The Foreign Investment Risk Review Modernization Act (FIRRMA) expanded CFIUS jurisdiction to cover minority investments in companies that develop or use critical technology, including AI. Even a small seed round from a foreign investor — or a US fund with foreign limited partners — can trigger CFIUS review if the startup works with AI, semiconductors, or sensitive data.
CFIUS traditionally focused on acquisitions of US businesses by foreign buyers, particularly in defense, semiconductor, and critical infrastructure sectors. With the expansion of the critical technology definition to include AI-related technologies, a broader set of transactions now falls within CFIUS jurisdiction, including minority investments that provide foreign investors with access to material nonpublic technical information, board representation, or substantive decision-making rights in AI companies. Gurpreet Bal regularly structures venture financing transactions to identify and address CFIUS exposure before the term sheet is signed.
A mandatory CFIUS declaration is required when a foreign person acquires a substantial interest in a TID US business — one that produces critical technology, handles critical infrastructure, or collects sensitive personal data. For AI startups, the critical technology prong is the most common trigger, and it applies regardless of the investment size if the company has a covered technology.
A mandatory CFIUS declaration is required when a foreign government has a substantial interest in the foreign investor and the US business being invested in is involved in critical technologies, critical infrastructure, or maintains sensitive personal data of US citizens. For AI startups, the critical technology prong is most commonly triggered. Many growth-stage investors in Silicon Valley have limited partner connections to sovereign wealth funds or state-affiliated entities, which can trigger the mandatory declaration requirement even in a standard Series B or Series C investment. In Gurpreet Bal's experience at Foley and Lardner, the CFIUS risk is most often identified during investor diligence rather than during term sheet negotiation, which can add months to the closing timeline if not anticipated.
AI startups can reduce CFIUS exposure by limiting foreign investor board seats and information rights, structuring foreign investments as passive with no governance rights, and obtaining CFIUS clearance proactively before closing. Some founders separate sensitive technology subsidiaries from the main entity to limit the scope of any required review.
When CFIUS risk is identified early, transaction structures can be designed to mitigate or eliminate the need for a filing. Common approaches include limiting the foreign investor's access to material nonpublic technical information, structuring the investment to avoid granting board seats or observer rights that would provide substantive decision-making authority, and using side fund or co-investment structures that separate the foreign government-affiliated capital from the direct investment. Gurpreet S. Bal advises AI startups on these structuring approaches and works with national security counsel when a CFIUS declaration or notice is required.
AI companies must assess whether their technology falls under Export Administration Regulations (EAR) or International Traffic in Arms Regulations (ITAR). Advanced AI models, particularly those with dual-use military applications or trained on restricted datasets, may require export licenses before being shared with foreign nationals or transferred outside the US — even in routine employment or commercial contexts.
CFIUS review is separate from but related to export control compliance under the Export Administration Regulations (EAR) administered by the Bureau of Industry and Security (BIS). AI startups with international customers, research collaborations, or engineering teams including foreign national employees may have export control obligations independent of any CFIUS filing. Deemed export rules can apply when controlled technology is shared with foreign national employees in the United States. Gurpreet Bal advises Silicon Valley AI startups on the intersection of CFIUS, export controls, and venture financing structures.
Gurpreet's framing for CFIUS is not about discouraging foreign investment — it is about showing foreign investors that you have set up a structure that protects their investment. The risk here falls hardest on the investors, not the company. An investor forced by CFIUS to divest a position faces a fire-sale dynamic with severely diminished returns. The most sophisticated foreign investors understand this and will be the ones raising CFIUS questions first. If you have a clean structure that addresses the exposure, that is a selling point with the investors who matter most. Founders who treat CFIUS planning as a housekeeping exercise rather than a competitive differentiator are missing the point.
Gurpreet S. Bal is a Partner at Foley and Lardner LLP in Silicon Valley, where he advises startups, founders, and investors on SAFE financings, venture capital rounds, mergers and acquisitions, acquihires, and IPOs. He has represented clients in hundreds of transactions with aggregate deal value exceeding $60 billion across AI, semiconductors, fintech, and emerging technology.