What Artificial Intelligence Companies Must Know to Comply with New Export Policies

In August 2018, Congress expanded the authority of the Committee on Foreign Investment in the United States (CFIUS) to review, block or unwind certain transactions involving foreign investment without “control” of key US assets, businesses or technologies. Following the passage of the Foreign Investment Risk Review Modernization Act (FIRRMA), CFIUS acting on authorities granted in FIRRMA issued new regulations under which certain transactions involving “critical technologies” impact the new pilot program industries that targets 27 industries.

Unlike the pre-FIRRMA CFIUS submissions that were technically voluntary, the new pilot program submissions are now required. (See 31 CFR Part 801.) Failure to submit a now required CFIUS Pilot Program submission can carry a maximum civil penalty equal to the value of the underlying transaction. The pilot program went into effect on November 10, 2018.

For transactions covered by the pilot program, which currently covers 27 critical industries, parties must submit a mandatory declaration if a transaction would give a non-US person control over the business or when a foreign person does not even gain “control” but merely makes a particular investment.

Pain Points and Requirements

The core new “pain point” is the now possible mandatory CFIUS Pilot Program (PP) filing, unlike the earlier filings which were “voluntary.” Broadly and with certain exceptions, the PP sets forth a 2-part test to assess if a mandatory filing applies to a transaction.

1. The transaction must involve a Pilot Program US business even if a foreign person does not acquire “control” but would afford the foreign person access to “any material nonpublic tech info” possessed by the PP US business or membership on a board/governing body of the PP US business or any involvement (other than thru voting of shares) in substantive decision making of the PP US business about the use, development, acquisition or release of “critical technology” or the transaction could result in foreign “control” of the PP US business.
2. The US business that is the recipient of the foreign investment must be one that produces, designs, tests, manufactures, fabricates or develops a “critical technology” that is (i) utilized in connection with the US business activity in a PP industry or (ii) designed by the US business specifically for use in one or more PP industries.

Shortly after the pilot program went into effect, the DOC’s Bureau of Industry and Security (BIS) issued a proposed rule to add 14 technology categories to list of emerging technologies, which could also be subject to the mandatory CFIUS declarations and would also impose new export license requirements by amending or adding additional Export Control Classification Numbers (ECCN) which are an alphanumeric designation (e.g., 1A984 or 4A001) used in the Commerce Control List (CCL) to identify items for export control purposes. Companies or individuals that wish to export items, technology or software on the CCL may be required to obtain an export license depending on the item being exported as informed by the correct ECCN properly determined and the country to which the item is being exported. Among these 14 additional technology categories were robotics, quantum computing, and artificial intelligence (AI).

It’s important to note that even if your organization is not seemingly related to one of the 27 specific industries, under other recent US Commerce Department action, your company may still be subject to the mandatory export license requirements. The DOC recently added discrete microwave transistors, continuity of operation software, post-quantum cryptography, underwater transducers, and air-launch platforms to the list of emerging technologies and designated these items with ECCNs than can trigger DOC export license requirements, outside the CFIUS purview.

The Issues with AI

The Trump Administration is keenly interested in controlling foreign access to AI. Artificial intelligence is increasingly viewed as critical to protecting US security interests because of its possible implications for military and national defense or other security policy. The AI field, which is focused on the capability of a machine to imitate intelligent human behavior, is rising rapidly with the advent of technologies such as driverless cars and autonomous weapons.

Machine learning, a collection of algorithms that can learn from and make predictions based on recorded data, makes up a large part of what drives AI. The accuracy of a machine learning model depends on the quality of that data. Within the IP sector, the number of machine learning related patents is growing because software-based methods and systems are generally patentable.

The data used to train machine learning models may be classified as “technical data” or information under export regulations. The International Traffic in Arms Regulations [ITAR] and the Export Administration Regulations [EAR] generally define export-controlled technical data or technology as information for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance or modification of as relates to certain items as specific in the applicable control. There are various exclusions from export regulations of technical data or technology and may include:

• Public domain or publicly available information
• Education information, including that commonly taught in schools and universities
• Fundamental research

Technical data or technology that falls into one of these three categories generally does not require a license to export, reexport, transfer, release or disclose to a foreign person. It is critical to know that any such export, release or disclosure in the United States to a foreign person, such as your employee, contractor or agent will be deemed by the US Government as an export to that foreign person’s country of nationality or birth in certain cases. These are commonly called “deemed exports.” Such export control license requirements are completely outside the scope of CFIUS’ purview.

Takeaways for AI Companies

The export controls DOC has proposed could end up hindering American AI technology development because the open availability and freewheeling exchange of information among employees and contractors of AI training data is so essential to researchers making strides in the field. As more AI may become subject to new and stricter export controls, the need to consider to obtain an export license to carry on with “routine” AI work will be critical. However, DOC also stated that it will not expand its jurisdiction over what it considers “fundamental research.”

The current policies assume that differentiating between commercial and military AI applications is easy, when in reality is there is plenty of overlap between the spaces. For example, iPhone users can unlock their phones with facial recognition technology. That same technology could be used to target weapons. As the regulations continue to roll out for identifying and imposing export controls on new ECCNs to AI and other emerging technologies essential to US national security, it will be important for lawmakers to consider how the AI export controls will be implemented so as not to hinder innovation.

Companies must be aware that while an export is generally considered to be materials, information, and technology that leaves the US, a deemed export is something that may be occurring frequently under the company’s nose. If deemed exports of newly controlled AI is not properly licensed for release or disclosure to foreign persons, export control violations will likely occur which may carry severe penalties. Items and technology that are controlled either by the EAR or ITAR will also be considered as critical technology by CFIUS for both voluntary and mandatory CFIUS purposes.

Companies looking to get ahead of the potential deemed export control implications, or seeking investment from foreign investors, should determine the ECCN of their AI, software, and other technology items. While there is still uncertainty in what will be implemented for CFIUS review, knowing these classifications will make it easier to understand what export licenses may be required in the future.

Reprinted with permission from the August 8, 2019, edition of Legaltech News.

© 2019 ALM Media Properties, LLC. All rights reserved.

Further duplication without permission is prohibited. ALMReprints.com – 877.257.3382 - reprints@alm.com.