The Question Every ITAD Facility Is Suddenly Asking
Hyperscalers are refreshing GPU fleets faster than anyone predicted two years ago, and the secondary market for decommissioned NVIDIA H100s, A100s, and similar data center accelerators has turned into real volume for R2-certified processors. That volume is bringing a question into my inbox that didn't used to show up: does R2v3 certification actually cover the export side of reselling this hardware, or is that a separate legal universe the certification doesn't touch?
The honest answer is both. R2v3 requires you to know about export control law. It does not do the export control work for you. Those are two different statements, and conflating them is how facilities end up with a clean R2v3 audit and an open license violation sitting in the same shipping container.
What R2v3 Actually Says About Export Control
R2v3 Core Requirement 4, titled Legal, is where export obligations live inside the standard. Core Requirement 4.1 requires every R2 facility to identify and maintain a documented list of the legal requirements applicable to its scope of certification, and that list is explicitly meant to include import and export law, not just the environmental and safety statutes people tend to think of first when they hear "legal requirements."
I've written before about how facilities build and maintain that legal tracking process, and it's worth reading if you haven't already: tracking import and export regulations under R2 walks through the mechanics of the list itself. What I want to add here is more specific to GPUs, because generic "know your import/export laws" guidance doesn't tell a facility manager what to actually do when a pallet of pulled H100s shows up needing a resale decision.
Here's the part that catches people off guard. An R2v3 auditor is not going to check whether your specific export license for a specific H100 shipment was valid. That's not what a certification body audit is built to verify. What the auditor checks is whether your facility identified export control as an applicable legal requirement in the first place, whether you have a documented process for screening transactions against it, and whether you can show evidence that the process actually runs. A facility that never identified the Export Administration Regulations as applicable, despite regularly reselling high-performance computing hardware internationally, has a Core Requirement 4 nonconformity before you even get to whether any individual shipment broke the law.
Why H100s Are a Different Animal: ECCN 3A090
Most of the electronics moving through an R2 facility never touch a dedicated export control classification beyond the general commercial designation. Data center GPUs are not most electronics.
In October 2022, the Bureau of Industry and Security published an interim final rule (87 FR 62186) creating new controls on advanced computing integrated circuits, establishing what's now known as Export Control Classification Number 3A090. A year later, BIS tightened the rule again with a second interim final rule (88 FR 73458, published October 25, 2023, effective November 17, 2023) that refined the performance thresholds and expanded the list of destinations subject to license requirements. Both rules target chips like the H100 and A100 by name in industry commentary, because both chips exceed the technical thresholds the rule uses to define "advanced."
The classification hinges on two calculated values: Total Processing Performance and Performance Density. Under 3A090.a, a chip whose calculated Total Processing Performance meets or exceeds 4800 falls under control, and the 2023 revision added the Performance Density threshold on top of it to catch chips designed with lower raw TPP but high enough density to still pose the same concern. An H100 clears that TPP threshold by a wide margin, which is precisely why NVIDIA has had to design cut-down variants for markets where the standard part can't legally ship.
Once a chip is classified under 3A090.a, exporting or reexporting it to destinations in Country Group D:5, which includes China and Macau along with roughly two dozen other countries subject to a U.S. arms embargo, generally requires a BIS license. No license, no shipment. That's true whether the chip left the factory floor six weeks ago or came out of a rack that ran for three years before a cloud provider retired it.
Used Doesn't Mean Unregulated
This is the point I push hardest on with clients, because it's the one that trips people up. Export jurisdiction under the EAR attaches to the item and its technical characteristics as classified on the Commerce Control List, not to its condition, its age, or how many operating hours it has logged. A used H100 pulled from a decommissioned data center carries the same ECCN 3A090.a classification it carried on day one. The scope provisions in 15 CFR Part 734 define what's "subject to the EAR" by reference to the item itself, and nothing in that framework carves out an exemption for depreciated, refurbished, or functionally-tested-for-resale equipment.
I've had facility managers tell me they assumed export control was a manufacturer problem, something NVIDIA and its authorized distributors worried about at the point of first sale, and that once a GPU entered the secondary market it was just used electronics like anything else moving through an R2 line. That assumption is wrong, and it's an expensive place to be wrong.
R2v3 Certification Is Not an Export License
I want to be direct about this because I think the marketing language around ITAD and R2 sometimes blurs it: holding an R2v3 certificate says nothing to BIS about whether a given export was lawful. The two systems answer different questions, enforced by different bodies, with different consequences for getting it wrong.
| R2v3 Core Requirement 4 | BIS Export Administration Regulations | |
|---|---|---|
| What it requires | Identify applicable legal requirements, including import/export law, and document a tracking process | Classify items, screen parties and destinations, obtain licenses where required |
| Who checks it | Your accredited R2 certification body, during initial and surveillance audits | Bureau of Industry and Security, through audits, investigations, and enforcement actions |
| What triggers scrutiny | Nonconformity findings during scheduled audit cycles | A specific export transaction, a tip, a screening hit, or a post-shipment review |
| Frequency of review | Annual surveillance, full recertification every three years | Continuous — every export transaction is a compliance event |
| Consequence of failure | Nonconformity, corrective action plan, possible certificate suspension | Civil penalties, denial of export privileges, and for willful violations, criminal liability |
Willful violations of the Export Control Reform Act of 2018 carry criminal penalties of up to $1,000,000 per violation and up to 20 years in prison, and that exposure exists regardless of whether the facility holds an R2v3 certificate at all. R2v3 can tell an auditor your legal tracking process is sound. It cannot tell BIS your H100 shipment to a Country Group D:5 destination was licensed correctly, because that's not what R2v3 was built to verify.
Where the Two Systems Actually Overlap
The overlap isn't nothing, though, and I don't want to leave the impression that R2v3 and export control live in entirely separate rooms. Two places in the standard do real work here.
The first is Core Requirement 4 itself, which I keep coming back to because it's the mechanism that forces the conversation to happen at all. A facility that takes CR4 seriously will have already identified ECCN classification and BIS screening as applicable processes before the first pallet of decommissioned GPUs arrives, rather than discovering the gap when a downstream buyer asks an uncomfortable question.
The second is Appendix A, the R2v3 downstream recycling chain requirement, which governs due diligence on the vendors a facility sells material to. If your facility resells used H100s to a broker rather than an end user, Appendix A due diligence is exactly where you'd normally catch whether that broker has its own export compliance program, or whether it's the kind of intermediary that might quietly reexport controlled hardware to a restricted destination on your behalf. I've written a fuller breakdown of what that due diligence should actually look like in practice, including the questions worth asking before you sign a downstream agreement, in downstream vendor due diligence best practices. For any facility handling high-value, high-performance computing hardware, I'd treat that due diligence process as load-bearing, not a formality.
A Practical Compliance Checklist
For facilities that are actually moving decommissioned data center GPUs, here's the sequence I recommend building into the resale workflow, in roughly the order it should happen:
- Classify the specific SKU. Confirm the exact model and generation of the GPU against current ECCN 3A090 guidance before it's staged for resale. NVIDIA's own export classification documentation for each product line is a reasonable starting point, but don't treat it as the final word for your own recordkeeping.
- Identify the buyer and the ultimate destination. Not just where the invoice is billed, but where the hardware physically ends up. Reexport risk through an intermediary is one of the most common ways advanced computing controls get violated.
- Screen against the restricted party lists. Check the buyer and any known intermediaries against the BIS Entity List (Supplement No. 4 to 15 CFR Part 744) and the Denied Persons List before finalizing the transaction.
- Check the destination against Country Group D:5. If the destination country appears on that list, assume a license is required unless you've confirmed otherwise.
- Apply for a license if required, and don't ship in the gap. There is no informal workaround for a required BIS license. Waiting on approval is the compliant posture, not shipping ahead of it.
- Document everything inside your CR4 legal tracking system. The classification determination, the screening results, and the license status (or the basis for concluding no license was needed) should all be retrievable evidence, because that's exactly what an R2v3 auditor and a BIS investigator will each ask to see, for different reasons.
- Extend the same scrutiny downstream. If you're not selling to the end user, your Appendix A due diligence should confirm the buyer has its own screening process, not just a general assurance that they'll "handle it."
None of this replaces qualified export control counsel for a specific transaction. It's the operational baseline that keeps a facility from finding out about a gap only after BIS does.
The Real Stakes, Stated Plainly
I've sat across the table from facility owners who genuinely believed that because their R2 certificate was current, they were covered on the export side too. They weren't being careless. The standard's own legal requirement language is broad enough that it's easy to read CR4 as a full compliance umbrella rather than what it actually is: a requirement to know what applies to you and prove you're tracking it.
The gap between those two readings is where the exposure lives, and with hardware like the H100 carrying real export control weight attached to its classification rather than its condition, that gap has gotten more expensive to ignore than it was five years ago when the highest-value item moving through most R2 facilities was a server chassis nobody outside the industry had heard of.
Frequently Asked Questions
Does R2v3 certification cover export compliance for GPUs automatically?
No. R2v3 Core Requirement 4 requires a facility to identify export control law as an applicable legal requirement and maintain a tracking process, but it does not verify individual export transactions or substitute for a BIS export license.
Are used or decommissioned H100 GPUs subject to the same export controls as new ones?
Yes. Export jurisdiction under the EAR attaches based on the item's technical classification under ECCN 3A090.a, not its age or condition. A used H100 carries the same classification it had when new.
What ECCN applies to NVIDIA H100 and similar advanced computing GPUs?
ECCN 3A090.a, created under BIS interim final rule 87 FR 62186 (October 2022) and revised by 88 FR 73458 (October 2023), covers advanced computing integrated circuits exceeding specified Total Processing Performance and Performance Density thresholds.
Which destinations require a license to export controlled GPUs?
Generally, destinations in Country Group D:5, which includes China and Macau along with other countries subject to a U.S. arms embargo, require a BIS export license for items classified under ECCN 3A090.a.
What happens if an R2-certified facility exports a controlled GPU without a license?
The facility faces exposure under the Export Control Reform Act of 2018, separate from its R2v3 status. Willful violations carry civil and criminal penalties, including up to $1,000,000 per violation and up to 20 years imprisonment for willful conduct, regardless of the facility's certification standing.
Facilities building out their legal tracking process from scratch, or auditing an existing one against current export control developments, may find it useful to review the fuller R2v3 legal framework before the next surveillance audit. See our R2v3 overview for how Core Requirement 4 fits into the broader certification scope.
Last updated: 2026-09-25
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.