GAO Holds Commerce’s Non-Enforcement of the AI Diffusion Rule Is a “Rule” Subject to the Congressional Review Act

The GAO’s decision sharpens the line between permissible enforcement discretion and across-the-board policies that effectively suspend regulations. Importantly, the AI Diffusion Rule remains legally in effect as of today’s date without a legally valid action to exempt compliance, notwithstanding the stated non-enforcement posture by the Bureau of Industry and Security (BIS), leaving companies to engage in risk-based decisions for compliance.

Background
Issued as an interim final rule on January 15, 2025, the AI Diffusion Rule amended the framework for controlling exports, reexports and in-country transfers of advanced computing integrated circuits and advanced AI model weights, including new model-weight controls, revised license requirements, expanded license exceptions, red-flag guidance and updates to the Data Center Validated End User authorization. On May 13, 2025, Commerce issued a press release that announced a planned rescission and replacement of the AI Diffusion Rule. On November 19, 2025, Sen. Elizabeth Warren (D-MA) formally requested that the Comptroller General determine whether the press release constituted a “rule” under the CRA.^[1]The GAO has since publicly confirmed that BIS has not submitted the press release to Congress or the Comptroller General, and BIS has not indicated whether it intends to do so.

GAO’s Decision

• Planned rescission: not ripe for CRA review. The GAO accepted Commerce’s position that the planned rescission was not yet a final agency action ripe for CRA review, because Commerce had not undertaken the rulemaking steps required to formally rescind and replace the rule, which remains codified in the Code of Federal Regulations.
• Non-enforcement directive: a CRA-covered rule. Applying the Administrative Procedure Act definition of a rule incorporated by the CRA, the GAO concluded that the non-enforcement directive was an “agency statement of general or particular applicability and future effect” because Commerce directed enforcement personnel not to enforce the rule going forward as to all regulated parties.
• No CRA exception applies. The GAO rejected each of the CRA’s three exceptions, focusing principally on the third—rules of agency organization, procedure or practice that do not substantially affect non-agency parties. The GAO found that the directive “effectively sets aside the AI Diffusion Rule’s revisions to EAR, thereby suspending the licensing, reporting, compliance, and license-exception eligibility requirements the rule would otherwise impose on regulated parties.” Commerce’s own statement that its action would have a “significant positive impact on the marketplace and third parties” confirmed, in the GAO’s view, that the directive was substantive rather than merely procedural.

Practical Implications and Looking Ahead
Per the GAO’s decision, an across-the-board decision by BIS to not enforce a duly promulgated export-control rule can itself be a CRA-covered rule when it effectively suspends licensing, reporting, compliance and license-exception eligibility requirements.

Looking ahead, exporters and other parties dealing in advanced computing hardware and technologies can:

• Continue to evaluate transactions against AI Diffusion Rule for purposes of managing risk. The AI Diffusion Rule remains codified and legally in effect, and exporters of advanced computing integrated circuits and covered AI model weights in particular should continue to assess whether transactions are controlled under the AI Diffusion Rule in light of the unusual situation of the GAO ruling and BIS’s continued non-enforcement posture.
• Evaluate potential exposure on a risk basis. The continued effectiveness of the AI Diffusion Rule creates some questions in connection with export activity occurring after publication of the May 2025 press release and any new exports in light of the GAO ruling. While the Administration has not altered its stated non-enforcement posture and companies arguably would have relied on the BIS press release, given the five-year statute of limitations under the Export Control Reform Act, and the complications that could arise under General Prohibition 10, companies will face risk assessments for potential exposure until further government action settles the landscape.
• Monitor for formal rulemaking. BIS retains the ability to rescind or replace the framework through ordinary rulemaking. BIS may soon proceed with a formal rescission of the AI Diffusion Rule, which could revert the legal framework to the regulations in place immediately prior to the AI Diffusion Rule. The timing of any replacement rule remains to be seen, as does how such a rule might address past activity in light of the May 2025 press release and GAO ruling.

^{[1] This request letter is cited in Footnote 2 of the GAO decision. It is not publicly available.}