Treasury has proposed a rule that would make developing any AI system a prohibited technology for US outbound investment into countries of concern, with comments due 7 December 2026

What did Treasury propose?

The Federal Register summary says the proposed rule "would require United States persons to provide notification to the U.S. Department of the Treasury regarding certain transactions involving foreign persons that are engaged in notifiable technologies; and prohibit United States persons from engaging in certain other transactions involving foreign persons that are engaged in prohibited technologies." It is a proposal. Comments are due 7 December 2026, and no final text exists.

The notice says Congress enacted the Comprehensive Outbound Investment National Security (COINS) Act on 18 December 2025 as part of the FY26 National Defense Authorization Act. Subtitle C added Title VIII to the Defense Production Act and, in Treasury's words, "establishes a statutory basis" for the Outbound Investment Security Program. Treasury's existing program began on 2 January 2025 under 31 CFR Part 850. The notice says Treasury received about 100 notifications from semiconductor and AI investments in roughly 21 months.

Title VIII widens the program beyond the three sectors in Part 850 (semiconductors and microelectronics, AI, quantum) to add high-performance computing and supercomputing, and hypersonic systems. It also lists more countries of concern: the People's Republic of China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia and Venezuela under the Maduro regime, as the notice describes them.

How would the proposal treat AI systems?

Title VIII names AI systems as a technology area but, the notice says, does not further define the term. Treasury proposes its own definition. Executive Order 14434, which the notice cites in a footnote, is described there as requiring agencies to use "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI" in certain documents, so the proposed text says "SI system". In what follows we say AI system.

Under proposed section 851.232(a), a system would be covered if it is a machine-based system that can, for human-defined objectives, generate content or make predictions, recommendations or decisions influencing real or virtual environments. Section 851.232(b) would extend the term to any data system, software, hardware, application, tool or utility that operates in whole or in part using such a system, including an agent harness and embodied systems such as industrial robots, humanoid robots and autonomous vehicles.

Section 851.226(h) would list "development of any SI system" as prohibited technology, with two provisos. First, a covered foreign person that builds on a third-party model "develops" a system when it enhances or extends that model's capability; the notice's example is an agentic harness layer. Second, using an off-the-shelf third-party system strictly for internal, non-commercial purposes, including customization or fine-tuning, is not development solely on that basis.

The notifiable-technology definition in the proposed text lists semiconductor, interconnect and hypersonic items. We found no AI item in it, which matches the notice's statement that Treasury lists SI systems within prohibited technology "and not within notifiable technology." Because this is a proposal, each of these is how the text would read, not how it reads today.

Why does the missing compute threshold matter?

The notice explains the change. Part 850 sorted AI systems into prohibited, notifiable or uncovered according to the quantity of training compute, designed end uses and intended end uses. Treasury now says that over the past two years models "have achieved notable performance gains through additional means other than the quantity of training compute," and that "no single measure, benchmark, or threshold is currently sufficient to distinguish advanced models."

Treasury also says end uses are harder to isolate because general-purpose models "may exhibit that functionality" without having been designed for national security applications, and that investors may not know what a developer has evaluated. It describes its approach as clear text "that does not rely on a U.S. person ascertaining the technical capabilities or thresholds of SI systems being developed by a covered foreign person."

This is where the desk's inference starts. The notice removes a measurement problem, and it relocates the diligence problem to definition and to the word "develop", which the proposed text defines to include stages before serial production and "high-level oversight, direction, approval, conceptual input, or strategic planning." Whether a given target meets that definition is a fact question the notice does not resolve for any company. Treasury asks for comment on "the potential implications arising from defining prohibited technology to include the development of any SI system," including alternative approaches.

What duties would attach to investors?

The proposed text says: "A U.S. person may not engage in a prohibited transaction unless an exemption for that transaction has been granted under § 851.502 or the transaction qualifies for the exemption under § 851.503." Section 851.502 is a national interest exemption; section 851.503 is an intelligence activities exemption. We did not read those two sections in the regulatory text.

The covered transactions the proposal would reach include acquiring an equity or contingent equity interest in a covered foreign person, certain loans, joint ventures, conversions of contingent equity or debt, and certain acquisitions or development of operations and assets in a country of concern. A covered foreign person is defined by its link to a country of concern, such as incorporation or principal place of business there, or ownership or control by such a person. Title VIII also excepts, among other things, underwriting, bank lending, payments processing, prime brokerage and global custody services, according to the notice.

A US person would also be required to "take all reasonable steps to prohibit and prevent" a prohibited transaction by its controlled foreign entity (proposed section 851.302). The notice says Treasury would consider factors such as agreements, governance rights, training, internal controls and testing or auditing. For notifiable transactions, the notice describes certification, record-keeping and deadlines; we did not read the notification content or timing provisions in full.

What are the open questions for counsel?

These are our questions, not Treasury's. Does a target's use of a licensed third-party model inside a product count as development under the harness proviso? How would a limited partner in a US fund with a non-US portfolio company analyze the proposed pooled-fund rule? What would the final applicability date be? The proposed Part 850 applicability section covers activities from 2 January 2025 until the final rule's effective date, which is not yet set.

Treasury's own cost analysis assumes about 150 different investors engaging in about 200 potentially covered transactions a year, after doubling its averages from PitchBook data. That is Treasury's estimate for this notice, and we have not tested it.

A public comment is the formal channel. The notice points to regulations.gov, docket TREAS-DO-2026-0595, and asks commenters for empirical data and for suggested ways the rule could be scoped to address national security concerns while accounting for the impact on US businesses and consumers.

What we did not verify

What we opened: the full Federal Register document 2026-21786 (91 FR 67396) as rendered on federalregister.gov, including the summary, dates, background, the narrative on AI systems, the cost discussion, and the proposed regulatory text for the definitions of prohibited technology, notifiable technology, develop, covered foreign person, covered national security transaction and SI system, and sections 851.301 and 851.302. The Federal Register site states that its web rendition is not the official legal edition; we have not compared it with the govinfo PDF.

What we did not open: the statute (COINS Act, Title VIII of the Defense Production Act), the existing 31 CFR Part 850, Executive Order 14434 itself, the regulations.gov docket and the comments filed (the page showed 9 at the time of our read), the plain-language summary, and the exemption sections 851.502 and 851.503 in the regulatory text. We did not read Subpart D's notification content and timing provisions, the pooled-fund provisions in full, or the proposed de minimis values, if any.

What we refuse to claim: that any named company or transaction is covered, that the final rule will keep the AI provision, that AI development anywhere is prohibited (the proposal concerns US persons' covered transactions with covered foreign persons), or how many investors the rule would reach. We make no comment on Treasury's national security findings beyond attributing them.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• China MOFCOM and MOST announcement 48 on the AI technology export catalogue
• BIS case-by-case license review for H200 chips to China and Macau
• BIS advanced computing export supplement for the UAE
• North America AI regulation
• AI Regulation News hub