America Controls AI Chips, Not Surveillance Software

Policy

US export controls are built around advanced computing hardware. Software that aggregates police records, matches faces and maps who travels with whom mostly falls outside them. As of 2 August 2026 that is not an oversight. Commerce tried to close the gap in 2008, again from 2014 to 2015, again in 2016 and again in 2024, and each attempt stalled.

Last updated 2 August 2026

Does this apply to you?

If you build or sell software, this is the map of what the US actually restricts. Export controls are widely assumed to cover anything that could be misused. They do not. They cover enumerated items on a list, and the list is organized around hardware categories.

If you follow AI policy, this explains a recurring confusion: why a country can be subject to sweeping chip restrictions while its police software vendors operate largely untouched by the same regime.

What do US export controls actually cover?

Enumerated items, by classification number. The Export Administration Regulations assign each controlled commodity, software package or technology an Export Control Classification Number, and a license requirement attaches to that number for particular destinations. Anything not enumerated falls into the residual category and moves freely in most cases. Whether the controls that do exist have slowed China on the hardware they cover is a separate question, taken up in our examination of whether US chip restrictions slowed or accelerated China's AI progress.

Surveillance-adjacent numbers do exist. A 2021 interim rule, finalized in 2022, added controls on intrusion software and on IP network communications surveillance systems, alongside a license exception called Authorized Cybersecurity Exports that carves out most destinations while excluding government end users in countries of concern.

Read that scope closely. It reaches equipment that intercepts network traffic and tools that penetrate systems. A platform that queries records a state already holds, joins them to camera hits and renders the result in a browser is a database and a web front end. It is not interception equipment, and no classification number describes it.

What about the Entity List?

It is a different instrument, and it is frequently misread. Commerce has used the Entity List against Chinese surveillance firms repeatedly, including a tranche of 28 parties in October 2019 that swept in public security bureaus and artificial intelligence companies, and further additions in 2020, 2021 and 2022.

What a listing does is restrict what US exporters may ship to the named party. It does not prohibit that party from operating, from selling to its own government, or from building products. It also names specific legal entities, which is why researchers have documented listed Chinese firms standing up fresh subsidiaries that carry no designation.

Why has the gap never been closed?

It has been attempted at least six times and failed each time. The record below is drawn from an Associated Press investigation published 29 October 2025 by Garance Burke, Dake Kang and Byron Tau, which traced the attempts through Federal Register notices, lobbying disclosures and interviews with the officials who wrote the rules. CLAIM

The obstacle named by the officials involved is not indifference. It is that mass surveillance runs on ordinary goods. The assistant secretary who drafted the 2016 rule told the AP that cameras, software and face-matching are overwhelmingly used for benign purposes, and that a control written broadly enough to catch the abuse would catch international trade with it. His colleagues judged the draft too complicated and it never shipped.

That is a real design problem rather than an excuse. It is also the reason the same rule keeps being drafted and keeps dying.

Where is the effort going in 2026?

Into compute. The Bureau of Industry and Security's own published items this year are a guidance document issued 31 May 2026 on license requirements for advanced computing items, an extension to 31 December 2026 of the timeline for approved integrated circuit designers, eased controls for the United Arab Emirates on 10 July 2026, and a $36 million penalty against Robert Bosch GmbH announced 17 June 2026 over shipments pertaining to Huawei.

Congress points the same way. The House Foreign Affairs Committee advanced the AI OVERWATCH Act in January 2026, aimed at advanced AI chips and congressional oversight of exports. The same argument over what should be restricted split the industry in public over open-weight models in July 2026. The bureau's fiscal 2026 budget hearing was framed around AI chokepoints and carried a request for a 133 percent increase in enforcement funding. CLAIM

None of that touches the application layer. A control regime organized around chips constrains who can train large models, and the size of the US lead in AI compute is the measure of how well that has worked. It does not constrain what a state does with records it already holds, and it was never built to.

What is not known

Whether any specific Chinese police software vendor carries a US designation today. Entity List entries name legal persons in their registered form, and a company known in English reporting under a translated name may not be findable in the list at all without its Chinese registration. Absence from a list is a claim that requires checking, and this piece does not assert it either way.

Whether the 2024 proposed rule is formally withdrawn or merely dormant. A stalled rule and a dead rule look identical from outside the agency.

And whether any of the 2026 chip legislation carries surveillance end use provisions in its final text. Committee passage is not enactment, and bill text moves.

Sources

1. Bureau of Industry and Security, agency homepage and news listing, retrieved 2 August 2026. Advanced computing guidance, IC designer extension, UAE action, Bosch penalty.
2. Garance Burke, Dake Kang and Byron Tau, Associated Press investigation on US technology sales to Chinese police, 29 October 2025, full text as reprinted by the office of Rep. Chris Smith. Historical record of failed rulemakings and bills.
3. Bureau of Industry and Security, Information Security Controls: Cybersecurity Items, Federal Register, 26 May 2022. Final treatment of the cybersecurity ECCNs and License Exception ACE.
4. US Department of Commerce, Entity List additions for human rights abuses in Xinjiang, 22 May 2020, and the October 2019 tranche it supplements.
5. US Department of Commerce, Commerce Tightens Export Controls on Items Used in Surveillance of Private Citizens, 20 October 2021. Scope and end-user restrictions of the interim rule.
6. House Select Committee on the Chinese Communist Party, committee passage of the AI OVERWATCH Act, January 2026.

Derivations

No figure in this article is calculated. Every number is stated by the source cited beside it.

Corrections policy

AI Race Facts corrects visibly, with a dated note, never silently. Two source documents behind the historical record above, the 2015 Wassenaar implementation notice and the 2024 proposed rule on face recognition end users, are cited here through the Associated Press investigation rather than opened directly. That limitation is stated rather than obscured, and this piece will be updated when those notices are read in full.

Last updated 2 August 2026