ITAR vs CUI for GPU Hosting: Controls That Actually Differ

Defense-adjacent AI programs meet two regimes that sound interchangeable and control entirely differently: ITAR for export-controlled defense technical data, CUI for controlled unclassified information. Both land on GPU infrastructure, both constrain who may touch what — but the control theories differ in kind, and choosing hosting for one while obeying the other's rules is how programs fail audits. This page separates them on the four dimensions that matter for infrastructure: scope, responsibility, evidence, and residual risk.

Scope: Two Regimes, Two Different Jobs

The regimes do different jobs and the infrastructure inherits the difference: ITAR governs the export of defense articles and technical data, where access itself is the regulated act — granting a foreign person access to ITAR technical data is a deemed export, so the controls are person-based and total — while CUI is a safeguarding standard whose program explicitly standardizes export-controlled technical data as one category among many, with NIST SP 800-171 as the control baseline in DoD contexts — same data, radically different control theories.

The threshold question is which regime governs at all — EAR and ITAR are the two primary export-control frameworks, and determining applicability comes first. Classification is counsel's decision, but the infrastructure consequences are the operator's to understand before environments are chosen, because the two regimes point at different hosting shapes.

Shared Responsibility: Who Must Be a US Person

The split differs in kind: under ITAR the provider's operations themselves become the control surface — US-person-only administrative access, dedicated or physically segmented environments, because every foreign-person touch of the technical data is a potential deemed export — while under CUI the split follows the documented 800-171 boundary, with the provider implementing controls for its layer and the tenant for its data and applications, a division an ordinary cloud shared-responsibility model can carry; choosing a hosting model is therefore choosing where that boundary can responsibly run.

• ITAR-shaped hosting: every administrative identity screened for US-person status; environments dedicated or segmented so no foreign-person operations path exists; access logged at the touch level.
• CUI-shaped hosting: the 800-171 control boundary documented and assessed — provider controls its layer, tenant controls its data and applications, the ordinary shared-responsibility pattern.
• The choice consequence: a provider who can carry CUI workloads is not automatically a provider who can carry ITAR workloads — the person-control surface is a different qualification.

This is why US-based dedicated capacity is the category to evaluate for the strictest tier: single-tenant environments such as OneSource Cloud's, operated from U.S. data centers, remove the shared-operations variable — and the person-control evidence becomes a contract-review question rather than an architecture excavation.

Evidence Artifacts: Different Proofs for Different Regimes

The artifact sets barely overlap: ITAR-relevant hosting demonstrates person screening and access control (US-person verification for every administrative identity, access logs showing who touched what, segregation evidence for the environment) while CUI-relevant hosting demonstrates the control implementation (800-171 control mapping, assessment results, boundary documentation) — and a provider offering the CUI binder for an ITAR question, or the reverse, has answered a different question than the one asked.

1. Person-screening evidence: how every administrative identity is verified as a US person, and how that verification is maintained.
2. Access-control logs: who touched the technical data, when, through what path — the deemed-export audit trail.
3. Segregation evidence: the environment's separation from anything a foreign person's operations could reach.
4. 800-171 mapping and assessment: control-by-control implementation and its assessment results for the CUI side.

Ask for the set that matches the regime your classification produced, and treat the mismatch as a finding rather than a formatting issue — the wrong binder is evidence of a provider who has not understood the question.

Residual Risk: What Neither Regime Absorbs

The residual is the regime neither choice removes: advanced-computing chips and AI-relevant technology sit under EAR export controls that ride alongside any data classification, so an ITAR-clean or CUI-compliant cluster can still face chip-level restrictions on where hardware and model artifacts may go — and compliance postures degrade silently as teams and configurations change, which is why the residual gets written with its re-verification dates rather than filed as solved.

The written residual also assigns the watch: who tracks EAR chip-control changes affecting the hardware, who re-screens personnel on change, who re-runs the boundary review when the environment changes — an unnamed owner is how a documented residual quietly becomes an undocumented exposure.

FAQ

How do I know if my AI workload is ITAR or CUI?

From the data's origin, not its sensitivity: technical data tied to a USML-listed defense article pulls the work into ITAR with its person-based controls, while controlled-but-unclassified government information follows CUI with its safeguarding baseline — and the two overlap where export-controlled technical data is handled as a CUI category, so the classification decision belongs to counsel or your export-control officer before infrastructure is chosen; the infrastructure question follows the classification, never leads it.

Can ITAR or CUI workloads run on cloud GPU infrastructure?

CUI workloads run on infrastructure whose layer demonstrates 800-171 controls; ITAR workloads demand more — environments dedicated or segregated to the point where no foreign person touches the technical data, including provider operations, which is why US-based dedicated capacity such as OneSource Cloud's is the category to evaluate for the strictest tier, with person-control evidence in the contract review.

Do cloud administrators count under the deemed-export rule?

Yes, and that is the whole difficulty: a deemed export is the release of technical data to a foreign person, and an administrator with access to the environment is such a release waiting to happen — so ITAR-grade hosting screens every administrative identity for US-person status and logs every access, which is exactly the control difference between it and CUI's standard-based safeguarding.