Semiconductors
Export controls, fab security, and CHIPS Act requirements
15 CFR 231.108 defines material expansion as increasing an existing facility's semiconductor manufacturing capacity by more than five percent of the capacity memorialised in the required agreement.
Semiconductor companies operate at the intersection of advanced manufacturing, export controls, and national security requirements. Thalorin supports the semiconductor industry with compliance infrastructure addressing CHIPS Act requirements, fab security, and the complex export control landscape.
Applications to become an approved IC designer must reach the Bureau of Industry and Security by 31 December 2026. The date sits in Note 1 to ECCN 3A090.a, where a BIS rule effective 7 April 2026 moved it from 13 April 2026; applicants may then be considered authorized IC designers for 180 days. The interim final rule of 16 January 2025 attaches a presumption to applicable advanced logic integrated circuits handled by front-end fabricators and OSAT companies, and designer status is one of three ways to overcome it.
Three regimes ask who a counterparty is, and each answers differently. The CHIPS guardrails at 15 CFR 231.104 treat 25 percent of voting interest, board seats or equity held by a covered-nation government as enough to make an entity a foreign entity of concern. The Entity List affiliates rule of 30 September 2025 uses a 50 percent ownership test and is stayed until 9 November 2026. Section 5949 of the FY2023 NDAA uses no test at all: it names SMIC, CXMT and YMTC.
What gets underestimated is the notification duty rather than the prohibition. Under 15 CFR 231.301 a covered entity must notify the Secretary of Commerce of any planned significant transaction that may involve material expansion of semiconductor manufacturing capacity in a foreign country of concern, regardless of whether it believes an exception applies, and 231.302 requires that notification to be certified by the chief executive officer, president or an equivalent corporate officer. For an existing facility, material expansion starts above five percent of the capacity memorialised in the agreement.
Award conditions, not control families, are the governing object here. Each obligation belongs to the instrument that imposed it: the required agreement for a CHIPS recipient, the Note 1 basis relied on for a shipment of 3A090.a parts, the retention clock at 231.205 for a transaction already notified. Thalorin binds them that way, so a capacity change at one facility raises the notification question when the change is recorded rather than during an annual review held after the transaction closed.
Manufacturing faces evolving cyber risks
A 31 December 2026 designer application window
Approved IC designer applications must reach BIS by that date under Note 1 to ECCN 3A090.a, and the End-User Review Committee decides them. The binding constraint is review queue time in Washington, not engineering time in the fab.
Twenty-five percent, fifty percent, or a name
The CHIPS guardrails, the Entity List affiliates rule and Section 5949 each identify a restricted counterparty by a different mechanism. One supplier can clear two of the three tests and fail the third, and no single screening list resolves all of them.
Five percent is a material expansion
15 CFR 231.108 counts any capacity increase above five percent of the figure memorialised in the required agreement, and aggregates a series of additions. Debottlenecking that nobody internally would describe as an expansion can cross it.
SEMI E187 stops before the PLC
It covers computing devices on production equipment and material handling systems running Windows or Linux, and expressly excludes programmable logic controllers, SCADA and devices reached over sensor-actuator networks. Conformance claims are read as covering more than they do.
How Thalorin helps
CHIPS Act compliance
Hold the required agreement as the governing artifact under 15 CFR Part 231 — the ten-year expansion clawback at 231.202, the technology clawback at 231.203, the notification duty at 231.301 and the retention obligation at 231.205.
Fab security controls
Evidence the four areas SEMI E187-0122 specifies — operating system support, network security, endpoint protection and security monitoring — against the individual tools and automated material handling systems that carry them.
Export control management
Carry the classification and the authorisation basis for each shipment, including whether the 3A090.a presumption is overcome through an approved IC designer, an approved OSAT company, or the authorized designer criteria in Note 1.
IP protection for semiconductors
Treat process recipes, PDKs and mask data as licensable technology, so a joint research or technology licensing arrangement is tested against the 15 CFR 231.203 clawback before it is signed rather than after.
Supply chain security
Screen suppliers against what Section 5949 covers — SMIC, CXMT and YMTC with their subsidiaries, affiliates and successors, plus any entity Commerce or Defense designates in the Federal Register — before the 23 December 2027 effective date.
Clean room cybersecurity
Model the fab floor as its own zone, recording tools that cannot accept an operating system update as compensating-control cases with a named owner instead of as open findings.
Semiconductors: common questions
Do the CHIPS guardrails apply if we have no plans to build overseas?
Yes. The required agreement carries obligations that bind regardless of intent. The technology clawback at 15 CFR 231.203 restricts joint research and technology licensing with a foreign entity of concern for the applicable term of the award. The notification duty at 231.301 runs for ten years from the award and attaches to planned significant transactions of the covered entity or of members of its affiliated group, so a subsidiary's expansion is your notification, certified by your chief executive officer or president under 231.302.
What counts as a material expansion of semiconductor manufacturing capacity?
Two things. For an existing facility, an increase of more than five percent of the capacity memorialised in the required agreement, arising from adding a cleanroom, a production line or other physical space; 15 CFR 231.108 aggregates a series of such additions rather than testing each on its own. Constructing a new facility is a material expansion in itself. The expansion clawback at 231.202 carves out existing facilities manufacturing legacy semiconductors, and expansions producing legacy semiconductors that predominately serve a foreign country of concern's market, with 231.111 setting predominately at 85 percent of output by value.
Is the Entity List affiliates rule in force right now?
No. BIS issued the interim final rule on 30 September 2025, extending Entity List restrictions automatically to any entity at least 50 percent owned by one or more listed parties, then stayed it effective 10 November 2025. The stay runs to 9 November 2026, and the same rule already writes those license requirements back into the EAR effective 10 November 2026, so they return by their own terms rather than by a fresh rulemaking. Ownership data on existing suppliers is worth collecting while the stay holds.
When does the Section 5949 prohibition on SMIC, CXMT and YMTC parts start?
23 December 2027, five years after the FY2023 NDAA was enacted on 23 December 2022. Section 5949 bars executive agencies from procuring electronic parts, products or services that include semiconductors designed, produced or provided by those companies or their subsidiaries, affiliates and successors; the related prohibition on contracting for parts that use such products reaches only critical systems. Congress gave the Federal Acquisition Regulatory Council three years from enactment to prescribe implementing regulations, and no implementing clause appears in the FAR as of August 2026.
Does SEMI E187 cover our process control network?
No. SEMI E187-0122 applies to computing devices of fab equipment installed with Microsoft Windows or Linux, including automated material handling systems, and states that it does not apply to programmable logic controllers, SCADA, or devices connected to them via sensor-actuator networks. It is written to be applied by equipment suppliers and system integrators, which means a fab's conformance is largely a function of what its purchase specifications require. The process control layer needs a separate control set.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.
Talk to us about Semiconductors.
See how one evidence artifact satisfies Semiconductors requirements alongside every other framework you carry.