Export controls, CFIUS, and national-security exposure.
Quantum has been formally classified by the U.S. and EU as a strategic technology in the same regulatory category as advanced semiconductors and frontier AI.
Quantum has been formally classified by the U.S. and EU as a strategic technology in the same regulatory category as advanced semiconductors and frontier AI. For any company that hires quantum engineers, acquires a quantum startup, takes foreign investment while doing quantum R&D, ships quantum-related hardware or software, or licenses quantum technology across borders, the exposure has become substantial — and the rules have changed materially over the past eighteen months.
A. The BIS Export-Control Rule
In September 2024, the U.S. Department of Commerce's Bureau of Industry and Security (BIS) published an Interim Final Rule (89 Fed. Reg. 72926) implementing export controls on quantum computing items and advanced semiconductor manufacturing equipment and related transistors. The rule added eighteen new classifications to the Commerce Control List and modified nine existing ones. For quantum, these include 3A901, 3D901, 3E901, 3A904, 4A906, 4D906, and 4E906, covering quantum computers, their components, software, and the technology required to develop or maintain them.
The rule created a License Exception (IEC) for a short list of countries that have enacted equivalent national controls, which initially consisted of Australia, Canada, France, Germany, Italy, Spain, and the UK, with Japan, the Netherlands, Finland, and Norway added later. Exports to other destinations require an export license. The rule also applies to so-called “deemed exports”: the release of controlled technology or source code to a foreign national inside the United States is treated, with a few exceptions, as an export to that person's country of citizenship or permanent residency. For a quantum research group whose engineers include PhD graduates from outside the IEC country list, deemed-export compliance is not a theoretical concern — it is an immediate HR and compliance matter.
B. Committee on Foreign Investment in the U.S.
The September 2024 Interim Final Rule also impacts companies that do not export anything. Any foreign investment in a U.S. business that engages in covered activities involving “critical technologies,” where the foreign investor (or any foreign person holding a 25 percent or more direct or indirect voting interest in the investor) first requires mandatory CFIUS review. For U.S. quantum startups raising capital from foreign funds, and for acquirers contemplating cross-border transactions, this has converted what was previously an optional notice into a required one.
Enforcement Trajectory
The enforcement trajectory is worth noting. In July 2025, Cadence Design Systems agreed to pay more than $140 million to resolve allegations that it sold its chip-design software to a Chinese military university — a case involving not physical goods but software licensing and technology transfer. Cadence is not a quantum company, but the example is directly applicable: export-control risk in advanced computing sectors now runs through software, cloud access, source-code sharing, and the presence of foreign nationals in sensitive engineering roles, not just through shipped hardware.
C. What Boards Should Confirm
A Four-Item Board Checklist
Classify items. Confirm the company's quantum-related items are classified against the new commerce-control numbers, including 4A906 for systems and the 900-series items for components, software, and technology. Where uncertain, a Commodity Classification Automated Tracking System (CCATS) determination from BIS is available and advisable.
Review foreign-national employment posture. Quantum research groups with graduate students or engineers from certain countries may need licenses, annual reporting, or internal access controls under the deemed-export rules.
Map foreign ownership against the CFIUS threshold. A foreign investor whose voting power crosses 25 percent, directly or indirectly, may trigger filing obligations that cannot be cured retroactively.
Evaluate M&A pipelines. Inbound and outbound transactions should be reviewed for export-control and CFIUS implications before a letter of intent is signed. A quantum-related acquisition that cannot close, or that closes on substantially different terms after a CFIUS review, is a material governance event.
The cost of this review is modest. The cost of discovering, after the fact, that a software release, a hire, or a financing round triggered a licensing or filing obligation is not, as the Cadence settlement and the broader enforcement environment demonstrate.