Use Cases for Emerging Technologies to Strengthen Export Controls on Biological Items

Rapid advances in emerging fields of science and technology increasingly pose risks for the regime for the prohibition of biological weapons. The use of emerging technologies such as artificial intelligence (AI) not only promises to speed up scientific development but also risks charting new pathways for the development, production, acquisition and proliferation of biological weapons.¹ While extensive research has been conducted on the risks associated with emerging technologies, fewer studies have explored the opportunities that emerging technologies provide to help reduce these risks and to strengthen states’ implementation of their biological weapon non-proliferation obligations. One area where states are increasingly exploring the adoption of emerging technologies for this purpose is export controls—that is, the set of policies and regulatory instruments that states use to govern the trade in military and dual-use items.²

National export control authorities (i.e. licensing, investigation, enforcement and intelligence agencies) play a key role in preventing transfers of pathogens and toxins, dual-use biological equipment, and related technology and software that could contribute to the proliferation of biological weapons. Export control authorities continuously need to adapt to keep up with the growing volumes of global trade and intangible transfers (i.e. non-physical transfers, e.g. via email or the cloud) and changing business models and supply chains, as well as the expanding range of actors that participate in the global biotechnology ecosystem.³

AI and distributed ledger technology (DLT) are emerging technologies that have received particular attention for their possible use across various functions of export licensing, compliance and enforcement and are thus the focus of this research policy paper. AI is an umbrella term for a wide set of computational techniques used to solve complex problems, such as natural language processing and learning, through acquisition, interpretation and reasoning using structured and unstructured data to achieve a specific goal. A distributed ledger is an immutable digital transaction ledger, such as blockchain, maintained through a distributed peer-to-peer network of nodes that each maintains a copy of the ledger verified through a consensus protocol and signed using cryptographic signatures (so-called hashes).

This research policy paper explores opportunities for export control authorities to adopt AI and DLT—and to adapt to the adoption of these technologies by exporters—in order to reduce biological weapon proliferation risks. It briefly profiles the roles of key export control authorities, before presenting three specific use cases of AI and DLT for strengthening the implementation of export controls. The paper concludes with recommendations on next steps towards advancing the use of these emerging technologies in export control.

I. The role of national export control authorities in preventing the proliferation of biological weapons

Under Article III of the 1972 Biological Weapons Convention (BWC), the states parties undertake to neither ‘transfer to any recipient’ proscribed biological agents, toxins, weapons, equipment or means of delivery nor ‘in any way to assist, encourage, or induce any State’ to ‘manufacture or otherwise acquire’ them.⁴ Under Article X, the states parties also ‘undertake to facilitate, and have the right to participate in, the fullest possible exchange of equipment, materials and scientific and technological information for the use of bacteriological (biological) agents and toxins for peaceful purposes’.

To meet their BWC commitments, many states have set up export control systems that enable oversight of international transfers of relevant pathogens, toxins and dual-use biological equipment and related technology and software. Their aim is to prevent transfers destined for proscribed biological weapon-related activities while safeguarding legitimate trade. As the implementation of export controls creates administrative burdens for exporters, it is important that states operate export control systems efficiently in order to limit—to the extent possible—any disruptions to legitimate trade. The main multilateral forum through which states coordinate their export controls on items related to biological (and chemical) weapons is the Australia Group. It currently has 42 participating states and the European Union (EU).⁵ The participating states agree on common guidelines for the responsible transfer of relevant dual-use items, maintain and update common control lists that define such items, and share their experiences with the implementation of the controls.⁶ Each Australia Group participant implements controls through its own national export control system and takes its decisions on whether to issue a licence to export independently.

The national authorities that contribute to a state’s export control system can generally be divided up into (a) licensing authorities, (b) investigative and enforcement agencies, and (c) intelligence agencies. Licensing authorities process (i.e. receive, assess, and grant or deny)—export licence applications. Investigative and enforcement agencies include national customs services, police services and prosecutor’s offices. National intelligence agencies, in particular foreign intelligence services, compile general country situation reports and risk assessments that can feed into both licence assessments and customs risk assessments. They also collect specific information on diversion and proliferation activities.

National export licensing authorities receive large amounts of data as part of licence applications and as part of the exchanging of intelligence, risk assessment and customs data with other domestic export control authorities. AI technologies can help process and analyse large amounts of such structured and unstructured data, and DLT can improve auditability of digital transactions through distributed record-keeping.⁷

II. Emerging technology use cases for export control authorities

Neither AI nor distributed ledger-based technology has yet been widely adopted by national export control authorities to strengthen the implementation of their national export control systems. However, studies and pilot projects have begun identifying and testing a range of possible use cases. These use cases are supported by a growing number of examples of deployments of AI and DLT in related areas that can serve as case studies for aspects of their usability, utility and limitations. The following three use cases outline specific challenges faced by export control authorities, related practices and, where applicable, current technologies in use. Each use case discusses how AI or DLT could be used to address specific challenges, and their current limitations. Notably, the three use cases discussed here do not represent an exhaustive account of relevant applications of AI and DLT but are rather a selection for illustrative purposes.

Use case 1. Using DLT to verify strategic trade flows and the authenticity of associated documentation

The implementation of export controls for biological (and other) dual-use items involves exporters compiling a set of documents to submit as part of the licence application. These provide key information about the item and about the declared end use and end user, and possible assurances from the recipient or national authorities of the recipient state, among others. The licensing and customs authorities should ideally be able to verify that this documentation is not falsified, altered or otherwise tampered with throughout the licensing process, shipping, and potential transit and trans-shipment, as well as post-delivery. The aim of this is to prevent illicit procurement of such items or their diversion or unauthorized re-export to biological weapon programmes and other activities proscribed by BWC Article III.⁸

The risk of falsification of documentation and obscuring of transaction parties

Previous illicit procurements of materials related to nuclear, biological or chemical weapons have, for example, sought to circumvent export controls by creating the appearance of a plausible arrangement of intermediaries that leads to a legitimate end user or which does not involve items that are subject to export controls.⁹ Proliferators make use of front companies that present a legitimate image and take advantage of critical nodes such as free ports and transit and trans-shipment hubs that can make tracing and verification of shipments more difficult. They also frequently falsify or tamper with required documents such as end-use or end-user certificates (e.g. by removing a clause prohibiting re-export). In these ways they compromise the integrity of the transaction and the broader supply chain that the export licensing process and the attached documentation seek to assure.¹⁰

The relevant national authorities may struggle to detect falsified documents submitted during licensing, trans-shipment, customs clearance or possible re-transfer. Streamlining and securing the exchange of information from the different contributing authorities and the processing of and secure access to all documentation accumulated related to a specific transfer is still difficult for many states.¹¹

DLT for authenticated licensing documentation

While a growing number of states have adopted electronic export licensing and customs declaration systems, the use of paper documentation is still widely accepted. In states with less advanced export control systems, it can be the standard. Even in states that have implemented electronic systems and software, there is a broad variety in capabilities, interoperability and integration between the various national authorities.

In this situation, adopting a DLT system for all of a state’s licensing documentation is currently neither realistic nor desirable. However, adopting DLT systems (e.g. blockchain) for specific licensing documentation has been proposed to address persisting challenges. It can, for example, help the secure management of sensitive data, the detection of falsified documents and identities, and the tracing of individual items.¹² Some commercial sectors have already adopted DLT to ensure the provenance and authenticity of items, including fresh produce, pharmaceuticals, artworks and diamonds.¹³ However, some pioneering DLT solutions (e.g. the TradeLens DLT platform created by Maersk and IBM for shipping companies) have also failed due to a lack of buy-in, incentives or institutional support and the momentum for adoption in regulatory functions appears to have slowed.¹⁴ Wider adoption of DLT in such functions is thus likely to depend on governance and incentives, not technology alone.

A permissioned blockchain for end-use and end-user documentation

One particularly promising use case would be the creation of a permissioned blockchain—that is, a closed network with additional control layers that limit access to information on the ledger to authenticated users with varying levels of permission. The permissioned blockchain would be operated by a national licensing authority and exporters would be required to exchange end-use and end-user certificates using this platform.¹⁵ Using a blockchain for this particular aspect of export controls could help improve verification of the exporter’s identity, the authenticity of end-use certificates and the end user’s identity, while maintaining privacy and chain-of-custody standards.

While a DLT cannot prevent the submission of a false digital identity by a transaction party or a falsified document, it can significantly increase barriers by requiring digital verification of identity when adding parties to the blockchain system, as well as timestamping and hashing each individual transaction and each modification of the documentation.¹⁶ This ensures the immutability of official documents, the traceability of any falsification attempts and permanent evidence of users attempting to use a false digital identity. Where digital assets are created to correlate with physical assets and to allow them to be traced and audited, including with a view to possible prosecutions of violations, such DLT solutions could simplify detection and prosecution and help deter violations.

Use case 2. Using AI to support classification of items

A key step in export control implementation is determining whether an item is subject to control. For physical goods, this usually involves comparing the technical specifications of an item with the parameters provided in relevant control list items. Controls on software are usually based on specific technical capabilities or the software being ‘specially designed or modified for the “development”, “production” or “use”’ of another controlled item.¹⁷ In the case of technology—that is, information, in the form of technical data or technical assistance, required for the development, production or use of a product—determining whether controls apply is often particularly difficult. National authorities have to be able to verify that the exporter has correctly classified the item (i.e. a good, software or technology) or if a false classification was submitted.

Keeping up with the demands of export licensing

Exporters expect the licensing process to be fast and efficient in order to prevent delays and uncertainties and thus competitive disadvantage. However, ensuring reasonable processing times while maintaining effective oversight is constantly demanding for many national authorities as volumes of trade grow, control lists and rationales for controls expand, and ever more intangible transfers of technology and software become subject to control.¹⁸ Human, financial and technical resources of national export control authorities have not grown in line with the demands in most states, resulting in longer processing time and reduced availability, for example, of classification assistance and direct engagement with exporters.

Many electronic licencing systems lack the technical capabilities to interface with information and data provided by other domestic export control authorities, which limits information exchange among the different authorities.¹⁹ Upgrading or even replacing an electronic licensing system is costly, time-intensive and a major project for any licensing authority. Many states provide a range of means to facilitate licensing by, for example, issuing general export authorizations for less sensitive transactions—these then allow exporters to ship multiple items to multiple destinations without having to reapply for a licence every time. However, even when guidance material on the use of these general licences is available, many exporters, particularly small and medium-size enterprises, struggle to determine whether they are eligible to use the general licence and to comply with its reporting requirements. As a result, they often rely on applying for single licences, increasing the case load for licensing authorities.²⁰

AI for classification of items and easing bottlenecks

Some states have begun exploring the use of AI in internal research or pilot projects or for narrow applications in the export control process. Customs authorities appear to be adopting AI-enabled solutions at a higher rate both for classification of items by tariff codes and for probabilistic risk assessment in customs screening and inspections.²¹ In contrast, only a small number of export licensing authorities have announced their adoption of AI technologies or have shared experiences from internal research and pilot projects. The most concrete example, to date, of a national licensing authority using an AI solution to assist classification of dual-use items comes from South Korea, where the Korean Institute of Nuclear Nonproliferation and Control (KINAC) has deployed the Intelligent Export Control Review System (IXCRS) to perform an initial classification of large volumes of items associated with the supply of nuclear power plants or research reactors.²²

A promising use case for AI technology in export control authorities is the use of a large language model (LLM) to perform an internal initial classification of an item based on the information provided by the exporter in a licence application. An LLM that has been custom trained on a sufficient amount of data on previous applications and classifications could be used to provide a first verification indication of the classification done by the exporter and a contextual analysis of whether submitted documents share characteristics with previous false classifications or falsified documents. Such an LLM would not be public facing and would be trained only on selected data. A human licensing official would still need to review and take the decision on the classification and what it means for the licensing process and decision. Building on AI-assisted classification, another use case would be an AI system that helps flag where a general licence could be used instead of several single licences and thus help reduce the burden on licensing authorities.

Notably, cybersecurity requirements place considerable limitations to the use of such AI tools, as do legal limitations on the extent to which a licensing authority might be allowed to use information provided in previous licence applications as training data. Any lack of an application programming interface (API) between the software and systems used by a state’s different export control authorities may also limit the utility and effectiveness of such tools.²³

Use case 3. Adapting to the use of AI-enabled compliance tools by exporters

Exporters of biological dual-use items—which could be major life science or pharmaceutical companies, start-ups in the biotechnology ecosystem, or laboratories, research institutes or universities—face challenges in complying with export controls. For large companies or research institutes, identifying the specific transactions subject to licence requirements among the significant volumes of transactions is difficult. The classification of items (as discussed in Use case 2) can also be complicated for exporters. Especially in the biotechnology sector, exporters already need to classify emerging technologies during the research and development phases and understand whether an export might occur. This requires considerable expertise and capacities as it often involves transfers of technical data, technical assistance or know-how.²⁴ Transaction party screening (including for restrictive measures)—which involves screening the end user and end use of the item considered for export—can also take significant time and require specific language skills that an exporter may lack.

Uptake in exporter use of AI for export control compliance

Exporters have increasingly adopted software tools to assist with some of the export control compliance steps, such as transaction party screening. These are either developed as in-house solutions or using commercial software and services offered by third-party vendors.²⁵ To manage intangible transfers of technology, many exporters have set up access-management and supply chain-management systems.²⁶ However, other steps (e.g. the classification of items) have not benefitted as much from software solutions. Classification is mainly carried out by an exporter’s export control compliance staff in cooperation with scientists and engineers. In the case of universities and research institutes, the decentralized nature of the work means that classification more often relies on scientists and engineers taking a lead role, with support from export control compliance staff.²⁷

Consultancy companies, other export control compliance service providers and exporters themselves are increasingly exploring the deployment of AI-supported tools to strengthen specific aspects of export control compliance procedures. These take advantage of recent advances in generative AI, particularly the capacities offered by LLMs. In particular, LLMs embedded in the exporter’s IT environment could be trained on specific, non-sensitive data in order to process significant volumes of information and unstructured data in a wide variety of languages.²⁸ Use of LLMs with such properties in an exporter’s compliance procedures would both ensure that sensitive data remains within the exporter and—through curation of the training data—reduce the risk of data poisoning. The integration of LLM-enabled tools into compliance workflows should not replace human judgement. Instead, it could help non-compliance staff provide information required for item classification, transaction party screening and other internal compliance procedures. The use of such tools could give compliance staff more time to focus on complicated cases, to take final decisions on cases and to ensure systematic proof of due diligence.²⁹

Adaptation and guidance provision by national authorities

Although the use of AI tools to support compliance is largely still in a developmental stage, some products are already commercially available. These include both tools for item classification and tools for transaction party screening.³⁰ At the same time, AI solutions could be misused to spoof or specifically counter the approach and methods of systems used by national export control authorities. For example, dual-use items could be misclassified in order to avoid detection. This could void some of the opportunities offered by AI.

These developments stress the need for national authorities to pursue and deepen dialogue with exporters and providers that are exploring AI-supported tools. This dialogue should cover how these tools could be used to meet obligations related to auditability, the retention periods for record-keeping and how to demonstrate the reasoning for results provided by such tools.

As the adoption of AI-enabled compliance tools progresses, national authorities—and, in the EU, the European Commission—may need to consider providing additional guidance. Specifically, they could consider providing new updated guidance materials on various export control topics in the light of the development of relevant AI systems, including internal compliance programmes (ICPs).³¹

III. The way forward

Adoption of AI and DLT by national export control authorities depends on many factors, including resources, innovation culture, bureaucratic politics and incentivization. They have been cautious in their exploration of AI tools for the implementation and enforcement of export controls, with cyber- and data-security considerations being of particular concern. The deployment of DLT continues to be discussed, in particular for applications in the wider supply-chain security framework. However, the momentum for its deployment in export control applications has markedly slowed down compared to the drive for the adoption of AI technologies.

Meanwhile, among compliance professionals, the development and marketing of AI-enabled trade compliance solutions—in particular product-classification tools—is spreading much more quickly. However, there are still significant limitations to the available tools, particularly for application in research- and innovation-heavy fields such as biotechnology. They cannot—and will probably never—substitute for adequate resourcing and final human assessment.

To help reap the benefits of AI and DLT in export control applications, states should facilitate the sharing of experiences between their national export control authorities. The Australia Group is one forum through which the participating states could share and discuss experiences, concerns and lessons learned from pilot projects that explore the adoption of AI-enabled tools and DLT systems by their national export control authorities. This could feed into and inform discussions within the wider framework of the BWC, thereby contributing to possible standard-setting and the strengthening of compliance with strategic trade controls around the world. Enabling global access to appropriate tools that make use of AI or DLT is essential. It could help increase both effectiveness and efficiency and thus reduce the impact of export controls on legitimate international trade in biological materials and related equipment, software and technology for peaceful purposes.

The adoption of emerging technologies by compliance professionals equally challenges national export control authorities to be prepared for assessing and auditing internal compliance programmes that use such tools. With AI increasingly posing new risks of biological weapon proliferation by unlocking new formulations, one approach to strengthen licensing and compliance systems could be AI-assisted human red-teaming of export and customs procedures. However, the use of AI for red-teaming also foreshadows the use of such tools to enable proliferators’ illicit procurement and circumvention tactics.³²

Endnotes

1. 1 Brockmann, K., Bauer, S. and Boulanin, V., Bio Plus X: Arms Control and the Convergence of Biology and Emerging Technologies (SIPRI: Stockholm, Mar. 2019).
2. 2 On another area see Smith, M., ‘Use cases for emerging technologies to strengthen high-containment laboratory governance’, SIPRI Research Policy Paper, Dec. 2025.
3. 3 Brockmann, K., Héau, L. and Maletta, G., ‘Cloud labs and other new actors in the biotechnology ecosystem: Export control challenges and good practices in outreach’, Non-proliferation and Disarmament Papers no. 98, EU Non-proliferation and Disarmament Consortium, May 2025.
4. 4 Convention on the Prohibition of the Development, Production and Stockpiling of Bacteriological (Biological) and Toxin Weapons and on their Destruction (Biological Weapons Convention, BWC), opened for signature 10 Apr. 1972, entered into force 26 Mar. 1975, British Foreign and Commonwealth Office, Treaty Series no. 11 (1976).
5. 5 Australia Group, ‘Introduction’, [n.d.]; and Australia Group, ‘Objectives of the Group’, [n.d.].
6. 6 Australia Group, ‘Guidelines for transfers of sensitive chemical or biological items’, June 2015; and Australia Group, ‘Common Control Lists’, [n.d.]. See also Brockmann, K., ‘The Australia Group at 40: Making the AG fit for an era of geopolitical competition’, Non-proliferation and Disarmament Papers no. 99, EU Non-proliferation and Disarmament Consortium, June 2025.
7. 7 Fefer, R. F., ‘Blockchain and international trade’, In Focus IF10810, US Congress, Congressional Research Service, 25 June 2019. On the specific challenges posed by the use of AI by intelligence agencies, which are not discussed in this paper, see e.g. Brown, Z. T., ‘“The incalculable element”: The promise and peril of artificial intelligence’, Studies in Intelligence, vol. 68, no. 1 (extracts, Mar. 2024).
8. 8 Cándano Laris, D., ‘Blockchain applications for export control compliance and global supply chain integrity’, ed. C. Vestergaard, Blockchain for International Security: The Potential of Distributed Ledger Technology for Nonproliferation and Export Controls (Springer: Cham, 2021), p. 95.
9. 9 Bauer, S. and Bromley, M., Detecting, Investigating and Prosecuting Export Control Violations: European Perspectives on Key Challenges and Good Practices (SIPRI: Stockholm, 2019), pp. 23–24, 27.
10. 10 Cándano, D., ‘Blockchain for export controls’, Stimson Center, 6 Apr. 2020; and Cupitt, R. T., ‘Blockchain for global trade in dual-use chemicals’, ed. Vestergaard (note 8).
11. 11 Cándano Laris (note 8), p. 95.
12. 12 Gahlaut, S., ‘Mental block? Time to revisit the potential of distributed ledger technology’, WorldECR, 9 Nov. 2021; and Cándano Laris (note 8), p. 97.
13. 13 Copigneaux, B. et al., Blockchain for Supply Chains and International Trade: Report on Key Features, Impacts and Policy Options, PE 641.544 (European Parliamentary Research Service, Panel for the Future of Science and Technology: Brussels, May 2020).
14. 14 Bousquette, I., ‘Blockchain fails to gain traction in the enterprise’, Wall Street Journal, 15 Dec. 2022.
15. 15 Cupitt (note 10), p. 83.
16. 16 Cándano Laris (note 8), p. 100.
17. 17 Regulation 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (recast), Official Journal of the European Union, L 206, 11 June 2021, annex I passim.
18. 18 Reinsch, W. A. and Benson, E., ‘Keeping pace: Export controls and the “promise” of digitised compliance’, WorldECR, no. 111 (July–Aug. 2022).
19. 19 ‘Germany to issue DU licenses exclusively in electronic form’, University of Liège, European Studies Unit, 25 Feb. 2021; and Representative of a national export control authority, Interview with authors, 17 Oct. 2025.
20. 20 Representative of a national export control authority, Interview with authors, 17 Oct. 2025.
21. 21 Chowdhary, R. et al., ‘Revolutionising customs with AI: Dream big, start small’, PwC, 2024; and Mikuriya, K. and Cantens, T., ‘If algorithms dream of customs, do customs officials dream of algorithms? A manifesto for data mobilisation in customs’, World Customs Journal, vol. 14, no. 2 (Sep. 2020).
22. 22 Tae, J. and Shin, D., ‘Keyword clustering for comparing documents in different languages’, International Journal of Machine Learning and Computing, vol. 5, no. 4 (Aug. 2015); and Shin, D., ‘Applications of artificial intelligence in the export control domain’, eds Y. Bi, S. Kapoor and R. Bhatia, Proceedings of SAI Intelligent Systems Conference (IntelliSys) 2016, vol. 2, Lecture Notes in Networks and Systems no. 16 (Springer: Cham, 2018).
23. 23 Representative of a national export control authority, Interview with authors, 17 Oct. 2025.
24. 24 KPMG, ‘Export compliance in the life sciences: Keys to international growth’, 2022.
25. 25 Sayari, ‘Law enforcement & regulatory: Illuminating cross-border illicit networks’, [n.d.]; and AEB, ‘Software trade compliance management’, [n.d.].
26. 26 Ankel, P. and Clark, E., ‘Export controls—Breaking new digital ground and driving impact through internal audit at Siemens’, WorldECR, no. 69 (May 2018).
27. 27 US Department of Commerce, Bureau of Industry and Security, ‘How to classify your item’, [n.d.], slide 18.
28. 28 Xapien, ‘Xapien FAQs’, [n.d.].
29. 29 Senior compliance officer in an international semiconductor research organization, Interview with authors, 16 Sep. 2025.
30. 30 See e.g. Deloitte, ‘TRADEclassifier’, [n.d.]; Deloitte, ‘Future proofing your sanctions compliance program’, 9 June 2025; Sayari (note 25); and Sayari, ‘Sayari acquires Mirato, combining unrivaled global commerce and trade data with AI workflow automation’, Press release, 28 July 2025.
31. 31 See e.g. European Commission, Commission Recommendation (EU) 2021/1700 of 15 September 2021 on internal compliance programmes for controls of research involving dual-use items under Regulation (EU) 2021/821 of the European Parliament and of the Council setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items, Official Journal of the European Union, L 338, 23 Sep. 2021.
32. 32 Urbina, F. et al., ‘Dual use of artificial-intelligence-powered drug discovery’, Nature Machine Intelligence, vol. 4, no. 3 (Mar. 2022); and Bray, D., ‘AI–human hybrid red teaming: A new paradigm for trade compliance and supply chain resilience’, WorldECR, no. 142 (Sep. 2025).