Export Controls and Dual-Use IT Hardware — BIS, OFAC, and AI Chip Restrictions

Enterprise IT hardware — particularly high-performance computing equipment, advanced semiconductors, and AI accelerators — is subject to export control regulations that govern where it can be sold, who can buy it, and what it can be used for. For channel partners, resellers, distributors, and importers operating in Hong Kong, Dubai, and the broader Asia-Pacific and MENA regions, understanding these controls is not optional: violations carry severe penalties including criminal prosecution, significant fines, and loss of export privileges. The landscape has become substantially more complex since 2022, with sweeping new controls on AI semiconductors that directly affect the enterprise IT hardware channel.

The Regulatory Framework: BIS and the EAR

The primary US export control authority for dual-use goods (items with both commercial and potential military applications) is the Bureau of Industry and Security (BIS), part of the US Department of Commerce. BIS administers the Export Administration Regulations (EAR), which apply to all items "subject to the EAR" — a category that includes hardware designed, manufactured, or containing significant US technology, regardless of where the transaction occurs or where the goods are physically located.

This extraterritorial reach is the critical concept for channel partners outside the US: a company in Hong Kong or Dubai selling US-origin IT hardware (NVIDIA GPUs, Cisco networking equipment, HP servers) to a restricted party or restricted destination is violating US export law — even though the transaction occurs entirely outside the US. Because so much enterprise IT hardware contains US-origin technology, EAR compliance is relevant to virtually every enterprise IT hardware channel partner globally.

AI Chip Export Controls — The 2023 and 2024 Rules

The most significant recent export control development affecting the IT hardware channel is the series of BIS rules restricting export of advanced AI computing chips introduced from October 2022 onwards, with major expansions in October 2023 and further updates in 2024.

What Is Restricted

The BIS rules target advanced integrated circuits used for AI training and inference — specifically those meeting threshold specifications for computational performance (measured in total processing performance, TPP) and interconnect bandwidth. The specific thresholds have evolved through multiple rule updates, but the practical effect is:

NVIDIA H100 (GH100 die, SXM5 and PCIe variants): Subject to export license requirements for sale to Mainland China, Macau, and countries under arms embargo. No license exceptions available for these destinations for H100.
NVIDIA H200 SXM5: Subject to the same restrictions as H100 due to exceeding the performance thresholds for controlled chips.
NVIDIA B200 SXM5, B300, GB200 NVL72: Subject to export license requirements; same destination restrictions apply.
NVIDIA L40S: As of the October 2023 rules, L40S was also restricted for China; subsequent rule adjustments have modified L40S status — verify current BIS rules or consult an export compliance attorney for the current classification.
NVIDIA A100, A800, H800: A100 is subject to export controls for China. NVIDIA's China-specific variants (A800, H800) were created specifically to fall below the original BIS thresholds; subsequent rule changes have restricted these as well.

What Is Not Restricted for Standard Enterprise Use

Standard enterprise IT hardware without high-performance AI computing capability is generally not subject to the AI chip-specific rules: HPE ProLiant servers, Dell PowerEdge servers (without restricted GPU cards), Cisco switching and routing, NetApp and HPE Alletra storage, and most networking products are not subject to the AI chip export controls. These products remain subject to general EAR regulations regarding end-user and end-use restrictions (sanctions, arms embargoes, prohibited end users), but do not require specific licenses for most commercial transactions to most countries.

OFAC Sanctions

The Office of Foreign Assets Control (OFAC) administers US economic sanctions programs that prohibit transactions with sanctioned countries, entities, and individuals. For IT hardware, OFAC sanctions are relevant when the buyer, end user, or destination country appears on a sanctions list. Currently sanctioned countries where IT hardware transactions are prohibited include Iran, North Korea, Cuba, Syria, and Russia (with significant restrictions). The UAE and Hong Kong are not sanctioned jurisdictions, but channel partners in these locations must screen all transactions against OFAC's Specially Designated Nationals (SDN) list to ensure no sanctioned parties are involved.

End-User Certificates (EUC)

For sales of controlled items — particularly high-performance GPU hardware — NVIDIA and other OEMs require channel partners to obtain End-User Certificates from buyers. An EUC is a signed statement from the purchasing company that:

Identifies the purchasing company and its address
Identifies the intended end use of the hardware (data center AI training, commercial inference, research)
Confirms the hardware will not be re-exported to restricted destinations
Confirms the hardware will not be used for prohibited end uses (weapons of mass destruction development, military end use in restricted countries)

EUCs are required for all sales of restricted GPU hardware and must be retained by the selling channel partner for a minimum of five years (the standard EAR recordkeeping requirement). If a buyer refuses to provide an EUC or provides documentation that raises compliance concerns, the sale must not proceed.

Compliance Obligations for Channel Partners in Hong Kong and Dubai

Channel partners operating from Hong Kong or Dubai selling US-origin IT hardware are subject to the EAR because the hardware is subject to US jurisdiction regardless of where it is sold. Practical compliance requirements include:

Screen all buyers and end users against OFAC SDN list, BIS Entity List, BIS Denied Persons List, and BIS Unverified List before each transaction. Free screening tools are available from BIS; commercial compliance software automates this screening.
Obtain EUCs for all sales of controlled GPU hardware. Keep copies for five years.
Verify end destination: Confirm that hardware will not be re-exported to restricted destinations. If a buyer in a non-restricted country appears to be acting as a transit point for hardware ultimately destined for Mainland China or other restricted destinations, the transaction must be declined.
Train staff on export compliance. All employees involved in sales, shipping, and customer management for controlled hardware should complete export compliance training. NVIDIA and other OEM partner programs require compliance training as a condition of partnership.
Maintain records: All export documents — commercial invoices, shipping records, EUCs, screening records — must be retained for five years.

Red Flags for Compliance Violations

BIS publishes guidance on "red flags" that should prompt additional due diligence or refusal of a transaction:

Customer is reluctant to provide end-user information or end-use description
Customer requests removal of standard export documentation (packing lists, country of origin labels)
Shipping destination does not match the customer's stated business location
Order is for an unusually large quantity of high-performance hardware without clear business justification
Customer pays in cash or requests unusual payment arrangements
Customer is unfamiliar with the technical specifications of the hardware they are ordering
Hardware is to be forwarded to a freight forwarder with no identified final destination

Consequences of Violations

EAR violations carry severe penalties: civil fines of up to $353,534 per violation (as of recent inflation adjustments) or twice the value of the transaction, whichever is greater. Criminal violations carry fines up to $1 million per violation and imprisonment up to 20 years. Companies found to have committed violations may be added to the BIS Denied Persons List, effectively prohibiting them from participating in any US export transaction. For channel partners whose business depends on selling US-origin IT hardware, a denied person listing is effectively a business-ending sanction.

Related Resources

Frequently Asked Questions

Can a Hong Kong company legally sell NVIDIA H100 servers to Mainland China?

No. NVIDIA H100 and H200 are subject to BIS export license requirements for export to Mainland China. The license requirement applies regardless of whether the selling company is located in the US, Hong Kong, or any other country — the EAR applies extraterritorially to US-origin controlled items. Selling H100 or H200 to a Mainland China buyer, through any routing, is a violation of US export law.

What GPU hardware can be legally sold to Mainland China?

The current BIS rules are complex and have evolved multiple times. Generally, chips below the performance thresholds specified in the rules can be sold without a license. Consult current BIS guidance or an export compliance attorney for the specific current status of each product. NVIDIA's China-market GPUs have historically been designed to fall below BIS thresholds, though the thresholds themselves have been revised. Huawei Ascend series AI chips are domestically produced and not subject to US export controls.

Do standard servers (HPE ProLiant, Dell PowerEdge without GPU) require export licenses?

Standard servers without high-performance AI GPUs are generally EAR99 (not controlled under any ECCN) or classified under low-level ECCNs that do not require licenses for most destinations. They do not require export licenses for sales to commercial buyers in most countries. However, all transactions still require OFAC sanctions screening to ensure no sanctioned parties are involved, and all products remain subject to end-use restrictions prohibiting use in weapons of mass destruction programs regardless of classification.