AI Export Controls and Europe Between Washington and Beijing

Yujiro Masaki is a researcher at the External Affairs Institute and an entrepreneur specializing in artificial intelligence, digital policy, and international cooperation. He studied for an M.S. in European Studies at UCLouvain and previously served at Japan’s Ministry of Foreign Affairs (Middle East Bureau). He is the Founder and CEO of Jexen. Views are the author’s.

1. Introduction

Export controls on advanced chips have made artificial intelligence an external-affairs problem. A licensing file for dual-use goods is now a contest over who may train, fine-tune, and run the systems that draft administrative language and sort intelligence. The United States is trying to freeze a military-civil lead. China is substituting, releasing open weights, and building around the ban. Europe is asked to align with Washington while remaining a trading power with Beijing.

Alignment is not a strategy. Controls that Europe implements but does not design leave European firms the compliance cost without the industrial upside. A chip licence can delay a shipment. It cannot recall a file that already sits on a laptop in Paris, Tokyo, or Shenzhen. Sovereignty is not a slogan and not a national champion. It is the capacity to train, fine-tune, and run systems so that public functions do not depend on a single API or a single foundry.

Written for EEAS and member-state economic-security units, this paper treats model access, cloud concentration, and chip licensing as one file. Europe should decide, with Japan and other middle powers, what must be autonomous, what may be allied, and what is acceptable dependence.

2. How chips became foreign policy

The conversion of semiconductors into statecraft began with a company, a list, and a theory of leakage. On 16 May 2019 the Bureau of Industry and Security added Huawei Technologies and sixty-eight non-U.S. affiliates, in twenty-six destinations, to the Entity List. A licence became required for items subject to the Export Administration Regulations, with a review policy that was, in substance, a presumption of denial. In 2020 BIS expanded the foreign direct product rule — in May, then more broadly in August — so that certain foreign-produced semiconductors made with specified U.S. software or technology also required a licence when destined to Huawei. Jurisdiction reached the product of American design tools wherever they were used.

The shift to a capability-based regime came in 2022. On 9 August President Biden signed the CHIPS and Science Act, Public Law 117-167, appropriating on the order of 52.7 billion dollars for domestic semiconductor manufacturing, research, and related funds. On 7 October BIS issued interim final rules on advanced computing integrated circuits, semiconductor manufacturing items, and supercomputer and semiconductor end-uses in the People’s Republic of China. The rules also notified U.S. persons that certain support for specified integrated-circuit work at PRC facilities required a licence, and they expanded the foreign direct product rule for twenty-eight entities already on the Entity List. The object was no longer a single firm. It was a class of compute.

Frontier model quality is a function of algorithms, data, and computation. Computation at the scale that now matters depends on advanced logic chips, high-bandwidth memory, and the packaging that binds them. The same accelerators that train a commercial assistant can train a targeting model. Dual use is old. What is new is the difficulty of detecting diversion once a chip sits in a civilian cloud, and the speed with which a civilian model can be adapted to a military task.

Europe entered as a supplier of the machines that make the chips, not as the designer of the rule. ASML’s extreme ultraviolet systems have not been shipped to China. The Dual-Use Regulation, (EU) 2021/821, already gave member states a Union framework. The October 2022 rules, and the understanding reached with Japan and the Netherlands in late January 2023, pulled that framework into a tempo Brussels did not set. Training had become expensive enough to seize as a bottleneck; the same model family sat on both sides of the civil-military line; and the foundry and equipment maps ran through a few firms and islands — TSMC, ASML, a Japanese materials cluster, an American design-software and graphics-processor cluster. A licence application was no longer a trade form.

3. Washington’s theory of the lead

Washington’s public theory is a theory of time. Officials have not claimed that controls will reduce Chinese artificial intelligence to zero. They have claimed that denying, delaying, and raising the cost of advanced compute will slow the military modernisation that rides on that compute, and that the interval must be used to rebuild American manufacturing and lock in a training lead. The CHIPS Act is the domestic half of the same sentence as the October 2022 rules. One side withholds. The other side builds. A control that only withholds is a delay dressed as a strategy.

The theory has been restated as the rules have been patched. On 17 October 2023 BIS adjusted performance thresholds that firms had learned to route around, expanded certain equipment controls, and created License Exception Notified Advanced Computing for specified lower-performance chips. On 2 December 2024 it added, among other measures, controls on high-bandwidth memory and further equipment and software tools. The bottleneck is not only the logic die. It is memory bandwidth and the package that feeds the die.

The instrument that makes the theory travel is extraterritoriality. The foreign direct product rule treats certain foreign-made items as subject to the EAR when they are the direct product of specified U.S. technology or software. A European or Japanese toolmaker that uses American software cannot treat U.S. law as a foreign curiosity. Compliance departments already know this. Foreign ministries sometimes write as if they do not.

Two features matter for Europe. First, the military-civil fusion premise: Washington does not need to prove that a particular shipment will be installed in a weapons programme, only that the class of item enables a class of capability the PRC is directed to acquire. Second, unilateral design with allied implementation: Washington writes the metrics, footnotes, and entity names; allies are asked to close the hole their own equipment would otherwise open. A state that designs the rule captures the industrial upside of the interval. A state that only implements it captures the compliance cost, the political cost in Beijing, and the risk that the next licence decision will be taken without it. Europe is closer to the second position than to the first.

4. Beijing’s workarounds

Beijing has not accepted the interval as fate. The public record shows three responses: substitute the hardware, open the software, and reorganise the supply chain around the ban.

Substitution is incomplete and expensive, which is not the same as impossible. In September 2023, public reporting on Huawei’s Mate 60 Pro described a seven-nanometre-class processor attributed to Semiconductor Manufacturing International Corporation, produced with deep-ultraviolet tools and multipatterning rather than EUV. Controls do not seal a technology. They impose a generation lag, a yield penalty, and a cost. Huawei’s Ascend line, and the CANN stack built to receive workloads that would otherwise sit on NVIDIA’s CUDA, are the industrial face of that bet. American restrictions have damaged Huawei’s access to leading-edge foundries. They have also made Huawei the political centre of a domestic compute ecosystem.

The software response is more awkward for a chip ban. On 20 January 2025 DeepSeek released the R1 reasoning model and published weights under an MIT licence, with a technical report. By 27 January, public reporting placed DeepSeek’s assistant at the top of the U.S. iOS App Store’s free chart and recorded a one-day fall in NVIDIA’s share price on the order of 17 per cent. The training-cost claims were contested; this paper does not adjudicate them. A Chinese laboratory operating under Washington’s chip constraints released a competitive reasoning model as a file. Opening the weights harvests a global developer community and shows that a ban on shipments is not a ban on capability. Practical weights now leave more than one legal jurisdiction, including the one the chip rules were written to constrain.

If logic chips are harder to buy, the next scarce inputs are high-bandwidth memory, advanced packaging, and the equipment that makes both. The December 2024 BIS rules recognised that shift. China has, in public, answered with its own licensing of gallium, germanium, antimony, and graphite. The October 2022 rules did what export controls usually do: they bought time and raised costs. They did not freeze a military-civil lead in place. A European strategy that copies the American theory without watching the Chinese response will be surprised by files, not by ships.

5. Europe’s alignment without a bargain

Europe is a large market, a dense regulator, a first-rank equipment supplier, and a second-rank producer of frontier models and leading-edge logic. It trades with China at a scale Washington treats as a problem and depends on American security guarantees it has not replaced. When Washington asks for alignment on chips, it is asking a trading power to spend political capital in Beijing in service of a military-civil theory written in Washington.

The alignment has been real. In late January 2023, U.S. officials and contemporaneous reporting described an understanding with Japan and the Netherlands to restrict specified semiconductor manufacturing equipment. Neither capital adopted the EAR as such. Both wrote national measures. On 30 June 2023 the Dutch government published new controls; ASML stated the same day that licences would be required, from 1 September, for its most advanced immersion DUV systems (TWINSCAN NXT:2000i and subsequent) and recalled that EUV sales were already restricted. Japan amended its foreign-exchange and trade ordinances to cover categories of manufacturing equipment, without naming China in the public design. In January 2024 ASML reported that a Dutch licence for certain NXT:2050i and NXT:2100i shipments had been partially revoked after the October 2023 U.S. updates. In September 2024 The Hague expanded licensing so as to retake oversight of DUV immersion tools that U.S. rules had been regulating from the outside.

These are sovereign acts whose timing and scope are not intelligible without Washington. That is alignment without a bargain. Europe and Japan closed the hole. They did not receive a seat on the metric, a predictable licence channel for their own firms’ non-controlled trade, or an industrial counterpart on the scale of the CHIPS Act’s American appropriations. The European Chips Act — Regulation (EU) 2023/1781, in force from 21 September 2023 — aims to raise the Union’s global semiconductor share toward 20 per cent by 2030. It is a supply-security statute, not a bargain over who writes the export rule.

The June 2023 European Economic Security Strategy, JOIN(2023) 20, named the right verbs: promote, protect, partner. It listed advanced semiconductors and artificial intelligence among technologies whose leakage to destinations that practise civil-military fusion should be assessed. The January 2024 follow-up put export controls, outbound investment, and research security on the same table. The missing noun is leverage. Partner still reads as partner on a text Washington has already drafted; protect, as national lists written under American time pressure; promote, as a foundry subsidy that does not change who trains the model in the public cloud.

The Dual-Use Regulation cannot supply the bargain. Wassenaar lists move by consensus; Russia sits in the room. A Union of twenty-seven national lists, updated when Washington updates a footnote, is not a common commercial policy. European firms absorb classification, end-use diligence, U.S. re-export analysis, and the risk that a licence granted in one capital is undermined by a rule in another. They do not absorb the training-cluster investment or the cloud margin the interval was supposed to protect. The political bill in Beijing is presented to Europe as a trading partner. Alignment that is not priced is a habit.

6. Open weights and the limits of a chip ban

A chip ban assumes that capability travels with hardware. Increasingly it also travels as a file. Open weights — trained parameters that a third party can download, run, and often fine-tune — move on a different clock from lithography tools. “Open source” is used for both a downloadable checkpoint and a system that can be reproduced. The two are not the same.

On 28 October 2024 the Open Source Initiative published version 1.0 of the Open Source AI Definition. An open-source AI system, under that text, grants the freedoms to use, study, modify, and share, and requires code, parameters, and enough data information to build a substantially equivalent system. Few frontier releases meet that test.

What has been released is still politically large. On 5 April 2025 Meta published Llama 4 Scout and Maverick as downloadable multimodal mixture-of-experts models under the Llama Community License. The weights can be run outside Meta’s API. The licence is not OSI open source: it carries an acceptable-use policy and, in the Llama family texts, a very large monthly-active-user threshold above which a separate permission is required.

Europe has a cleaner legal object in at least one product line. On 2 December 2025 Mistral AI released the Mistral 3 family, including Ministral dense models and Mistral Large 3, a mixture-of-experts model with 675 billion total parameters, under Apache 2.0. Apache 2.0 is an OSI-approved software licence. It is still not an open-source AI system in the OSI sense: the training data and the full reproduction recipe do not arrive with the weights. The policy value is that a European firm has put a capable, permissively licensed checkpoint into the world. Choice is leverage. A single checkpoint is not an ecosystem.

DeepSeek’s R1 release completed the triangle. American closed APIs, American and European open weights, and Chinese open weights now coexist. A ministry that blocks a chip shipment to Shanghai does not block a researcher in Berlin from pulling a Chinese checkpoint the next morning. The chip remains necessary for training at the frontier and for inference at scale. It is no longer sufficient as a theory of denial. Weights can move when chips cannot. Open weights accelerate legitimate science and on-premise deployment. They also accelerate fraud, cyber operations, and influence work. A state that cannot run an open-weight model under its own law, with its own logs and stop button, is not safer for having aligned on a chip rule. It has chosen a different foreign dependency. Every cable and procurement note should state whether the weights are published; whether the licence is OSI-approved or a community instrument; whether training data and code are disclosed to a reproducible standard; and whether the system will run in an auditable jurisdiction. A document that says only “open” is a brochure.

7. A middle-power file: autonomy, alliance, dependence

Middle powers do not get to choose autarky. They get to choose the composition of their dependence. Japan learned this in energy at the Strait of Hormuz. It is learning it again in compute at the Taiwan Strait. Europe is in the same structural position, with a larger market and a weaker habit of naming the position.

Sovereignty, here, is the capacity to keep core public functions running if an API is withdrawn, a cloud region is partitioned, or a foundry is blockaded. It is not a requirement to win a chatbot benchmark or to fabricate the leading logic node in a Union foundry by a date chosen for a press conference. The test is operational. If the model that drafts social-security correspondence, or that supports a headquarters’ open-source exploitation, is withdrawn on a Friday, what runs on Monday, in which building, under which law, at what degraded quality? A government that cannot answer that question has a subscription, not a digital policy.

Three columns make the question usable. Autonomy is what must remain runnable, fine-tunable, and evaluable without depending on a single foreign firm or statute: evaluation suites in the Union’s official languages and legal orders; the ability to run at least a mid-tier open-weight model for core administration on compute in a member-state or tightly allied jurisdiction; the data needed to adapt that model to European public law; and a crisis quota of inference that is not a line item on an American invoice. It does not include every consumer application.

Alliance is what Europe should hold in common with the United States, Japan, the Netherlands, Korea, and Taiwan because the physics of the supply chain is already common. Export metrics on genuine chokepoints — EUV, the most advanced immersion DUV, specified etch and deposition tools, leading-edge high-bandwidth memory — belong here, provided the metric is negotiated and not merely received. So do arrangements on Taiwan’s stability and on access to American design software. Alliance is a joint decision about a joint bottleneck, not obedience.

Acceptable dependence is what Europe will continue to buy from the United States and, in defined civilian channels, from China, with eyes open. Most commercial model use and a large share of peacetime cloud will remain American for years. Some electronics and industrial components will remain Chinese. Acceptable dependence is a written residual risk, with a trigger for review. Unacceptable dependence is a public function that dies when a terms-of-service page is updated in California or a licence footnote is rewritten in Washington.

Japan is the natural counterpart: an equipment and materials power, a U.S. security ally, a trading state with China, and a polity that will not become a frontier-model capital in the next political cycle. Its interests in predictability, in Taiwan, and in not being a silent enforcement arm of the EAR are European interests with a different accent. A middle-power file that is only transatlantic will be written in Washington. Model access, cloud concentration, and chip licensing must sit on one desk. A ministry that assigns them to digital, interior, and trade units will discover the unity of the file on the day one of the three is withdrawn.

8. Recommendations

First, write the three-column inventory. EEAS, with the Commission services that hold dual-use and semiconductor files, should ask each member state for a restricted list of public functions that must remain runnable under autonomy, those that may rest on allied systems, and those accepted as dependent. The list should name the model, the cloud, and the chip or instance type.

Second, stop implementing American metrics in the dark. Where the Union or a member state adopts a control that tracks a BIS performance threshold, the accompanying note should state the European purpose, the expected cost to European firms, and the review date. COREPER and the Dual-Use Coordination Group cannot remain a mailbox for a Federal Register notice.

Third, price the bargain. Alignment on equipment and entity designations should be exchanged for consultation before new extraterritorial footnotes that hit Union firms; a predictable channel for licence-exception treatment of European civilian exports that are not the target of the military-civil theory; and a reciprocal industrial measure — access, investment, or guaranteed capacity — on training compute and advanced packaging.

Fourth, treat open weights as a controlled vocabulary. Ban the standalone adjective “open.” Require the four-item statement set out above. For systems that touch personal data, justice, or defence, prefer weights that can be run on-premise or in a Union-jurisdiction cloud, under a licence that does not impose a foreign acceptable-use layer on European public law. Mistral’s Apache-licensed line is a relevant option, not a designated champion. Llama-class community licences can be used where the use and scale limits are understood. Chinese open weights should be evaluated as technical objects and as influence objects.

Fifth, build the small autonomous stack before advertising a large one. Fund, at Union or coalition-of-the-willing level, an evaluation office that can score models against European languages, law, and safety requirements; a shared run-time for at least one mid-tier open-weight family on public-interest compute; and a crisis plan that states, in days, how long core inference can continue if transatlantic cloud access is degraded.

Sixth, sit with Japan, and then with Korea, on a middle-power text covering equipment metrics, licence predictability, Taiwan, and the evaluation of open-weight releases. The January 2023 understanding was necessary and insufficient. The next instrument should be written by the implementers.

Seventh, keep the China commercial channel explicit. Economic-security units should maintain a living map of Union trade that the chip file will strain and should give ministers a number, not an adjective, before the next licence cycle.

9. Conclusion

The United States is trying to freeze a lead. China is trying to make the freeze expensive and incomplete. Europe is trying to remain a market and an ally at the same time. Those three sentences are all true. They do not yet add up to a European policy.

A policy would treat the model, the cloud, and the chip as one file. It would distinguish alignment from strategy, open weights from open source, and sovereignty from branding. It would decide, in writing, which public functions must be autonomous, which may be allied, and which dependence is acceptable — with Japan and the other middle powers that live between a security guarantee and a trading relationship.

I spent seven years in a foreign ministry and now work on adopting these systems in firms that will never train a frontier model. The danger is not that Europe will pick the wrong champion. It is that it will implement a rule it did not write, pay for a compliance system it does not own, and discover, on the morning an API stops, that the public function was a login. The only question that belongs to Europe is whether it can still run what it cannot afford to see stopped.

Selected references

Bureau of Industry and Security, “Addition of Entities to the Entity List,” 84 Fed. Reg. 22961 (21 May 2019; effective 16 May 2019).

Bureau of Industry and Security, “Amendments to General Prohibition Three (Foreign-Produced Direct Product Rule) and the Entity List,” 85 Fed. Reg. 29849 (19 May 2020; effective 15 May 2020); and 85 Fed. Reg. 51596 (17 August 2020).

BIS, 87 Fed. Reg. 62186 (13 October 2022; measures effective 7, 12 and 21 October 2022); updates of 17 October 2023; and the 2 December 2024 package adding, inter alia, high-bandwidth memory controls.

CHIPS and Science Act of 2022, Public Law 117-167 (signed 9 August 2022).

Regulation (EU) 2021/821 (Dual-Use Regulation); Regulation (EU) 2023/1781 (Chips Act, in force 21 September 2023); Regulation (EU) 2024/1689 (AI Act).

European Commission and High Representative, “European Economic Security Strategy,” JOIN(2023) 20 final (20 June 2023); European Commission, COM(2024) 22 final (24 January 2024).

ASML, “Statement regarding export control regulations Dutch government” (30 June 2023).

Open Source Initiative, “The Open Source AI Definition – 1.0” (28 October 2024).

DeepSeek, “DeepSeek-R1 Release” (20 January 2025).

Meta, “The Llama 4 herd” (5 April 2025).

Mistral AI, “Introducing Mistral 3” (2 December 2025).