Framework for Artificial Intelligence Diffusion

• Authority: Department of Commerce
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. regulations, executive orders, and agency policies
• Most recent activity: Defunct
• Most recent activity date: 2025-05-13

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Competitive dynamics
• Governance failure
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2), AI system security (2.2), competitive dynamics (6.4), governance failure (6.5), and dangerous capabilities (7.2). Coverage is concentrated in security, export control, and strategic competition domains related to AI chip and model diffusion.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Professional & Technical Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This is an external regulation that applies primarily to the Information sector (AI chip manufacturers, cloud providers, data processing companies) and Scientific Research and Development Services sector (AI model developers). It also has significant implications for Professional and Technical Services (IT consultants, export compliance services) and potentially affects all sectors that use advanced AI computing resources.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding regulatory framework issued by the Department of Commerce with explicit license requirements, enforcement mechanisms, penalties for non-compliance, and mandatory language throughout.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is issued by the Department of Commerce through the Bureau of Industry and Security, which has regulatory authority over export controls. Multiple sections reference BIS as the issuing authority.

Target

• Entity Types: AI_Developer, AI_Infrastructure_Provider, AI_Deployer
• Summary: The regulation applies to multiple categories of entities involved in AI chip and model export, development, and deployment. It specifically targets exporters of advanced computing chips, IaaS providers, entities training AI models specified in ECCN 4E091, and data center operators.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: BIS is the primary enforcement authority with explicit powers to review applications, grant or deny licenses, revoke VEU status, conduct audits, and impose penalties. Other departments are involved in review processes.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: BIS conducts ongoing monitoring through mandatory reporting requirements, end use checks, and facility audits. Third-party assessment organizations provide independent certification of security compliance.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Build and Use Model
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Deploy and Operate and Monitor lifecycle stages, with some coverage of Build and Use Model stage. It focuses extensively on deployment controls, export restrictions, and ongoing monitoring requirements for AI chips and model weights, rather than earlier development stages.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Compute Threshold
• Open Weight / Open Source

Technical Scope Summary

The document explicitly covers AI models and AI systems, with detailed focus on advanced computing integrated circuits and AI model weights (ECCN 4E091). It establishes compute thresholds measured in TPP (Total Processing Performance) and FLOPs. It does not explicitly define frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, or predictive AI, though it references advanced AI models. Open-weight models are implicitly covered through model weight export controls.