US Policy & Export

The Regulatory Layer That Conditions Every GPU Deal

Every NVIDIA Blackwell system that ships to Saudi Arabia, every AMD Instinct accelerator that enters a Humain data center, every piece of advanced AI hardware manufactured in the United States — all of it travels under a US export license. The Bureau of Industry and Security (BIS), the Commerce Department’s export control agency, must approve the transfer. The conditions attached to that approval determine what the hardware can be used for, who can access it, and what reporting the recipient must provide back to the US government.

US export control policy is therefore not a background regulatory consideration for Saudi AI — it is a central structural condition. The $77 billion that Humain has announced in AI compute commitments, the NVIDIA partnership, the AMD-Cisco joint venture — none of these deals can proceed without navigating the BIS approval process. Understanding that process, its history, and its current trajectory is essential for anyone tracking or operating in the Saudi AI ecosystem.

The AI Diffusion Framework: Architecture and Intent

In November 2024, the Biden administration finalized the “Framework for Artificial Intelligence Diffusion” — a rule establishing country-tier classifications for the export of advanced AI chips and related technology. The framework divided the world into three tiers based on their assessed relationship with US national security and their alignment with US AI governance norms.

Tier 1 consists of approximately 18 close US allies — the UK, EU member states, Japan, South Korea, Australia, Canada, and a small number of others. Tier-1 countries receive the most permissive treatment: US AI hardware can be exported to them under a license exception, with minimal bureaucratic friction, reflecting the judgment that these countries’ AI governance frameworks and geopolitical alignments are sufficiently aligned with US interests that unrestricted technology sharing is appropriate.

Tier 2 encompasses most of the rest of the world — approximately 120 countries — that are neither close allies nor adversaries. Saudi Arabia falls in Tier 2. For Tier-2 countries, advanced AI chips (defined by performance thresholds that capture Blackwell-class and equivalent hardware) require a BIS export license. Licenses are reviewable and can be conditioned on end-user verification, facility security standards, and reporting requirements. There is no automatic right to receive the hardware; the BIS review process applies.

Tier 3 covers countries subject to arms embargoes and other restrictions — China, Russia, Iran, North Korea, and a small number of others. AI hardware export to Tier-3 countries is essentially prohibited, with narrow exceptions.

The framework’s architecture reflects a specific policy thesis: that the most powerful AI systems are strategically significant enough that their global distribution should be managed actively rather than treated as ordinary technology exports. The tier structure is an attempt to operationalize this thesis — more permissive for aligned partners, controlled for neutral parties, prohibited for adversaries.

What Tier-2 Means for Saudi Arabia in Practice

Saudi Arabia’s Tier-2 classification means that acquiring US-origin advanced AI hardware requires a BIS export license for each significant transaction. The license application process involves several steps: the exporter (typically the US company — NVIDIA, AMD) submits an application describing the hardware, the buyer, the end use, and the facility; BIS reviews the application, typically within 30–90 days though complex cases can take longer; BIS may request additional information, including facility security assessments, end-user verification, or commitments about resale and transfer restrictions; BIS issues an approval (with or without conditions) or denies the license.

License conditions attached to Saudi AI hardware approvals typically include: prohibition on re-export to Tier-3 countries (especially China), facility access controls and security standards, reporting requirements on actual hardware deployment, restrictions on the types of models trained on the hardware (specifically, models with potential weapons applications), and periodic audits or verification visits.

The practical effect of these conditions is that Saudi AI data centers receiving US hardware must implement a compliance infrastructure — security controls, access logging, personnel vetting, and documentation — that goes beyond what a standard commercial data center operates. For a foreign buyer, building this compliance infrastructure is an investment that requires legal counsel, technical implementation, and ongoing management. It also creates an ongoing relationship with US regulatory authorities that has geopolitical dimensions.

The November 2025 Structural Unlock: 35,000 GB300 Systems for Humain

The most consequential single export control action in Saudi AI history occurred in November 2025, when BIS approved the export of 35,000 NVIDIA GB300 NVL72 systems to Humain. This was the largest export license approval for AI hardware to a Tier-2 country since the framework’s implementation — an explicit policy decision to enable Saudi Arabia’s AI buildout at a scale that clearly crossed a material threshold.

The 35,000 GB300 system approval is the structural unlock that makes the Humain program real in hardware terms. Prior to this approval, the May 2025 announcement of NVIDIA’s partnership with Humain (initially 18,000 GB300 systems for Phase 1, with a path to 600,000 NVIDIA GPUs over three years) was a statement of intent without confirmed hardware delivery authorization. The November 2025 license converted that intent into an executable transaction.

Understanding what this approval represents geopolitically: BIS and the broader US national security apparatus made a deliberate judgment that enabling Saudi Arabia’s AI buildout — at this scale, for this purchaser (a PIF-owned company), with these hardware specifications — was consistent with US national security interests. That judgment reflects the bilateral relationship, the conditions attached to the license, and the administration’s assessment of Saudi Arabia’s reliability as a hardware custodian.

How Export Licenses Work: The Application-to-Delivery Timeline

For international companies selling AI hardware to Saudi customers, understanding the export license process is operationally critical. The timeline from application to delivery runs roughly:

Pre-application preparation (1–3 months): Before filing, the exporter must verify the end user, obtain commitment letters on end-use restrictions, assess whether the specific hardware crosses BIS classification thresholds, and determine whether any existing license exceptions apply. For the most advanced AI chips, this pre-work is substantial.

Application review (30–90 days standard, 6–12 months for complex cases): BIS reviews the application against the EAR (Export Administration Regulations) and the AI Diffusion framework. Complex cases involving large quantities, novel hardware, or buyers with limited prior compliance history take longer. Interagency review — involving State Department, Defense Department, and intelligence agencies — adds time for politically sensitive applications.

License issuance with conditions: Approved licenses specify exactly what hardware can be shipped, in what quantities, to which facilities, for which end uses. Conditions are binding on both the exporter and the importer. Violations of license conditions can result in denial of future licenses, civil penalties, and in serious cases, criminal prosecution.

Ongoing compliance: After delivery, license conditions require periodic reporting and may require facility access for verification visits. This is not theoretical — BIS has conducted end-user verification visits in multiple countries following large AI hardware exports.

The Trump Administration’s Approach: Commercial Diplomacy

The Trump administration (January 2025 onward) has approached Saudi AI exports through a commercial diplomacy framework that differs in emphasis from its predecessor. Where the Biden administration’s AI Diffusion framework was driven primarily by national security concerns about technology transfer to adversaries, the Trump administration has weighted the commercial relationship and bilateral investment heavily.

The context is the broader US-Saudi economic relationship: Saudi Arabia’s sovereign wealth fund (PIF) manages over $700 billion in assets and is a major investor in US companies, real estate, and infrastructure. Saudi Arabia’s oil production decisions affect global energy prices and the US economy. The Trump-MBS relationship is warm by both parties’ accounts, and the billion-dollar AI compute deals announced during the May 2025 US-Saudi Summit were explicitly presented as deliverables of that relationship.

This does not mean that the Trump administration has abandoned export controls for Saudi AI — the licensing requirement remains, and the conditions attached to approvals are real. But the administration’s posture is to enable large-scale Saudi hardware acquisition while enforcing compliance conditions, rather than to restrict Saudi access in ways that might push Saudi Arabia toward Chinese AI hardware and Chinese cloud infrastructure. This is a deliberate strategic choice: better that Saudi AI runs on NVIDIA hardware with US-imposed compliance conditions than on Huawei hardware outside US visibility.

CFIUS and Saudi Investment in US AI Companies

The Committee on Foreign Investment in the United States (CFIUS) reviews foreign investments in US companies for national security implications. PIF investments in US technology companies — and PIF is one of the world’s most active sovereign wealth fund investors in US tech — require CFIUS notification and potentially review.

CFIUS’s relevance to Saudi AI is structural: any significant PIF stake in a US AI company (hardware, software, cloud, or model developer) triggers the review process. CFIUS can impose conditions on investments (board composition restrictions, data handling requirements, facility access controls), require divestitures, or in rare cases block transactions entirely. For Saudi Arabia’s stated goal of building a globally competitive AI ecosystem with PIF as the investment vehicle, CFIUS review is a recurring feature of the acquisition strategy.

CFIUS reviews are confidential, which limits public visibility into their outcomes. But the general pattern for PIF investments in US tech has been: CFIUS review occurs, conditions are negotiated (typically involving national security agreements that restrict access to sensitive data and US person information), and investments proceed with those conditions attached. The conditions are meaningful constraints on how PIF-owned entities like Humain can use US technology and access US-person data.

The Debate About AI Diffusion: Is It Working?

The AI Diffusion framework has generated substantial policy debate since its finalization. Critics from the technology industry argue that the restrictions are commercially counterproductive — they push Tier-2 countries toward alternatives (Huawei’s Ascend chips, Chinese cloud infrastructure) while failing to prevent the most determined actors from acquiring the hardware through indirect channels. They argue that restricting US exports of AI hardware costs US companies revenue and global market share without meaningfully slowing AI development elsewhere.

Critics from the national security community argue the opposite: that the framework is not restrictive enough, that Tier-2 exports at the scale of the Humain approval create risks that the compliance conditions do not adequately mitigate, and that the end-user verification and audit mechanisms are too resource-constrained to be effective against sophisticated evasion.

The debate will continue to evolve as the AI hardware export market grows. For Saudi Arabia specifically, the relevant near-term policy question is whether the AI Diffusion framework will be revised — the Trump administration initiated a review in early 2025 — and whether any revision will alter Saudi Arabia’s classification or the conditions attached to Saudi hardware approvals. A reclassification of Saudi Arabia to Tier 1 would be a significant upgrade to the Kingdom’s AI procurement environment; a tightening of Tier-2 conditions would add friction and cost to every hardware deal.

What This Means for International Companies

For non-US companies seeking to supply hardware, software, or services to Saudi AI customers, the US export control framework has downstream effects even on non-US products. Any product incorporating US-origin technology above de minimis thresholds — including foreign products built on US chip designs, fabricated at TSMC on US equipment, or containing US-developed software — is subject to US export administration jurisdiction. The “foreign direct product rule” has become a significant constraint on non-US companies’ ability to supply the Saudi market without engaging with BIS requirements.

The practical implication: a company anywhere in the world selling AI hardware to Saudi customers should assume US export administration jurisdiction applies to their products and that BIS compliance counsel should be engaged before commercial terms are agreed. The cost of a compliance mistake — denied export privileges, civil penalties, or in serious cases criminal prosecution — significantly exceeds the cost of advance legal advice.

---

Tracked entities in this sector include BIS (Bureau of Industry and Security), CFIUS (Committee on Foreign Investment in the United States), the US Commerce Department’s export control apparatus, and the political actors and policy frameworks shaping the regulatory environment for Saudi AI hardware acquisition. Coverage focuses on license approvals, framework revisions, and the geopolitical dynamics conditioning technology transfer to the Kingdom.