Washington, D.C. – Today, the Commerce Department’s Bureau of Industry and Security (BIS) announced the expansion of the Validated End User (VEU) program to include data centers.  This update will contribute to the development of a trusted ecosystem for the responsible use of advanced computing and artificial intelligence (AI). This new license exception is an element of the Biden-Harris Administration’s broader strategy to ensure the United States leads the way in responsible AI innovation and development.

This update to the VEU program was designed to protect national security by ensuring high standards for physical and cybersecurity at data centers that house advanced AI systems. It will also reduce licensing burdens on industry by allowing data centers to fulfill the stringent requirements of the VEU program up front, enabling U.S. exporters to ship designated items to pre-approved entities under a general authorization, instead of under multiple individual export licenses.

“BIS is committed to facilitating international AI development while mitigating risks to U.S. and global security,” said Under Secretary of Commerce for Industry and Security, Alan F. Estevez. “The Data Center VEU program will rigorously vet applicants to ensure that any authorization includes appropriate safeguards and security measures that protect our most advanced technologies.”

“AI is the quintessential dual-use technology; it is in the interest of U.S. national security to work with industry and partner governments to develop a secure global technology ecosystem,” said Assistant Secretary of Commerce for Export Administration, Thea D. Rozman Kendler. “Through the Data Center VEU program, working with our interagency partners, we will ensure that data centers that demonstrate commitment to the highest security standards obtain facilitated access to advanced U.S. technological innovation.”

The Data Center VEU updates the existing VEU program and builds on the Biden-Harris Administration’s imposition of controls on advanced computing semiconductor chips (87 FR 62186), which were expanded in October 2023, to cover a wider group of countries identified in country groups D:1, D:4, and D:5 of the Export Administration Regulations (EAR) (88 FR 73424).  It incorporates much of the existing VEU program’s framework, adding new requirements tailored to the needs and security concerns of a data center.

Data center operators will only be admitted into the program after a thorough interagency review and approvals process whereby the Departments of Commerce, Defense, Energy and State determine that the applicant meets the strict standards established for Validated End Users.

This rigorous review process of each application by the U.S. Government ensures necessary safeguards are in place to protect U.S. technology from diversion or misuse contrary to U.S. national security and foreign policy. In return for their commitment to fulfill U.S. national security requirements, these entities will obtain, consistent with other applicable regulations, facilitated access to predictable exports and reexports of items required to operate a data center as well as transfers (in-country) by and among Authorized VEU locations by the same VEU.

This program requires that certain assurances exist prior to any authorization. Additionally, it may include assurances by the government of the country in which the data center operates, agreement to facilitate on-site data center compliance reviews, commitments to extensive physical and logical security, and new reporting requirements specific to data center operations. Once a data center is authorized under this new program, it will be identified by name and location(s) in the EAR and at that point may begin receiving items pursuant to the terms of its entity-specific approval under VEU.

While the Department is currently developing additional, forthcoming regulation and guidance related to the data center VEU program, eligible companies are now able to begin applying. See here for eligibility and application information.

Additional Background on the Validated End User (VEU) Program:

The End-User Review Committee (ERC), composed of representatives of the Departments of State, Defense, Energy, and Commerce, and other agencies as appropriate, is responsible for determining whether to add to, to remove from, or otherwise amend the list of VEUs and associated eligible items. The Department of Commerce chairs the ERC. Applications are reviewed based on a variety of national security factors including technology levels, end customers, compliance plans, and other information.

For more information, visit BIS’s website at: https://www.bis.gov.

###