Most of the H100 and H200 server requests we get come from outside the US, and the first real question on each one is export control. This is the picture as of November 5, 2026, built from the Export Administration Regulations (EAR), the Federal Register, and guidance the Bureau of Industry and Security (BIS) has published. Every rule below links to its source.
Short answer by destination
This table covers the destination-based license requirement for H100 and H200 servers shipped from the US. The ownership test in the next section applies on top of it, in every country.
| Destination | EAR country groups | Destination triggers a US license? |
|---|---|---|
| Canada | A:5 | No |
| Poland, Czech Republic, Slovakia, Hungary, Romania, Bulgaria, Estonia, Latvia, Lithuania, Slovenia, Croatia | A:5 | No |
| Singapore | A:6 | No |
| Malaysia, Thailand, Indonesia, Philippines | None of A:5, A:6, D:1, D:4, D:5 | No. Malaysia has its own permit for sending the hardware onward |
| Vietnam, Laos, Cambodia | D:1 | Yes |
| Georgia, Moldova | D:1 | Yes |
| Burma | D:1, D:5 | Yes, with a presumption of denial |
| Russia, Belarus | D:5, plus the sanctions in 15 CFR 746.8 | Yes, for any item on the Commerce Control List |
Country group memberships come from Supplement No. 1 to part 740, read on November 5, 2026.
"No" means the destination alone does not trigger a license. A buyer that is headquartered in China, Macau, or another D:5 country, or whose ultimate parent company is, needs a license in every row of this table.
Where the rules stand
Which hardware is covered
BIS describes advanced computing items as items in "ECCNs 3A090.a, 4A090.a, and .z items in Categories 3, 4, and 5, such as servers classified as ECCN 5A992.z" (BIS diversion guidance, May 13, 2025). NVIDIA's own annual report for fiscal 2026 lists the H100 among the products that need licenses for China and Country Groups D:1, D:4, and D:5, and BIS's January 2026 rule names the H200 as an example of a covered chip. An 8-GPU server built around either one is covered. Ask the seller to put the ECCN on the quote.
The destination list in force
The October 2023 advanced computing rule (88 FR 73458, effective November 17, 2023) requires a license for destinations in Country Groups D:1, D:4, and D:5, except destinations that are also in A:5 or A:6. BIS's own May 2025 guidance still describes those destinations as places that require "an export license for advanced computing ICs."
For those destinations outside D:5 and Macau, the licensing policy that predates 2025 was a presumption of approval when the buyer is not headquartered in, and has no ultimate parent in, D:5 or Macau (15 CFR 742.6(b)(10), as of January 10, 2025). License Exception ACA covered D:1 and D:4 shipments, but it excluded 3A090.a items "designed or marketed for use in a datacenter" (15 CFR 740.8, as of January 10, 2025). H100 and H200 are datacenter parts, so plan on an actual license for Vietnam, Laos, Cambodia, Georgia, or Moldova.
The AI Diffusion Rule is still printed in the regulations
The Framework for Artificial Intelligence Diffusion (90 FR 4544, January 15, 2025) replaced the destination list with a worldwide license requirement and per-country caps. Only 18 countries plus the US were exempt from the caps. That list included Canada and left out Poland, the Czech Republic, Slovakia, Hungary, Romania, and the Baltic states.
On May 13, 2025, BIS announced that its enforcement officials would not enforce the rule, that it would publish a regulation formalizing the rescission, and that a replacement rule would follow. As of November 5, 2026, we could not find either one in the Federal Register. On May 12, 2026, the Government Accountability Office concluded that "the AI Diffusion Rule remains legally in effect until Commerce completes its planned rulemaking to rescind it."
In practice, that means 15 CFR 742.6 on eCFR today still shows the worldwide license requirement and the country allocations, and BIS is not enforcing them. Exporters work from the pre-2025 destination list above. A replacement rule could change that table with little notice, so check the date on anything you read about it, including this post.
China and Macau
The January 15, 2026 rule (91 FR 1684) moved license review for chips with a TPP under 21,000 and total DRAM bandwidth under 6,500 GB/s, "such as the NVIDIA H200 or AMD MI325X," from a presumption of denial to case-by-case review. It applies only to exports from the United States to end users located in China or Macau, and only with a set of certifications that include independent third-party testing in the US and a cap tied to 50% of US shipments of the same product. It does not help a buyer in a third country. The same rule keeps a presumption of denial for entities headquartered in D:5 or Macau, or whose ultimate parent company is.
Recent country changes
BIS moved Cambodia out of Country Group D:5 effective February 3, 2026. Cambodia is still in D:1, so the license requirement for these servers did not go away. BIS moved the United Arab Emirates into Country Group A:5 effective July 10, 2026. Country groups move one rule at a time, so read the current supplement before you plan a route.
The ultimate parent company decides the license
The October 2023 rule added a license requirement for advanced computing items going to any entity "headquartered in, or whose ultimate parent company is headquartered in, either Macau or a destination specified in Country Group D:5," wherever that entity is located. BIS wrote that it was aimed at "a PRC-headquartered cloud or data server provider located outside of China." The requirement started in 15 CFR 744.23(a)(3), and BIS now cites 15 CFR 742.6(a)(6)(iii)(A) for it.
On May 31, 2026, BIS published guidance confirming that this requirement is still enforced despite the AI Diffusion Rule non-enforcement. It says a license is required "even if the entities themselves are located outside Country Group D:5 or Macau," and that exporters "should continue to seek BIS licenses for such transactions."
So a company registered in Bratislava, Toronto, or Bangkok whose parent is headquartered in China needs a license, and the policy for that license is a presumption of denial. The ship-to address in an A:5 country does not change the answer.
What the exporter will check
BIS's May 2025 guidance lists the due diligence it expects for new customers, "especially those located in destinations outside of Country Group A:1." Country Group A:1 is the Wassenaar Arrangement participants. No Southeast Asian country is in it. The checks include:
- the customer's date of incorporation, with incorporation after October 2022 called out;
- the ownership structure, to find whether any party is headquartered in D:5 or Macau or has an ultimate parent there;
- a copy of the business license for new customers;
- the delivery and installation address;
- a written attestation from the data center that the end user is authorized to operate there and that the site has the power and cooling to run the servers;
- for hosting and cloud providers, an attestation that they are not providing access for training models for or on behalf of parties headquartered in D:5 or Macau;
- a signed certification that the customer will comply with the EAR and flow the requirements down to anyone it resells to.
The same guidance lists red flags. A buyer that will not disclose where its headquarters or ultimate parent is located, a freight forwarder or logistics company listed as the ultimate consignee, a virtual office as the end user address, or a data center that cannot confirm it has the power for the order are all on that list. Expect an exporter to stop and ask questions on any one of them. BIS also says data centers able to run more than 10 megawatts of these servers "merit additional scrutiny."
A national company register usually answers the ownership question better than a website does. Expect us to ask for a register extract that shows owners up to the ultimate parent.
Entity List affiliates
In September 2025 BIS extended Entity List restrictions to entities 50% or more owned by listed parties (90 FR 47201). In November 2025 it suspended that rule until November 9, 2026 (90 FR 50857). As of November 5, 2026, we found no Federal Register notice extending the suspension. If it lapses, a buyer that is 50% or more owned by a listed company takes on that company's restrictions. Screen every party against the Consolidated Screening List either way.
What to expect by region
Canada
Canada is in A:5, so there is no destination-based license. The ownership test still applies: a Canadian hosting company whose parent is headquartered in China needs a license. US-origin items stay subject to the EAR wherever they are located (15 CFR 734.3), so moving or reselling the servers out of Canada later carries the same rules as shipping from the US.
Southeast Asia
Singapore, Malaysia, Thailand, Indonesia, and the Philippines have no destination-based US license requirement for these servers. Vietnam, Laos, and Cambodia are in D:1 and need a BIS license. Burma is in D:5.
Malaysia adds its own layer. On July 14, 2025, Malaysia's Ministry of Investment, Trade and Industry made "all exports, tranships and transits of high-performance AI chips of US origin" subject to a Strategic Trade Permit under section 12 of the Strategic Trade Act 2010 (MITI statement). Hardware that stays in a Malaysian data center is outside that statement. Routing servers through Malaysia to another country needs the permit. We did not find a later MITI statement that changes it.
Because every country in the region sits outside Country Group A:1, expect the full due diligence list above on every order: register extract, end-use statement, installation address, and the data center attestation.
Eastern Europe
The EU members in the region are in A:5, so there is no destination-based license. The caps that the AI Diffusion Rule would have applied to Poland, the Czech Republic, Slovakia, Hungary, Romania, and the Baltic states are not being enforced. The ownership test applies in full.
Outside the EU, Georgia and Moldova are in D:1 and need a license. Russia and Belarus are in D:5 and under the separate sanctions in 15 CFR 746.8, which require a license for any item on the Commerce Control List. Treat them as closed. Because the hardware stays subject to the EAR after delivery, a reexport from Slovakia to Georgia needs the same license a direct shipment from the US would.
What to send with a quote request
- The legal entity that will buy, its registration number, and a register extract showing ownership up to the ultimate parent
- Where the buyer and its ultimate parent are headquartered, and the end user if it is a different company
- The installation address and the data center operator
- Whether you will use the servers yourself, resell them (and to whom), or rent capacity to others
- Confirmation that the site has the power and cooling for the configuration
For destinations that need a BIS license, the license comes before the ship date. Build that into the schedule.
Frequently Asked Questions
Do I need a US export license to buy an H100 server in Canada?
The destination does not trigger one, because Canada is in Country Group A:5. You do need one if your company, or its ultimate parent company, is headquartered in China, Macau, or another Country Group D:5 country.
Does a Malaysian Strategic Trade Permit replace a US license?
No. The two are separate. Malaysia's permit covers exports, transshipments, and transits of US-origin high-performance AI chips out of Malaysia. The US rules apply to the same hardware at the same time.
Can a reseller in Singapore buy H200 servers and sell them into Vietnam?
Only with a BIS license for Vietnam. US-origin items stay subject to the EAR after they reach Singapore, and Vietnam is in Country Group D:1.
Is the AI Diffusion Rule in effect?
It is still printed in 15 CFR, and GAO concluded in May 2026 that it remains legally in effect until Commerce finishes rescinding it. BIS announced in May 2025 that it would not enforce it, and it has not published the rescission or a replacement as of November 5, 2026.
Get a sourced quote
Tell us the destination, the buying entity, and its ultimate parent when you ask for pricing. We source H100 and H200 servers through dealers and quote on request, and we will tell you up front if a shipment needs a license.
