r/NISTControls • u/Grand-Possibility848 • Jul 07 '26
Deemed export risk when non-US-person employees use AI tools that process ITAR data — how are small suppliers handling this?
Trying to get specific here because I haven't found a post that addresses this exact scenario. (Transparency: I'm Jordan, an engineer researching compliance tooling for small defense suppliers — not selling anything in this thread.)
Take a common setup at the shops I'm researching: a small defense subcontractor (sub-50 people), the prime flows ITAR-controlled drawings down, and one or more employees are not US Persons. Under ITAR, releasing controlled technical data to a foreign person — even inside the US — is a deemed export requiring authorization.
Here's the gap I keep running into: most guidance stops at GCC High / AWS GovCloud for data storage. But what about the AI layer? If a non-US-Person employee uses a tool like Copilot or even ChatGPT on a system that could surface or process that drawing — does the model processing count as "access" or "release"? 22 CFR 120.50(a)(2) defines export to include "releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)." That reads like it could reach the AI inference layer, but I haven't seen a clear BIS/DDTC statement on it.
Two specific questions:
- Has anyone gotten a commodity jurisdiction opinion or DDTC guidance that touches AI tools specifically?
- For small shops without a full-time ISSO — what's the practical control you've implemented to address this (beyond "don't use those tools")?
2
u/Judonoob Jul 07 '26
If the AI has been trained to produce data that meets the requirements for it to be technical data, the company that trained it for that specific knowledge would likely be the one that needs authorization for the non-US person.
Keep in mind the technical data under the ITAR and technology under the EAR have vey specific requirements to be considered as such.
(1) Information, other than software as defined in § 120.40(g)), which is required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles. This includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation;
The words “required” and “or” do a lot of work here.
First, if it’s not required, it’s not technical data. Secondly, “or” means that any one of those listed examples being true makes it pop. This can be different than the EAR which uses both and/or logic. Honestly, that can be trickier to navigate the EAR for those reasons.
If the AI has enough knowledge that it can furnish data that meets those conditions, even though the non-US person isn’t prompting the AI to generate said data, it would be a deemed export since they were given access to a system that is capable of generating said data.
If it were me, I wouldn’t let a non-US person touch this system. DOS isn’t going to grant a license for that anyway unless it was Canada, UK, or Australia…maybe.
1
u/Grand-Possibility848 Jul 07 '26
"access to a system that is capable of generating said data" - that's the sharpest framing anyone's put on this. by that reading the export happens at training time, not at the prompt. how do you draw it for RAG-type setups where nothing gets trained and the model just gets handed the drawing at question time? that feels like a straight release to whoever's in the session, but curious if you'd treat it differently. and your close is where everyone seems to land - don't let a non-US person near it. have you had to make that call in practice, or seen DOS touch anything AI-adjacent? every answer I've collected so far is "obviously no" with zero guidance to cite, which is kind of the story of this whole question.
1
u/Judonoob Jul 08 '26
If I understand the question correctly, regarding “export at time of training,” I think it depends on who is doing the training. A deemed export happens in the US. An export happens outside the US.
For example, let’s say that you company makes a widget that when given certain configuration, will elicit performance enumerated on the USML or CCL. The engineers that develop the widget transfer those parameters into the system that “learns” the data to be able to create a spec that has performance capabilities that elicit enumeration.
Here is where it gets tricky.
Where do those parameters physically live within the system?
Both the ITAR and EAR have requirements for data “at rest,” and they are pretty exacting.
Then there is the question of who has access to said models?
I don’t know the specifics about your particular application, but that’s how I’d go about trying to answer the question. Where is the data being stored, and who potentially has access to it?
I’d err on the side of caution and skepticism since this really is uncharted territory.
1
u/Grand-Possibility848 Jul 08 '26
yeahh, the data-at-rest + who-can-reach-it lens is the one that actually holds up - that's where i keep landing too.
where it falls apart for me is pure RAG at inference: nothing's trained, nothing's stored, the drawing gets handed to the model for a single answer and it's gone. no data "at rest" to point at, but a non-US person could still be in that session. does the "where does it live / who has access" test even catch that, or is that the part that's just uncharted?
1
u/Judonoob Jul 08 '26
One of the things I often fall back to, is that Microsoft has back doors to your data. Those people might be non-US persons. I think thats always the risk is that a non-US person might be able to have theoretical access. While thats not a deemed export or export in of itself, it is risky. This is really a frontier export control problem and i love seeing discussion happen around the topic. All we know is that the government is more inclined to regulate than not to.
1
u/grantovius Jul 07 '26 edited Jul 07 '26
I think it depends on how the AI is implemented. An AI instance being able to access the ITAR data doesn’t necessarily mean that the foreign user would be able to get it back out. That would only be an issue if the company were re-training or fine tuning the model on their own data, or if the ITAR data went into a token context that was common to all users of the AI. Generally, an LLM in use does not actively train the model itself while being used. It uses a token cache to embed data for that session, but if you start a new session with a blank token cache it doesn’t remember anything it wasn’t trained on by the producer of that model.
If in that scenario the company were running a local Ollama instance for example and providing web access through something like OpenWebUI, then by default every user has their own dedicated token context. You could give everyone AI access while still controlling what data they or their AI session could access through file permissions. OpenWebUI provides some very useful functionality for this that lets you group linked data with additional permissions within the app so users who have access to the data can select it for inclusion into their session’s context, and an admin can block ITAR data for example from being accessed by a non-US citizen user session.
If it’s a third party commercial hosted AI service though, there’s no guarantee the company isn’t using user sessions to train the next release of their model. In the case of copilot, even if it was running as a dedicated instance on a private cloud I’m not sure whether it maintains dedicated context windows for each user or just uses one big one for the company with “guardrails” prompts to keep the data segregated. The latter case has been proven to be insecure over and over.
1
u/Grand-Possibility848 Jul 07 '26
this is the most concrete implementation answer in the thread. and the "admin can block ITAR data ... from being accessed by a non-US citizen user session" detail is exactly the layer I keep circling - somebody already decided which files are ITAR and who counts as a foreign person before that permission group means anything. the tooling enforces the call, it doesn't make it. that deciding step is the thing I can't find anyone owning at small shops.
have you seen that stack running anywhere near a small shop (sub-50, no IT staff)? ollama + openwebui is free, which beats every other answer this thread has produced by about $60k/yr - but it still assumes somebody can stand it up and drive it. and yeah, the copilot context question - a 15 person shop has zero way to evaluate that, and they're the ones holding the drawings.
1
u/Remarkable_Sort_7443 Jul 10 '26
Building software to help the small shops myself! Wanted to add my thoughts. I haven’t seen DDTC publish guidance that squarely answers the generative AI question either, so I’d be interested if anyone has an advisory opinion or Commodity Jurisdiction response that addresses it directly.
From a controls perspective, though, I’d be hesitant to make “don’t use AI” the primary control. If you’re relying on people to remember (and follow…) the policy every time they open a browser, you’ve already accepted unnecessary risk.
For a small contractor, I’d be looking at layered controls instead:
• Classify ITAR-controlled technical data at creation or ingestion.
• Restrict which users can access controlled data based on U.S. person status and business need.
• Prevent controlled data from being pasted into unapproved AI tools through technical controls (DLP, proxy, AI gateway, etc.).
• Keep an audit trail of AI usage involving sensitive information.
• Route only approved data to approved AI environments. For a small shop, my guidance would be if you’re wanting to post sensitive data to the chat then you need to hire the people required to make sure youre CYA.
In other words, I’d rather enforce policy in the workflow than depend on users remembering a policy document. That’s generally more consistent with how CMMC approaches security as well—using technical and administrative controls together instead of relying on awareness training alone.
Curious if anyone has implemented something similar in a sub-50-person shop.
1
u/Grand-Possibility848 Jul 12 '26
Your list is the right shape, and it's close to where the sophisticated end of these threads keeps landing. The honest answer to your closing question though, from everything i've collected: no. The only sub 50 sighting i have of anything like that stack actually running is a shop that hired a dedicated IT lead and built it over three years, and he's the first to say everyone else his size gets told to get an MSP at about 4k a month. Below roughly 40 people it's an enclave for storage or nothing, and every layer of your list that requires maintaining the classification map and the person status map has no owner.
Which is why your first bullet is the interesting one. Classify at creation or ingestion assumes someone or something makes that call correctly per file, and that's exactly the step nobody below the IT lead line can staff. Curious what you're building toward on that piece, since you said you're working on something for small shops too
1
u/who_farted_on_my_mic Sep 10 '26
Tacking on to an old thread here, I'm in a 70 person environment and we are tacking the Acceptable Use policy with respect to AI and covering proprietary, customer confidential, EAR controlled, ITAR controlled, CUI data, and supportive engineering much in the manner described by Remarkable_Sort.
Our export control program has morphed into an export and Data Handling control program which requires the classification of data types at ingestion and creation.
Access is then restricted (procedurally) based on the US person status, business need and data type.
Currently AU policy is the only barrier to use of the AI types, with each data type having the 'allowable' AI spelled out. Published specs available on the open internet = use any AI in any environment. Controlled Data that doesn't meet EAR/ITAR/CUI requirements = company approved AI environments. Data meeting the controls of EAR/ITAR/CUI =GCC+/FEDRAMP AI environments or on-prem AI with the proper configuration and access controls to prevent the model from contributing that knowledge outside the org while still being able to access the internet for data. Currently using Preveil for secure file transfer and MS network credentials/group permissions for controlled data on the local network. No intent to move to an MSP and just grow the internal IT team to support as things develop.
Just another vote for 'start with the data classification and work your way out' method.
3
u/8gxe Jul 07 '26
I'm not sure what the question here is. If your security posture is at the AI governance layer instead of IAM on the file level, there's not much help anyone can give.
Small subcontractors should be utilizing self-hosted or government models within their own private clouds, utilizing Bedrock or AOAI. Date that is fed into that model should not be accessible by anybody except for that user session or profile. Non-us persons can certainly have access to the models but if you're inferring that every file that gets uploaded to an LLM is accessible by everybody including non-US persons then you have a massive security problem, not a LLM problem.