A foreign-produced item located outside the United States is subject to the EAR when it meets both the product scope and the country, destination, end-use or end-user scope of one of the FDP rules: National Security (NS-controlled direct products of technology or software needing a written assurance, to D:1, E:1, E:2); 9x515 (to D:5, E:1, E:2); 600 series and 0A919 (to D:1, D:3, D:4, D:5, E:1, E:2); the Entity List rules for Footnote 1, Footnote 4 and Footnote 5 entities and advanced-node IC production facilities in Macau or D:5, including entities owned 50 percent or more by listed or restricted parties (that ownership extension is stayed from 10 November 2025 to 9 November 2026 by 90 FR 50857); Russia, Belarus and occupied Crimea; Russia and Belarus military end users and procurement entities (Footnote 3); advanced computing (3A090, 4A090 and .z items, and mask or wafer technology developed by D:5 or Macau-headquartered entities); supercomputers in the PRC or Macau; Iran; semiconductor manufacturing equipment to Macau or D:5; and AI model weights under 4E091 produced with controlled advanced computing items, worldwide. Product scope covers direct products of the specified U.S.-origin technology or software, products of a complete plant or major component of a plant that is itself such a direct product, and for Footnote 5 and SME rules commodities containing such products (including integrated circuits). Once an item is subject, the licence requirements are separately determined; BIS may inform persons by specific notice (confirmed in writing within two working days) and the model supplier certificate in Supplement No. 1 is optional support for due diligence, not a substitute.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.