GPU server export controls: how to ship AI servers abroad legally

GPU server export controls are the US rules that decide whether a server built around advanced accelerators can leave the factory, reach a given country and be used by a given customer. Before shipping, confirm the ECCN of every item, screen the end user and its ultimate parent, and check whether a license is needed.

Most companies meet these rules late. The purchase order is signed, the data center has a go-live date, and then the seller asks for an end-user statement, a description of who will access the compute and the name of the parent company of the buyer. If nobody prepared those answers, the servers wait at the factory or, worse, leave without the right authorization and become a problem for everyone whose name is on the paperwork.

This guide explains how export controls apply to GPU servers in 2026, how to tell whether a shipment needs a license, what end-user checks look like in practice, and how the exporter and the Importer of Record split the work when the hardware goes to Argentina, Brazil, the United States, the European Union or Uruguay.

What are GPU server export controls, and why do they follow the hardware?

GPU server export controls are the parts of the US Export Administration Regulations (EAR) that cover advanced computing chips and the computers that contain them. They apply to the item, not to the seller, so they follow US-origin chips and many foreign-made products through every export, re-export and transfer until the hardware reaches its final user.

The starting point is the Export Control Classification Number, or ECCN. High-end data center accelerators are usually classified under ECCN 3A090, and servers and other computers that contain them under ECCN 4A090. Less capable GPUs often fall under 3A991, and networking cards or appliances with strong encryption can bring ECCN 5A002 into the same order. One rack can therefore carry three or four different classifications, each with its own rules.

The second point is reach. The EAR does not stop at the US border. A server assembled in Taiwan or Mexico with US-origin accelerators, or produced abroad with certain US technology, can still be subject to US rules when it is shipped to a third country. The same applies when the buyer later moves the equipment to another country or sells it to someone else. That is why a seller in Asia may ask a Brazilian buyer the same questions as a seller in California.

For importers, the practical lesson is that export controls are a condition of the sale, not a customs formality at destination. If you want the wider context of how GPU hardware moves across borders, our guide on how to import AI servers covers the import side, taxes and the role of the Importer of Record in more detail.

Does your GPU server shipment need an export license?

It depends on three things: the item's ECCN, the destination country and the end user, including where that end user's ultimate parent is headquartered. A shipment to a country with no license requirement can still need one if the buyer belongs to a group headquartered in a restricted jurisdiction.

The rules have moved quickly. In May 2025, the Bureau of Industry and Security (BIS) announced it would not enforce the AI Diffusion Rule published in January 2025 and would replace it, and as of mid-2026 no replacement rule had been issued. In January 2026, BIS revised its license review policy for certain advanced computing commodities going to China and Macau, moving some chips below defined thresholds to case-by-case review. In July 2026, the rule on Enhanced Favorable Treatment for the United Arab Emirates created a list of approved UAE entities that can receive advanced computing items without a license, while everyone else in that country still needs one.

The most important recent clarification came on May 31, 2026, when BIS published its guidance on license requirements for advanced computing items. It confirms that a license is required to export these items to entities headquartered in Country Group D:5, which includes China, or in Macau, and to entities whose ultimate parent is headquartered there, even when the entity itself sits somewhere else. BIS also said that the non-enforcement policy announced in 2025 does not cover those transactions.

For the destinations we serve, this has a clear consequence. Under the policy BIS applies today, a shipment to a customer in Brazil, Argentina, Uruguay or most of the European Union is usually not blocked by the destination alone. The question is who the customer really is. A colocation provider in São Paulo owned by a group headquartered in a D:5 country, or a Uruguayan subsidiary whose ultimate parent sits in Macau, can turn an ordinary shipment into one that needs a license. Exporters therefore look past the consignee on the invoice to the ownership chain behind it.

Who is the end user, and how deep does the check go?

The end user is the party that will actually use the GPU servers, which is not always the buyer or the consignee. Sellers of high-end systems now check the end user's identity, ownership, headquarters, location of the hardware and, increasingly, who will access the compute remotely.

In practice, the check usually starts with an end-user statement signed by the customer. It names the end user, the address of the data center, the intended use, and a commitment not to re-export or transfer the equipment without authorization. Many sellers add questions about the corporate group, the ultimate parent and the main cloud customers who will rent capacity on the cluster. Some ask for site photos or a visit before shipping.

Screening is the other half. Exporters run every party against the Entity List, the Specially Designated Nationals (SDN) List of the Office of Foreign Assets Control, including its 50 percent ownership rule, and other US restricted party lists. The parties include the buyer, the consignee, the end user, the freight forwarder and, increasingly, the Importer of Record at destination. A refusal to answer an ownership question, an end-user address that is a small office instead of a data center, or a request to split the order across several consignees are typical red flags that stop a sale.

For the importer, this is where preparation pays off. When the end-user statement, the commercial invoice, the packing list with serial numbers and the import declaration all tell the same story, the export side and the import side reinforce each other. When they contradict each other, the shipment invites questions from both governments.

Who does what: the exporter or the Importer of Record?

The exporter owns the export side: classification, licenses, export filings and the end-user screening the US rules require. The Importer of Record owns the import side at destination: the customs declaration, duties and taxes, and local approvals. Each needs documents from the other, so the work has to be planned together.

This split is often misunderstood. An Importer of Record cannot obtain a US export license on the seller's behalf, and an exporter cannot clear goods through customs in Brazil or Argentina without a local importer. If the role of the IOR is new to you, our explanation of what an Importer of Record is covers the basics. The table below shows how responsibilities usually fall on a GPU server shipment.

On Electronic Export Information, the general rule for exports from the United States is that it must be filed through the Automated Export System when the value per Schedule B number exceeds 2,500 US dollars or when a license is required. GPU servers exceed that value in almost every case, so the filing is part of the normal routine, and its data should match the commercial invoice used at destination.

How do the five destinations fit into the picture?

Each destination adds its own import requirements on top of the export controls. The export checks are almost the same whether the servers go to Miami or Montevideo; what changes is who can import, which approvals apply and how the equipment can move after arrival.

In the United States, export controls mostly matter for servers leaving the country, but importers also deal with US rules on the way in, such as the Section 232 duty on certain advanced semiconductors imposed by Proclamation 11002 of January 2026, which excludes uses such as US data centers. Foreign companies that want to act as importer in their own name face stricter conditions in 2026, which we cover in our guide to the Importer of Record USA.

In Brazil, the importer must be a local company qualified in Siscomex, and any item with radio or telecom functions needs Anatel homologation. Our guide on how to import IT equipment into Brazil explains the Radar qualification, the tax cascade and the rules on used servers. Argentina requires an importer registered with a CUIT and, for telecom-related items, attention to the ENACOM rules updated in 2026. In the European Union, a non-EU company needs an EORI number or an indirect customs representative, pays import VAT in the member state of entry, and must remember that the EU has its own dual-use regime, Regulation (EU) 2021/821, which applies if the servers later leave the Union. Uruguay is often chosen as a regional hub, and a free trade zone can hold equipment that will serve several countries, but every onward shipment from the zone is a new re-export under the US rules.

What happens if the servers are moved, resold or rented out later?

The obligations do not end at delivery. Moving GPU servers to another country, selling them to a different user or changing how they are used can each require new authorization, and the original end-user statement usually forbids doing so without the seller's consent.

Three situations come up often. The first is relocation: a company buys servers for a site in Uruguay and later decides to move half of them to Argentina. That is a re-export of items subject to the EAR, and it has to be checked like a new export. The second is resale: refurbished GPU servers are traded actively, and a reseller that does not know the original ECCN or the history of the equipment can end up shipping controlled items to a party that needs a license. The third is remote access. Under the May 31, 2026 guidance, bona fide data center operators acting consistently with the EAR do not need to stop ongoing use, storage or servicing of these items until further notice from BIS, but renting capacity to customers headquartered in restricted jurisdictions is exactly the area where future rules are expected.

For an importer, the safe habit is to keep the export classification, the end-user statement and the serial numbers in the same file as the import declaration. When the equipment moves again, that file is what lets the next exporter answer the questions quickly.

What does it cost to get GPU export controls wrong?

Much more than the shipment. Under the Export Control Reform Act, civil penalties can reach the greater of an inflation-adjusted amount per violation, currently above 370,000 US dollars, or twice the value of the transaction, and criminal cases can lead to fines of up to 1 million US dollars and prison terms for individuals.

Penalties are only part of the cost. A company found to have diverted controlled chips can be added to the Entity List, which cuts it off from US-origin technology and makes its suppliers wary of dealing with it. Shipments under review can sit for weeks while lawyers on both sides exchange documents. And because the rules look at the whole chain, a forwarder, a trading company or an Importer of Record that ignored obvious red flags can share the consequences. That is why serious IOR providers ask for the same export documents that sellers do: it protects the importer as much as the customer.

What should you check before booking freight?

Check the classification, the parties, the license status and the import requirements before the freight is booked, not after the servers are packed. The order below reflects what we see work on high-value GPU projects.

1. Ask the manufacturer or seller for the ECCN of every item on the order, including GPUs, servers, network cards, switches and optics.
2. Identify every party: buyer, consignee, end user, ultimate parent, forwarder and Importer of Record, with full legal names and addresses.
3. Confirm whether any party is headquartered, or has an ultimate parent headquartered, in Country Group D:5 or Macau, and screen all parties against the US restricted lists.
4. Prepare the end-user statement with the real data center address, the intended use and the commitment on re-exports and transfers.
5. Let the exporter decide whether a license or a license exception applies, and wait for written confirmation before shipping.
6. In parallel, confirm the import side: who will be Importer of Record, local approvals, duties and taxes, and the documents customs will ask for.

When does an Importer of Record help with GPU clusters?

An Importer of Record helps when the servers must arrive in a country where you or your customer have no import structure, and when the project cannot afford a mismatch between the export and import documents. The IOR takes the import role and works with the exporter so that both sides of the file agree.

That situation is common in AI infrastructure. A US hardware vendor wins a cluster for a cloud provider in Brazil that has never imported directly. An integrator needs to deliver racks to a colocation site in Argentina before its local subsidiary exists. A European company tests demand for GPU capacity in Uruguay before committing to an entity. In each case, the exporter still owns the export controls, and the Importer of Record makes sure the import declaration, the end-user information and the local approvals line up with what was declared on the way out.

If you are planning a GPU cluster or a batch of AI servers for Argentina, Brazil, the United States, the European Union or Uruguay, talk to Comex IOR Services about IOR services for GPU clusters. Tell us what you are shipping, who the end user is and when the hardware has to be running, and we will tell you plainly which structure makes sense and what it would take.