A Free-Trade Zone and a Chip Export Rule Are Not the Same Thing
On July 1, 2026, ByteDance announced a $39 billion data center complex at the Pecém Industrial and Port Complex in Brazil's Ceará state — its largest outside China, targeting 1 gigawatt of total IT capacity at full buildout. The investment's rationale was partly straightforward: Ceará's designation as an Export Processing Zone eliminates Brazilian import taxes on computer hardware, including the import duty (II), the industrialized products tax (IPI), and PIS/Pasep contributions that would otherwise raise the cost of every server rack ByteDance imports. Ceará's ZPE was named the world's best free trade zone in 2025 by FDI Intelligence. The fiscal case was real.
What the announcement immediately triggered, however, was a different question in trade compliance circles: do those Brazilian tax advantages extend to US semiconductor export controls? The answer is no — and the reasons why illuminate how modern chip controls are actually structured.
What the Export Processing Zone Actually Covers
Brazil's 2020 legal framework for Export Processing Zones, reaffirmed by the federal government in subsequent reforms, grants EPZ companies sweeping import incentives: zero tariffs on raw materials, machinery, and technology; full exemption from IPI and PIS/Pasep; and relief from the merchant navy surcharge. A later reform removed the requirement that EPZ companies export 80% of their production, allowing domestic sales as well.
For a hardware-intensive hyperscale data center, these are material cost reductions. Brazil's standard import tariffs on servers and networking equipment add meaningful friction to infrastructure buildout; the EPZ eliminates them. ByteDance's Ceará site was going to need enormous quantities of imported hardware, and the Brazilian fiscal advantage is genuine.
But the EPZ framework operates entirely within Brazilian customs law. It governs what arrives at the Brazilian border and who pays duty on it. United States export controls govern what leaves US soil — or originates from US-controlled technology anywhere in the world — and who receives it. These are parallel, independent legal regimes. Brazilian customs law has no jurisdiction over US export licensing requirements, and US export controls contain no exception for goods destined for a Brazilian Export Processing Zone.
The Rule That Follows Ownership Across Borders
The foundational US legal instrument here is embedded in EAR §742.6(a)(6)(iii)(A), which took effect in November 2023 following the Biden administration's October 17, 2023 export control expansion. The rule establishes the "ultimate parent company test": an export license is required for advanced computing items — the classes of chips ByteDance would need for a frontier AI data center — when the purchasing entity is headquartered in China, or when its ultimate parent company is headquartered in China. The subsidiary's physical location is irrelevant to the licensing trigger.
BIS reaffirmed this rule explicitly on May 31, 2026, issuing guidance clarifying that the ultimate-parent-company test "has continuously applied under the EAR since November 2023." The occasion was a documented enforcement gap over the preceding year, during which Chinese companies purchased an estimated hundreds of thousands of restricted NVIDIA Blackwell and Rubin-generation chips through subsidiaries in Malaysia and Singapore — correctly reasoning that geography-based controls did not formally cover those jurisdictions, but incorrectly concluding that the underlying ownership-based rule had been suspended. BIS also issued dedicated counter-diversion guidance in May 2025 that listed behavioral red flags for transactions with Chinese ultimate parents, including subsidiaries unable to confirm their physical data center infrastructure, unusual payment routing, and reluctance to disclose beneficial ownership chains.
ByteDance is a Chinese-headquartered company. A Brazilian subsidiary purchasing restricted AI chips — regardless of EPZ designation or import duty treatment — is a transaction that requires a BIS export license under the existing framework. The free-trade zone changes the price of the hardware in Brazilian reals. It does not change who is receiving it in the eyes of BIS.
A More Complicated Picture
The legal analysis is not entirely monolithic. ByteDance is not currently on the BIS Entity List, which matters for one specific rule: the "Affiliates Rule" published in September 2025 — which would automatically impose Entity List-equivalent restrictions on any subsidiary 50% or more owned by a listed company — was suspended for one year on November 10, 2025, as part of a broader US-China trade arrangement. That suspension expires November 10, 2026.
But this complication is less significant than it appears. The Affiliates Rule is a subsidiary mechanism built on top of Entity List designations. The underlying ultimate-parent-company test under §742.6 applies to Chinese-headquartered companies broadly, independent of Entity List status, for the specific category of advanced computing items. ByteDance's exposure to US chip controls does not depend on whether the Affiliates Rule is in force.
Also worth noting: ByteDance has stated the Ceará facility will serve TikTok users in markets outside Brazil, the United States, Europe, and China — essentially a "rest of world" data center deliberately positioned outside every major regulatory jurisdiction's direct reach. That framing is commercially rational, but it does not change the licensing calculus, which follows the corporate ownership structure rather than the intended geographic service area of the data center.
The Proportionate Ask
The strongest case for tight chip controls is substantiated: the enforcement gap from mid-2025 onward was real, the diversion through Southeast Asian subsidiaries was documented at scale, and advanced AI compute has legitimate dual-use dimensions. Closing a gap that was being demonstrably exploited is not overreach.
But proportionate implementation requires clarity on both sides. The May 31 guidance confirmed that the licensing requirement exists for ByteDance's Brazilian operation. What neither that guidance nor BIS's public posture has clarified is what conditions would make a license approvable — what technical controls, third-party audit structures, data-access restrictions, or end-use commitments would satisfy BIS for a commercial content-delivery data center with no plausible connection to Chinese military or intelligence programs.
For Brazil, the stakes are concrete. The country is not in the US's restricted-destination framework. Its semiconductor import ecosystem is heavily weighted toward Chinese suppliers already. Allowing regulatory ambiguity to function as a de facto investment veto on $39 billion of infrastructure would push Brazil further toward Chinese supply chains and away from US-aligned technology norms — precisely the opposite of the stated strategic objective. BIS can impose strict conditions. What it owes the market is a published answer to the question it has now raised: what does compliant access look like here?