The US Department of Commerce’s recent imposition in mid-June of an export licensing requirement (since lifted at end of June for select US entities) on exports, reexports, and in-country transfers of Anthropic’s Claude Mythos 5 Model and Claude Fable 5 Model to all destinations worldwide and to “all foreign persons” is a stark reminder of how export controls may go beyond the control of physical goods and also apply to intangible goods such as software, AI models, or technology transfers in the cloud. More recent news about AI models going rogue and a proposed bipartisan “AI Kill Switch” bill introduced by two US congressmen foreshadow additional controls in the near future.
Traditionally export controls controlled the physical movement of physical goods. The rapid growth of the digital economy has required governments to consider export controls on the transfer by intangible means (e.g., uploading/downloading from a server) of certain intangible goods (e.g., software, AI models and technology). This update is intended to consider the status of Canada’s export control regime as it applies to certain software, transfers in the cloud, and AI which continue to integrate and intersect in the modern digital economy.
Canada’s Export Control Regime
For national security and foreign policy reasons, Canada maintains comprehensive controls on the export of certain military and strategic goods. The Export and Import Permits Act (EIPA) is the central piece of legislation controlling the export of certain goods, software and technology. Under the EIPA, the federal government has established a list of items (i.e., goods, software and technology) called the Export Control List (ECL) to ensure that exports of controlled items from Canada are made in a manner consistent with Canada’s national interests and international obligations. Listed items on the ECL require an export permit from Global Affairs Canada subject to certain exemptions and exceptions.
The ECL incorporates by reference, A Guide to Canada’s Export Control List (ECL Guide) which divides ECL items into distinct groups which include:
|
|
|
|
|
|
|
|
Key Concepts Relevant to Intangible Goods and Intangible Transfers
Intangible goods such as software are generally transferred by intangible means. The days when software was delivered or transferred via a physical medium such as a CD or DVD are long gone. Software is now generally uploaded to and downloaded from private remote or cloud servers.
The ECL covers both physical shipments and transfers of controlled software or technology by intangible means. Under the EIPA, transfer means, in relation to technology or software, to dispose of it or disclose its content in any manner from a place in Canada to a place outside Canada. Global Affairs Canada, in its Export and Brokering Controls Handbook provides for several examples of exports by intangible means including downloads or other electronic file transfers, file sharing, cloud access and e-mails.
Software
Software and related technology are typically listed as specific sub-entries to the groups in the ECL Guice. For example, software specially designed or modified for military, nuclear or missile items or related software for chemical and biological items are listed as items within these specific groups. Typically, businesses dealing with items controlled under these groups are aware of their export control obligations for related or specially designed software.
Nevertheless, it can come to a surprise to many businesses that export software for legitimate commercial purposes that the software may be considered dual- use (i.e., although designed for civilian purposes it may also have a military use or be used to produce military items) and therefore listed under Group 1 of the ECL Guide and controlled for export. Most modern software contains or makes use of encryption or cryptographic libraries, which is a major reason why modern software may be considered dual-use and therefore subject to export control.
The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies (Wassenaar Arrangement) is a voluntary multilateral export control regime that has 42 participating members, including Canada and the United States. Understanding that cryptography may be used to undermine or threaten international security (brings to mind the World War II German Enigma machine depicted in the movie, “The Imitation Game”), the participating members of the Wassenaar Arrangement committed to implementing export controls on cryptography and encryption items.
Encryption items or cryptographic products are included in Group 1: List of Dual-Use Goods and Technologies (Group 1) of the Wassenaar Arrangement which is incorporated into the ECL Guide. Category 5 – Part 2 – “Information Security” of Group 1 provides for Cryptographic “Information Security” which includes products, software and technology that are designed or modified to use cryptography that employs digital techniques and performs any cryptographic function other than certain functions such as authentication, digital signature, data integrity and digital rights management. Software that contains or can make use of encryption or cryptography may therefore be subject to export control. Many popular software tools and applications contain or make use of cryptography and therefore must be checked against Group 1, Category 5-Part 2 of the ECL Guide prior to export or transfer outside of Canada. Where covered by the ECL, one must consider whether the software meets any exceptions or exemptions such as the “mass market” exception under the Cryptography Note (Note 3). Where it does not, an individual export or multi-destination permit must be obtained, or the software transfer must meet the conditions of any applicable general export permit prior to any transfer outside of Canada.
Other examples of dual-use software listed in Group 1 of the ECL Guide include certain intrusion software, software for digital computers and computer-aided design software designed for the development of integrated circuits.
Cloud Guidance
In November of 2025, Global Affairs Canada issued for the first time guidance on when the use of cloud services constitutes a transfer of controlled technology within the meaning of the EIPA. In its Notice to exporters no 1159 – Guidance on the movement to and storage of controlled technology in the Cloud (Cloud Guidance), Global Affairs Canada noted that industry increasingly relies on cloud computing solutions to store and share files permitting businesses and individuals to access data, technology, and services from anywhere on servers routinely located all over the world.
Reasonable Possibility of Access or Examination
The Cloud Guidance introduces new guidance on the term disclosure as it applies to the concept of transfers of technology under the EIPA. Under the EIPA, transfer means, in relation to technology, to dispose of it or disclose its content in any manner from a place in Canada to a place outside Canada.
The key point in the Gloud Guidance is that a disclosure occurs where there is a reasonable possibility that a person located outside of Canada would be able to examine or access controlled technology that was initially sent from Canada and subsequently stored in a foreign location. Reasonable possibility means more than a mere possibility, but less than the standard of more likely than not – if there is more than a remote possibility that controlled technology may be directly examined or accessed by a person outside of Canada in a usable form or where that person holds decryption keys or access rights in a way that creates more than a remote possibility of access. The Cloud Guidance emphasizes that the determination of whether there is a transfer does not require clear and definitive evidence or certainty that the technology has been or will be accessed outside of Canada.
The Cloud Guidance, although specifically addressing transfers of technology, is also helpful when considering software transfers as the concepts in the Gloud Guidance serve to inform any situation where an intangible good (e.g., software) is transferred by intangible means (e.g., upload/download). The Export and Brokering Controls Handbook when considering exports by intangible means specifically references software together with technology.
Recent Development and Proposed Amendments Relevant to AI
Unlike the US Department of Commerce, Global Affairs Canada has yet to directly target specific AI models or systems. Rather, the focus to date has been on the physical hardware and tools required for AI models and systems. Relatively recently introduced Group 5, Item 5506 – Other Strategic Goods and Technology of the ECL includes controls on the following physical hardware and equipment that power AI systems. Current and proposed export controls relevant to the AI industry include:
- Quantum computer and related equipment
- Advanced semiconductor manufacturing equipment and materials
- Lithography and epitaxial dispositioning equipment
- Boards containing field programmable logic devices
- Advanced computing integrated circuits and electronic assemblies
- Specialized powders used in additive manufacturing (3D printing)
In introducing the latest round of proposed controls in April of 2026, Global Affairs Canada commented that “rapid advances in high-performance computing and semiconductor manufacturing have increased the potential for these technologies to be used in the development of military systems, including artificial intelligence.” Global Affairs Canada also noted that “[l]ithography and deposition equipment are critical to fabricating the smallest and fastest microprocessors, which are increasingly used in artificial intelligence” systems.
As is the case with other areas parts of the ECL, these controls not only apply to the export of the physical good, but also to any software or technology necessary for the development or use of the physical good. Important to keep in mind that, as of now, the controls apply to software and technology used in the production or development of the physical hardware used in AI systems, rather than controls on specific AI models or systems.
Implications for Business
The above should be of concern to any Canadian and international businesses that use, develop or transfer software or technology, use cloud computing or operate in the AI sector. Export controls continue to dynamically evolve together with the tools used in the modern digital economy and businesses should understand any related export control obligations that they may have and ensure that they have the necessary compliance infrastructure in place.
How Cassels Can Help
The Cassels International Trade Group has extensive experience advising Canadian and international clients on export controls and can assist clients in navigating their export control obligations as they may apply to software or technology, transfers in the cloud or AI. Our team will continue to monitor any future developments.