Mapping five international export control regimes to SWT3 witness procedures. Classification evidence, supply chain attestation, and jurisdiction-aware compliance for AI models and components.
Who this is for: Export control counsel, compliance officers, AI governance leads, trade compliance analysts, and auditors assessing dual-use AI technology transfers.
EO 14110 Sec 4(a) requires reporting of dual-use foundation models exceeding compute thresholds. EU Dual-Use Regulation 2021/821 controls AI-related technology transfers to sanctioned destinations. Organizations developing, deploying, or transferring AI models across borders must maintain auditable classification and reporting records.
"Dual-use" technology has civilian applications but can also be applied to military, intelligence, or mass surveillance purposes. AI systems increasingly fall under dual-use controls because the same foundation model that powers a customer service chatbot can be fine-tuned for autonomous weapons targeting, synthetic biology design, or cyber-offensive operations.
Three primary triggers classify an AI system as dual-use:
Executive Order 14110 Section 4(a) requires companies to report foundation models trained with compute exceeding 10^26 integer or floating-point operations, or biological sequence models exceeding 10^23 operations. The reporting obligation flows to the U.S. Department of Commerce, which maintains the reporting framework. Models exceeding these thresholds are presumptively dual-use regardless of intended application.
EU AI Act Article 6 classifies AI systems as high-risk based on their application domain (Annex III) or product integration (Annex I). While not identical to "dual-use" under trade law, high-risk classification triggers conformity assessment obligations that overlap with export control documentation requirements. General-purpose AI models (GPAI) with systemic risk face additional obligations under Articles 51-55.
The Wassenaar Arrangement Category 4 (Computers) and Category 5 Part 2 (Information Security) control specific technical capabilities. AI-related controls focus on neural network hardware accelerators, training infrastructure above specified performance thresholds, and software specifically designed for autonomous target recognition, signals intelligence, or cryptanalysis. The 2023 and 2024 plenary updates expanded coverage to include advanced computing ICs and certain cloud computing services.
SWT3 does not determine whether a model is dual-use. Classification authority rests with the relevant regulatory body (BIS, EU Commission, Wassenaar Participating States). SWT3 provides cryptographic evidence that classification was performed, reported, and maintained -- producing an auditable record for inspectors and trade compliance reviewers.
Five regimes govern AI-related dual-use technology transfers. Each imposes distinct obligations, but all require evidence of classification, reporting, and ongoing monitoring.
| Regime | Scope | AI Triggers | Key Obligation |
|---|---|---|---|
| EO 14110 (US) | Foundation models exceeding compute thresholds | 10^26 FLOP (general), 10^23 FLOP (bio) | Report to Dept. of Commerce; disclose training runs, safety test results, model weights provenance |
| EU 2021/821 | Dual-use items including AI software and technology | Annex I items; catch-all clause Art. 4 for unlisted items with WMD/surveillance end-use | Export authorization; end-use monitoring; record keeping (min. 5 years) |
| Wassenaar | Conventional arms and dual-use goods/technology | Cat. 4 (computing), Cat. 5.2 (infosec), neural network accelerators | National implementation varies; license determination; post-shipment verification |
| BIS EAR (US) | Items on Commerce Control List (CCL) | ECCN 3A090 (advanced computing ICs), 4A003 (computers), 4D/4E (software/technology) | License required for Entity List destinations; deemed export rules for foreign nationals |
| UK ECJU | Strategic export controls on dual-use items | UK Strategic Export Control List mirroring Wassenaar + national additions | Export license; end-use undertaking; compliance audit trail |
AI-specific risks that export control regimes increasingly target:
Eight SWT3 procedures produce evidence relevant to dual-use export control compliance. Together, they cover classification, supply chain tracking, model governance, revocation, jurisdiction awareness, and safety documentation.
| SWT3 Procedure | Evidence Produced | Export Control Relevance |
|---|---|---|
AI-DUALUSE.1 |
Classification code, reporting status, days since classification | EO 14110 Sec 4(a), EU 2021/821 Annex I, Wassenaar Cat. 4 |
AI-MDL.1 |
Model registration and inventory attestation | BIS license determination (model identification), EU GPAI model card |
AI-MDL.2 |
Model version governance, lineage tracking | Derivative model classification inheritance, fine-tuning provenance |
AI-SUPPLY.1 |
Supply chain integrity attestation | End-use monitoring, post-shipment verification, Entity List screening |
AI-REV.1 |
Anchor revocation with 7 reason codes | Government recall response, license revocation, emergency withdrawal |
AI-JUR.1 |
Jurisdiction and legal basis attestation | Cross-border transfer documentation, deemed export records |
AI-SAFE.1 |
Safety evaluation attestation | EO 14110 safety test results, red-team findings, risk assessment |
AI-BASE.1 |
Baseline integrity attestation | Model weights provenance, training configuration baseline |
Factor A (classification_code): 0 = standard (no dual-use determination), 1 = dual_use (classified under applicable regime), 2 = high_impact (exceeds reporting thresholds)
Factor B (reporting_status_code): 0 = not_required, 1 = pending (classification made, report not yet filed), 2 = notified (report submitted to authority), 3 = acknowledged (authority has confirmed receipt)
Factor C (days_since_classification): Days elapsed since the model was last classified. Stale classifications (e.g., >365 days) signal a re-review obligation.
Verdict logic: PASS when reporting status matches or exceeds classification severity (factor_b >= factor_a). A model classified as dual_use (1) with reporting status not_required (0) will FAIL, indicating an unfiled reporting obligation.
Regulatory mapping: EO 14110 Sec 4(a), NIST AI RMF GOVERN 1.1, EU AI Act Art 6, ISO 42001 A.6.2.3
Query the ledger for AI-DUALUSE.1 anchors across all models in the inventory. Models with classification_code = 0 and no accompanying risk assessment anchor (AI-SAFE.1) should be flagged for review. Check that days_since_classification does not exceed the organization's reclassification policy interval.
The SWT3 protocol includes jurisdiction-aware fields (ISO 3166-1 country code, legal basis, purpose classification) that travel with every witness anchor. For export control, this means every inference, model access event, and governance action carries a jurisdiction stamp.
Export control application: When a model is accessed from a controlled destination, the jurisdiction field creates an auditable record. Deemed export scenarios (foreign national access within the US) are captured when the jurisdiction field reflects the employee's nationality alongside the deployment location.
Filter witness anchors by jurisdiction field to identify cross-border access patterns. Compare jurisdiction values against the organization's Entity List screening records. Anchors from controlled destinations without corresponding export licenses indicate a compliance gap.
Supply chain attestation creates evidence that the organization has screened downstream recipients against restricted party lists before transferring model weights, APIs, or training data. This directly supports EU 2021/821 Article 4 catch-all obligations and BIS Entity List compliance.
Evidence produced: Attestation that screening was performed, screening date, and screening outcome. Does not store the screening results themselves (which may be export-controlled information).
Supply chain anchors should appear before or concurrent with model distribution events (AI-MDL.2 version releases). A model version anchor without a preceding supply chain anchor indicates distribution without end-use screening.
When a government issues a recall directive or an export license is revoked, AI-REV.1 creates an immutable record of the revocation event. Seven reason codes cover the range of export control scenarios:
regulatory_order (5) -- Government recall or license revocation directivemodel_recall (1) -- Voluntary withdrawal due to safety or compliance concernpolicy_violation (2) -- Internal policy breach (e.g., unauthorized transfer to restricted party)data_contamination (3) -- Training data tainted by controlled technical dataconsent_withdrawal (4) -- Data subject consent revocation affecting model legalityerror_correction (6) -- Misclassification correction (e.g., model reclassified from standard to dual-use)Revocation anchors with reason code 5 (regulatory_order) should be traceable to a specific government directive. Verify that the timestamp of the revocation anchor falls within the compliance window specified in the directive. Check that downstream inference anchors cease after revocation.
AI-MDL.1 records initial model registration (name, architecture, intended use). AI-MDL.2 tracks version changes, fine-tuning events, and distillation. Together, they answer the question every export control regime asks: "What exactly was transferred, and where did it come from?"
Classification inheritance: When a model classified as dual-use (AI-DUALUSE.1 classification_code = 1) is fine-tuned or distilled, the derivative model should carry forward the parent's classification until independently assessed. AI-MDL.2 version anchors linked to the parent model's fingerprint create this lineage chain.
For any model with AI-DUALUSE.1 classification_code > 0, trace the AI-MDL.2 version chain to identify all derivative models. Each derivative should have its own AI-DUALUSE.1 anchor. Derivatives without classification anchors represent unassessed dual-use risk.
EO 14110 Sec 4(a)(ii) requires developers of dual-use foundation models to report safety test results, including red-team evaluations, to the Department of Commerce. AI-SAFE.1 attests that these evaluations occurred and records their completion status without exposing the test results themselves (which may contain sensitive vulnerability information).
AI-SAFE.1 anchors should precede AI-DUALUSE.1 reporting_status transitions from "pending" to "notified." A model reported as dual-use without a prior safety evaluation anchor indicates the report was filed without completing required safety testing.
Export control compliance requires knowing whether the model transferred is the same model that was classified. AI-BASE.1 creates a cryptographic fingerprint of the model at the time of classification. If the model is subsequently modified (additional training, weight quantization, adapter merging), the baseline diverges, triggering a reclassification review.
Compare AI-BASE.1 fingerprints at classification time vs. transfer time. Any divergence means the transferred model differs from what was originally assessed and may require fresh classification under the applicable export control regime.
The export control compliance lifecycle has three phases. Each phase produces distinct SWT3 witness anchors that together form a complete compliance record.
Before a model is deployed or transferred, classify it against applicable export control thresholds and record the determination.
# Python -- Record dual-use classification
from swt3_ai import Witness
witness = Witness(
endpoint="https://your-instance.example.com/api/v1/witness",
api_key="axm_your_key",
agent_id="export-compliance-system",
jurisdiction="US",
legal_basis="EO-14110-4a",
purpose_class="dual_use_classification"
)
# Classify a model as dual-use with pending reporting
witness.witness_dual_use(
classification_code=1, # 1 = dual_use
reporting_status="pending", # Report not yet filed
days_since_classification=0,
model_id="llm-foundation-v3",
classification_basis="compute_threshold_exceeded",
compute_threshold="1.2e26_flop"
)
witness.flush()// TypeScript -- Record dual-use classification
import { Witness } from '@tenova/swt3-ai';
const witness = new Witness({
endpoint: 'https://your-instance.example.com/api/v1/witness',
apiKey: 'axm_your_key',
agentId: 'export-compliance-system',
jurisdiction: 'US',
legalBasis: 'EO-14110-4a',
purposeClass: 'dual_use_classification'
});
witness.witnessDualUse({
classificationCode: 1,
reportingStatus: 'pending',
daysSinceClassification: 0,
modelId: 'llm-foundation-v3',
classificationBasis: 'compute_threshold_exceeded',
computeThreshold: '1.2e26_flop'
});
await witness.flush();After classification, maintain ongoing evidence of compliance through jurisdiction-aware witnessing and supply chain screening.
When a regulatory directive requires model recall or an export violation is discovered:
For detailed incident response procedures including model transition workflows, see the AI Model Export Control Compliance case study guide.
SWT3 procedures mapped against five export control regimes. Green cells indicate direct evidence coverage.
| Procedure | EO 14110 | EU 2021/821 | Wassenaar | BIS EAR | UK ECJU |
|---|---|---|---|---|---|
AI-DUALUSE.1 |
✓ | ✓ | ✓ | ✓ | ✓ |
AI-JUR.1 |
✓ | ✓ | ✓ | ✓ | |
AI-SUPPLY.1 |
✓ | ✓ | ✓ | ✓ | |
AI-REV.1 |
✓ | ✓ | ✓ | ✓ | |
AI-MDL.1 |
✓ | ✓ | ✓ | ✓ | ✓ |
AI-MDL.2 |
✓ | ✓ | ✓ | ||
AI-SAFE.1 |
✓ | ||||
AI-BASE.1 |
✓ | ✓ | ✓ | ✓ | ✓ |
Coverage summary: 8 SWT3 procedures across 5 export control regimes. Every regime is covered by at least 4 procedures. AI-DUALUSE.1, AI-MDL.1, and AI-BASE.1 provide universal coverage across all five regimes.
from swt3_ai import Witness
w = Witness(endpoint="https://...", api_key="axm_...",
jurisdiction="US", legal_basis="EO-14110-4a")
# Classify model as dual-use, report filed
w.witness_dual_use(
classification_code=1, reporting_status="notified",
days_since_classification=14, model_id="foundation-v3"
)
w.flush()import { Witness } from '@tenova/swt3-ai';
const w = new Witness({
endpoint: 'https://...', apiKey: 'axm_...',
jurisdiction: 'US', legalBasis: 'EO-14110-4a'
});
w.witnessDualUse({
classificationCode: 1, reportingStatus: 'notified',
daysSinceClassification: 14, modelId: 'foundation-v3'
});
await w.flush();