VEU authorises exports, reexports and transfers of eligible items to end users approved by BIS and listed in Supplement No. 7: General VEU for the PRC and India, and Data Center VEU (universal, for owners headquartered in the AI Authorization countries, or national, per country) for data centers outside Macau and D:5. Requests are advisory opinion requests with Supplement No. 8 information (and, for data centers, evidence of meeting Supplement No. 10: security, military and intelligence ties, outbound investment rules, chip transfer limits, geographic allocations, AI training and model weight rules, human rights safeguards, reporting, FOCI, NIST SP 800-53 and FedRAMP High controls with third-party attestation, AI security, transit security, disposal and personnel vetting); the ERC weighs the end user's record, compliance, on-site reviews and technology control plan. MT and CC items are excluded, data center items exclude the 600 series; items must be used at the VEU's own facilities for permitted uses and not transferred without authorisation; exporters must obtain VEU certifications before the first shipment, notify the VEU in writing of each shipment within an agreed timeframe, keep records under Part 762, and reexporters (and data center VEUs) must report annually or semi-annually; submitted information is a continuing representation and status may be revised, suspended or revoked.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.