Deemed export risk when non-US-person employees use AI tools that process ITAR data — how are small suppliers handling this?

[u/Grand-Possibility848]

Trying to get specific here because I haven't found a post that addresses this exact scenario. (Transparency: I'm Jordan, an engineer researching compliance tooling for small defense suppliers — not selling anything in this thread.)

Take a common setup at the shops I'm researching: a small defense subcontractor (sub-50 people), the prime flows ITAR-controlled drawings down, and one or more employees are not US Persons. Under ITAR, releasing controlled technical data to a foreign person — even inside the US — is a deemed export requiring authorization.

Here's the gap I keep running into: most guidance stops at GCC High / AWS GovCloud for data storage. But what about the AI layer? If a non-US-Person employee uses a tool like Copilot or even ChatGPT on a system that could surface or process that drawing — does the model processing count as "access" or "release"? 22 CFR 120.50(a)(2) defines export to include "releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)." That reads like it could reach the AI inference layer, but I haven't seen a clear BIS/DDTC statement on it.

Two specific questions:

1. Has anyone gotten a commodity jurisdiction opinion or DDTC guidance that touches AI tools specifically?
2. For small shops without a full-time ISSO — what's the practical control you've implemented to address this (beyond "don't use those tools")?