Commerce's HBM3E export guidance is narrower than reported. The HBM4 ambiguity is the real story.

When the Bureau of Industry and Security published its interim final rule on high-bandwidth memory in December 2024, headlines focused on the 2 gigabyte per square millimeter control threshold. That number matters, but reading the actual regulatory text reveals a more nuanced picture: three separate carve-outs that narrow the rule's practical reach, and a conspicuous silence on next-generation HBM4 that leaves exporters without clear guidance as commercial shipments approach.

The rule established ECCN 3A090.c to control HBM stacks with memory bandwidth density exceeding 2GB per second per square millimeter, a threshold that captures all HBM currently in production. The control structure includes exemptions for lower-density memory, co-packaged logic chips, and specific packaging workflows that together create a narrower regime than the top-line threshold suggests.

The 3.3 GB/mm² ceiling and the HBM2 carve-out

License Exception HBM, added at 15 C.F.R. § 740.25, authorizes exports by U.S.-headquartered companies (without an ultimate parent in Country Group D:5 or Macau) for HBM with memory bandwidth density below 3.3 GB per second per square millimeter. According to Mondaq's analysis, this threshold "only really carves out an exception for HBM2," the previous generation that predates the HBM3 and HBM3E products now shipping in volume.

The exception requires direct purchase by the designer of the co-packaged commodity and direct shipment to the packaging site, conditions intended to prevent diversion. Promise Legal notes that License Exception HBM was established as a "critical authorization" in the December 2024 rule, but its practical utility is limited to older memory technology that represents a shrinking share of advanced AI data center deployments.

The 3.3 GB/mm² ceiling means the exception does not cover the memory stacks used in current-generation AI accelerators from Nvidia, AMD, and other vendors.

Co-packaged chips and the dominant function test

The December 2024 rule includes a technical note specifying that ECCN 3A090.c "does not cover co-packaged integrated circuits with both HBM and logic integrated circuit where the dominant function of the co-packaged integrated circuit is processing," according to the Mondaq summary. This exemption applies to products where HBM and processing logic are integrated in a single package, provided the logic function dominates.

The rule clarifies that the control does include "HBM permanently affixed to a logic integrated circuit designed as a control interface and incorporating a physical layer (PHY) function," distinguishing between packages where the logic performs substantial computation versus those where it merely manages memory access. The distinction turns on functional analysis rather than physical configuration, creating a fact-specific inquiry for each product design.

Advanced computing integrated circuits containing co-packaged logic and HBM are not controlled by 3A090.c, though they may fall under ECCN 3A090.a or 3A090.b depending on their Total Processing Performance and performance density. A chip with integrated HBM could be controlled as an advanced computing IC rather than as memory, depending on its processing capabilities.

January 2026 case-by-case review and the 6,500 GB/s threshold

On January 15, 2026, BIS shifted its license review policy for certain exports to China and Macau from presumption of denial to case-by-case consideration. Baker McKenzie reports that the new policy applies to chips with Total Processing Performance below 21,000 and total DRAM bandwidth below 6,500 gigabytes per second, when exported from the United States to China or Macau end users.

The 6,500 GB/s bandwidth threshold provides a second numerical boundary distinct from the 3.3 GB/mm² density ceiling in License Exception HBM. Products meeting both the TPP and bandwidth criteria, such as Nvidia's H200 and AMD's MI325X, became eligible for case-by-case review rather than facing presumptive denial. The policy applies only to exports originating in the United States, not to reexports from third countries.

License applications under the case-by-case policy require certification and supporting data per 15 C.F.R. Part 748, Supplement No. 2, paragraph (dd). The January 2026 shift created a third pathway alongside License Exception HBM and the co-packaged exemption, though its scope is limited to specific product categories and export origins.

May 2026 clarification and the RS controls shift

BIS issued enforcement guidance on May 31, 2026, that clarified the legal basis for ongoing license requirements while announcing nonenforcement of the AI Diffusion Rule. Holland & Knight explains that the guidance shifted the license requirement for advanced computing items to Country Group D:5 or Macau-headquartered entities from end-user controls under § 744.23(a)(3) to RS controls under § 742.6(a)(6)(iii)(A).

The shift matters because RS controls impose license requirements on a strict liability basis, with no requirement that the exporter have knowledge at the time of export that items are destined for D:5 or Macau-headquartered entities. This creates a more stringent compliance standard than the previous end-user control framework, which incorporated knowledge requirements.

Ward Law Trade notes that the May 2026 guidance left ambiguity around which license exceptions remain available, specifically questioning whether License Exceptions ACA, HBM, and AIA can still be used under the RS controls framework. The guidance confirmed that preexisting license requirements for HBM meeting control thresholds remain fully in force, contrary to some initial interpretations that the AI Diffusion Rule nonenforcement relaxed all advanced computing export requirements.

The HBM4 specification gap

The December 2024 rule's technical note defines memory bandwidth density as "the memory bandwidth of the package or stack measured in GB per second divided by the area of the package or stack measured in square millimeters," according to Mondaq. This calculation method applies regardless of whether products conform to JEDEC standards for high-bandwidth memory, provided they exceed the 2 GB/mm² threshold.

The regulatory silence creates uncertainty for manufacturers including SK Hynix, Samsung, and Micron, which produce the majority of the world's HBM and face dual compliance burdens from both the HBM controls and the semiconductor manufacturing equipment Foreign Direct Product Rule. Without explicit guidance on HBM4 classification, exporters must either calculate bandwidth density from product specifications and self-classify, or seek commodity classification from BIS before commercial shipments begin.

The absence of HBM4 guidance stands in contrast to the detailed thresholds provided for earlier generations, suggesting either that BIS intends to address next-generation memory in a separate rulemaking, or that the existing calculation methodology is considered sufficient for self-classification. Neither interpretation eliminates the compliance risk for exporters who must make classification decisions before regulatory clarity arrives.