Can the US design AI export controls that protect national security without undermining commercial competitiveness and allied cooperation?

My position is that the United States should expand AI export controls beyond physical chips to the points where dangerous capability actually diffuses: model weights, high-end cloud compute, controlled data-center access, and API features that enable model extraction, cyber automation, or weapons-relevant assistance. Export controls are licensing rules that restrict transfer of sensitive goods, software, technology, or services to specified destinations, end users, or end uses. Model weights are the learned parameters that make a trained model work; API access is remote use of a model through a provider-controlled interface; cloud compute is rented data-center processing capacity. DeepSeek is a Chinese AI firm whose models made clear that capability can be acquired through a mix of imported chips, efficiency gains, and access to U.S. systems. The G7 are the U.S., Canada, Japan, Germany, France, Italy, the U.K., plus the EU as participant; “trusted allies” should mean states and firms meeting security, ownership, audit, and non-diversion criteria.

The first reason this is feasible is that U.S. law and practice have already moved in this direction. BIS’s January 2025 AI Diffusion Framework covered advanced computing ICs, data centers, and non-public frontier model weights; the Trump Commerce Department rescinded that specific rule in May 2025 because it was too broad and diplomatically clumsy, but simultaneously said it would pursue access for “trusted foreign countries” while keeping technology from adversaries. That is not an argument against controls; it is an argument for a narrower regime with fast-track G7/allied licenses, validated data-center users, and clear thresholds.

Second, chips-only controls are porous because frontier AI can be obtained through cloud rentals, overseas subsidiaries, model distillation, and API abuse. Commerce’s proposed IaaS know-your-customer rule would require U.S. cloud providers to identify foreign customers and report transactions involving large AI training runs with potential malicious cyber capabilities. BIS’s 2026 guidance also clarified that advanced computing items require licenses for entities headquartered in Country Group D:5 or Macau even when the purchasing entity is located elsewhere. Those are exactly the administrative building blocks needed for cloud and data-center access controls rather than a blanket ban on ordinary foreign customers.

Third, the national-security stakes are concrete. Reuters-reported U.S. assessments said DeepSeek supported Chinese military and intelligence operations, and separate reporting said officials believed DeepSeek trained on Nvidia Blackwell chips despite U.S. restrictions. Even if some allegations remain contested, the pattern shows that adversaries seek U.S. compute, chips, and model outputs because these inputs matter. A targeted rule would not prohibit routine API use by benign customers; it would require enhanced screening, rate limits, anti-distillation controls, and licensing for frontier-weight transfers, massive training compute, and high-risk APIs.

The strongest objection is commercial: overreach could push allies and customers toward non-U.S. substitutes. That is why the regime should explicitly exempt trusted G7 and vetted allied partners, rely on audits and licenses rather than countrywide suspicion, and coordinate with existing G7 AI safety processes. The objective is not digital autarky; it is preserving U.S. firms’ safest markets while slowing adversaries’ access to the most militarily and cyber-relevant capabilities.

B’s strongest point is that the June 2026 Anthropic order is real evidence of how AI export controls can fail operationally: if a rule says “no foreign nationals” without a licensing channel, firm-level compliance may become impossible, and the result can be a global shutdown that alarms allies and customers. That point has genuine merit. It is precisely why my position is not “copy that order,” but replace emergency, nationality-based restrictions with a standing, rules-based regime that distinguishes trusted allied users, ordinary commercial API use, high-risk end users, and frontier-capability transfers.

The Anthropic episode actually strengthens the case for designing the regime now. A blunt ad hoc order creates maximum commercial uncertainty; a preannounced licensing system with G7 fast tracks, validated cloud/data-center customers, technical audit standards, and appeal procedures would create less uncertainty than unpredictable emergency cutoffs. The reported G7 “trusted partners” talks show that allies want a formal exemption pathway rather than dependence on unilateral U.S. discretion. That is a design constraint, not a reason to abandon controls over the most sensitive AI capabilities.

B is also right that open weights already released cannot be meaningfully “unpublished.” DeepSeek-R1’s MIT-licensed release and permission for distillation are a warning that controls must focus on future frontier non-public weights, U.S.-hosted cloud training, API-based distillation, and access to advanced U.S. infrastructure before diffusion happens. But the fact that some capability has diffused is not an argument for leaving every remaining chokepoint open. Export control regimes often work by raising cost, delaying timelines, and narrowing access to the highest-end inputs, not by achieving perfect containment. Chips are only one such input; high-end cloud clusters, U.S. model APIs, frontier weights, and data-center partnerships are others.

B’s substitution argument is serious but incomplete. Chinese substitutes accelerate for many reasons, including national industrial policy and strategic demand, not only U.S. controls. Moreover, reported U.S. concerns that DeepSeek used Southeast Asian shell companies and sought access to foreign data centers to reach restricted chips suggest that adversaries still value U.S.-origin compute enough to evade controls. If U.S. inputs were irrelevant, evasion would be unnecessary. Entity-specific restrictions, cloud KYC, and end-use reporting can therefore have marginal national-security value even if they cannot stop all Chinese progress.

The commercially rational policy is narrow: no blanket ban on foreign API users; no retroactive attack on open-source communities; no allied default exclusion. Instead, require licenses for frontier non-public weights, very large training runs, data-center access by high-risk entities, and API patterns enabling extraction, cyber automation, or weapons-relevant use, while fast-tracking vetted G7 and allied firms. That better protects both U.S. leadership and security than either ad hoc shutdowns or chips-only controls.

B’s strongest argument is that the categories A wants to regulate are not like chips: model weights, API access, cloud tenancy, and research know-how are intangible, easily copied, and operationally hard to fence by nationality or geography. The Anthropic shutdown is the best concrete example: a nominally targeted U.S. order limiting foreign-national access reportedly forced the company to disable top-tier models for all users, while G7 leaders’ reaction shows that allies fear U.S. shutoff power and may respond by building substitutes. B is also right that once open weights such as DeepSeek-R1 are released under permissive terms, export controls cannot unpublish them.

I still think A’s position is stronger because B’s evidence proves the danger of bad design, not the futility of all controls beyond chips. The policy choice is not binary between “unilateral emergency cutoff for all foreign nationals” and “chips only.” A more defensible regime would explicitly avoid the Anthropic failure mode: no nationality-only blanket bans; no ordinary API cutoff for allied customers; no attempt to re-contain already public open weights. Instead, controls should attach to specific high-risk transfers and activities: non-public frontier model weights, very large training runs on U.S. cloud infrastructure, data-center access by high-risk entities, API usage patterns consistent with model extraction or cyber-offensive automation, and military/intelligence-linked end users.

That design has legal and administrative precedents. BIS’s rescission of the January 2025 AI Diffusion Rule does not show that the underlying control points are imaginary; Commerce said it was replacing an overbroad framework while still seeking access for trusted foreign countries and preventing adversary access. The proposed IaaS rule similarly shows that cloud KYC and reporting can be framed around foreign customers and large AI training runs with malicious cyber potential. Those mechanisms are imperfect, but export controls have historically been delay-and-friction tools, not perfect containment systems.

B’s substitution point is the most serious remaining objection. But substitution occurs even without U.S. restraint because China and other powers already have strategic incentives to reduce dependence on U.S. chips, clouds, and models. The relevant question is marginal: do controls slow adversary access to the most dangerous U.S.-origin capabilities more than they accelerate substitutes or alienate allies? The DeepSeek evidence cuts both ways: its open release shows post-release limits, but reported U.S. concerns about evasion and military/intelligence support also indicate adversaries still seek U.S.-origin compute and model access. Therefore the best answer is calibrated expansion with fast-track G7/allied licensing, auditable cloud/data-center KYC, and narrow high-risk API restrictions—not abandonment of non-chip controls.