U.S. Department of Commerce, Bureau of Industry and Security—Applicability of the Congressional Review Act to the Rescission of the Artificial Intelligence Diffusion Rule

Decision

Matter of: U.S. Department of Commerce, Bureau of Industry and Security—Applicability of the Congressional Review Act to the Rescission of the Artificial Intelligence Diffusion Rule

File: B-337935

Date: May 12, 2026

DIGEST

The U.S. Department of Commerce, Bureau of Industry and Security (Commerce) issued a press release titled Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule, Strengthens Chip-Related Export Controls (Press Release). The Press Release announced the non-enforcement of the AI Diffusion rule. The Press Release also announced the planned rescission of the Framework for Artificial Intelligence Diffusion rule (AI Diffusion rule).

The Congressional Review Act (CRA) requires that before a rule can take effect, an agency must submit the rule to both the House of Representatives and the Senate, as well as the Comptroller General. CRA adopts the definition of rule under the Administrative Procedure Act (APA) but excludes certain categories of rules from coverage.

As of the date of the Press Release, Commerce announced a non-enforcement policy that applies to all parties otherwise subject to the AI Diffusion Rule. As such, Commerce's non-enforcement policy is generally applicable, operates prospectively, and implements agency policy. We conclude that the non-enforcement policy announcement in the Press Releases falls within APA's definition of a rule, and that no CRA exception applies. Therefore, the Press Release is a rule subject to CRA's submission requirements.

DECISION

On May 13, 2025, the U.S. Department of Commerce, Bureau of Industry and Security (Commerce), issued a press release titled Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule, Strengthens Chip-Related Export Controls (Press Release).0F[1] We received a request for a decision about whether rescission of the AI Diffusion rule announced in the Press Release is a rule for purposes of the Congressional Review Act (CRA).1F[2] As discussed below, we conclude that the Press Release is a rule for purposes of CRA.

Our practice when issuing decisions is to obtain the legal views of the relevant agency on the subject of the request.2F[3] Accordingly, we reached out to Commerce to obtain its views.3F[4] We received Commerce's response on January 30, 2026.4F[5]

BACKGROUND

Export Control Reform Act of 2018

To protect national security and support U.S. foreign policy and economic objectives, the Export Control Reform Act of 2018 (ECRA)5F[6] authorizes the President to regulate exports of technologies and other items as well as certain high-risk activities of U.S. persons.6F[7] ECRA also provides that the President shall carry out these authorities primarily through Commerce.7F[8] Commerce administers and enforces export controls on specified items and activities through its Export Administration Regulations (EAR).8F[9]

Under ECRA, Commerce is authorized to establish and maintain the Commerce Control List (CCL).9F[10] The CCL identifies items subject to export, reexport, and in-country transfer controls.10F[11] ECRA also authorizes Commerce to require licenses for the export, reexport, or transfer of controlled items.11F[12] Lastly, Commerce holds exclusive responsibility for investigating and enforcing criminal and civil violations of ECRA and EAR.12F[13]

AI Diffusion Rule

On January 15, 2025, Commerce issued an interim final rule titled Framework for Artificial Intelligence Diffusion (AI Diffusion Rule).13F[14] The rule took effect on January 13, 2025, and established a separate compliance date of May 15, 2025, with certain provisions having a delayed compliance date of January 15, 2026.14F[15] The AI Diffusion Rule establishes a regulatory framework to control the global proliferation of advanced Artificial Intelligence (AI) by requiring licenses for the export, reexport, or in-country transfer of advanced computing integrated circuits and the model weights15F[16] of the most advanced AI models.16F[17]

More specifically, the AI Diffusion Rule added a new control for AI model weights; revised license requirements and its review policy for advance integrated circuits and other related items; expanded upon or added to licensing exceptions; added red‑flag guidance for AI model weights; and updated its Data Center Validated End User authorization to facilitate exports of advanced computing items to destinations that do not raise national security or foreign-policy concerns.17F[18]

Press Release

Before the May 15, 2025, compliance date for the AI Diffusion Rule, Commerce issued its Press Release in two formats: a webpage version released on May 13, 2025, and a portable document format (PDF) version dated May 12, 2025, accessible via a link on the webpage version.18F[19] Commerce announced that enforcement officials were instructed not to enforce the AI Diffusion Rule, because it represented “ill-conceived and counterproductive” policies.19F[20] Commerce explained that its actions were done to “ensure that the United States will remain at the forefront of AI innovation and maintain global AI dominance.”20F[21]

In the two documents, Commerce also referred to a rescission of the AI Diffusion Rule. Although the two versions are substantively similar, they contain a subtle difference in wording with respect to whether the rescission is described as “announced” or “initiated.”21F[22] Specifically, the May 13, 2025, webpage version states that Commerce “announced” a rescission of the rule while the May 12, 2025, PDF version states that Commerce “initiated” a rescission of the rule. In its response to our development letter, Commerce explained that it has initiated a rescission of the AI Diffusion Rule, which announced the beginning of the rulemaking process, and that it is not a final agency action.22F[23]

Accordingly, through its Press Release, Commerce announced that it had initiated a rescission of the AI Diffusion Rule and that it planned to publish a regulation to formalize the rescission and issue a replacement rule in the future.23F[24] Commerce further explained that until the rulemaking process is complete, the AI Diffusion Framework remains in the Code of Federal Regulations.24F[25] As explained more fully below, we find that this announcement does not constitute a final action that is ripe for review under the CRA. And as discussed further below, this decision examines Commerce's non‑enforcement policy for the AI Diffusion Rule under the CRA.25F[26]

Congressional Review Act

CRA, enacted in 1996 to strengthen congressional oversight of agency rulemaking, requires federal agencies to submit a report on each new rule to both houses of Congress and to the Comptroller General for review before a rule can take effect.26F[27] The report must contain a copy of the rule, “a concise general statement relating to the rule,” and the rule's proposed effective date.27F[28] CRA allows Congress to review and disapprove rules issued by federal agencies for a period of 60 days using special procedures.28F[29] If a resolution of disapproval is enacted, then the new rule has no force or effect.29F[30]

CRA adopts the definition of a rule under the Administrative Procedure Act (APA), which states that a rule is “the whole or a part of an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy or describing the organization, procedure, or practice requirements of an agency.”30F[31] However, CRA excludes three categories of rules from coverage:

(1) rules of particular applicability; (2) rules relating to agency management or personnel; and (3) rules of agency organization, procedure, or practice that do not substantially affect the rights or obligations of non-agency parties.31F[32]

DISCUSSION

At issue here is whether Commerce's Press Release meets CRA's definition of a rule, which adopts APA's definition of a rule, with three exceptions. As explained below, we conclude that it does and that no exceptions apply. Consequently, the Press Release is subject to review under CRA.

The Press Release is a Rule under APA

Applying APA's definition of a rule, the Press Release meets all of the required elements. First, the Press Release is an agency statement as it was issued by Commerce, a federal agency. Although ECRA vests export control authority in the President, it directs that such authority be carried out through Commerce.32F[33] Here Commerce did not act as a mere conduit for presidential action but exercised its express statutory authority in announcing its regulatory and enforcement policy and practice.33F[34] Accordingly, the Press Release is an agency statement.

Second, the Press Release is a rule of general applicability and future effect. Here the Press Release applies to all regulated parties, thus it is generally applicable. Also, an agency's action is of future effect when it addresses policy considerations for the future rather than evaluating past or present conduct.34F[35] Here, the Press Release satisfies this element because, as of the date of its issuance, it informed regulated entities and other interested parties that Commerce had adopted a non-enforcement policy for the AI Diffusion Rule.35F[36]

Lastly, the Press Release implements policy and describes agency organization, procedure, and practice. An agency statement implements, interprets, or prescribes law or policy when the action issues new regulations, changes regulatory requirements or official policy, or alters how the agency will exercise its discretion, among other things.36F[37] Here, the Press Release announces that the agency will forbear from exercising its enforcement discretion with respect to the AI Diffusion Rule by adopting a blanket non-enforcement policy toward the rule.37F[38] In addition, Commerce also announced that it was planning to rescind the AI Diffusion Rule.38F[39] Commerce explained its actions as a change in policy, that is a significant departure from the prior Administration's “ill-conceived” policies.39F[40]

Additionally, an agency statement describes agency organization, procedure, or practice requirements when the statement discusses the internal operations of an agency, including statements that govern the conduct of agency proceedings.40F[41]  The Press Release stated that a Commerce official directed staff not to enforce the AI Diffusion Rule—a matter of internal agency operations and practice. Accordingly, the Press Release is a statement of agency organization, procedure, or practice. Having satisfied all the required elements, the Press Release meets APA's definition of a rule.

Commerce Response

In its response to us, Commerce asserted that the Press Release is not a rule under CRA because it is not a final agency action; rather, it is an initial step before the regulatory framework is finalized.41F[42] Commerce argues that the two-part finality test applied by the D.C. Circuit Court governs whether an agency action is a final agency action subject to CRA.42F[43] In Soundboard Ass'n v. FTC, 888 F.3d 1261 (D.C. Cir. 2018), the Court addressed when an agency action is “final” for purposes of judicial review under APA, not when an action constitutes a rule for purposes of congressional oversight.43F[44] Under that test, an action is final only if it marks the consummation of the agency's decision‑making process and determines rights or obligations or produces legal consequences.44F[45] As we explained in B-238859, Oct. 23, 2017, judicial precedent regarding the ripeness of a party's right to bring suit is "inapposite for CRA purposes," because the issue at hand is the exercise of Congress's oversight procedures over agency rules, not a private party's standing to challenge administrative action in court.

Relevant here, our prior decisions illustrate how we distinguish between interim steps and final agency actions for CRA purposes. In B-336146, May 28, 2024, the National Institute of Standards and Technology issued a notice in the Federal Register requesting public comment on draft guidance and planned to use the feedback it received to develop the final version of the guidance document. We concluded that the draft guidance was not a rule because the agency sought public comment and planned to revise the document before issuing final guidance.45F[46] Additionally, we found that the draft guidance did not alter the rights or obligations of regulated parties, rather, it represented an interim step that, in its current draft form, broke no new ground.46F[47]

By contrast in B-335175, May 6, 2024, Commerce argued that a notice of funding opportunity (NOFO) was not a final agency action and therefore not subject to the CRA, asserting that only the later adjudication of individual applications constituted final agency action. We disagreed. We explained that the NOFO itself represented Commerce's final determination of the overall application process and evaluation criteria, and that any subsequent adjudications were distinct agency actions undertaken pursuant to the NOFO's procedures.47F[48]

Commerce maintains that the Press Release merely announces the beginning of a rulemaking process to formally rescind and replace the AI Diffusion Rule.48F[49] There are various steps that Commerce would need to take in order to rescind and replace the AI Diffusion Rule.49F[50] Commerce has explained it has not taken those steps, and we are not aware that any have been taken.50F[51] Therefore, we find that the planned rescission of the AI Diffusion Rule is not a final agency action that is ripe for review under the CRA.

We turn to the other subject in the Press Release where Commerce announced that it will not enforce the AI Diffusion Rule even though the AI Diffusion Rule remains legally in effect until Commerce completes its planned rulemaking to rescind it.51F[52] Commerce's Press Release stated that enforcement personnel were instructed not to enforce the AI Diffusion Rule and describes the Rule's requirements in the past tense, as obligations and rights that no longer operate in practice.52F[53] Because Commerce is operating as if the rule were already rescinded by applying a categorical non-enforcement policy, our analysis focuses on whether the agency's announced non‑enforcement policy constitutes a rule under CRA.

Pertinent here, Commerce maintains that its announced enforcement policy is not a final agency action, arguing that it merely informs the public about how it intends to exercise its internal enforcement discretion.53F[54] We disagree. Our analysis in B‑336146, May 28, 2024, is instructive here. Unlike the action at issue there, Commerce's non-enforcement policy does not bear the hallmarks of an interim step in an ongoing process, such as a request for comment on proposed guidance or a proposed rule.54F[55] The Press Release is a definitive announcement that Commerce has directed its enforcement personnel not to enforce the AI Diffusion Rule. Commerce has identified no procedural mechanism, whether notice‑and‑comment, draft guidance, or any other step, within which this directive operates. In the absence of any such process, the announcement of Commerce's nonenforcement directive in the Press Release cannot be viewed as preliminary. Accordingly, the Press Release is a final determination regarding the agency's enforcement policy.

CRA Exceptions

We must next determine whether any of CRA's three exceptions apply. CRA provides for three types of rules that are not subject to its requirements: (1) rules of particular applicability; (2) rules relating to agency management or personnel; and (3) rules of agency organization, procedure, or practice that do not substantially affect the rights or obligations of non-agency parties.55F[56]

(1) Rule of Particular Applicability

We have explained that rules of particular applicability are those rules that are addressed to an identified entity and also address actions that entity may or may not take, taking into account facts and circumstances specific to that entity.56F[57] The Press Release is not limited to a single person or entity as it announces policy changes and guidance that apply broadly to all parties subject to EAR, rather than to any specifically identified individuals or entities.57F[58]

(1) Rule of Agency Management or Personnel

The Press Release is not a rule of agency management or personnel. We have previously found that rules that fall into this category relate to purely internal agency matters.58F[59] These include rules related to controlling, directing, or supervising internal management issues, as well as those related to personnel issues like communications between employees and managers, leave, or benefits.59F[60] Because the Press Release primarily focuses on regulatory relief for industry it does not fall into this exception.

(3) Rule of Agency Organization, Procedure, or Practice that Does Not Substantially Affect Non-Agency Parties

Lastly, the Press Release is not a rule of agency organization, procedure, or practice that does not substantially affect the rights or obligations of non‑agency parties.60F[61] CRA's third exception was modeled on a similar APA exception, which excludes “rules of agency organization, procedure, or practice” from notice‑and‑comment requirements.61F[62] Accordingly, we look to APA case law concerning this exception for guidance.62F[63] Some courts have explained that the purpose of the APA exception is to ensure “that agencies retain latitude in organizing their internal operations,” but only where such rules do not have a “substantial impact” on non‑agency parties.63F[64]

As an initial matter, we must first determine whether the Press Release is a rule of agency organization, procedure, or practice. Rules of agency organization, procedure, or practice are limited to an agency's methods of operation or how the agency organizes its internal operations, including the way that regulated entities submit information to an agency, how the agency reviews that information, and rules that affect the type or timing of actions the agency will take based on that submission.64F[65] We have only applied this exception to rules that primarily focus on the internal operations of an agency.65F[66]

For example, in B‑329926, Sept. 10, 2018, we found that updates to a Social Security Administration (SSA) hearing manual governing SSA adjudicators' use of information from the internet qualified as a rule of agency organization, procedure, or practice. There, the manual outlined procedures for SSA employees to follow in processing and adjudicating benefits claims.66F[67] Because the manual was directed to and binding only on SSA officials without imposing new burdens on claimants, we concluded that the manual met CRA's third exception.67F[68]

The Press Release concerns a change in agency policy and practice regarding enforcement of the AI Diffusion Rule. Accordingly, it constitutes a rule of agency organization, procedure, or practice. However, the Press Release is not primarily concerned with internal agency operations. Commerce explains that its recent actions were necessary to protect industry from the AI Diffusion Rule's harmful effects and to ensure continued U.S. leadership in AI innovation.

Rather than serving as a mechanism for internal quality‑control or resource allocation, the non-enforcement of the AI Diffusion Rule directly affects licensing and the regulatory treatment of AI model weights and hardware for non‑agency parties. Therefore, the analysis turns to whether this change substantially affects the rights or obligations of non‑agency parties.

When analyzing this aspect of CRA's third exception, “the critical question is whether the agency action alters the rights or interests of the regulated entities.”68F[69] Along similar lines, courts have determined that “[a]n agency rule that modifies substantive rights and interests can only be nominally procedural, and the exemption for such rules of agency procedure cannot apply.”69F[70]

For example, we have previously concluded that statements that encourage regulated entities to alter internal operations or policies have a substantial impact on non-agency parties.70F[71] In B‑331560, Apr. 16, 2020, and B‑330843, Oct. 22, 2019, we concluded that certain Federal Reserve supervisory letters set forth supervisory expectations that shaped the internal operations of regulated entities and therefore had a substantial impact on the regulated community.71F[72]

In another example, B‑337673, Jan. 16, 2026, the National Credit Union Administration (NCUA) announced, in a press statement, that certain federally insured credit unions would no longer be required to report overdraft and non‑sufficient funds (NSF) fee income, thereby eliminating a mandatory disclosure obligation. NCUA's press statement indicated that the withdrawal of the reporting requirement was intended to encourage credit unions to use overdraft and NSF fees when appropriate, which also affects the non-agency parties who would be subject to the imposition of such fees.72F[73] We concluded that the withdrawal of the reporting requirements altered the rights or obligations of affected credit unions as it encouraged regulated entities to modify their operations.73F[74]

The Press Release is analogous to the action at issue in our NCUA decision, where we found that withdrawing a reporting requirement for non-agency parties constituted a substantive change with a substantial impact on non-agency parties.

Although the AI Diffusion Rule remains in effect, Commerce has directed its personnel not to enforce it and is operating as though the rule has been rescinded, such that the rights and obligations created by the rule no longer function in practice. The non‑enforcement directive effectively sets aside the AI Diffusion Rule's revisions to EAR, thereby suspending the licensing, reporting, compliance, and license‑exception eligibility requirements the rule would otherwise impose on regulated parties.74F[75]

More specifically, the AI Diffusion Rule would have required authorization for exports, reexports, and in‑country transfers of newly controlled AI model weights.75F[76] It would also have required regulated parties to obtain licenses for transactions involving specified advanced‑computing integrated circuits and added provisions regarding foreign‑produced items subject to EAR.76F[77] In addition, the rule would have required regulated parties to treat certain training of controlled models as a red‑flag diversion risk and to verify whether the resulting model weights could be exported to a destination requiring a license.77F[78] Lastly the rule would have provided newly created license exceptions.78F[79]

Commerce asserts that the Press Release is analogous to a separate line of GAO decisions—specifically B‑330190, Dec. 19, 2018, and B‑334045, July 5, 2023.79F[80] These decisions involved the manner in which an agency exercises its enforcement discretion within the bounds of the law through prioritization schemes or other procedural mechanisms and are distinguishable from the approach taken by Commerce here.

For instance, in B‑330190, Dec. 19, 2018, we considered a Department of Justice (DOJ) memorandum adopting a “zero‑tolerance” policy for prosecuting individuals who violated the law by entering the country illegally.80F[81] Although the memorandum noted that previous administrations did not prosecute individuals who entered the country illegally under the relevant statutory provision, the statute authorized civil and criminal penalties including fines and imprisonment.81F[82] We concluded that the rights and obligations in question were prescribed by existing immigration laws and remained unchanged by the agency's internal enforcement procedures. Thus, the memorandum did not change the underlying rights or obligations of regulated parties; rather, it reflected DOJ's decision to reallocate its prosecutorial resources within the existing statutory framework.82F[83]

In B‑334045, July 5, 2023, we considered the Department of Homeland Security's (DHS) termination of its Migrant Protection Protocols (MPP). MPP was a program under which DHS could return certain migrants, who arrived at the southern border, to Mexico to await proceedings to determine inadmissibility or deportability.83F[84] We reasoned that the termination of MPP fell into CRA's third exception because although it changed previous policy, there was no underlying change in the legal rights of migrants.84F[85] We noted that the ultimate inadmissibility or deportability of migrants arriving on land from a foreign contiguous territory was already prescribed by existing immigration laws, and those rights were unchanged by DHS's termination of MPP and the location from which individuals await the proceedings to determine inadmissibility or deportability.85F[86] DHS had instead restored case‑by‑case exercise of its statutory discretion.86F[87] Thus, the underlying law from which the rights and obligations of migrants emerged remained unchanged as DHS did not change the basis upon which it assessed compliance with immigration laws.87F[88]

In B‑335516, Jan. 24, 2024, the Department of Education (Education) announced a twelve‑month “On‑Ramp” payment period to ease the transition as large numbers of borrowers resumed the repayment of their student loans. During this period, payments remained due, interest accrued, and borrowers would not be reported to credit bureaus, considered in default, or referred to collections.88F[89] Borrowers who did not make payments would not receive credit toward loan‑forgiveness programs, and Education emphasized that borrowers who could pay should pay.89F[90] We concluded that the action fell within CRA's third exception because it did not alter borrowers' underlying legal obligations.90F[91] Education only changed when it would assess compliance with the duty to make payments and when it would impose corresponding penalties.91F[92] The legal obligation to pay remained fully in force, interest continued to accrue, and penalties would be enforced after the On‑Ramp period.92F[93] Education therefore announced only a temporary adjustment to enforcement procedures, not a change to borrowers' substantive rights or obligations or how the agency will assess compliance with existing law, but rather when the assessment would happen.93F[94]

This action by Commerce is analogous to those in B‑337673, Jan. 16, 2026, and similar cases in which the agency altered the basis or factors for assessing compliance with the law, thereby influencing the internal operations of regulated entities, even though the underlying law remained the same. In those cases, we concluded that an agency action can have substantial effect because it changes the framework through which compliance with that law is evaluated.94F[95]

Commerce itself underscored the substantive effect of the actions announced in the Press Release. Commerce explained that the AI Diffusion Rule would have had severe negative impacts on industry and the interests of the United States,95F[96] and that its decision not to enforce the rule will have a “significant positive impact on the marketplace and third parties.”96F[97] These statements confirm that Commerce was not merely allocating enforcement resources, ensuring quality control, or organizing its internal operations; rather, it was making a prospective, across‑the‑board determination that the AI Diffusion Rule would not be given effect, thereby eliminating rights and obligations noted above. Consistent with our prior decisions, Commerce's announcement of its non-enforcement of a duly promulgated rule alters existing regulatory rights and obligations of non-agency parties. Accordingly, it does not fall within CRA's third exception.

CONCLUSION

The Press Release is a rule for purposes of CRA because it meets the APA definition of a rule and no CRA exception applies. Therefore, the Press Release is subject to the CRA requirement that it be submitted to Congress and the Comptroller General before it can take effect.

Edda Emmanuelli Perez
General Counsel