From an export controls perspective, the U.S. Department of Commerce, Bureau of Industry and Security (BIS) appeared relatively inactive for most of the first year and a half of the second Trump administration—at least when compared to the preceding four years. BIS tightened and refined some controls while retreating from other proposed restrictions. Amid significant personnel turnover and impacts caused by an extended government shutdown, among other factors, the agency's typical degree of public engagement on export controls and the average speed at which it processed license applications both decreased. However, BIS has signaled an increase in regulatory activity to kick-start the second half of 2026, with signs that a variety of changes may occur before its fiscal year ends in September. 

Notable developments from the start of 2025 through the end of June 2026 included the publication and later informal rescission of the "AI Diffusion Rule," publication then pause on implementation of the so-called "Affiliates Rule," relaxation of certain export controls on Syria, and a redoubled focus on enforcement. This period also saw the increased use of export controls as a foreign policy tool rather than as a tool primarily employed to address national security concerns. These and select other BIS activities from 2025 and the first half of 2026 are highlighted below.

Semiconductors and AI

On January 15, 2025, in the final days of the Biden administration, BIS released the so-called "AI Diffusion Rule," which aimed to promote the spread of AI capability to end users who do not create national security or foreign policy concerns while preventing strategic competitors from accessing U.S. and allied advanced AI technology. Among other aspects, the complex rule proposed a three-tier global licensing framework, grouping countries into tiers to determine the applicable export controls for advanced computing chips and certain AI model weights. Countries in Tier 1 and Tier 2 would be exempt from licensing requirements or would have a presumption of license approval, respectively. Countries in Tier 3, such as the People's Republic of China (China), would be subject to a presumption of denial. The rule also intended to restrict China's access to AI computing power via offshore data centers. While full compliance with the rule was not required until May 15, 2025, under the incoming Trump administration, the rule was immediately controversial. 

The day after publishing the AI Diffusion Rule, BIS published another rule focused on providing additional due diligence procedures regarding advanced computing integrated circuits (ICs) and expanding requirements for front-end fabricators and Outsourced Semiconductor Assembly and Test (OSAT) companies (the Due Diligence Rule). In addition to new license requirements, new reporting requirements, and a "Know Your Customer" vetting form, the rule created lists of "Approved IC Designers" and "Approved "OSAT" Companies," with corresponding application processes and license exception eligibility. The rule was effective immediately, but with a two-week delay on compliance for certain aspects.

In light of the controversy generated by the AI Diffusion Rule, on May 13, 2025, BIS announced that it was rescinding the rule and planned to issue a replacement in the future. However, as of this writing, the AI Diffusion Rule has yet to be formally rescinded via an update to the Code of Federal Regulations. In the interim, BIS has taken a non-enforcement approach regarding compliance with the requirements imposed by that rule. BIS reminded exporters in May 2026 that the informal rescission left the pre-existing regulations in place, including license requirements for the export of advanced computing items to entities headquartered in Country Group D:5 countries like China. (Unlike the AI Diffusion Rule, the Due Diligence Rule remains in effect.)

Among a variety of additional AI-related activities, the Trump administration imposed new restrictions on exports of certain companies' AI chips in April 2025. In May 2025, BIS flagged the risk of potential violations of export controls tied to use of Huawei's Ascend chips. Furthermore, effective at the end of 2025, BIS removed three Chinese facilities from the validated end-user (VEU) program, a program which allows the export of certain dual-use items without a BIS license to approved applicants. Recalibrating its approach at the start of the new year, the administration relaxed controls on some advanced chips in January 2026, changing its license review policy from a presumption of denial to case-by-case basis if the exporters meet security, testing, and production criteria.

In the midst of that activity, the Trump administration announced the AI Action Plan in July 2025, which calls on the country to "meet global demand for AI by exporting its full AI technology stack—hardware, models, software, applications, and standards—to all countries willing to join America's AI alliance." The AI Action Plan includes a number of export provisions, such as strengthening enforcement regarding diversion of AI compute and plugging loopholes in existing controls on semiconductor manufacturing sub-systems. The BIS 2026 regulatory plan indicates it will implement the export controls aspects of the AI Action Plan in conjunction with a formal rescission of the "AI Diffusion Rule" by the end of the 2026 fiscal year.

The Entity List and Affiliates Rule 

With one significant exception, 2025 and the first half of 2026 saw comparatively limited changes to the BIS Entity List. BIS added 82 entities to the Entity List over two sets of revisions in March 2025, 32 more in September, and 29 in October, followed by one removal in November. An unusually quiet first half of 2026 saw no additions or removals. However, in the midst of that relative calm, the fall of 2025 saw significant tumult surrounding BIS's enactment, and later suspension, of the Affiliates Rule (also informally known as the BIS 50 Percent Rule).

Published on September 30, 2025, the Affiliates Rule expanded the scope of existing end-user controls to include foreign affiliates of listed parties, meaning any entity owned 50 percent or more, directly or indirectly, by an entity or multiple entities on the Entity List or the Military End User (MEU) List or by a Specially Designated National (SDN) subject to end-user controls under section 744.8 of the Export Administration Regulations (EAR). The Affiliates Rule was a departure from BIS's longstanding policy that end-use controls apply only to the explicitly listed entities and addresses, and it expanded the reach of export controls using an established concept employed by the U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) for the application of economic sanctions. The goal of this expansion was to address diversion risks.

Less than two months later, in response to ongoing trade negotiations between the United States and China, BIS suspended the Affiliates Rule and pushed the rule's effective date back to November 10, 2026. The pause provides a valuable window for exporters and re-exporters to evaluate their compliance, screening, and due diligence procedures and review ownership structures to ensure that they are prepared for how the Affiliates Rule will impact their activities.

Easing of Export Controls on Syria

Following the collapse of former President Bashar al-Assad's regime in late 2024, President Trump issued Executive Order (E.O.) 14312 on June 30, 2025, revoking the national emergency and six E.O.s that underpinned decades-long comprehensive sanctions on Syria. As part of E.O. 14312, President Trump authorized the Secretary of Commerce to relax some export licensing requirements. These actions are part of a larger shift in U.S. policy aimed at supporting stabilization and economic recovery in Syria, which is transitioning to new leadership under President Ahmed al-Sharaa.

Syria will remain a Country Group E:1 (terrorist-supporting) country at least until its status as a State Sponsor of Terrorism is rescinded, meaning the lifting of comprehensive sanctions did not permit significant changes to all export controls. Instead, on September 2, 2025, BIS published a Federal Register Notice making eight license exceptions available for exports or reexports to Syria. The rule created a new license exception—License Exception Syria Peace and Prosperity (SPP)—authorizing the export of EAR99 items to Syria. Changes to pre-existing license exceptions permit, among other activities, the export without a license of consumer smartphones, tablets, personal computers, and similar, as well as the temporary sojourn of U.S.-registered aircraft. Restrictions remain for end-use and end-user controls under part 744 of the EAR, including transactions with entities on the Entity List, Denied Persons List, and other restricted party lists.

As part of the revised controls, BIS stated that it would begin reviewing certain license applications under a presumption of approval, specifically, applications involving exports and reexports of items on the Commerce Control List (CCL) for economic and business development or support of the Syrian people, including telecommunications, water supply and sanitation, power generation, aviation, and other civil services. Applications for exports with dual use purposes are now reviewed on a case-by-case basis. 

Other Regulatory Changes 

Concurrent with (and overshadowed by) the release of the Due Diligence Rule, BIS published enhanced national security-driven controls on two types of biotechnology equipment: high parameter flow cytometers and certain liquid chromatography mass spectrometers. BIS created two new Export Control Classification Numbers (ECCNs) to implement the changes.

On September 29, 2025, BIS largely rescinded a prior Interim Final Rule (IFR) which had significantly revised export controls on civilian firearms, ammunition, and components. The rescission removed three key aspects of the IFR: (a) a presumption of denial for exports of civilian firearms to 36 "high-risk" countries; (b) license requirements for exports of sporting shotguns and optics to U.S. allies; and (c) short validity periods and additional documentation requirements for obtaining firearm export licenses. After the rescission, export license requirements remain for most pistols and rifles and certain shotguns. The final rule reverted many controls to the status quo prior to the IFR, while retaining several new ECCNs. 

January 2026 saw the easing of export controls on some civil drones that have a maximum endurance of less than an hour, as well as making other civil drones—like certain drones with crop-spraying functionality—eligible for License Exception Strategic Trade Authorization (STA). The revisions implemented E.O. 14307 (June 6, 2025), "Unleashing American Drone Dominance."

In February 2026, BIS released a conforming change, reflecting that the Kingdom of Cambodia (Cambodia) is no longer a Country Group D:5 country. This change brought the EAR into alignment with the Department of State's November 2025 removal of Cambodia from the list of arms embargoed destinations under the International Traffic in Arms Regulations (ITAR). Cambodia remains a Country Group D:1 country under the EAR, subject to corresponding national security controls.

Export Enforcement

BIS maintained an assertive enforcement posture in 2025 and into 2026, with a focus on circumvention of controls related to semiconductors and high-performance computing, as well as incorrect interpretations of some of the EAR's more complex concepts: the de minimis provisions and Foreign Direct Product (FDP) Rules. Enforcement actions involving the use of front companies, falsified end-user statements, and opaque ownership structures designed to obscure ultimate recipients underscored BIS's increasing focus on complex evasion networks. Enforcement actions also highlighted failures in corporate compliance programs, with BIS emphasizing the expectation that exporters have adequate staffing and resources, and that they conduct robust due diligence on customers, intermediaries, and end-users. A handful of these enforcement activities are highlighted in brief below. 

BIS underscored the importance of adequate due diligence in a July 2025 action involving Cadence Design Systems Inc. (Cadence Design). BIS's enforcement package stated, among other allegations, that Cadence Design had "reason to know" its customer Central South CAD Center (CSCC) was an alias of National University of Defense Technology (NUDT)—which is on the Entity list—and that Cadence had "awareness of circumstances that should have prompted further diligence" in relation to its customer's true identity. BIS further stated that exports to another associated entity, which occurred after the legal team had identified the red flags linking CSCC and NUDT and had worked to terminate CSCC as a customer, violated General Prohibition 10 of the EAR. In parallel civil and criminal actions, Cadence Design admitted to alleged conduct including 61 violations of the EAR and pleaded guilty to exporting electronic design automation (EDA) software, hardware, and semiconductor design items without a license, ultimately facing combined penalties and forfeitures of $140 million USD. 

In February 2026, BIS announced that Applied Materials, Inc. (AMAT) and Applied Materials Korea, Ltd. had agreed to pay approximately $252 million to resolve allegations involving unlicensed re-exports of semiconductor manufacturing equipment. The charged violations occurred after the companies shifted assembly and testing of items partially produced in the United States to the Republic of Korea (South Korea), in an effort to avoid loss of business arising from a customer's addition to the Entity List. BIS stated that trade compliance personnel "incorrectly" applied a "substantial transformation" test to the overseas activities. This test does not appear in the EAR but is frequently used to determine a product's country of origin for import purposes. Applying the wrong test led to incorrect analysis of the items assembled in South Korea as foreign-made commodities under the EAR's de minimis rules, instead of treatment of the items as U.S.-produced commodities. The assessed penalty was the maximum allowed by statute, constituting twice the underlying transaction value, and is the second highest penalty imposed in BIS's history. 

In June 2026, BIS highlighted application of an FDP Rule and the adequacy of compliance programs when pursuing enforcement against Robert Bosch GmbH (Bosch). Among other facts, BIS noted that two German subsidiaries of Bosch utilized semiconductor manufacturing equipment and microcontrollers which constituted "direct products" of U.S.-origin "technology" or "software," and which in turn constituted "major components" of the respective plants used to produce sensor products and automotive software, triggering application of an FDP Rule that first appeared in the EAR in 2020. Because Bosch "had 'knowledge'" that Huawei Technologies Co. or its affiliates were end users for the sensors and software, the relevant FDP Rule required obtaining U.S. export licenses for the German-produced items. BIS stated that Bosch's small U.S. export controls compliance team in 2020 "did not have sufficient expertise or resources" to address the addition of the rule to the EAR, contributing directly to the charged violations. BIS assessed a civil penalty of approximately $36 million USD, while the U.S. Department of Justice declined to further investigate or pursue criminal charges against the company, citing Bosch's voluntary self-disclosure and the company's "cooperation and timely remediation."

Many of BIS's enforcement activities during the period covered in this review were supported by budget and staffing increases. For FY2026, BIS received a $44 million increase to its annual budget for enforcement of export controls and protection of sensitive technologies, at which point BIS began hiring additional personnel—particularly agents and overseas officers.

Anti-Boycott Updates

The EAR's anti-boycott regulations discourage and, in some cases, prohibit U.S. persons from participating in unsanctioned foreign boycotts. Compliance requirements include mandatory reporting of any boycott requests received in each calendar quarter. Starting in 2024, BIS began publishing quarterly updates to a non-exhaustive "Requester List," identifying entities that have been reported as making a boycott-related request. The list aids due diligence by providing names of entities who may present an anti-boycott compliance red flag. BIS added 80 names to the requester list in 2025 and 33 more through June 2026. (Parties who believe they have been listed in error can request to be removed.)

On the enforcement front, BIS published only one anti-boycott settlement agreement in 2025, addressing alleged violations committed in 2019. While this total was three and four agreements fewer, respectively, than each of the prior two years, 2021 only saw two settlements, and none were published in 2022, revealing that anti-boycott enforcement in 2025 was not a dramatic departure from recent years. Hinting at an uptick in enforcement activity for 2026, BIS published another three anti-boycott settlement agreements through June, covering alleged violations committed between 2019 and 2024. All of the anti-boycott settlement agreements during this period involved voluntary self-disclosures. 

Outlook for the Second Half of 2026

BIS's publications in July of 2026 indicate the second half of the year may prove far more active than the period covered in this review. July saw release of a final rule enhancing favorable treatment for the United Arab Emirates under the EAR. It also saw release of an interim final rule that will complete the transfer of certain sound suppressors from the ITAR to the EAR. Among other planned activity, such as formal rescission of the AI Diffusion Rule, BIS also intends to release another rule to reduce export controls on drones to certain destinations. Unless trade negotiations or other factors lead to further delay or revisions, BIS will not need to take any action for the Affiliates Rule to go into effect in November. Meanwhile, the Department of State has announced its intention to rescind Syria's designation as a State Sponsor of Terrorism, which will likely lead BIS to further relax export controls on Syria once the relevant congressional notification period expires in the fall.

In addition to the $44 million FY2026 budget increase noted above, the bureau has requested a $215 million budget increase for FY2027, which would more than double the size of the enforcement team, while also adding specialized engineers to that team to support the expected increase in enforcement actions, particularly criminal enforcement matters. Even before the FY2027 budget is approved or further enforcement-focused hiring commences, announcement of multiple enforcement actions throughout the rest of 2026 is highly likely. 

---

For more information, please contact:

Timothy P. O'Toole, totoole@milchev.com, 202-626-5552

Melissa Burgess, mburgess@milchev.com, 202-626-5914

Peter Kentz, pkentz@milchev.com, 202-626-5891

*Summer associate Elina Saxena contributed to this report.

---

The information contained in this communication is not intended as legal advice or as an opinion on specific facts. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. For more information, please contact one of the senders or your existing Miller & Chevalier lawyer contact. The invitation to contact the firm and its lawyers is not to be construed as a solicitation for legal work. Any new lawyer-client relationship will be confirmed in writing.

This, and related communications, are protected by copyright laws and treaties. You may make a single copy for personal use. You may make copies for others, but not for commercial purposes. If you give a copy to anyone else, it must be in its original, unmodified form, and must include all attributions of authorship, copyright notices, and republication notices. Except as described above, it is unlawful to copy, republish, redistribute, and/or alter this presentation without prior written consent of the copyright holder.