AI Export-Control Readiness Checklist

Export control is no longer only about physical shipments. For advanced technology companies, sensitive capability can move through AI tools, cloud environments, prompts, outputs, logs, customer demos, contractors and foreign-person access.

This checklist helps technical and commercial teams identify where their access-control architecture may create export-control exposure before it becomes urgent.

Who this is for

Deep-tech companies
Defence and dual-use startups
Aerospace and space companies
AI infrastructure, model and cloud teams
Semiconductor, photonics and advanced manufacturing teams
Companies preparing overseas customer demos, bids, pilots or fundraising

The 72-hour test

Could your team restrict access by user, country, customer, project and data class within 72 hours?

If not, the issue is not only legal awareness. It is system design.

1. Controlled technical data

Do we know which product data, source code, drawings, test results or model outputs may be controlled?
Do we know whether this is EU dual-use, military, EAR/ITAR-relevant, or customer-restricted?
Is this data labelled before it enters AI tools or shared workspaces?

2. AI tool usage

Are employees allowed to paste controlled technical data into external AI tools?
Are prompts, outputs, logs or embeddings retained by the provider?
Do we know where that data is stored and processed?

3. User and foreign-person access

Can we identify who has access by nationality, location, role and employer?
Do contractors, subsidiaries, customers or partners have access from other jurisdictions?
Can access be restricted by project or data class?

4. Demo and customer environments

Are demos separated from production or sensitive engineering data?
Can a customer trial reveal controlled capability?
Do we review export-control exposure before opening access to an overseas prospect?

5. Incident and revocation readiness

Who can revoke access immediately?
Can we disable access by country, customer, user group or project within 72 hours?
Do we have an audit trail showing who accessed what, when and from where?

6. Commercial readiness

Is export-control review part of sales qualification?
Are controlled-technology risks checked before bids, fundraising, partnerships or overseas pilots?
Do legal, engineering and sales share the same escalation path?

How to read your answers

If several answers are unclear, the risk is probably not the regulation itself. It is that your technical and commercial systems were not designed with export-control boundaries in mind.

Borie Consulting helps advanced technology companies turn export-control uncertainty into practical operating decisions before they export, bid or raise.

Talk to Borie Consulting

This checklist is a scoping tool. It is not legal advice.