Commerce Dept. gets $100M to build export-control AI—with no privacy guardrails

What it does

This bill authorizes $25 million per year through 2029 for the Commerce Department's Bureau of Industry and Security to modernize its aging IT systems, replacing them with unified case-management and data-analytics platforms. The modernization is intended to speed up export license reviews, better track military end-users and dual-use technology flows to adversaries (especially China, Russia, Iran), and share data more efficiently with federal agencies and international partners.

Why we flagged it

The bill's primary stated purpose is routine IT infrastructure modernization for a federal agency. However, the operative language explicitly expands data collection, fusion, and sharing authorities—particularly with the intelligence community and international partners—without corresponding privacy or transparency guardrails, making it functionally a surveillance-capability upgrade wrapped in modernization framing.

What the text implies

• The bill authorizes 'data fusion' and 'additional commercial data sets' without defining what commercial data may be collected, how long it is retained, or what privacy notice companies receive. This may enable warrantless aggregation of U.S. business supply-chain and trade data.
• Explicit authorization to share 'appropriate data elements' with the 'intelligence community' lacks statutory definition of 'appropriate' and creates no audit trail or congressional reporting requirement, potentially enabling bulk data transfers to CIA, NSA, or other agencies without public disclosure.
• The bill directs the Bureau to 'comprehensively map' the defense industrial bases and commercial linkages of China, Russia, North Korea, and Iran—a legitimate counterintelligence objective, but the IT systems being built will also house U.S. company data, creating a dual-use infrastructure that could be repurposed for industrial espionage or competitive intelligence.
• Personnel reassessment language (subsection on 'Personnel assessment') signals potential workforce reduction or reallocation, but the bill does not require public reporting on staffing changes, potentially obscuring whether export-control enforcement capacity is actually maintained or hollowed out.
• No sunset clause, no privacy impact assessment requirement, and no mandate for annual transparency reporting to Congress on data-sharing volumes, retention periods, or incidents—standard safeguards for government surveillance systems are absent.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill funds a legitimate government modernization that may improve export-control enforcement and national security screening—a public benefit. However, the bill explicitly authorizes expanded data fusion, commercial data integration, and intelligence-community data sharing without clear privacy safeguards, oversight mechanisms, or transparency requirements for how U.S. companies' trade and supply-chain data will be collected, retained, or shared—creating a concrete risk to business privacy a

Who stands to gain

• IT systems integrators and contractors (likely large defense/IT firms such as Booz Allen Hamilton, L
• Commercial data brokers and analytics firms providing 'data fusion' and 'supply chain illumination'

Named in the bill

Bureau of Industry and Security (BIS), Department of Commerce, Under Secretary for Industry and Security, House Committee on Foreign Affairs, Senate Committee on Banking, Housing, and Urban Affairs, Entity List, Military End User List, Unverified List, People's Republic of China, Russia, Iran, North Korea — and 1 more

Where it stands

6 cosponsors: 3 Democrats, 3 Republicans.

• Aug 8, 2025 — Introduced · Congress.gov: “Introduced in House”
• Aug 8, 2025 — Referred to House Committee on Foreign Affairs · Congress.gov: “Referred to the House Committee on Foreign Affairs”
• Apr 22, 2026 — Markup held in committee · Congress.gov: “Committee Consideration and Mark-up Session Held”
• Apr 22, 2026 — Reported out of committee · Congress.gov: “Ordered to be Reported in the Nature of a Substitute by the Yeas and Nays: 39 - 5”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

7 lobbying clients named this bill on 7 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $3,375,803 in lobbying spend. A filing names 37 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 86% of bills with at least one filing.

Jason Crow, the sponsor, reported $227,840 in PAC receipts in the 2026 cycle.

• Software & Information Industry Association — $1,396,909 on 1 filing
• Intel Corporation — $700,000 on 1 filing
• Semi — $470,000 on 1 filing
• Synopsys, Inc. — $310,000 on 1 filing
• Fdd Action — $240,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.