Getting Approved for NVEU (National Validated End User) Authorization
To get approved as an NVEU, companies have to go through a rigorous application process that will be reviewed by different U.S. government agencies. The company will need to send an application to the Bureau of Industry and Security (BIS) that includes a comprehensive list of information, as outlined in Supplement No. 8 to Part 748 of the IFR. Some of the key things the BIS want to know about are:
-
Any business connections the company has with government or military groups in places like China, etc.A
-
The company's plans for managing risks in your supply chain, especially to keep equipment from China, etc out of your data centers.
-
Details about the company's training on export rules and your overall compliance procedures.
-
How the company can make sure that any advanced computer equipment the company procures stays within the specific country you're authorized for.
-
The company will also need to commit to follow the rules in Supplement No. 10 to Part 748, which includes meeting certain security standards for your data centers.
-
It's important to know that the owner of the advanced computer equipment needs to apply. If the company that operates the equipment is different from the owner, then the operator also needs to get their own NVEU approval.
-
Being an NVEU is specific to one country. If the company wants to operate in other countries, the company will need separate NVEU authorizations.
-
A commitment to provide biannual reports
Getting authorized as an NVEU is more than just filling out an application form. In essence, the Framework for Diffusion of AI regulation subjects companies in Tier-2 countries to extra-territorial regulations and expects ongoing compliance with those regulations per biannual reports (and what's implied is the right for the U.S. to perform direct audits). So what the U.S. BIS (Bureau of Industry and Security) will expect in NVEU applications is the implementation and demonstration of a system of compliance controls that creates a "report" for the initial application and the ongoing use of the compliance system to generate the biannual reports.
There is no company management that doesn't cringe at the notion of another set of regulatory requirements and the drudgery of compliance systems and overhead. At Aiolian International, we strive to make that process as seamless and painlessly as possible. We have a structured approach to work with your departments to augment the company's existing operations processes with only what's necessary to achieve compliance.
Please contact us at Aiolian International and we can help you get started on planning for your NVEU application.