Trust as a Trade Asset

On Nov. 19, 2025, the Commerce Department issued a three-sentence statement that said more about the future of American exports than most trade speeches. It authorized G42, an artificial intelligence company in the United Arab Emirates, and Humain, its Saudi counterpart, to buy “the equivalent of up to 35,000” of Nvidia’s advanced Blackwell GB300 chips. The approvals were “conditioned on both companies meeting rigorous security and reporting requirements,” and the department’s Bureau of Industry and Security would keep monitoring compliance. The buyers did not get the chips alone. They got the chips plus a set of rules about how the chips would be guarded, and a U.S. agency that would keep checking. That bundle is becoming part of the product. Across artificial intelligence, defense supply chains and consumer electronics, Washington is treating security requirements that companies once filed under paperwork as something closer to a seal of quality. For a foreign buyer choosing the technology its economy will run on for the next decade, the question is no longer only who makes the fastest chip or the cheapest router. It is whose rules it can live with and whose promises it can verify. Selling the Whole Stack The clearest expression of the idea is a program few executives outside the tech industry have heard of. On July 23, 2025, the White House issued Executive Order 14320, which directed Commerce to create the American AI Exports Program. Its stated aim is to “decrease international dependence on AI technologies developed by our adversaries.” The order does not promote chips or software on their own. It asks industry consortiums to propose full packages: AI hardware and data centers, cloud and networking services, data pipelines, AI models, applications for fields such as health care, education and agriculture and, as a required layer, measures to ensure “the security and cybersecurity of AI models and systems.” Commerce opened its first call for proposals on April 1, 2026, and accepted bids through June 30. Selected packages can receive priority government-to-government advocacy, faster engagement on export licenses and easier access to federal financing. On July 6, the International Trade Administration said companies had submitted 78 applications, which would be reviewed before the secretary issues final designations. It set no date for those decisions. The logic is commercial as much as strategic. A government that buys a national AI system is choosing suppliers, operating standards and a technology ecosystem it will depend on for years. A package that arrives with a security layer, an export license already cleared and Washington’s backing is easier to defend before a parliament than a cheaper system whose supply chain no one can audit, provided it also meets the buyer’s technical needs and budget. The Audit Behind the Contract The defense supply chain shows both the promise and the price of the approach. On Nov. 10, 2025, the Pentagon began phasing in the Cybersecurity Maturity Model Certification, known as CMMC, under a final rule published in the Federal Register. Contractors that handle sensitive government information must show that their systems meet set security controls before they can win the work. The rule applies to contractors “whether foreign or domestic.” The department estimated that about 338,000 companies, most of them small businesses, would eventually be covered. The rollout has since slowed. On July 13, 2026, the department suspended Phase II, which was set to require third-party assessments starting Nov. 10, 2026. It cited “prohibitive compliance costs” for small businesses and a shortage of qualified assessors, and it created a task force to review the program. Self-assessments under Phase I remain in force, as do the underlying security obligations. The pause is a reminder that a credential has value only if suppliers can afford to earn it. For a machine shop in Ohio or a parts supplier in Poland, new controls and audits are a real cost. A program that verifies security without pricing small firms out of the supply chain would give them something more useful than a burden: proof, recognized by a demanding customer, that their systems can be trusted. A Label That Had to Earn Its Own Trust The consumer version of the idea shows how seriously Washington now treats the question of who does the checking. The U.S. Cyber Trust Mark, a voluntary label run by the Federal Communications Commission, is meant to tell shoppers that a smart camera or baby monitor meets cybersecurity standards based on guidance from the National Institute of Standards and Technology. In 2025, the program stalled over its own supply chain. UL Solutions, chosen as lead administrator, stepped down on Dec. 19 after the FCC examined its joint venture with a Chinese company and its testing sites in China. On April 13, 2026, the commission named the ioXt Alliance, a U.S.-based nonprofit, to replace it. The delay cost the program time. It also made the point that a trust label is only as credible as the people verifying it, and that Washington was willing to wait rather than compromise that chain. What Trust Costs The sharpest objections come from people who share the goal. In a June 11 analysis for Just Security, Sam Winter-Levy and Teddy Tawil of the Carnegie Endowment for International Peace argued that the AI exports program risks taking credit for deals American companies would win anyway. They noted that the first project marketed under it was a data center in South Korea, a close ally that already buys from U.S. vendors, and urged Commerce to name priority markets where the contest with Chinese suppliers is real. The criticism sharpens the point rather than undercutting it. Trust has commercial value where buyers have a real alternative. In Seoul, it confirms a choice already made. In a country weighing a cheaper offer from a strategic rival, a security layer that a U.S. agency stands behind can decide the contract. The Next Test The pieces are in place: chip approvals tied to security conditions, a defense certification that foreign suppliers must also meet, a consumer label with a vetted administrator and an AI program that sells security as part of the package. Three decisions will show whether they add up to an export strategy. Commerce has to choose among the 78 AI proposals and say which countries they target. The Pentagon’s task force has to find a version of CMMC that small suppliers can pass. The FCC has to get labeled devices onto store shelves. If those steps land in the markets where buyers still have a choice, the United States will be selling something its competitors find hard to copy: technology that comes with proof. Sources • U.S. Department of Commerce, Statement on UAE and Saudi Chip Exports (Nov. 19, 2025) • The White House, Executive Order 14320: Promoting the Export of the American AI Technology Stack (July 23, 2025) • International Trade Administration, Department of Commerce Begins Inaugural Call for Proposals for American AI Exports Program (April 1, 2026) • International Trade Administration, Commerce Statement on Application Conclusion, Next Steps of the American AI Exports Program (July 6, 2026) • Federal Register, DFARS: Assessing Contractor Implementation of Cybersecurity Requirements, final rule (Sept. 10, 2025) • Davis Wright Tremaine, Department of Defense Suspends CMMC Phase II (July 2026) • Broadband Breakfast, FCC Seeking More Cyber Trust Mark Administrators (Jan. 26, 2026) and FCC Picks ioXt Alliance to Head Cyber Trust Mark Program (April 2026) • Sam Winter-Levy and Teddy Tawil, analysis of the American AI Exports Program, Just Security (June 11, 2026)