Global Encryption, Cloud & Cyber Export Controls

• The AI EO: Cloud-specific details, including the cloud ”Infrastructure as a Service” provisions
  • Impact of Chinese Generative AI Rules on U.S. AI regulatory efforts
• When Chinese users can still access controlled chips (ECCN 3A090) through clouds services and how to address this
• Anticipating U.S. government restrictions on sale of cloud services to China

• Implementing licensing requirements
• Updating licensing policies and Temporary General Licenses
• Gap analysis: Strengthening compliance programs to make sure legal, engineering, and trade compliance are all in the loop with new controls

• Applying licensing requirements for items controlled under ECCNs 5A002 or 5D002 that meet or exceed the performance parameters of the new ECCNs 3A090 or 4A090
• Applying licensing requirements for mass market encryption hardware and software items controlled under ECCNs 5A992 or 5D992
• Restrictions on US persons activities: US persons (citizens, permanent residents, asylees, and refugees) that support the development or production of integrated circuits (IC’s) in China now requires a license
  • What kind of ICs are involved?
  • What ECCNs are relevant?
  • Are any license exceptions available?
• New foreign direct product rules focused on otherwise uncontrolled foreign-origin content for advanced computing and supercomputer-related applications in China
  • Expanded “Entity List FDP Rule” (§ 734.9(e)(2)
  • New “Supercomputer FDP Rule” (§ 734.9(i)
  • New “Advanced Computing FDP Rule” (§ 734.9(h)

• The EU AI Act:
  • The changes it will require from AI companies: How soon will they take effect?
  • How the Act divides its rules on the level of risk an AI systema
  • Will the Act stifle technological innovation?
• Defining DIGITALEUROPE EU export control guidelines vs. U.S. requirements:
  • The definition of “export” when encrypted technology is sent outside of the EU
  • The definition of software “exports” when the software is provided as a service (SaaS)
  • Should an “export” occur when administrators (e.g., at a telecom, cloud service, or SaaS provider) have access to user data for purposes of providing, supporting, or maintaining the service?
• Government of Canada cloud controls:
  • Performing security categorization: Attributing “High Watermark” risk profiles of cloud security
  • Cloud security control profile selections
  • Determining scope of security responsibility for various cloud service models
  • Performing security assessments
• Germany:
  • Pushback towards EU AI Act around “foundation models”
  • The BAFA guidance
  • Bitkom’s position
  • BAFA guidance vs. EU Dual Use regulation
  • Suggestions concerning potential coordination between ANS and Bitkom

What are the short and long-term computing supply chain impacts of BIS’ latest October 2023 rule covering semiconductors and supercomputing technology? How do the 2023 updates raise the compliance bar? How do they impact encryption compliance? As with any complex and novel export control rule involving innovative technologies and supply chains, many anticipate that the new rules will likely have unintended consequences. Might the controls backfire without buy-in from foreign partners and allies?

This panel of experts will address the future of the U.S. microelectronics sector and supply chain amid unprecedented regulatory change.

• Gap analysis: Changes in DDTC/BIS insights into compliance monitoring
• Working in silos versus working as a whole
• Road map for a written compliance plan to cultivate a culture of compliance
• Touchpoint inventories: A holistic review of operations and where third-party data is stored and how it is screened
• Working with verified entities – How much due diligence is enough?
• Delve into certain components that companies have integrated within their current processes
• Industry specific challenges – Semiconductor companies, telecommunication companies, aerospace companies, O&G, etc.
• How to manage your compliance program with remote employees