🧠 Food for thought

Implications, context, and why it matters.

How the U.S. could enforce “produced with U.S. software” controls

• U.S. policymakers could use Foreign Direct Product rules in 15 CFR 734.9, which give the Bureau of Industry and Security (BIS) power to curb foreign items that are direct products of U.S. technology or software 1. A direct product is the immediate output made by use of such technology or software 1. Production covers engineering, manufacture, and assembly. It also covers inspection, testing, and quality assurance 1.
• BIS used a similar approach with the Russia and Belarus FDP Rule after the 2022 Ukraine invasion 1. Foreign-produced items not designated EAR99 fall under the Export Administration Regulations. EAR99 is a catch-all for items not on the Commerce Control List. Coverage applies if the items are direct products of U.S.-origin technology or software in any Export Control Classification Number in product groups D or E of the Commerce Control List. It also applies if a plant or a major plant component that made them is itself a direct product. The rule triggers when the items are headed to Russia or Belarus or for certain uses there.

Export compliance software providers

• Non-U.S. manufacturers shipping to China would need to check for U.S. software use 2. The work involves de minimis thresholds of 25% for most destinations and lower for sanctioned ones. Companies must assess FDP coverage and track controlled content 2. Incorporated means essential to the function, customarily included in the sale, and exported with the item. They must file a one-time report with U.S. content percentages and fair market value 2.
• SBOM and export control vendors could see demand from manufacturers, logistics providers, and multinationals. Software that computes EAR de minimis shares, maps software dependencies in supply chains, and drafts BIS documentation could become core compliance infrastructure 3. A precedent comes from the 2016 end-to-end encryption carve-out using Federal Information Processing Standards (FIPS) 140-2 validated modules, a U.S. government security standard for cryptographic modules.