CADChain Blog
2026-11-06 13:20 News

BIS Affiliates Rule Suspension Extended to 10 January 2027: What the US 50% Export Control Rule Means for CAD Files and Design Data Shared With Suppliers | CADChain | CAD DRM & IP

On 5 November 2026, the US Bureau of Industry and Security (BIS) filed a final rule that keeps its so-called Affiliates Rule, often called the 50% rule, suspended until 10 January 2027. Without it, the rule would have come back into force on 10 November 2026. The notice is due to be published in the Federal Register on 9 November. It buys exporters two more months, but it does not withdraw the rule, and it does not change a single word of it.
The Affiliates Rule extends US export restrictions from the companies named on the Entity List and the Military End-User List to every foreign company that those listed parties own by 50% or more, directly or indirectly, alone or together. BIS issued it in September 2025 and suspended it for one year in November 2025 as part of the trade truce agreed with China in Busan. The suspension has now been stretched to match the wider US-China truce, which Treasury Secretary Scott Bessent said in September would run until 10 January 2027.
For engineering companies this is not only a customs topic. Under the US Export Administration Regulations (EAR), technology includes drawings, models, engineering designs and computer-aided design files. If the rule returns, the list of companies that may not receive certain CAD files, drawings and specifications without a US licence will grow by thousands of subsidiaries that appear on no list at all.
TL;DR: the 50% rule is paused, not gone

BIS has extended the suspension of its Affiliates Rule from 9 November 2026 to 10 January 2027, without giving a reason and without changing the rule. Once in force, the rule treats any company owned 50% or more, directly or indirectly, by parties on the Entity List, the Military End-User List or certain US sanctions lists as if it were listed itself. Because the EAR treats blueprints, drawings, models and CAD files as technology, sharing design data with such a company can need a US licence when that data is subject to the EAR. Lesson: use the two months to map who owns your customers, suppliers and partners, and to make sure you can control and prove who receives each design file.

What did BIS announce on 5 November 2026?

On Thursday 5 November, BIS released a final rule that extends the suspension of the Affiliates Rule until 10 January 2027. According to Baker McKenzie's export control team, the rule formally suspends the amendments the Affiliates Rule made to 15 CFR Parts 732, 734, 736, 744 and 748, does not otherwise modify the rule and does not respond to the public comments BIS received; BIS says it will consider those in future rulemakings. The trade analytics firm Kharon reported that the notice gave no explanation for the extension and that the BIS press office did not immediately respond to questions.
The first suspension ran from 10 November 2025 to 9 November 2026, and the rule would have returned automatically on 10 November 2026. In September, Bessent signalled that the suspension would be extended to 10 January 2027, but until this week BIS had published no notice to make that happen, which left exporters unsure whether the 50% rule would return on Tuesday 10 November. Reed Smith's trade lawyers write that the further suspension allows Washington and Beijing to keep negotiating a broader trade deal under the status quo, and that the rule and China's rare earth export controls could both take effect in January if no permanent agreement is reached.

What is the BIS Affiliates Rule?

BIS published the rule, formally called Expansion of End-User Controls to Cover Affiliates of Certain Listed Entities, as an interim final rule effective 29 September 2025. Until then, the Entity List worked like a name list: a licence requirement applied to the company named in the entry, not automatically to its subsidiaries. The Affiliates Rule closed that gap. When BIS issued it, Under Secretary Jeffrey Kessler said: “For too long, loopholes have enabled exports that undermine American national security and foreign policy interests.”
  • Who is covered: foreign companies owned 50% or more, directly or indirectly, individually or in the aggregate, by one or more parties on the Entity List, the Military End-User List or the SDN list under certain sanctions programmes named in the EAR.
  • Aggregation: stakes held by different listed parties are added up. In a worked example by King & Spalding, a company that is 35% owned by one listed entity and 15% by another is covered, and the most restrictive licence policy of the two applies.
  • Ownership chains: the test runs through holding companies and multi-tier structures, so a grandchild company can be caught.
  • Unknown ownership: a new red flag says that if you know a listed party holds a stake but cannot establish the percentage, you treat the counterparty as restricted until that is resolved, apply for a licence or use a licence exception where one is available.
  • No longer a complete list: BIS's own FAQs say the Entity List will no longer be an exhaustive listing of the foreign companies subject to its licence requirements.
In 2025, Kharon estimated that thousands of subsidiaries in nearly 100 jurisdictions across six continents would fall under it. For most Entity List entries, a licence is needed for all items subject to the EAR, including low-level EAR99 items, and licence exceptions are generally not available. Liability for unauthorised exports is strict, so not knowing who owned the recipient is not a defence.

Why do CAD files and drawings fall under export controls?

The EAR defines technology as information necessary for the development, production, use, operation, installation, maintenance, repair, overhaul or refurbishing of an item, and a note to that definition lists the forms it can take: written or oral communications, blueprints, drawings, photographs, plans, diagrams, models, formulae, tables, engineering designs and specifications, and computer-aided design files, among others.
Technology does not need a lorry. Sending a STEP file by email, granting a supplier access to a PDM vault, sharing a model in a cloud workspace or showing drawings to a visiting engineer can each count as an export, reexport or release under the EAR, depending on where the data and the person are. Export compliance and CAD file security therefore ask the same question: who can open this file?
European companies are not automatically outside the EAR. US rules can follow US-origin technology wherever it goes, and certain foreign-made items that incorporate or are produced with US technology or software. A Dutch or German engineering firm that received design data from a US customer, licenses US-developed process know-how or builds on US technology can hold files that are subject to the EAR. Whether a file is in scope is a classification question for your export control officer or counsel; a CAD protection system can then enforce the answer.

Who in Europe should pay attention?

The rule matters most where design data that may be subject to the EAR meets counterparties with complex ownership and file sharing that nobody tracks per file. Typical situations:
SituationWhy the 50% rule mattersWhat to check now
Contract manufacturer or tooling supplier in AsiaIts parent group may be majority-owned by a listed company, even if its own name is on no listUltimate ownership, including aggregated stakes, before the next drawing package is sent
Joint venture or research partnerTwo listed shareholders with 30% and 20% would make the joint venture a covered affiliateShareholder register, change-of-ownership notice duties in the agreement
Distributor or reseller receiving service manualsRepair and maintenance information counts as technology under the EARWhich manuals and models are shared, and with which legal entity
Supplier portal or shared cloud workspaceEvery account holder who can download a file is a potential recipientWho has access per file, per company and per country
We cover these supplier situations in our guides to CAD file security for supply chain collaboration and protecting CAD files across borders in offshore manufacturing. The difference is that an ownership change you did not notice can now turn a routine drawing release into a licence question.

How does the 50% ownership test work in practice?

You add up all direct and indirect stakes held by listed parties. If the total reaches 50%, the company is treated as if it were on the list with the most restrictive of its owners' licence requirements. If you know a listed party is among the owners but cannot find the percentage, the red flag tells you to treat the company as restricted until you can.
In practice, ownership data for private companies is often incomplete, group structures change faster than vendor master data, and few engineering teams can say which legal entity sits behind each account that can open a file in their vault, portal or cloud workspace.

What happens on 10 January 2027?

BIS can extend the suspension again, let it expire so that the rule returns on 10 January 2027 as written, or amend the rule after reviewing the public comments, which this week's notice left for future rulemakings. In a client alert published before the extension, Pillsbury describes the rule as a bargaining chip whose timing has tracked broader US-China negotiations, and lists the steps companies should prepare if the Affiliates Rule comes into force.

What should engineering and IP teams do now?

  1. Classify your design data. Ask export control or counsel which models, drawings, process documents and manuals may be subject to the EAR, and tag them. Unclassified CAD data cannot be controlled.
  2. Map who receives it. List every legal entity outside your company that can open those files: suppliers, contract manufacturers, partners, distributors, investors in data rooms.
  3. Screen ownership, not just names. Check direct and indirect owners against the Entity List, the Military End-User List and the relevant SDN programmes, add up the stakes and record the evidence.
  4. Treat unknown ownership as restricted. If a listed party is among the owners and the percentage is unclear, hold sensitive drawing packages until the question is resolved.
  5. Update contracts. Add ownership representations, change-of-ownership notice duties, export control clauses and the right to revoke access to design data.
  6. Control access per file. Use view, edit, print and export permissions instead of sending open files, and use geographic restrictions where location matters.
  7. Log and audit every release. Keep access audits and tamper-proof audit trails so you can show who received which revision and when.
  8. Prepare a revocation plan for 10 January. Know which files you would need to withdraw from which partners if the rule returns, and test that revocation actually works.
Know who can open every design file. CADChain adds file-level encryption, per-file permissions, access logs and blockchain proof of ownership to CAD files, so a change in a partner's ownership is a permission change, not a lost drawing package.

👉 See how CADChain controls CAD file access

How does this connect to trade secret protection?

Export controls and trade secret law push in the same direction. Export rules ask whether a specific recipient may receive specific technology; trade secret law asks whether you took reasonable steps to keep your know-how secret. Both are easier to answer when every design file is encrypted, permissioned and logged. Our overview of the legal framework for trade secret protection of CAD designs explains why those records matter in court.
The backdrop points to more ownership-based measures, not fewer. In October, the US imposed sanctions under its Protecting American Intellectual Property Act, which we covered in PAIPA sanctions over Google AI trade secrets, and China's commerce ministry published draft rules that would let it sanction foreign companies over trade secret disputes, explained in our article on China's draft trade secret sanctions rules. European suppliers caught between the two are safest when they can show who received which design data, and why.

How does this fit the bigger picture?

Our sister sites covered other changes engineering teams face this week.

Conclusion

The extension is good news only in the short term. The rule is unchanged, BIS gave no reason for the delay, and 10 January 2027 comes straight after the holiday season. If it returns, thousands of companies that appear on no list will be treated as listed, and technology, including drawings, models and CAD files, is squarely within the EAR's reach.
Engineering companies that share design data with suppliers, partners and customers around the world should use the next two months to answer three questions: which of our files may be subject to US export controls, which legal entities can open them, and who owns those entities. Companies that can answer them per file will keep working on 10 January, whatever Washington and Beijing decide.
Control your design data before the rules change again. CADChain encrypts CAD files at file level, applies per-file and per-company permissions, logs every access and timestamps ownership on a blockchain, so you can prove who received which design and revoke it when you must.

👉 Protect your CAD files with CADChain

FAQ: BIS Affiliates Rule and CAD files

What is the BIS Affiliates Rule?

It is a US export control rule, issued as an interim final rule effective 29 September 2025, that extends Entity List, Military End-User List and certain sanctions-based licence requirements to foreign companies owned 50% or more, directly or indirectly, individually or in the aggregate, by listed parties.

What did BIS decide on 5 November 2026?

BIS filed a final rule that extends the suspension of the Affiliates Rule until 10 January 2027. The notice is scheduled for publication in the Federal Register on 9 November 2026. It does not change the rule itself or respond to public comments.

Are CAD files covered by US export controls?

They can be. The EAR defines technology to include blueprints, drawings, models, engineering designs and computer-aided design files. Whether a specific file is subject to the EAR depends on its origin and content, which is a classification question for export control specialists.

Does the rule apply to European companies?

It applies to items and technology subject to the EAR wherever they are, including US-origin technology held by European companies. European firms sharing such data with partners owned by listed parties could need a US licence once the rule is in force.

What should we do before 10 January 2027?

Classify design data, map which legal entities can open it, screen their direct and indirect owners, treat unknown ownership as restricted, update contracts and make sure you can control, log and revoke access per file.

How does CADChain help?

CADChain encrypts CAD files at file level, applies per-file permissions and access rules, logs every access and records ownership on a blockchain, so companies can enforce and prove who received which design data. It does not classify technology or replace export control advice.