The January 2025 BIS 'Framework for Artificial Intelligence Diffusion' did something the export-control system had never done before: it placed an item that is not hardware, an AI model's trained weights, on the Commerce Control List. New ECCN 4E091 controls the model weights of certain advanced closed-weight dual-use AI models. Reading the entry carefully shows just how unusual the drafting had to be, because BIS could not use a fixed nanometer or a fixed TPP figure to describe a software artifact whose 'performance' is defined by benchmarks that move every few months.
A relative, benchmark-anchored threshold
4E091 does not control a model below a moving floor. The entry states that 4E091 does not control the parameters of any AI model trained using fewer operations than the number needed, based on the most efficient published methods, to train a model as capable, on an aggregate of widely used benchmarks, as the most advanced model that has itself been published. In plain terms, the control floor is defined relative to the most capable openly published model at any given time. Once a frontier model's weights are published, the rule effectively recalibrates: training compute below what is needed to match that published model is excluded from control. This is a self-updating threshold, and it is a striking design choice. Rather than naming a fixed compute number that would age instantly, BIS tied the control to a benchmark-relative capability frontier and pointed exporters to BIS guidance, plus the option of a technical opinion from the U.S. AI Safety Institute and the Department of Energy, to determine where they sit.
Only closed-weight models are reached. The entry's logic is that open-weight models are, by definition, already public and reverse-engineerable, so controlling them would accomplish nothing. The control therefore targets the trained weights of frontier closed models, which BIS treats as valuable intellectual property whose diffusion can be regulated precisely because, unlike most software, the weights are not published.
The compute thresholds that travel with the weights
The same rule revised the license requirements and review policy for ECCNs 3A090.a, 4A090.a and corresponding .z items, and it tied a set of due-diligence triggers to specific compute figures. The rule flags, among other things, whether the ICs in a transaction exceed 2800 TPP or have more than 1,000 GB/s memory bandwidth, and whether they will be aggregated into a data-center cluster. It also built numeric ceilings into its new license exceptions: one authorization covers consignees receiving up to a cumulative 26,900,000 TPP of advanced computing ICs per calendar year, while another references a far larger cumulative figure of 253,000,000 TPP for qualifying recipients. These are not arbitrary. They translate the abstract concern, 'how much compute is concentrating in one place,' into countable units of TPP that a compliance officer can sum across shipments.
Three tiers of destination
The framework's most consequential structural move was to sort the world into tiers. Close partners listed in paragraph (a) of supplement no. 5 to part 740 sit at the top; Macau and Country Group D:5 destinations sit at the bottom; and everywhere else falls into a middle band subject to uniform default country allocations of advanced ICs. BIS then bifurcated the Data Center Validated End User authorization into a universal VEU (UVEU) and a national VEU (NVEU). Companies headquartered in, or whose ultimate parent is headquartered in, the supplement-no.-5 destinations may apply for the UVEU authorization; companies elsewhere in the world (except Macau and D:5) that would import large quantities of advanced computing ICs may apply for the more limited NVEU authorization. The tiering means that an identical accelerator faces three very different regulatory paths depending solely on where its end user and that end user's ultimate parent are headquartered.
Taken together, 4E091 and the tiered VEU structure mark a conceptual shift. The control surface is no longer just 'which chip,' but 'how much aggregate compute, going to which tier of destination, with what model-weight payload.' The thresholds, 2800 TPP and 1,000 GB/s as due-diligence flags, 26,900,000 and 253,000,000 TPP as cumulative license-exception ceilings, and a benchmark-relative floor for model weights, are the machinery that makes a software-and-hardware diffusion regime operable. Whether the AI Diffusion framework survives in its January 2025 form, its drafting is the clearest illustration yet of how far BIS has moved from controlling parts to controlling capability.
Why compute is the proxy for capability
The intellectual foundation of 4E091 is stated plainly in the rule: a reasonable proxy for the performance of an AI model is the amount of compute, the number of computational operations, used to train it. BIS rests this on empirical scaling work showing that model capability depends in large part on training compute. That premise is what lets a hardware-and-software regime hang together. If capability scales with compute, then controlling the accelerators that supply compute (via 3A090 and 4A090), controlling the aggregate compute that can pool in one place (via the cumulative TPP ceilings), and controlling the weights that result from the largest training runs (via 4E091) are three views of the same lever. The rule even acknowledges the limit of weight controls: it notes that basic model architectures and supporting code are often publicly documented or reverse-engineerable, which is exactly why only the closed-weight frontier is controlled and why the floor is benchmarked to whatever has already been published.
The self-classification mechanism deserves emphasis because it is how a moving threshold becomes administrable. Rather than asking exporters to guess at an abstract capability frontier, the rule lets a developer self-classify using BIS guidance, or seek a technical opinion from the U.S. AI Safety Institute and the Department of Energy, or request a formal BIS classification. This builds an institutional process around a threshold that would otherwise be impossible to apply, because 'as capable as the most advanced published model' is a target that shifts with each new open release. The design effectively delegates part of the line-drawing to a benchmarking and classification apparatus, an unusual but logical answer to the problem of controlling something whose 'specifications' are not fixed at manufacture but emerge from training.