BIS Moved the UAE Up a Tier. The AI Chip Access Goes to a List of Names.

The published rule still has its placeholders in it. In the table of approved AI chip recipients in the UAE, the Federal Register column for each of the ten listed companies reads “91 FR [INSERT FR PAGE NUMBER]” [1]. The address column for G42 and Core42 says “[RESERVED]” [1].

That’s a small thing. The table is not. It is now the part of the Export Administration Regulations that decides who in the UAE can take delivery of advanced AI chips without a license, and it is a list of names.

What the UAE rule does

The Bureau of Industry and Security filed the rule on July 10, made it effective that day and published it on July 14 as 91 FR 43034 [1]. It does three things [1]:

• Takes the UAE out of Country Groups D:3 and D:4, the chemical and biological and missile technology groups. That opens more of the TMP, GOV, TSU, AVS, APR, ACE and BAG license exceptions for CB- and MT-controlled items, and drops the missile end-use restrictions in section 744.3 [1].
• Adds the UAE to Country Group A:5, which normally brings License Exception STA (Strategic Trade Authorization). A new section 740.2(a)(26) limits STA in the UAE to transactions where the ultimate consignee and all end users are on a new Supplement No. 8 to part 740 [1].
• Keeps the advanced computing license requirement for the UAE, except for approved entities in that supplement [1].

Supplement No. 8 has three tiers [1]. UAE government agencies, including the Ministry of Defense and Armed Forces, get both license-free advanced computing items and full STA, but not state-owned corporations or agency contractors and grantees. G42 (including G42 Cloud Technology LLC) and Core42 get the advanced computing items only, and that approval “shall automatically expire on April 6, 2027” absent further notice. The rule says the two need to “become U.S. companies” by then or go back through the approval process.

The third tier is eight U.S. companies and their subsidiaries, approved for both: Amazon, Apple, Google, Meta, Microsoft, OpenAI Group PBC, Oracle and X.AI [1]. BIS says that lets them receive items like thermal imaging cameras “to enable data center buildouts in the UAE” [1].

MGX, the UAE-headquartered investment company, isn’t on the list. BIS says it “intends to favorably review” MGX’s license applications for semiconductors and servers [1].

Why the UAE chip license was hard to read in the first place

If you’ve followed chip controls since 2025, the license requirement here takes some untangling.

The January 2025 AI Diffusion Rule created a worldwide license requirement for the top-end “.a” chips and computers, ECCNs 3A090.a and 4A090.a [2]. In May 2025, BIS said it would not enforce that rule and promised a replacement [3]. The worldwide requirement stayed in the regulation text. What changed was enforcement: per the July rule, BIS enforces it only for Country Groups D:1, D:4 and D:5 (minus anything also in A:5 or A:6), and for companies headquartered in D:5 or Macau wherever they are [1]. The May 31, 2026 guidance confirmed that last piece, which dates to November 2023 [2].

So moving the UAE out of D:4 and into A:5 would, on that enforcement policy alone, have freed AI chip exports to anyone there. The rule says BIS will keep enforcing for the UAE anyway, except for listed recipients [1]. For the lower “.b” tier, BIS rewrote section 742.6(a)(6)(iii)(B) to name the UAE in the regulation directly [1].

Put plainly: a license requirement that is written as worldwide but enforced selectively under two guidance documents now has a country-specific exception to the non-enforcement policy. Skadden’s alert reads it the same way: the tier upgrade does not free up chip exports on its own, and every party, “not just the purchaser,” has to be listed for the treatment claimed [4].

How the UAE approved list works if you’re not on it

You don’t have to be listed to be the purchaser or an intermediate consignee [1]. You do have to be listed to be the ultimate consignee or an end user. A UAE company, or a U.S.-headquartered AI company operating there, asks for a BIS advisory opinion under section 748.3(c) [1]. The Commerce secretary, consulting State and the national security adviser, decides within 30 days whether to approve and for what, chips, STA or both [1]. BIS notifies the requester within 5 days and then starts adding it to the supplement [1]. Approval is “case-by-case,” including on “the applicant’s compliance capabilities and track record” [1].

Two caveats in the text. Listing does not override the end-use and end-user requirements in part 744 [1]. And for STA, the approval extends to deemed exports and deemed reexports to UAE nationals, which matters if you’re staffing a facility there [1].

What it means if you build things

My opinions from here.

If you want GPUs in the UAE, you probably rent them. The list names the companies that run the clouds. A startup that wants compute in the region now has a clear path: use a listed provider’s UAE subsidiary, and the hardware question becomes the provider’s problem. Owning the racks yourself means an advisory opinion and a 30-day wait, and a big part of the test is your compliance track record [1]. That’s a fair thing to ask for. It is also something a 40-person company has less of on paper than Microsoft does.

The rule says nothing about remote access. Supplement No. 8 is about who receives the items [1]. It doesn’t say whether a non-listed company running workloads on a listed provider’s chips in Abu Dhabi has any obligation. I’d read the silence as leaving the remote-access analysis where it was before July 10, but I wouldn’t bet a contract on it. Back in June, Commerce used a deemed-export theory against model API access that nobody saw coming. Ask your provider what they’ve told BIS.

Process. ECRA lets BIS skip notice and comment, and it did [1]. That’s lawful. But this rule writes named private companies into the regulations, with a sunset for two of them, and the reasoning is a page of foreign policy background. The paperwork estimate is that about 50 fewer license applications a year will save 25 burden hours and $950 [1]. That number tells you who this rule is for. It is not tuned for the long tail of exporters.

Legibility. The core requirement now sits across the regulation text, the July rule’s preamble and two guidance documents a year apart [1, 2, 3]. Large exporters have people who track that. Small ones read section 742.6, see a worldwide license requirement, and either over-comply or call a lawyer.

Not everyone likes the substance. EnterpriseAM reports that Sen. Elizabeth Warren objected to G42’s license-free access and the MGX treatment “despite reported concerns” about diversion to China, while UAE Ambassador Yousef Al Otaiba said the move “opens new doors” [5]. EnterpriseAM also notes the two countries’ planned 5 GW data center complex in Abu Dhabi, part of a $200 billion investment agreement [5]. Its own summary of the rule: “This is not a blanket free-for-all” [5].

What I’m watching

• The first additions to Supplement No. 8. The 30-day clock means the first advisory opinions could be decided by mid-August if requests went in right away [1]. Who gets added, and whether any are smaller U.S. companies, will show whether the list is a door or a fence.
• April 6, 2027. G42 and Core42’s approval lapses that day absent BIS notice, and the rule ties their status to becoming U.S. companies [1]. Nothing in the rule defines what that means.
• A correction notice. The table still says “[INSERT FR PAGE NUMBER],” and the approval dates differ between tiers: July 10 for G42 and Core42, July 14 for the U.S. companies [1]. If you’re citing your authority in export records, you’ll want the corrected cite.