controlling the purposes for which compute is deployed, we may expect to see control mechanisms such as On-Chip Governance Mechanisms soon. But for now, we should expect to see absolute caps on the number of advanced chip imports to Tier 2 countries as the only mode of control available to the US is through physical control of such chips. Needless to say, this is not great for India's goals of obtaining a significant foothold in the semiconductor and AI global value chains. It also directly affects the possibility of India scaling up compute demand in the future, not simply for its industry but also for critical infrastructure running on systems based on such advanced chips.

Alongside the NVEU mechanism, there are two other ways in which Tier 2 countries can acquire advanced chips. First, one-time export licenses could be provided to companies in Tier 2 countries on a first-come, first-served basis. This mechanism's requirements are unclear but should mirror the VEU avenues. However, these export licenses will also count towards a country-specific hard cap of around 50,000 H100-equivalent chips through 2027. Finally, for small-volume imports (Low Processing Performance (LPP) Exemption), companies in Tier 2 countries can apply for authorisation to receive 1700 such chips per year; this will not count towards the aforementioned per-country cap.

On the face of it, these exemptions and requirements asked of Tier 2 countries seem generous enough in the short term. To put things into perspective, the IndiaAI mission seeks to set up a sovereign compute infrastructure of 10,000 GPUs. Despite the staggering cost, it is still a far cry from the caps established under the NVEU mechanism.

After looking at the lattice of restrictions and exemptions, the immediate question is: what happens when the export controls are revised following generational breakthroughs in chip design and as AI chips perform better and better? Current high-end consumer GPUs such as NVIDIA's RTX 4090 and the newly announced RTX 5090 (based on the same Blackwell architecture as the top-of-the-line AI-focused B100 and B200 GPUs) are already excluded from being sold in China due to existing export controls. While consumer GPUs are an imperfect and much less performant substitute to AI-focused data centre GPUs due to limited connectivity and memory capacities, China has demonstrated that AI inference and training can be done on them. Even mid-range consumer GPUs will likely showcase similar capabilities in a couple of generations. Will these, consequently, also need prior authorisation and count towards each Tier 2 country's hard caps? 

The framework has a bespoke provision for chips that would ordinarily flout the control thresholds but are “not designed or marketed for use in a data centre”: the License Exception Advanced Computing Authorized (ACA). Tier 2 countries can freely import these chips, but companies from Tier 3 countries must be approved by the BIS and be subject to a fairly stringent review. For all intents and purposes, countries like China will be prohibited from accessing the highest-end of the consumer-grade advanced chips market.

Minimum computing capability thresholds for attracting export restrictions on AI chips will likely be revised, but it will still be at the unilateral discretion of the US executive. This should give pause even to US allies concerned about technological sovereignty.

Authorisations for Indian and Chinese Companies

There is another authorisation type, General VEU authorisations, which applies specifically to Indian and Chinese entities, extending beyond data centres. This authorisation mechanism has existed since 2007, with China and India being the only two countries notified under it. This is largely an authorisation system that was created to allow the export of eligible dual-use items to countries that had not acceded to the Wassenaar arrangement. India, notably, was permitted to apply for general VEU authorisation for entities seeking to use controlled items for military purposes, while China was not. Since India became a signatory to the arrangement in 2017, this pathway for Indian entities to acquire controlled items seems to have been rendered mostly unnecessary. We may begin to see prospective non-data centre buyers of such commodities apply for General VEU status. It is unclear if exports under this mechanism will count towards the per-country cap.

Controls on AI model weights have now been introduced

The Diffusion Framework also introduces measures to control the ‘export’ of model weights. Model weights are numerical parameters that determine the internal structure and decision-making ability of the AI model. For starters, the export restriction only gets triggered for AI models that require more than 10^26 FLOPs for their training. No existing model reaches this threshold. Moreover, the BIS seems to be accurately aware that controlling publicly available knowledge is a losing game, and the Diffusion Framework maintains that open-weight models will also not trigger restrictions. (Funnily enough, the BIS may be actively investigating ways in which to restrict the similarly open-source RISC-V Instruction Set Architecture)

Tier 1 countries can freely deploy restricted-weight models in Tier 1 and Tier 2 countries, contingent upon meeting specific storage security measures. However, entities from Tier 2 countries apparently face a blanket restriction for accessing compute infrastructure controlled by companies from Tier 1 countries to develop restricted-weight models altogether. The Diffusion Framework’s export licensing conditions mandate that VEU-authorised cloud service providers in must implement mechanisms to prevent such unauthorised training of models by Tier 2 and Tier 3 companies. This effectively seeks to plug the possibility of unauthorised entities being able to train their AI models by accessing the compute power of controlled AI chips remotely through a foreign cloud provider located in Tier 1/ Tier 2 countries. US companies face an additional restriction in that their subsidiaries in Tier 2 and 3 countries also cannot be involved in training restricted-weight models because of the possibility of security breaches or a relatively high risk of subsequent export. 

This is likely to be a sore spot for countries like India. While most AI models being developed in India build upon existing open-source models like Meta’s Llama family of models, this will not remain the case for long. The new restrictions can further make it difficult for Indian companies to partner with entities from Tier 1 countries to develop any such advanced model. So, even if India were to try and play catch up with the incumbents in the industry, it may be prohibited from doing so in the future. 

What does this mean for India?

This is uncharted territory for US export controls. While India has previously faced US-led restrictions in accessing the meta-critical components of transformational technologies such as nuclear technology or, more recently, supercomputer exports, present-day geopolitical dynamics are a far cry from the era of the 1970s and the 90s. Technology (particularly, semiconductors and AI) was a long-standing focal point in improving India-US relations for the Biden administration. As we have mentioned in earlier analyses, the US-India relationship in recent years has been marked by drastically positive steps. In June 2024, for example, both countries announced plans to manufacture chips for dual-use technology collaboration, such as in “advanced sensing, communication, and power electronics for national security, next-generation telecommunications, and green energy applications”. This made it a unique collaboration between the Indian and US defence establishments. From most perspectives, it would seem that the US and India were heading towards becoming true technological and strategic partners.

Therefore, it is particularly perplexing as to why India figures in the list of Tier 2 countries. It could be argued that the US is concerned about Indian companies being used to divert controlled chips to countries like Russia. This is a legitimate concern, and by instituting caps on shipments of advanced chips, the US can minimise the number of chips that could potentially be subsequently exported to Tier 3 countries. VEU authorisation for Indian companies carries stringent due diligence and accounting requirements, which should help manage diversion risks. 

However, the framework’s blanket restraints on restricted-weight model development for Tier 2 countries would probably raise eyebrows in New Delhi. There may not be an immediate impact since the Indian AI sector’s strengths primarily lie in the application layer of the AI value chain; that said, the industry’s dependencies on US-based cloud computing providers mean that Indian companies cannot train future models using Tier 1 company-owned data centres. Further, this may also mean that Indian subsidiaries of industry stalwarts such as OpenAI, Google or Meta may wind down activities related to frontier AI model development and transfer Indian talent abroad to Tier 1 countries. Combined with restrictions on India’s compute capacity, this can mean that AI researchers may continue to gravitate towards companies based in Tier 1 countries. This does not bode well for India’s goal of cultivating the next generation of AI talent.

There is also no pathway enumerated in the framework for countries in Tier 2 to potentially advance into Tier 1, so the choices available for India are fairly limited. In the short to medium term, India may only be able to manoeuvre diplomatically to reassure the US about its security measures and sustained compliance with the rules. 

Interestingly, the outgoing administration announced these export controls less than a week before the incoming Trump presidency assumes control. On the one hand, this could mean that no significant amendment or withdrawal of these measures will be sought and that these measures have a degree of bipartisan support. The House Select Committee on the CCP has endorsed the IFR explicitly. The Trump administration has its fair share of China hawks as well; the prospective new head of the US BIS had, in fact, overseen semiconductor sanctions on China’s ZTE and Huawei during Trump’s first term. In a nutshell, these export controls fit in perfectly with Trump’s rhetoric regarding being tough on China. 

On the other hand, the US technology-industrial complex has had no qualms cosying up to the incoming administration, with the leaders of Meta, Google, Microsoft, NVIDIA, and, of course, Tesla, having made generous donations to the inauguration fund. In fact, shortly after the IFR was released, Nvidia (which commands the lion’s share of the global advanced AI chips market) also released a statement commending Trump’s first presidency for laying

“the foundation for America’s current strength and success in AI, fostering an environment where US industry could compete and win on merit without compromising national security” and panned the Biden administration, saying that the “new Biden rules would only weaken America’s global competitiveness, undermining the innovation that has kept the US ahead.”

Trump’s support in the tech industry could very well be contingent on making changes to regulations and policies that are less restrictive, as the recent debate on H1B visas indicates. How effective any such lobbying is in overturning Biden’s new export controls remains to be seen.

In the long term, India now has a demonstrable incentive to build not just advanced AI chips and models but also the essential facets of the ecosystem that allow their production. Designing and producing advanced chips needed for frontier AI development also depends on software design tools and machinery made by the US or other Tier 1 countries. Building robust alternatives to Cadence or Synopys’ EDA tools, or acquiring equally capable chipmaking tools from Applied Materials, Canon, or ASML will ordinarily take decades. Even China’s Huawei and SMIC, who have met success in producing vast numbers of older chips, continue to struggle in the volume production of advanced chips. The prospect of India being able to make quick progress on this front on its own is bleak. On the other hand, India can also take a leaf out of China’s book and pivot towards building AI models that are more compute-efficient and use-case-specific. This technological trajectory will require a more focused push from both government and industry alike.

For a couple of years now, the primary criticism of India’s efforts to build a gargantuan sovereign compute infrastructure by purchasing 10,000 odd GPUs and building data centres for their deployment has been that it is likely not the most efficient usage of public resources. It does not necessarily provide disproportionate benefits compared to the alternative policy option: that of allowing the private sector to build compute capacity in the country, while the government builds and maintains a significantly smaller-scale, focused compute infrastructure for strategic purposes. Questions about the wisdom of spending public largesse on H100 GPUs also abound, as the timeframe required to purchase, build, and deploy them in data centres would render these chips obsolete by at least a few years. Criticisms along a similar line could also be levied at the government’s plans to focus the majority of resources and attention on building chip fabrication foundries in India, rather than focus primarily on the much-less capital-intensive chip design sector. 

However, as this new flurry of export controls indicates, India’s national power, as well as its ambitions of securing a significant foothold in the global value chains for AI and semiconductor chips, are now also dependent on indigenously building up and maintaining a much higher capability to produce advanced AI chips, and develop AI models. How far the US and its allies will transact to help India achieve these goals is now unclear.

At the end of the day, the Diffusion Framework places India in a less favourable category than US allies. It is inconsistent with the recent trend of India’s increasing technology cooperation with the US as a strategic partner in the Indo-Pacific region, particularly regarding both countries’ shared goals of countering China’s burgeoning influence. It also hints at a disconnect between America's technology control policies and strategic partnerships, explicitly concerning India's role in the global AI landscape. This misalignment may erode trust and drive Indian self-reliance and diversification beyond US partnerships in the coming years. Hopefully, the first few weeks of the new presidency will give us some answers.

---

We strongly recommend reading this excellent primer from RAND Corp for a more detailed overview of the diffusion framework. Also, listen to the ChinaTalk and the CSIS emergency podcasts on this topic.

---