BIS Upgrades UAE Export Control Status, with AI Chip Access Limited to Approved Entities

The US Department of Commerce’s Bureau of Industry and Security (BIS) issued a final rule, effective July 10, 2026, that significantly updates the United Arab Emirates’ treatment under the Export Administration Regulations. The rule removes the UAE from Country Groups D:3 and D:4, adds the UAE to Country Group A:5, and creates a new entity-specific approval framework for advanced computing items and License Exception Strategic Trade Authorization.

The Bureau of Industry and Security (BIS) framed the changes as reflecting the UAE’s status as a US Major Defense Partner, its support for US national security interests, and its commitments to protect sensitive US technology from diversion or misuse.[1] BIS also linked the rule to the May 2025 US-UAE AI Acceleration Partnership framework,[2] under which the countries agreed to deepen technology cooperation, including the launch of a 1 gigawatt (GW) AI data center as part of a planned 5 GW AI technology cluster in Abu Dhabi.

UAE REMOVED FROM COUNTRY GROUPS D:3 AND D:4

On September 23, 2024, the United States recognized the UAE as a Major Defense Partner of the United States, then a designation shared only with India, to support deeper defense cooperation, joint training, exercises, and military-to-military collaboration.[3] The designation is distinct from Major Non-NATO Ally status and does not itself supply an Export Administration Regulations (EAR)or International Traffic in Arms Regulations (“ITAR”) authorization.

Before the July 10, 2026 final rule, the UAE was listed in Country Group B but also in Country Groups D:3 and D:4, which limited the availability of several license exceptions for items controlled for chemical and biological weapons (CB) and missile technology (MT) reasons. BIS specifically noted that, prior to the rule, an MT-controlled unmanned aerial vehicle (UAV) could not be temporarily exported to the UAE for display at a defense trade show under License Exception Temporary Imports, Exports, Reexports, and Transfers (in-country) (TMP).

The new final rule now gives concrete export control consequence to UAE’s Major Defense Partner status by removing the UAE from Country Groups D:3 and D:4.

As a result, additional exports, reexports, and in-country transfers of CB- and MT-controlled items may now be eligible for license exceptions, including TMP, GOV, TSU, AVS, and APR, and additional provisions of ACE and BAG will become available for the UAE. The rule also removes certain UAE-related missile end-use restrictions and certain US person restrictions. BIS stated that this will eliminate restrictions on support for UAE UAV programs.

Importantly, the rule does not remove Commerce Control List (CCL)-based license requirements. MT- and CB-controlled items that require a license by Export Control Classification Number (ECCN) classification will still require authorization unless a license exception is available and all conditions are met. The practical change is therefore not a wholesale decontrol of UAE-bound items, but a significant expansion of license exception eligibility.

BRIEF EXPLANATION OF LICENSE EXCEPTION ‘STA’

License Exception Strategic Trade Authorization (STA) is one of the EAR’s most important license exceptions. In general terms, it allows exports, reexports, and in-country transfers of certain controlled items to specified destinations and users without obtaining an individual BIS license, provided the exporter, consignee, and other parties satisfy detailed eligibility, certification, notification, and recordkeeping conditions. STA is not a blanket authorization; rather, parties must confirm that the destination, item, end use, end user, and transaction structure all fit within the exception and are not otherwise restricted by the EAR’s general limitations on license exceptions.

For the UAE, the significance of STA is that some transactions involving sensitive dual-use, commercial space, and certain military items may move through a license-exception rather than a transaction-specific license.

UAE ADDED TO COUNTRY GROUP A:5, BUT ‘STA’ IS ENTITY-LIMITED

The final rule adds the UAE to Country Group A:5, a change that would normally expand access to STA.

However, BIS paired that country-group upgrade with a new limitation. For exports, reexports, or in-country transfers to or within the UAE, STA is available only where the ultimate consignee and all end users are approved entities listed in new Supplement No. 8 to Part 740 and are specified as eligible for STA. In other words, UAE’s A:5 status creates the country-level basis for more favorable treatment, but Supplement No. 8 determines which specific UAE government agencies and companies can actually use that treatment.

BIS stated that STA may authorize eligible exports, reexports, and transfers of items controlled for national security (NS), CB, nuclear nonproliferation (NP), regional stability (RS), crime control (CC), and significant items (SI) reasons, including certain military items, commercial space-related items, and dual-use items relevant to semiconductor packaging, oil and gas production, desalination, and civil nuclear power generation.

Commercial entities in the UAE seeking approval may submit an advisory opinion request to BIS, which will assess requests case by case based on US national security and foreign policy interests, including the applicant’s compliance capabilities and track record.

ADVANCED COMPUTING ITEMS REMAIN CONTROLLED, WITH A NEW APPROVED-ENTITY EXCEPTION

The rule does not generally ease exports of advanced computing items to the UAE.

BIS will continue enforcing license requirements for advanced computing items (described in 15 CFR § 742.6(a)(6)(iii)(A)), including ECCNs 3A090.a and 4A090.a and related “.z” paragraph items, for exports, reexports, and in-country transfers to or within the UAE unless the ultimate consignee and all end users are listed in Supplement No. 8 and approved to receive those items license-free.

BIS also amended § 742.6(a)(6)(iii)(B) to maintain UAE-specific license requirements for lower-performance advanced computing items, including ECCNs 3A090.b and 4A090.b and related “.z.b” items, again with an exception for approved Supplement No. 8 entities.

This approach is consistent with BIS’s broader post-AI Diffusion Rule posture. In May 2025, BIS announced that it would not enforce the Biden-era Framework for Artificial Intelligence Diffusion (AI Diffusion Rule) and would issue a replacement rule in the future.[4] Subsequently, in May 2026, BIS clarified that certain advanced computing license requirements continue to apply to entities headquartered in, or with an ultimate parent headquartered in, Country Group D:5 or Macau, even if the entity is located elsewhere.[5] More recently, on July 14, 2026, Under Secretary for Industry & Security Jeffrey Kessler told the US Congress that the US administration no longer intends to replace the AI Diffusion Rule, instead focusing on new rulemaking.

SUPPLEMENT NO. 8 CREATES THREE CATEGORIES OF APPROVED ENTITIES

As mentioned, the new Supplement No. 8 to Part 740 identifies approved ultimate consignees and end users in the UAE for advanced computing items and/or STA:

• UAE government agencies, including the Ministry of Defense and Armed Forces, are approved to receive advanced computing items license-free and to use STA for eligible items. This approval does not extend to UAE state-owned corporations or to contractors or grantees of UAE government agencies.
• BIS approved two UAE-based AI companies to receive advanced computing items license-free. These entities are not approved for STA in the table as published. Their authorization is also time-limited: absent further BIS notice, the authorization automatically expires 270 days after April 6, 2027 (270 days after the rule’s July 10, 2026 effective date), unless these companies “become US companies” by that date. Otherwise, they will need to apply for authorization to maintain approved status. The rule does not define what it means for those companies to “become US companies.”
• BIS approved subsidiaries of certain US-headquartered hyperscalers to receive advanced computing items license-free, and these entities may use STA for eligible items in the UAE.

It is notable that the preamble separately states that BIS will “favorably review” license applications involving another entity for semiconductor and server exports. That statement does not appear as a self-executing authorization in the regulatory text. Accordingly, transactions related to that entity may benefit from a favorable licensing policy, but they still require transaction-specific review unless another authorization applies.

These deployment-specific controls do not modify BIS’s industry-wide anti-diversion requirements. BIS’s final rule specifically warns that “approval in supplement no. 8 to part 740 does not overcome the end-use and end-user based license requirements in part 744 of the EAR,” and otherwise applicable inchoate provisions (e.g., aiding and abetting or causing a violation, conspiracies to violate the EAR, evasion) and General Prohibition 10 (prohibiting acts related to an item subject to US export controls while “knowing”—defined to include “an awareness of a high probability”—of a past, present, or future violation) still apply.[6]

Certain UAE companies have already developed tailored compliance frameworks to meet enhanced US physical security, cybersecurity, and anti-diversion requirements associated with prior authorizations. These measures are likely to frame US government expectations for other UAE companies and other companies in the broader region.

POTENTIAL IMPACT ON CFIUS MANDATORY FILINGS

The UAE’s new, entity-limited STA eligibility may also narrow the scope of some mandatory filings before the Committee on Foreign Investment in the United States (CFIUS).

A declaration (or full notice in lieu of a declaration) is generally required for certain covered transactions involving a technology, infrastructure, or data (TID) US business that produces, designs, tests, manufactures, fabricates, or develops “critical technology” when a US regulatory authorization would be required to export that technology to specified foreign transaction parties or relevant owners.[7]

CFIUS generally evaluates that hypothetical export without giving effect to EAR license exceptions. There is, however, a carveout where each relevant critical technology and each relevant foreign person is eligible for at least one of three specified EAR license exceptions: (1) Technology and Software Unrestricted (TSU); (2) Encryption Commodities, Software and Technology (ENC); or (3) STA. “Eligible” includes satisfying any pre-export conditions, even though no export may occur.[8]

Accordingly, the final rule could create an opportunity for UAE investors to not have a critical-technology mandatory filing requirement, to the extent STA is authorized for them. This potential opportunity appears limited in the final rule to the UAE government itself, because the two authorized commercial entities are specifically not authorized to benefit from STA (unlike the subsidiaries of US hyperscalers, which are authorized to use STA). The scope of future authorizations and whether commercial entities are authorized to benefit from STA will be important to watch for the potential implications of those entities’ investments in the United States.

PRACTICAL IMPLICATIONS

The rule creates meaningful new opportunities for companies supporting UAE defense, aerospace, energy, desalination, civil nuclear, data center, and AI infrastructure projects. It also marks a notable evolution in BIS’s use of export controls, in that it combines country-group treatment with an entity-specific approval list.

Companies should consider taking the following steps to benefit from these opportunities:

• Review UAE-related classifications and license exception determinations, particularly for CB- and MT-controlled items that may now have expanded license exception eligibility.
• Confirm whether all parties needed for STA eligibility are listed in Supplement No. 8 and specifically approved for STA. UAE A:5 status alone is not enough.
• Monitor the list in Supplement No. 8 for potential impact on future CFIUS filing obligations, specifically related to any authorized uses of STA.
• For advanced computing transactions, verify whether the ultimate consignee and every end user are approved for advanced computing items under Supplement No. 8. The UAE remains subject to advanced computing license requirements outside that approved-entity framework.
• Treat entity-related transactions as potentially eligible for favorable license review, but not as license-free unless another authorization applies.
• Continue to engage in risk-based trade compliance to identify, analyze, and where possible mitigate (through enhanced due diligence or a license application) “red flags” indicating a risk of diversion—including in violation of the knowledge-based inchoate provisions and General Prohibition 10.

LOOKING AHEAD

The UAE rule is part of the US administration’s broader effort to promote US AI technology exports to countries that the United States has determined warrant more favorable export treatment, while maintaining restrictions on advanced chips and sensitive end uses. Executive Order 14320, issued July 23, 2025, established the American AI Exports Program to support full-stack AI export packages, while requiring compliance with export controls and end-user policies.[9]

For now, the UAE has benefitted from a bespoke model that involves favorable country-group treatment, expanded STA eligibility for approved entities, and license-free advanced computing access for selected government and commercial entities. As the US considers other Gulf or strategic partner countries for comparable treatment, this rule should be anticipated to be the template.