The Shockwaves of the AI Diffusion Rule Rollback and H200 China Unlock | Three Axes of Generative AI Export Control [2026 Latest]

Hello, this is Hamamoto from TIMEWELL. Since the start of 2026, the landscape around AI export controls has shifted dramatically. The Biden administration's AI Diffusion Rule, launched with considerable fanfare, was rescinded by the Trump administration; NVIDIA H200 can now be sold into China under certain conditions; and in Japan, catch-all controls under the Foreign Exchange and Foreign Trade Act (FEFTA) have been tightened. AI has clearly joined the club of "controlled technologies."

Over the past few months, we have seen a sharp rise in inquiries from both domestic and overseas companies, ranging from "we want to deploy our AI SaaS overseas but we're not sure whether it's subject to export controls" to "can we really ship GPU servers to our Chinese subsidiary?" Below, I summarize the latest US, EU, and Japanese rules as of April 2026, and outline the issues Japanese companies need to get on top of right now.

Why AI became a target of export controls

It's worth emphasizing that AI did not suddenly become a regulated technology overnight. The backdrop is the US-China technology rivalry that has been unfolding since the early 2020s, combined with the rapid jump in generative AI capabilities after the launch of ChatGPT.

AI chips have always been a textbook example of dual-use technology. The boundary between civilian applications such as image recognition, natural language processing, and autonomous driving, and military applications such as imagery intelligence, target recognition, autonomous weapons, and cyber operations, is extremely blurry. Tens of thousands of H100-class NVIDIA GPUs, aggregated together, can effectively become the foundation for a country's military AI infrastructure.

In October 2022, the US Bureau of Industry and Security (BIS) tightened advanced semiconductor exports to China in a single sweep. Over 2023 and 2024, those controls were expanded step by step, eventually covering manufacturing equipment, design software, and high-bandwidth memory (HBM). Then in January 2025, the Biden administration left behind one more piece of the puzzle: the Interim Final Rule commonly referred to as the "AI Diffusion Rule." For the first time, AI model weights themselves were explicitly swept into the export control regime.

What's being regulated has expanded from "hardware (chips)" to "software (model weights)" to "services (cloud APIs)." Without tracking that trajectory, it's easy to misread the significance of newer rules. When I think about AI through the lens of economic security, I find it helpful to focus on four elements: compute, models, data, and talent. The AI Diffusion Rule was the first systematic regulation to reach into the first two.

What was the AI Diffusion Rule, and why was it rescinded?

The AI Diffusion Rule was published by BIS on January 13, 2025, in the final days of the Biden administration. Its defining feature was a three-tier classification of the world, with different licensing conditions applied to each tier.

Tier 1 covered 18 allied countries such as Japan, the UK, and Australia, which could procure AI chips with essentially no limits. Tier 2 covered most other countries, with an annual per-entity cap of roughly 1,700 Total Processing Performance (TPP). Tier 3 covered China, Russia, North Korea, Iran, and others, under the strictest treatment—presumption of denial. On top of that, the rule introduced, for the first time, a licensing requirement for the weights of "frontier models" trained with more than 10^26 FLOP of compute. BIS noted that "fewer than five models globally currently exceed this threshold," meaning the rule was effectively aimed at a small set of frontier players—OpenAI, Anthropic, Google DeepMind, and Meta.

However, just before coming into full effect, the rule was formally rescinded on May 13, 2025 by BIS under the Trump administration (Under Secretary Jeffery Kessler). According to JETRO's reporting, the stated reasons for rescission were that the rule "hampered US innovation and imposed excessive regulatory burden on companies" and "damaged diplomatic relationships." Tier 2 countries such as Saudi Arabia and the UAE had pushed back strongly, and think tanks like Brookings had criticized it for "undermining US AI leadership," so the change of administration provided a natural moment to roll it back.

The critical point is that only "the AI Diffusion Rule as one specific package" was rescinded. The broader policy direction of controlling AI chips and model weights did not disappear. The Trump administration is instead rebuilding the regime around a bifurcated approach—"open to allies, tough on adversaries." The fact that Anthropic's CEO Dario Amodei publicly warned in early 2026 about "the risk of China's DeepSeek being repurposed for military AI" is worth keeping in mind as context for the next round of regulatory debate.

Trends for AI chips such as NVIDIA H100/H200

After the AI Diffusion Rule was rescinded, attention shifted to the final rule titled "Revision to License Review Policy for Advanced Computing Commodities," which took effect on January 15, 2026. Published as 2026-00789 in the Federal Register, the rule, in plain language, "allows sales of NVIDIA H200 and AMD MI325X-class AI chips into China."

Specifically, the review policy for exports to China and Macau changed from "presumption of denial" to "case-by-case review." The covered items are semiconductors with TPP below 21,000 and DRAM bandwidth below 6,500 GB/s. These numbers were designed to map neatly onto the NVIDIA H200 and AMD MI325X, while the latest-generation Blackwell products (B100, B200) remain off-limits for China.

To clear a case-by-case review, a license applicant must demonstrate three things. First, that the export will not reduce the supply of semiconductors available to US users. Second, that the Chinese purchaser has export compliance procedures in place, including customer screening. Third, that the product has passed a third-party security test conducted in the United States. In parallel, on January 14, 2026, President Trump issued an executive order imposing a 25% value-based tariff on these "covered products." Reports suggest that the cap on H200 sales to China has been set at around 75,000 units.

There has been strong pushback in Congress. The House Foreign Affairs Committee passed a bipartisan bill, 42 to 2, calling for tighter AI chip controls against China, with a steady drumbeat of criticism that the administration is "selling too much." At the same time, in December 2025, a federal case was filed in the Western District of Washington over the smuggling of H100 and H200 chips worth about USD 160 million. The Wire China's reporting on this case underscored that a parallel gray market is operating alongside official channels, and that enforcement remains difficult. For Japanese companies shipping H200 into their Chinese operations, US EAR re-export controls apply through the US-origin content of the product, so it is not enough to look only at Japan's FEFTA.

Export controls on large-scale AI models and weights

Alongside AI chips, another key issue is the export control of model weights themselves. Many companies have yet to internalize this area, so I want to address it carefully.

One of the most notable aspects of the (now rescinded) AI Diffusion Rule was that it explicitly placed the weights of closed-source models trained with more than 10^26 FLOP under licensing for the first time. At the time, this threshold was set with models like GPT-4, Claude 3 Opus, and Gemini Ultra in mind. According to Epoch AI's forecasts, open-weight frontier models are projected to cross the 10^26 FLOP line around January 2026—meaning that Llama, Mistral, Qwen, and other major open-source models are expected to reach comparable levels in the near future.

The rule itself was rescinded, but the underlying idea that "frontier model weights are strategic assets" is deeply embedded in the US national security community. It is reasonable to expect this concept to re-emerge in a different form. Indeed, think tanks such as the Institute for Law & AI continue to debate the "legal definition of frontier models," and a new rule could easily surface in the latter half of 2026.

The implication for Japanese companies is that if such controls are reintroduced in the US, every business that fine-tunes a US-origin foundation model and deploys it overseas would be affected. For example, a workflow that takes an OpenAI model via Azure OpenAI Service, fine-tunes it in Japanese, and deploys it across Southeast Asia could be caught as a controlled provision of technology. On top of that, the 24 domestic foundation model projects selected under METI's GENIAC (Generative AI Accelerator Challenge) in July 2025 may need to consider that inviting overseas researchers for joint development could trigger FEFTA's technology transfer controls (provision of technology from a resident to a non-resident). Even a verbal explanation over an online call counts as "provision of technology," so R&D organizations need to be careful.

What Japanese companies should do

Putting this all together, here are the practical issues Japanese companies need to address right now. The short answer is that, with the 2026 FEFTA amendments as the baseline, you cannot avoid a thorough inventory of all AI-related exports and service transactions.

In January 2025, METI published a draft amendment to FEFTA-related ordinances and ministerial orders, which took effect around the end of September 2025. The centerpiece is a major expansion of catch-all controls. Previously, catch-all controls were split into "weapons of mass destruction" and "conventional weapons" end-use reviews; after the amendment, specific HS-code-based items were designated, and even exports bound for general destinations now require end-use and end-user review. In addition, new entities associated with conventional weapons development concerns were added to the Foreign End User List, significantly broadening the scope of covered transactions.

In practice, Japanese companies should pay attention to three categories of transactions. The first is "shipping AI chips and GPU servers to overseas sites." When sending GPUs to a Chinese or Southeast Asian subsidiary, you need to look at both US EAR re-export controls and Japan's FEFTA list controls. The second is "AI SaaS and API delivery overseas." Cloud-based model access can be treated as a service transaction, so you need to screen end-users to confirm they are not on concern lists. The third is "online communication between engineers." Explaining a model's design to a researcher at an overseas subsidiary or partner can, in itself, constitute provision of technology.

TRAFEED (formerly ZEROCK ExCHECK), developed by TIMEWELL, is an AI-powered export compliance agent built to operate export controls in an AI era. It supports classification based on METI's security trade control criteria, automated matching against the Foreign End User List and other concern lists, and multilingual counterparty due diligence. Users are no longer limited to AI companies—manufacturers, trading houses, and technology transfer offices at universities all use it. See the TRAFEED service page if you'd like to learn more.

Linking to the EU AI Act, heading into the second half of 2026

Finally, some notes on Europe. The remaining provisions of the EU AI Act come fully into force on August 2, 2026, and transparency obligations begin to apply. In parallel, the EU treats AI as one dimension of dual-use technology under Regulation 2021/821 (the Dual-Use Regulation), and intangible transfers are subject to controls.

For Japanese AI companies entering the EU market, if a system qualifies as a "high-risk AI system" under the AI Act, you must complete conformity assessment, prepare technical documentation, obtain a CE marking, and register in the EU database by August 2, 2026. On top of that, you also need to check from the export control side whether deploying that same AI into a third country would trigger the EU Dual-Use Regulation. International institutions like the Institute for Law & AI, based in Geneva, watch EU, US, and Japanese regulations horizontally, and the practical question of how to handle a single model whose classification differs by jurisdiction is becoming a central theme.

For context, I also recommend reading China's export controls on Japan, US export and tariff trends, and military diversion risks in dual-use technology alongside this piece, which should help you grasp the full picture.

Summary: three steps AI companies should start right now

As of April 2026, here is what I would prioritize for AI companies and manufacturers.

First, inventory your AI-related assets. GPU servers, training datasets, model weights, API offerings, overseas dispatch and hosting of engineers—catalog each of these from an export control perspective. Simply sorting out which items are goods, which are technology, and which are services already surfaces where your real risk lies.

Second, build an end-user screening function. You need a system that can check Japan's Foreign End User List, the US Entity List, and EU sanctions lists in an integrated way. AI SaaS, in particular, is accessible from around the world with only an account signup, so real-time screening is essential. Manual processes cannot keep up.

Third, invest in internal training and governance. If an R&D engineer doesn't know that an online explanation can be a controlled export, even the best-designed compliance setup will have gaps. My reading is that 2026 is the year when every employee handling AI needs at least a baseline of export control literacy.

The intersection of AI and export controls will only get more complex. What matters is not reacting each time a new rule drops, but proactively asking, against your own technology and business model, "what among our assets might be a strategic resource?" TIMEWELL will continue to accompany clients on this journey, on both the technology and operational sides.

References

• BIS, "Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule," May 13, 2025
• Federal Register, "Revision to License Review Policy for Advanced Computing Commodities," 2026-00789 (effective January 15, 2026)
• JETRO Business Brief, "US Department of Commerce announces plan to rescind AI semiconductor export control interim final rule," May 2025
• METI, "GENIAC" project
• United States Studies Centre, "The US AI Diffusion Rule"
• Epoch AI, "Frontier open models may surpass 1e26 FLOP of training compute before 2026"
• European Commission, "AI Act | Shaping Europe's digital future"
• EY Japan, "METI publishes draft amendment to ordinances—strengthening security trade controls including catch-all regulations"