The AI Diffusion Rule is the export regulation everyone heard about and few understand the current status of. It was issued, then rescinded before it ever took effect, yet its core ideas did not disappear. For anyone retiring, reselling, or relocating AI infrastructure, the story of what survived the rescission matters more than the rule itself. Here is the ITAD-perspective breakdown.
Important: This article is educational and does not constitute legal advice. Export control law is complex, fact-specific, and changing rapidly, and this area is especially unsettled. The status described here reflects our understanding as of mid-2026 and may have changed. Always consult qualified export-control counsel before exporting, reexporting, or transferring controlled hardware or providing compute access. ROC Telecom is not a law firm and does not provide legal or export-classification opinions.
TL;DR
The AI Diffusion Rule had a short and strange life, and understanding its afterlife is what matters for AI infrastructure disposition:
- It was issued in January 2025, then rescinded in May 2025 before its compliance date, by the incoming administration, which called it burdensome and diplomatically damaging.
- It is in regulatory purgatory. BIS announced the rescission and said it will not enforce the rule, but as of mid-2026 a formal replacement had not been issued, and the original text technically remained on the books.
- Its concepts survived through other mechanisms. Many of the same controls (know-your-customer requirements, restrictions on compute access, tiered-destination thinking) live on through General Prohibition 10 (GP10), Foreign Direct Product (FDP) rules, IaaS restrictions, and case-by-case licensing.
- The chip-level controls never went away. ECCN 3A090 and the underlying advanced-computing controls remain fully in force. The Diffusion Rule was a layer on top, not the foundation.
- Enforcement risk is rising, not falling. BIS received a 23 percent budget increase for FY2026, and DOJ and BIS are pursuing cases that reach intermediaries, service providers, and data center operators, not just manufacturers.
- The disposition implication: anyone retiring, reselling, or relocating AI infrastructure across borders still faces real export-control obligations. The Diffusion Rule’s rescission simplified nothing at the hardware level.
This guide covers what the rule was, why it was rescinded, what survived, and what it all means for the disposition of AI infrastructure, the retirement side that almost no coverage addresses.
What the AI Diffusion Rule Was
To understand the current landscape, it helps to understand what the rule tried to do, because its ambitions explain what survived it.
The Framework for Artificial Intelligence Diffusion was issued by BIS (the Bureau of Industry and Security, within the U.S. Department of Commerce) on January 15, 2025, in the final days of the Biden administration. It was an ambitious, late-breaking effort to control the global spread of advanced AI capability, and it worked through two main mechanisms.
First, it imposed a tiered, worldwide framework on the export of advanced computing chips. The rule divided the world into three tiers: a small group of close U.S. allies with broad access, a large middle group subject to a rationing system built around country-wide compute quotas measured in total processing performance (TPP), and arms-embargoed and adversary destinations under a policy of denial. It was, in effect, a global rationing regime for AI compute.
Second, it introduced new controls on the export of certain closed-weight AI model weights, the trained parameters that represent a model’s capability, treating the most advanced models themselves as controlled items.
The rule was scheduled to take effect on May 15, 2025. It never did.
Why It Was Rescinded
The AI Diffusion Rule generated immediate and intense debate, and the change of administration sealed its fate.
On May 13, 2025, two days before the rule’s compliance date, the Department of Commerce announced its intention to rescind it. BIS instructed enforcement officials not to enforce the rule, with the Under Secretary for Industry and Security framing the decision as clearing the way for a bolder, more inclusive American AI strategy. The stated objections were that the rule would have stifled American innovation, saddled companies with burdensome regulatory requirements, and undermined U.S. diplomatic relations by downgrading dozens of countries to second-tier status.
The timing was notable. The rescission was announced in parallel with a presidential trip to the Middle East, during which U.S. companies were seeking to expand AI infrastructure investments in the region. The rescinded rule would have limited exports to countries including Saudi Arabia and the UAE, and the administration signaled a preference for having those regions build AI infrastructure on a U.S.-centric technology stack rather than turning to alternatives.
Critically, though, the rescission did not abandon the underlying strategic goal. The administration maintained the aim of keeping advanced U.S. AI technology from adversaries, and simultaneously took other actions to restrict certain higher-end chip exports to China. The message was not “controls are going away.” It was “we will pursue the same goals through different means.”
The Regulatory Purgatory
Here is where the current picture gets genuinely unusual, and why the situation demands care rather than assumptions.
As of mid-2026, the AI Diffusion Rule existed in a strange in-between state. BIS had announced the rescission and committed to not enforcing the rule, and had said a replacement rule would come in the future. But the formal replacement had not been issued, and the original rule text technically remained in the Code of Federal Regulations. The rule was, in the words of one legal analysis, caught in regulatory purgatory: announced as rescinded, not enforced, but not fully removed, and not yet replaced.
This creates real uncertainty for anyone planning around it. The rule cannot be relied upon as governing law, because BIS has said it will not enforce it. But its formal presence and the promised replacement mean the framework’s ideas remain live policy questions. Open questions that legal observers were tracking into 2026 included whether the administration would issue a full replacement for the Diffusion Framework, and if not, which elements it would keep or cut through other means.
For infrastructure planning, the practical takeaway is that this is an area to watch closely and to approach with current counsel, not settled assumptions. The status can change with a single BIS announcement.
What Actually Survived the Rescission
This is the most important section for disposition, because the rescission of the headline rule did not clear the underlying compliance landscape. Several mechanisms carry forward much of what the Diffusion Rule would have done.
The Chip-Level Controls Remain
Most fundamentally, ECCN 3A090 and the advanced-computing export controls it sits within were never part of the Diffusion Rule and never went away. The chip-level classification of advanced GPUs (H100, H200, A100, B200, and the rest) remains fully in force. The Diffusion Rule was a layer of destination-based rationing on top of these controls, not their source. (For the chip-level detail, see our guide to GPU export controls and ECCN 3A090.)
GP10 and the FDP Rules
On the same day it announced the rescission, BIS issued guidance documents that connected export controls directly to data centers. One key piece addressed General Prohibition 10 (GP10), which prohibits proceeding with a transaction knowing a violation has occurred or is about to occur. BIS guidance advised that for certain advanced chips associated with China, a Foreign Direct Product (FDP) rule will likely require a U.S. license, because there is a high probability that a BIS license was required in the chip’s design or production. In effect, this guidance confers “knowledge” on industry, and knowledge can itself trigger licensing requirements. These mechanisms reach transactions the Diffusion Rule would have covered, through different legal machinery.
IaaS and Remote-Access Restrictions
The controls extended beyond physical hardware to compute access. Licensing conditions have restricted the provision of remote infrastructure-as-a-service access to end users located in or ultimately headquartered in restricted jurisdictions (including China, Russia, Iran, and others) or otherwise restricted under Part 744. This means controlling AI compute is not solely about where the hardware physically sits, but also about who is given access to it.
This dimension has continued to harden. In early 2026, the House passed the Remote Access Security Act (by a 369-22 vote), aimed at closing the so-called cloud loophole, whereby a restricted party could rent remote access to controlled GPUs hosted in a permitted country rather than importing the hardware directly. It is a direct legislative expression of a concept the Diffusion Framework contemplated: that access to advanced compute, not just possession of the chips, is what the controls are ultimately trying to govern. The rule was rescinded, but this piece of its logic is advancing through Congress on its own.
KYC and Case-by-Case Licensing
The administration has in practice applied many of the same know-your-customer and enhanced-diligence requirements the Diffusion Framework envisioned, on a bilateral or case-specific basis. Authorizations for certain Middle Eastern countries, for example, came with rigorous security and reporting requirements. And a January 15, 2026 BIS rule created a case-by-case review path (rather than automatic denial) for certain chips (notably the NVIDIA H200 and AMD MI325X, below a total processing performance of 21,000 and DRAM bandwidth of 6,500 GB/s) to China and Macau, subject to a 25 percent tariff, a 50 percent volume cap, third-party testing, and strict know-your-customer screening. It offers a clear window into the diligence conditions the government considers important, and it shows the same concepts the Diffusion Rule contemplated being applied through case-specific licensing rather than a single framework. (For the chip-level detail on that rule, see our guide to GPU export controls and ECCN 3A090.)
The Affiliates Rule
A related development, the Affiliates Rule (extending controls to certain foreign affiliates of listed entities), was suspended until November 2026, but BIS signaled it continues to evaluate the national-security concerns behind it. Operators were advised to review ownership and investment structures well ahead of any resumption.
What This Means for AI Hardware Disposition
Translating this unsettled landscape into disposition practice, several realities hold regardless of the Diffusion Rule’s uncertain status.
The Hardware Obligations Did Not Simplify
The rescission of the Diffusion Rule did not lighten the compliance load for physically retiring, reselling, or shipping AI hardware across borders. The chip-level controls remain, GP10 and FDP mechanisms remain, and enforcement is intensifying. An operator disposing of covered AI infrastructure faces the same core obligations described in our GPU export-controls guide: classify the hardware, screen buyers and destinations, document the compliance basis, and match hardware to compliant outcomes. The Diffusion Rule’s disappearance changed none of that.
Compute Access Is Part of Disposition Thinking
The IaaS and remote-access restrictions add a dimension many operators overlook. If retired-but-functional AI hardware is redeployed into a service that provides compute access, the question of who can access that compute carries its own export-control implications. Disposition planning that involves redeploying rather than destroying capacity should account for this.
Enforcement Risk Is the Real Story
The single most important trend is that enforcement is rising even as the headline rule receded. BIS received a 23 percent budget increase for FY2026, with funds specifically marked for semiconductor-related enforcement, and DOJ and BIS have pursued complex, multi-jurisdictional cases reaching intermediaries, service providers, and data center operators, not just chip makers. For the disposition chain, this means brokers, resellers, logistics providers, and ITAD vendors are within the enforcement aperture. A compliant disposition process is not just good practice, it is risk management in an environment of increasing scrutiny.
Data Centers as National-Security “First Responders”
Legal commentators have begun describing data centers and their customers as national-security first responders, expected to maintain export-control guardrails through risk-based compliance and diligence. That framing extends naturally to end of life. The same operator expected to control who accesses its AI compute in operation is expected to control where that hardware goes at retirement. Disposition is part of the compliance perimeter, not outside it.
The Uncertainty Argues for Conservative Disposition
Because the regulatory picture is unsettled and a replacement rule could arrive at any time with new requirements, the prudent disposition posture is conservative. Favoring compliant domestic outcomes, documenting thoroughly, screening rigorously, and involving counsel on cross-border transactions all hedge against a landscape that could tighten with a single announcement. The strong domestic U.S. secondary market for AI hardware often allows meaningful recovery value without engaging the cross-border questions at all.
How This Connects to the Broader AI Retirement Wave
The Diffusion Rule saga is unfolding at the same moment as the first large wave of AI infrastructure retirement, and the two intersect in a way that raises the stakes.
The AI hardware deployed at scale from 2024 onward is entering its retirement window on compressed refresh cycles, which means growing volumes of advanced GPUs and AI systems flowing into the secondary market. That flow is happening into an export-control environment that is simultaneously unsettled at the framework level (the Diffusion Rule’s purgatory) and intensifying at the enforcement level (rising budgets and expanding cases). The combination is challenging: the rules that apply are partly in flux, while the consequences of getting them wrong are growing.
For operators, this argues for treating AI hardware disposition as a compliance-sensitive process managed with current expertise, not as routine surplus handling. The recovery value in retired AI fleets is real and substantial. Capturing it without stepping on an evolving and increasingly enforced set of controls is the challenge, and it is a solvable one with the right diligence, documentation, and disposition strategy.
Frequently Asked Questions
The following is general information, not legal advice. Consult qualified export-control counsel for guidance on specific transactions.
What is the AI Diffusion Rule?
The Framework for Artificial Intelligence Diffusion was a U.S. export regulation issued by the Bureau of Industry and Security (BIS) on January 15, 2025. It aimed to control the global spread of advanced AI capability through two main mechanisms: a tiered, worldwide framework dividing countries into three groups with different levels of access to advanced computing chips (built around country-wide compute quotas measured in total processing performance), and new controls on the export of certain advanced closed-weight AI model weights. It was scheduled to take effect on May 15, 2025.
Is the AI Diffusion Rule still in effect?
No, not in an enforceable sense, but its status is unusual. On May 13, 2025, the Department of Commerce announced it would rescind the rule, and BIS instructed officials not to enforce it. However, as of mid-2026, a formal replacement rule had not been issued, and the original rule text technically remained in the Code of Federal Regulations. The rule is often described as being in regulatory purgatory: announced as rescinded and unenforced, but not fully removed and not yet replaced. Because this status can change, anyone planning around it should consult current export-control counsel.
Why was the AI Diffusion Rule rescinded?
The incoming administration announced the rescission in May 2025, objecting that the rule would have stifled American innovation, imposed burdensome regulatory requirements, and undermined U.S. diplomatic relations by downgrading dozens of countries to second-tier status. The timing coincided with a presidential trip to the Middle East during which U.S. companies were pursuing AI infrastructure investments in the region, and the administration signaled a preference for having allied regions build AI infrastructure on a U.S.-centric technology stack. Importantly, the rescission did not abandon the underlying goal of keeping advanced AI technology from adversaries.
Do export controls on AI chips still apply after the rescission?
Yes. The chip-level controls, centered on ECCN 3A090 and the broader advanced-computing export controls, were never part of the AI Diffusion Rule and remain fully in force. The Diffusion Rule was a layer of destination-based rationing on top of those controls, not their source. In addition, mechanisms including General Prohibition 10 (GP10), Foreign Direct Product (FDP) rules, IaaS and remote-access restrictions, and case-by-case licensing carry forward much of what the Diffusion Rule would have done. The rescission of the headline rule did not clear the underlying compliance landscape.
What is the replacement for the AI Diffusion Rule?
As of mid-2026, no formal replacement rule had been issued. BIS said at the time of the rescission that it would issue a replacement in the future, but the specifics remained an open question that legal observers were actively tracking, including whether a full replacement would come at all and, if not, which elements of the original framework would be preserved through other mechanisms. In the meantime, the administration has applied many of the framework’s concepts (know-your-customer requirements, compute-access restrictions, case-specific conditions) on a bilateral or case-by-case basis.
How does the AI Diffusion Rule affect data centers and infrastructure disposition?
Even in its rescinded state, the surrounding controls affect data centers significantly. The chip-level controls, GP10, FDP rules, and IaaS restrictions all bear on how AI hardware can be exported, transferred, or provided as compute access, including at end of life. For disposition specifically, retiring, reselling, or relocating covered AI infrastructure across borders still triggers export-control obligations: classification, denied-party and destination screening, and documentation. Legal commentators increasingly describe data centers as national-security first responders expected to maintain export-control guardrails, a framing that extends to how they handle hardware at retirement.
Is enforcement of AI export controls increasing?
Yes. Even as the headline Diffusion Rule receded, enforcement intensified. BIS received a 23 percent budget increase for fiscal year 2026, with funds specifically marked for semiconductor-related enforcement, and both DOJ and BIS have pursued complex, multi-jurisdictional cases that reach beyond manufacturers to include intermediaries, service providers, financial institutions, and data center operators. For the disposition chain, this means brokers, resellers, logistics providers, and ITAD vendors handling covered hardware are within the enforcement aperture, which makes compliant disposition a matter of risk management, not just good practice.
What should operators do about AI hardware disposition given the uncertainty?
Given the unsettled framework and rising enforcement, a conservative disposition posture is prudent. That means favoring compliant domestic outcomes where possible (the strong domestic U.S. secondary market often captures meaningful recovery value without cross-border complications), classifying hardware before it is marketed, screening buyers and destinations rigorously, documenting the compliance basis thoroughly, accounting for compute-access questions if hardware is redeployed rather than destroyed, and involving qualified export-control counsel in cross-border transactions. Because a replacement rule could arrive with new requirements, building disposition processes that are conservative and well-documented hedges against a landscape that could tighten quickly.
How is the AI Diffusion Rule different from ECCN 3A090 controls?
They operate at different levels. ECCN 3A090 is the export classification for the advanced chips themselves, controlling specific GPUs and AI accelerators based on their performance characteristics. It is foundational and remains fully in force. The AI Diffusion Rule was a broader framework layered on top, adding a tiered, destination-based rationing system for how much advanced compute different countries could receive, plus controls on AI model weights. When the Diffusion Rule was rescinded, the underlying 3A090 chip controls were unaffected. In short, 3A090 controls the chip, while the Diffusion Rule would have controlled the global distribution of compute capacity built from those chips.
The Bottom Line
The AI Diffusion Rule is a cautionary tale about assuming a rescinded rule means a cleared landscape. Issued in January 2025 and rescinded in May 2025 before it took effect, the rule left behind a regulatory purgatory: announced as gone, unenforced, but not formally removed and not yet replaced. More importantly, its core ideas survived through other mechanisms. The chip-level ECCN 3A090 controls never went away, and General Prohibition 10, Foreign Direct Product rules, IaaS restrictions, and case-by-case licensing carry forward much of what the rule would have done.
For anyone retiring, reselling, or relocating AI infrastructure, the practical reality is that the compliance obligations at the hardware level did not simplify, while enforcement is intensifying, reaching intermediaries, service providers, and data center operators, not just chip makers. The disposition of AI hardware sits inside this evolving and increasingly enforced perimeter, not outside it.
The retirement wave of AI infrastructure is arriving into exactly this environment: unsettled at the framework level, tightening at the enforcement level. The recovery value in retired AI fleets is substantial, and it is capturable compliantly, but doing so requires treating disposition as a compliance-sensitive process guided by current counsel, favoring compliant domestic outcomes, and documenting thoroughly. In an area changing this fast, conservative and well-documented disposition is the sound posture.
How ROC Telecom Helps
ROC Telecom is an R2v3, RIOS, NIST 800-88, and ITAR-compliant ITAD specialist with export-control awareness built into AI infrastructure disposition:
- Export-classification awareness integrated into AI hardware disposition, so covered infrastructure is identified before it is marketed for resale
- Denied-party and destination screening as part of the resale process, matching covered hardware to compliant buyers
- Deep domestic U.S. buyer network across enterprises, neoclouds, and research institutions, frequently capturing strong recovery value without cross-border complications
- ITAR-compliant handling and the documentation discipline that export-controlled equipment requires
- Per-asset serialized documentation with chain-of-custody, aligned with the diligence that an intensifying enforcement environment rewards
- NIST 800-88 data destruction on all data-bearing components before any disposition
- Specialist GPU and AI infrastructure recovery with speed-to-remarketing that protects value against generational decay
15+ years of ITAD experience, $25M+ in client capital recovered, 45M+ pounds diverted from landfill.
ROC Telecom is not a law firm and does not provide legal or export-classification opinions. For covered hardware and cross-border questions, we work alongside your export-control counsel to support compliant disposition.
Request a Free AI Infrastructure Disposition Assessment
Tell us about the AI infrastructure you are retiring. A specialist will discuss recovery value, secure data destruction, and compliant disposition pathways, including domestic options that capture value without cross-border complications. No commitment, no spam. Prefer to talk directly? Call 585-406-1249 or email info@roctelecom.com.
"*" indicates required fields
Related reading:
- GPU Export Controls and ITAD: What ECCN 3A090 Means When You Retire and Resell AI Hardware
- How GPU Decommissioning Differs from Standard Server Retirement
- Hyperscale ITAD vs Enterprise ITAD: What’s Actually Different in 2026
- ITAD for Cloud Providers: The 2026 Strategic Guide
- Why AI Is Shortening Your Hardware Lifecycles (and What to Do About It)
- Data Center Asset Recovery: The 2026 Strategic Guide
- The Northern Virginia Data Center Market: A 2026 Overview
