Export-Controlled AI Chips: An R2 Recycler's Guide

Not long ago, the most valuable thing on a pallet of retired data center equipment was probably the memory. Today it may be the accelerator. When a hyperscaler or an AI startup decommissions a rack of GPU servers, the boards coming through your dock can carry resale value that dwarfs everything else on the truck, and a legal status that most electronics recyclers have never had to think about. Some of those chips are controlled under the Export Administration Regulations (EAR), and a recycler that sells or ships them without knowing that is taking on risk that no R2 certificate will absorb for you.

This guide walks through how an R2v3 facility should handle this material: what makes a chip controlled, where R2v3 touches the question, how to screen buyers, and what to do when the honest answer is that you should not resell the part at all. This is general compliance guidance and not legal advice for a specific transaction, and the control lists change often enough that you should always check the current text of the EAR on the eCFR and BIS's Federal Register notices before relying on anything below.

Why are AI accelerator chips export-controlled?

The U.S. Bureau of Industry and Security (BIS) regulates exports, reexports, and in-country transfers of certain advanced computing items under the EAR, 15 CFR Parts 730 through 774. The advanced computing controls began with an interim final rule published October 13, 2022 (87 FR 62186) and were substantially revised in a rule published October 25, 2023 (88 FR 73458). Both rules have been amended since, so confirm the current ECCN text on the eCFR rather than relying on the original Federal Register versions. Those rules created the ECCNs 3A090 (certain advanced integrated circuits) and 4A090 (computers and assemblies that contain them), and they define the covered chips by performance measures, chiefly total processing performance and performance density, instead of by brand or model name.

That detail matters for a recycler. Nobody is going to hand you a manifest that says "controlled item." You will receive a server, a baseboard, or a loose module, and someone in your organization has to determine whether the part inside falls under 3A090 or 4A090, or under some other entry on the Commerce Control List. The regulations have been amended several times since 2022, and BIS has also issued guidance and FAQs on the advanced computing rules, so any classification you rely on should be dated and documented.

A second point that is easy to miss: the EAR follows the item. It applies to items in the United States, to U.S.-origin items wherever they are, and to certain foreign-made items containing U.S.-origin content (15 CFR 734.3). Being a domestic recycler selling to a domestic broker does not take you outside the rules, because a sale that leads to an unauthorized reexport or transfer can still be a violation, and proceeding with a transaction when you know a violation is about to occur is separately prohibited (see General Prohibition Ten below).

Where does R2v3 come into this?

R2v3 does not contain a clause titled "AI chips," and you should be wary of anyone who says it does. What it does contain is a core requirement on legal and other requirements (check the clause number and exact wording against the current R2v3 standard), which obliges a certified facility to identify and comply with the legal requirements that apply to its operations, including those governing import and export. Export controls sit squarely inside that. If your legal requirements register has an entry for the Basel Convention and the EPA hazardous waste export rules but nothing for the EAR, an auditor who knows you handle data center equipment has every reason to ask why.

The standard also leans on traceability. Your throughput records, downstream due diligence, and chain of custody all need to hold together, and a high-value controlled component is exactly the sort of item where a gap in those records turns from an audit finding into a federal enforcement problem. The general import/export tracking obligations are covered in this article on R2 legal requirements for import and export regulations, and the points there carry over directly.

The cleanest way to frame the relationship is this: R2v3 requires you to have a functioning system for knowing your legal obligations and proving you followed them, and the EAR is one of the obligations that system has to catch.

How do you tell whether a chip is controlled?

Classification is the step everything else depends on, and it is the step recyclers most often skip. A workable approach has four parts.

Identify the part precisely. Record manufacturer, part number, module or board type, and serial number at receiving. A server labeled "GPU node" is not enough. You need to know what accelerator is actually installed, and whether the parts are the data center class devices the advanced computing rules were written for or consumer graphics cards. Do not assume consumer cards are out of scope: some have met the performance thresholds or been caught by the 3A090/4A090 provisions and notes, so classification must still be checked for every accelerator.

Get the classification from an authoritative source. The manufacturer's published export classification (many publish ECCNs for their products) is a good starting point, but the legal responsibility for the determination stays with the exporter. For anything ambiguous or high-value, you can request a formal classification from BIS under 15 CFR 748.3, or retain export counsel to make and document the call.

Check the license requirements for the destination. Classification alone does not tell you whether a license is needed. You read the ECCN's reasons for control against the Country Chart in Supplement No. 1 to Part 738, and then look at the license exceptions in Part 740 and any specific restrictions that apply to advanced computing items. Several of the advanced computing controls apply to a long list of destinations and some apply to transactions involving particular end users regardless of destination.

Record the determination. Date it, name who made it, and keep the sources. The recordkeeping rule in 15 CFR Part 762 generally requires you to keep export-related records for five years (762.6), and a classification memo is the first thing an investigator will ask for.

What do the customer and end-use controls add?

Even an uncontrolled part can be blocked by who is buying it. Part 744 imposes end-use and end-user restrictions, and several lists matter to a recycler. Each means something different in practice:

• Entity List (Supplement No. 4 to Part 744): a license is required for the items specified for each listed party, and license policy is often restrictive. Treat a match as a stop.
• Denied Persons List: these parties are barred from participating in export transactions, so dealing with them is prohibited.
• Unverified List: a due-diligence flag. BIS could not verify the party's end use, and additional documentation and license exception limits apply.
• Military End-User List: a license is required for specified items going to listed parties; treat a match as a stop pending license analysis.

Screening your buyers and their stated consignees against the Consolidated Screening List, which the International Trade Administration hosts and which consolidates these and other U.S. government lists, is a baseline for any facility that sells used equipment outside its own walls.

BIS's own Know Your Customer guidance and red flags appear in Supplement No. 3 to Part 732. Print that supplement and pin it in the sales office. A few of the red flags that fit the secondary market especially well:

• A buyer who is reluctant to say who the end user is or where the equipment is going
• Willingness to pay far above market price, or in cash, for hardware that has no obvious use for that buyer
• A freight forwarder listed as the final destination
• Routing through transshipment hubs that do not match the buyer's stated location
• Requests to strip labels, serial numbers, or packaging

If you see any of these around accelerator hardware, stop and escalate. General Prohibition Ten (15 CFR 736.2(b)(10)) bars proceeding with a transaction when you know that a violation has occurred or is about to occur, and "know" in the EAR includes awareness of a high probability, not just certainty. Looking away is not a defense.

What happens if you get it wrong?

The statutory penalties come from the Export Control Reform Act of 2018, 50 U.S.C. 4819. Criminal violations can carry fines up to $1,000,000 and imprisonment up to 20 years per violation. Civil penalties can reach the greater of a statutory amount or twice the value of the transaction; the statutory amount is adjusted for inflation every year, so check the current figure in 15 CFR 6.3 rather than relying on a number printed in an article. Because the transaction-value alternative scales with the goods, a pallet of high-value accelerators can produce very large exposure. BIS also has a voluntary self-disclosure process at 15 CFR 764.5, which can be a significant mitigating factor if you discover a problem yourself.

The practical point is this: the economics of this material tempt people into shortcuts, and the penalty structure was designed to make those shortcuts expensive.

How do the disposition options compare?

Not every route for an AI accelerator carries the same export risk. This table compares the common choices from the standpoint of a certified recycler.

The exposure ratings in the table are the author's general judgment, not a regulatory finding, and they will vary with the specific buyer, item, and destination. Destroying a controlled item that belongs to a customer may also require the owner's authorization or a contract clause covering it. Because reuse ranks above recycling in the R2 hierarchy, many recyclers feel pulled toward resale, but that pull should not override the legal analysis. If you cannot confirm a lawful, traceable path for a controlled part, responsible destruction is a defensible disposition, and in some cases it is the only one you can document.

How should receiving and inventory change?

Controlled accelerators need to be treated more like a regulated asset than like generic IT scrap, and that starts at the dock.

At receiving, capture serial numbers for accelerator modules and the host systems they ship in, and tag them into a segregated, access-controlled area. Your R2 throughput and inventory control requirements already push you toward lot-level tracking; for high-value accelerators, go to unit level, so that you can reconcile what came in against what left and prove nothing walked out the side door. Theft and diversion are as real a source of export violations as bad paperwork.

Use the same discipline on the paper side. A controlled-items register should link each unit to its classification, its screening results, its disposition decision, and its shipping record. Where a license exception or authorization is relied on, keep the supporting analysis with it.

A few practical habits:

1. Hold controlled items on a "pending classification" status until someone qualified has signed off.
2. Require a second person to approve any outbound release of an accelerator.
3. Refuse to ship to parties who cannot be screened, whatever the price.
4. Train sales and logistics staff on the Supplement No. 3 red flags at least annually, and document the training under your competence requirements.

What about data on the accelerators?

Accelerator-equipped servers still carry the same data security obligations as any other storage-bearing equipment. The accelerators themselves hold volatile memory and firmware rather than the user data that sits on attached SSDs, but the host system's drives, NVMe devices, and management controllers can hold model weights, training data, credentials, and customer information, and those are often the most sensitive items in the building. Your sanitization process has to cover them before any resale decision is made. For the details on verification and what auditors look for, see R2 technical data destruction requirements.

How should you prepare for the audit?

A certification body auditor is not going to expect you to be a BIS licensing specialist. They will expect to see that you identified export controls as an applicable legal requirement, assigned responsibility, built a process, and followed it. Have the following ready:

• Your legal requirements register, with the EAR and the relevant parts listed and a review date
• A written procedure for identifying and classifying controlled electronics, including accelerators
• Screening records for the buyers and consignees in your sample period
• A controlled-items register that reconciles to inventory
• Training records for staff in receiving, sales, and shipping
• Evidence of management review of export-control risk, since leadership should know the exposure exists

If you are building this from scratch, a pre-assessment gap analysis is a good place to start, and the overview at theR2consultant.com/r2v3/ will orient you to the standard itself.

How do you keep up with changing rules?

The control lists change, and a process built around checking the current rule before each controlled shipment will hold up better than one built on remembered thresholds. Concrete monitoring steps:

• Subscribe to BIS email updates and watch BIS's rules and Federal Register notices for changes to Parts 734 through 774.
• Set a Federal Register alert for the advanced computing ECCNs (3A090, 4A090).
• Re-check the Consolidated Screening List at each sale, not once per customer.
• Review the classification and legal requirements register on a set schedule and after any rule change, and record the review date.

Last updated: 2026-10-13. This article is general guidance and has not been reviewed by licensed export counsel. Have qualified export counsel review your procedures and any specific transaction before you rely on them.

Frequently Asked Questions

Does R2v3 specifically address AI accelerator chips?

No. R2v3 does not name AI chips, but Core Requirement 3 requires certified facilities to identify and comply with applicable legal requirements, including import and export laws. The Export Administration Regulations are one of those requirements, so controlled accelerators fall under your legal compliance and traceability obligations.

Which ECCNs apply to AI accelerator chips?

ECCN 3A090 covers certain advanced integrated circuits and 4A090 covers computers and assemblies containing them. These were introduced in a BIS rule published October 13, 2022 (87 FR 62186) and revised on October 25, 2023 (88 FR 73458). Because the rules have been amended since, confirm the current text on the eCFR and the manufacturer's published classification.

Can an R2 certified recycler resell used GPUs domestically?

Often yes, but the EAR still applies to reexports and in-country transfers. You should classify the part, screen the buyer against government restricted-party lists, obtain an end-use statement, and avoid brokers whose final destination you cannot verify. If you cannot document a lawful path, destruction with a certificate is a defensible alternative.

How long must export records be kept?

15 CFR 762.6 generally requires export-control records to be retained for five years from the latest of the export, reexport, or other termination of the transaction. Keep classification memos, screening results, and shipping records for at least that period.

What should I do if I discover I shipped a controlled item without authorization?

Stop further shipments of similar items, preserve all records, and consult export counsel promptly. BIS has a voluntary self-disclosure process at 15 CFR 764.5, and disclosure is considered a mitigating factor in enforcement decisions.