Near-Term Verification Methods for AI Chip Exports

• BIS, exporters, or accredited third-party auditors could conduct verification, while private-sector participation could help scale enforcement despite BIS’s resource constraints.A third-party auditor accreditation system does not currently exist, but the paper says it could help scale enforcement.Source: Executive Summary · p. 3
• A mechanism can be useful without being impossible to evade if it makes evasion more costly, and the paper considers cost, intrusiveness, and enforcement value.Source: Executive Summary · p. 3
• On-site inspections, remote video walkthroughs, and delay-based checks can verify chip locations, with anomalies prompting more intensive inspections.Delay-based checks use response times between chips and trusted landmark servers, but provide limited visibility before deployment; the approaches can be layered.Source: Executive Summary · p. 3
• Enhanced KYC checks use public information, including corporate filings, to identify concealed ownership links to entities of concern before export.They are preventive rather than ongoing monitoring, and may be ineffective against sophisticated actors using front companies.Source: Executive Summary · p. 3
• Cross-checking end-use declarations against public information about a customer’s business can help exporters assess whether declared chip use is consistent with actual activities.Cloud providers could use similar checks if cloud access becomes regulated under the BIS Export Administration Regulations.Source: Executive Summary · p. 4
• Verification mechanisms detect suspected violations but do not enforce compliance on their own; the paper also identifies potential use in monitoring future international AI agreements.Robust enforcement pairs verification with follow-up investigations and enforcement action when violations are confirmed.Source: Executive Summary · p. 4

1.1 Export Documentation Checks

• Export documentation checks can trace sampled chips through shipment records, but are most practical for detecting direct sales by U.S. companies and subsidiaries to prohibited customers or restricted end uses.Documents may be forged and corporate structures obscured, so checks alone are meaningful mainly against low- to moderate-sophistication actors; enhanced KYC can address some weaknesses. Exporters, internal compliance teams, accredited auditors, or BIS can review licensing and shipment records.Source: §1.1 · p. 6

1.2 On-Site Inspections

• On-site inspections let BIS or accredited auditors verify chip serial numbers and inventories against records, using scheduled or unannounced visits according to risk and compliance history.Inspections depend on reliable records of which chips should be present; inspectors should verify representatives’ credentials, probe equipment for operation, and check for tampering or replicas.Source: §1.2 · pp. 6–7

1.3 Remote Video Inspections

• Remote video inspections offer a lower-cost, less robust alternative to site visits, but AI-generated spoofing requires anti-spoofing safeguards and a wider verification system.Auditor-controlled encrypted streams, randomized requests, and active sensing can raise the difficulty of spoofing; remote checks should complement other evidence rather than merely confirm declared information.Source: §1.3 · p. 8

1.4 Auditor-Directed Video Walkthroughs

• Auditor-directed video walkthroughs use live staff navigation and unpredictable instructions to check chip locations, especially where fixed cameras are infeasible or other checks raise red flags.Auditors can request specific racks or chip samples, verify live transmission with unscripted tasks, and cross-check observations against export and inventory records; signed timestamps and geolocation metadata raise the bar for manipulation but do not eliminate spoofing.Source: §1.4 · p. 9

1.5 Random Return Requests

• Random chip-return requests can verify authorized location without inspector travel, and an operational study found a 0.45% annual replacement rate across 1,056 controlled GPUs.That rate corresponds to roughly nine swaps per 2,000 chips annually; a return program would add only a small fraction to existing swap activity. BIS could use a centralized ownership registry and short return deadlines, but broader coverage would depend on re-exporter and foreign-government cooperation, and secure intake at diplomatic posts would require investment.Source: §1.5 · pp. 9–10
• Random return requests can verify selected chips’ serial numbers and identifiers against export and inventory records.BIS or accredited auditors can randomly select serial numbers from a centralized registry and request return to an authorized facility within a short timeframe, such as 24–48 hours, using an established shipping company.Source: §1.5 · p. 10

1.6 Delay-Based Location Verification

• Ping-response latency to trusted landmark servers can estimate advanced AI chips’ location in near-real time once they are installed and networked in a data center.Manufacturers could enable cryptographic challenge-response through firmware and unique chip keys, establish landmark networks, and respond to periodic verification requests from BIS; exporters or end users would initiate pings.Source: §1.6 · pp. 10–11
• Under $1 million for firmware development and $2.5 million to $12.5 million annually for a landmark-server network are the estimated costs of ping-based verification at scale.The passage characterizes these costs as relatively low compared with major chip manufacturers’ profit margins.Source: §1.6 · p. 10
• Ping-based verification cannot detect diversion during shipping or warehousing, and attackers may manipulate latency or compromise landmark servers.Mitigations include a centralized chip registry requiring location registration and dense landmark-server coverage near high-risk jurisdictions.Source: §1.6 · p. 11

2 End-User Verification

• Enhanced KYC checks and KYC compliance audits are the two proposed mechanisms for strengthening end-user verification.Enhanced checks apply in defined high-risk cases; audits independently verify that checks are conducted properly.Source: §2 · p. 12

2.1 Enhanced KYC Checks

• For BIS-defined high-risk transactions, enhanced KYC collects ownership, executive, end-use, and location details and screens customers against restricted-party lists.Automated screening platforms depend on their underlying datasets, which may be incomplete or outdated and miss sophisticated actors concealing ownership.Source: §2.1 · pp. 12–13

2.2 KYC Compliance Audits

• KYC audits independently verify required due diligence through accredited reports, automated completeness checks against licenses and shipment records, and BIS review of high-risk submissions.Exporters’ failure to flag customers crossing reporting thresholds is a vulnerability; automated completeness checks can mitigate it.Source: §2.2 · p. 13

3 End-Use Verification

• The section distinguishes direct customer sales, where screening is primarily pre-sale, from cloud-access restrictions that may require checks on compute use.For direct sales, the main available tool is cross-checking declared use against actual business activities.Source: §3 · p. 14
• If cloud access were brought under the EAR, end-use checks could verify prohibited-use restrictions; compute-provisioning limits could also be audited if BIS imposed them.Cloud access is not directly regulated under the EAR as of July 2026, though BIS has authority to impose cloud restrictions as export-license conditions or through U.S. persons controls.Source: §3 · p. 14

3.1 End-Use and Line-of-Business Cross-Checks

• End-use and line-of-business checks compare customers’ declared workloads with public business records, flagging mismatches such as unusually high compute use by a biological research lab.Customers would submit declarations; accredited auditors could verify business records and providers could submit standardized attestations through a BIS platform.Source: §3.1 · pp. 14–15
• The cross-checks can be scoped to customers above a periodically reassessed compute threshold to limit the burden on exporters and cloud providers.Thresholds could be based on chip orders or quarterly GPU-hours.Source: §3.1 · p. 14
• Front companies can make declared business lines appear consistent with high compute use, so cross-checks suit lower-risk jurisdictions or use alongside other mechanisms.The method is likely ineffective against sophisticated actors able to establish or acquire such companies.Source: §3.1 · p. 14

3.2 Compute Provisioning Audits

• Compute provisioning audits total customer FLOP from cloud allocation logs, billing records, and usage metrics to check compliance with potential compute-based restrictions.They may be scoped to high-consumption customers in jurisdictions at high risk of restricted end uses.Source: §3.2 · p. 15
• Verifying customer compute across providers would likely require information sharing, because customers could distribute workloads across providers to evade restrictions.The proposed audits would aggregate customer jobs and submit compute-usage reports to BIS or accredited auditors twice yearly.Source: §3.2 · pp. 15–16

Conclusion

• No individual proposed mechanism is impossible to evade, but using mechanisms together compounds the costs and friction imposed on bad actors.Most mechanisms rely to some degree on trusting exporters or chip owners because they validate materials those actors provide, which could be falsified.Source: Conclusion · p. 17
• The systems are presented as near-term responses to inefficient enforcement and insufficient resources because they can be quickly implemented with private-sector actors collaborating with BIS.Source: Conclusion · p. 17
• The proposed systems address enforcement challenges, while document validation leaves some reliance on exporter or chip-owner trust.Source: Conclusion · p. 17

Appendix: Methodology

• Candidate mechanisms came from other domains’ verification approaches, studies of AI-governance mechanisms, and mechanisms designed to address export-control enforcement gaps.Source: Appendix: Methodology · p. 17
• Mechanisms were selected for implementation within approximately one year using existing authorities, technologies, or infrastructure, meaningful enforcement value, and cost-effectiveness.Source: Appendix: Methodology · p. 17
• Cost-effectiveness combined direct costs, private-sector compliance burden, and BIS implementation complexity, assessed qualitatively rather than through formal modeling.Source: Appendix: Methodology · p. 17

Summary Table Ratings

• Maturity ratings classify mechanisms as established, relatively established, or novel based on whether they or close analogs are already implemented.Source: Summary Table Ratings · p. 17
• Effectiveness ratings assess detection reliability against state-linked entities, commercial shell-company users, and brokers serving restricted users.Source: Summary Table Ratings · p. 17
• High effectiveness means difficult to evade across the described adversaries; medium offers meaningful assurance but has sophisticated evasion paths; low is limited as a stand-alone tool.Source: Summary Table Ratings · pp. 17–18
• Effectiveness ratings are qualitative author judgments rather than results of empirical testing.Source: Summary Table Ratings · p. 18
• Access ratings distinguish invasive mechanisms requiring premises or sensitive operational access, relatively invasive limited or remote access, and non-invasive reliance on public or already reported information.Source: Summary Table Ratings · p. 18