Illustrative: packages on a board with routed traces carrying clocked signals, or a data hall of racks and their status lights

Risk Academy, led by the Nexus Consortium · Course catalogue · Governance, Policy and International Affairs

Science, Technology and Society

Technology security: dual-use, export controls and compute governance

Technology security: dual-use, export controls and compute governance, taught twice over: as the working methods of the field and as its frontier since 2024, with labs on the Academy's tools, open data and the Nexus Standards.

Core course Frontier course

The discipline

01Core course · L2 Intermediate

Technology security: dual-use, export controls and compute governance: foundations and practice

This area covers the security governance of technologies that can be used for harm as well as benefit: dual-use research and goods, export control regimes, investment screening and the governance of advanced compute.

Level
L2 Intermediate
Study time
about 24 hours (planning estimate)
Status
In authoring
Prerequisites
An L1 course in the area, or an entry review

Why now

Country reclassification shows how compute access is tied to bilateral security deals, shaping where AI capacity can be built. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Eases Export Controls for UAE, 10 July 2026

Learning outcomes

  1. Define dual-use item and the other key terms of the discipline and use them correctly in a written case
  2. Explain dual-use technology and research and multilateral export control regimes with a worked example and its source
  3. Apply the discipline's method to a documented case and explain each result with its source
  4. Analyse a named case against national export and investment screening, stating evidence, date and limits

Modules

  1. Dual-use technology and research
    • Dual-use technology and research
    • Multilateral export control regimes
    • National export and investment screening
  2. Compute governance and thresholds
    • Compute governance and thresholds
    • Semiconductor supply and controls
    • Technology transfer and research security
  3. Compliance programmes for controlled items
    • Compliance programmes for controlled items
    • Effects of controls on innovation and access
  4. Lab: the discipline's method
    • The compute used to train a model is about six times its parameter count times the tokens it sees; measured in floating-point operations, that quantity is compared with a stated threshold, and crossing it triggers obligations, screening and sometimes a licence decision.
    • Work the method through a documented case and explain each result
    • Read the method's sources and stated values

Labs with Academy tools

Nexus Standards

Teaches

  • NRS-T0 Exponential technology risk and responsible innovation
  • NRS-P8 Security, terrorism and geopolitical risk
  • NRS-H97 Hazard family: AI misuse and capability uplift
  • NRS-H100 Hazard family: Robotics, autonomy and autonomous weapons
  • NRS-M19 Method fabric: Cyber, AI and frontier technology

Relies on

  • NS-1 The UNI and the artefact catalogue
  • NS-16 UNI application profile (how articles, documents, code, data, APIs and interfaces carry the UNI)
  • NRS-C1 Risk vocabulary and ontology
  • NRS-C2 Risk assessment method
  • NRS-C3 Hazard, exposure, vulnerability and capacity data
  • NRS-C4 Risk data model, identifiers and exchange
  • NRS-C6 Systemic and cascading risk
  • NRS-C7 Early warning, triggers and anticipatory action

Assessment

  • 40%Lab recordWork the discipline's method through a documented case and explain each result with its source and date
  • 40%Case memoApply the discipline's methods to a named place or organisation, stating evidence and limits
  • 20%Key terms checkShort answers on the key terms, marked against the definitions

Delivery

  • Self-paced online, with the labs in the browser
  • Cohort study over six to eight weeks, with a weekly lab review
  • Co-delivered with a partner institution, inside its own courses

Partner on this course

  • Co-teach a module and bring a current case from your work
  • Host a cohort for your learners, with your own schedule and review
  • Contribute a lab: a dataset your institution publishes openly, or a model
  • Review the course content and its references before it opens
  • Translate the course and adapt its cases to your region

How institutions and experts take part

In the Academy LMS

Course on the learning platform
Intermediate, 4 topics
Cohort group
A community group for each cohort of learners
Achievement
Recorded on completion of the assessed work

References

  1. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Eases Export Controls for UAE, 10 July 2026
  2. Sastry and others, Computing Power and the Governance of Artificial Intelligence, 2024
  3. European Parliament and Council, Regulation (EU) 2024/1689 (Artificial Intelligence Act), 2024
  4. European Parliament and Council, Regulation (EU) 2021/821 setting up a Union regime for the control of exports of dual-use items, 2021
02Live map

Activity and hazards in the Black Sea region

Night-time lights and population, the geography of production and markets, with floods and sea state, over the Black Sea region.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Activity and hazards

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Activity and hazards, framed on the Black Sea region.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONETSources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • GHRSST Level 4 MUR analyses, NASA Jet Propulsion Laboratory; distributed by the NASA Physical Oceanography DAAC (PO.DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Weather data by Open-Meteo.com (https://open-meteo.com/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
  • Optional layers (5 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
  • Sea surface temperature anomaly: GHRSST MUR25, NASA JPL PO.DAAC · 12 Oct 2026
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

03How learning runs

How learning runs, as a process you can run

Select a scenario and press Play: course, pathway, practice, faculty, cells and record.

04What is changing

What is changing, with standards and evidence

Technology security: dual-use, export controls and compute governance: frontier methods

The methods, data, tools and studies that changed technology security: dual-use, export controls and compute governance between 2024 and 2026, taught by reproducing them on open data.

Level
L3 Advanced
Study time
about 28 hours (planning estimate)
Status
Planned
Prerequisites
Technology security: dual-use, export controls and compute governance: foundations and practice; Working knowledge of a scripting language (Python or R) for the labs

Why now

Country reclassification shows how compute access is tied to bilateral security deals, shaping where AI capacity can be built. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Eases Export Controls for UAE, 10 July 2026

Learning outcomes

  1. Explain what changed in technology security: dual-use, export controls and compute governance since 2024 and cite the studies, data or rules behind each change
  2. Reproduce US eased export controls for the United Arab Emirates on open data and state the uncertainty of the result
  3. Evaluate a 2024 to 2026 study: its question, data, method, limits and what it changes for practice
  4. Design an analysis that combines a frontier method with the faculty's instruments, and justify each choice

Modules

  1. US eased export controls for the United Arab Emirates
    • Commerce moved the UAE to Country Group A:5, allowing approved entities licence-free access to certain controlled items, and approved the UAE government and some firms to receive advanced AI chips and servers without a licence.
    • Country reclassification shows how compute access is tied to bilateral security deals, shaping where AI capacity can be built.
    • Bureau of Industry and Security, US Department of Commerce, 10 July 2026
  2. US moved to case-by-case review of advanced chips to China
    • BIS revised licence review policy so applications for Nvidia H200, AMD MI325X and similar chips to China are reviewed case by case, subject to conditions on supply to US customers, buyer compliance and independent testing in the US.
    • Conditional licensing shows controls being tuned rather than simply tightened, which affects planning for semiconductor supply and access.
    • Bureau of Industry and Security, US Department of Commerce, 13 January 2026
  3. US export controls now cover affiliates of listed entities
    • A BIS rule makes companies at least 50 per cent owned by Entity List or Military End-User List parties subject to the same restrictions, closing a loophole; significant minority ownership becomes a red flag for due diligence.
    • Ownership-based screening raises the bar for know-your-customer checks in controlled item compliance programmes.
    • Bureau of Industry and Security, US Department of Commerce, 29 September 2025
  4. US rescinded the AI Diffusion Rule and tightened chip guidance
    • Commerce rescinded the January 2025 AI Diffusion Rule, which had tiered countries and controlled closed model weights, before it took effect.
    • Compute governance rules can change abruptly, so exporters and data centre operators need adaptable compliance programmes.
    • Bureau of Industry and Security, US Department of Commerce, 13 May 2025
  5. US outbound investment rules took effect for China tech sectors
    • Treasury's final rule bars or requires notification of certain US investments in semiconductors, quantum and AI involving China, including the Hong Kong and Macao Special Administrative Regions.
    • Investment screening now extends to capital flowing out, adding a compliance layer for funds and firms with technology exposure.
    • US Department of the Treasury, 28 October 2024
  6. Reproduction lab
    • Extend the discipline's method with one frontier method and compare its results
    • State the uncertainty and the limits of the result
    • Peer review against a shared checklist
  7. Technology that helps and the risks it carries
    • Foresight tools and regulatory sandboxes.
    • Threats to information integrity, and AI in public decisions.

Labs with Academy tools

Nexus Standards

Teaches

  • NRS-T0 Exponential technology risk and responsible innovation
  • NRS-P8 Security, terrorism and geopolitical risk
  • NRS-H97 Hazard family: AI misuse and capability uplift
  • NRS-H100 Hazard family: Robotics, autonomy and autonomous weapons
  • NRS-M19 Method fabric: Cyber, AI and frontier technology

Relies on

  • NS-1 The UNI and the artefact catalogue
  • NS-16 UNI application profile (how articles, documents, code, data, APIs and interfaces carry the UNI)
  • NRS-C1 Risk vocabulary and ontology
  • NRS-C2 Risk assessment method
  • NRS-C3 Hazard, exposure, vulnerability and capacity data
  • NRS-C4 Risk data model, identifiers and exchange
  • NRS-C6 Systemic and cascading risk
  • NRS-C7 Early warning, triggers and anticipatory action

Assessment

  • 50%Method reproductionReproduce one frontier method on open data and state the uncertainty of the result
  • 30%Study reviewA critical review of a 2024 to 2026 study: question, data, method, limits, what it changes
  • 20%Peer reviewReview two other learners' reproductions against a shared checklist

Delivery

  • Self-paced online, with the labs in the browser
  • Cohort study over six to eight weeks, with a weekly lab review
  • Co-delivered with a partner institution, inside its own courses

Partner on this course

  • Co-teach a module and bring a current case from your work
  • Host a cohort for your learners, with your own schedule and review
  • Contribute a lab: a dataset your institution publishes openly, or a model
  • Review the course content and its references before it opens
  • Translate the course and adapt its cases to your region

How institutions and experts take part

In the Academy LMS

Course on the learning platform
Expert, 7 topics
Cohort group
A community group for each cohort of learners
Achievement
Recorded on completion of the assessed work

References

  1. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Eases Export Controls for UAE, 10 July 2026
  2. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Revises License Review Policy for Semiconductors Exported to China, 13 January 2026
  3. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Expands Entity List to Cover Affiliates of Listed Entities, 29 September 2025
  4. Bureau of Industry and Security, US Department of Commerce, Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule, Strengthens Chip-Related Export Controls, 13 May 2025
  5. US Department of the Treasury, Treasury Issues Regulations to Implement Executive Order Addressing U.S. Investments in Certain National Security Technologies and Products in Countries of Concern, 28 October 2024
  6. Sastry and others, Computing Power and the Governance of Artificial Intelligence, 2024
  7. European Parliament and Council, Regulation (EU) 2024/1689 (Artificial Intelligence Act), 2024
  8. European Parliament and Council, Regulation (EU) 2021/821 setting up a Union regime for the control of exports of dual-use items, 2021
05Take part

Take part in the work

Start from who you are.

06Questions

Questions, answers and key terms

Is the course free?
Yes. Every course and learning material of Risk Academy, led by the Nexus Consortium, is free to study, self-paced or with a cohort. Ordinary participation has no fee; paid work, internships and fellowships are separate arrangements.
What does completing a course give me?
A completion record: the course, its version, the date and what was assessed, private by default and shared by you. It stacks into discipline, department and programme achievements. A record states what was studied and assessed and does not certify competence; it is not a licence, a professional title or an employment status.
Where do the data and the places come from?
Every faculty teaches on a twin of a real place built from open data; each layer carries its provider, licence and date, and every result on the Academy states its source. Maps and figures are indicators for teaching, never an assessment of a place.
How do I take part beyond the course?
Form a competence cell of three to seven people, study a shared pathway, take a supervised assignment in the National Working Groups, or bring a cohort from your institution. For organisations.

Key terms

Term

Dual-use item

A good, software or technology that can be used for both civilian and military or harmful purposes.

Term

Export control

A legal restriction on sending certain goods, software or technology abroad.

Term

Investment screening

A government review of foreign investment in sensitive sectors for security risk.

Term

Compute governance

Rules and practices that oversee access to and use of large-scale computing for advanced AI.

ReportsContribute

Contribute evidence from this page.

Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Risk Academy
Related

Around Technology security: dual-use, export controls and compute governance: courses

Risk Academy

Study technology security: dual-use, export controls and compute governance with us, or teach it

Every course is free and open. Institutions and experts can co-teach, host a cohort, contribute a lab or review a course before it opens.

Browse the course catalogue Partner with the Academy
Risk Academy

Courses · practice · credentials

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Support our work

Who funds us

Risk Academy is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices