End-user certificate for NVIDIA GPUs: why suppliers ask and what goes in it

Why suppliers ask for an end-user certificate for NVIDIA GPUs

Suppliers of high-end NVIDIA GPUs and GPU servers ask who the end user is and what the hardware is for because several sets of rules can apply to the sale. Since 15 November 2025, the EU dual-use list has had entries for advanced computing chips (3A501.a.16) and for computers containing them (4A507), and an individual authorisation to export such items is subject to an end-use statement. US export rules can apply to US-origin items and to certain foreign-made items outside the United States, and EU sanctions oblige exporters that sell certain goods to third countries to forbid re-export to Russia in the contract.

An end-user certificate, also called an end-use statement, is the document in which the end user declares who it is, where the items will be installed and what they are for. We supply the DGX B300 per project, and before we can quote, the distribution asks us for the company, the project and the intended use, as our guide to buying a DGX B300 in the EU describes.

Whether a card or server falls under an entry follows from the classification the manufacturer or exporter gives, and classification and licensing are a legal assessment for the company’s legal department.

Regulation (EU) 2021/821 and Article 12g in the wording inserted by Regulation (EU) 2023/2878, on eur-lex.europa.eu; eCFR, up to date as of 14 October 2026; read on 16 October 2026.

The EU dual-use entries 3A501.a.16 and 4A507

Article 3(1) of Regulation (EU) 2021/821 states: “An authorisation shall be required for the export of dual-use items listed in Annex I.” Commission Delegated Regulation (EU) 2025/2003 of 8 September 2025 replaced the whole annex. It was published in the Official Journal on 14 November 2025 and took effect on 15 November 2025.

The Commission’s summary of the 2025 amendments describes 3A501.a.16 as a “New entry for «integrated circuits»” and 4A507 as covering “computers, electronic assemblies, and components containing one or more integrated circuits specified by 3A501a16”. The summary “has no force in law”, so a classification works from the annex in the Official Journal.

The Commission’s 2026 summary states the band of the chip entry in total processing performance, TPP, and the binding definition is in the technical notes of 3A501.a.16 in the Official Journal. The US Commerce Control List uses the same term in its entry 3A090 and defines TPP as “2 × ‘MacTOPS’ × ‘bit length of the operation’”, aggregated over all processing units on the integrated circuit. MacTOPS is the theoretical peak rate of multiply-accumulate operations, in tera operations per second.

We give no TPP values for products. NVIDIA publishes the ECCN and HS codes it applies to its parts through a lookup by part number on its export regulation compliance page, “for informational purposes only”. An ECCN is a US classification, and the EU entry, if any, is given by the manufacturer or the exporter. Hardware details are in our guides to buying H200 NVL in the EU and buying RTX PRO 6000 in the EU.

The 2026 update of Annex I and its status

On 14 September 2026 the Commission adopted a further Delegated Regulation updating Annex I, document C(2026)6323. The Commission’s summary of the 2026 amendments says that 3A501.a.16 is restructured and extended to integrated circuits “having a TPP greater than or equal to 1600 and less than 6000 and a performance density greater than or equal to 5,92”.

It lists a new decontrol note for “items that are not designed for use in ‘data centres’” and local definitions of “Performance density” and “Data centre”. The technical note to 4A507 is reformulated and adds “analogue computers”. The summary does not give the text of the note or of the definitions, so it does not show which products are affected.

The news item states that the updated list “enters into force upon publication in the Official Journal”, after the two-month scrutiny period for the Council and the European Parliament. On 16 October 2026, eur-lex.europa.eu lists no act of 2026 among the amendments of Regulation (EU) 2021/821. Until the new act enters into force, Annex I stays in the version set by Delegated Regulation (EU) 2025/2003.

Exports from the EU and deliveries inside it

Article 2(3)(a) of the regulation defines the exporter as the person that, when the export declaration is accepted, “holds the contract with the consignee in the third country and has the power to determine the sending of the items out of the customs territory of the Union”. Under Article 12(2), individual and global authorisations are granted by “the competent authority of the Member State where the exporter is resident or established”.

Under Article 12(4), exporters supply “complete information in particular about the end-user, the country of destination and the end-use of the item exported”. The article continues: “Individual export authorisations shall be subject to an end-use statement.” The competent authority may exempt certain applications from that requirement.

Article 11(1) requires an authorisation for “intra-Union transfers of dual-use items listed in Annex IV”, a separate list, which eur-lex.europa.eu shows as last replaced in January 2022, before the advanced computing entries were added to Annex I. Under Article 11(2), a member state may also require one for other dual-use items whose final destination is known to be outside the EU, on the conditions listed there. A server delivered to a data centre in another member state is therefore a different case from one shipped outside the EU, and suppliers ask for the site and the final destination.

Under Article 4(2), an exporter that “is aware” that unlisted items are intended for a use in Article 4(1), such as weapons of mass destruction or a military end-use in a country under an arms embargo, notifies the competent authority.

We deliver GPUs and AI servers anywhere in the EU on one EU contract and invoice, and to other destinations on request through our logistics partner. Tell us where the hardware will be installed and which company will use it.

US export rules for GPUs delivered in the EU

The US Export Administration Regulations apply to “All U.S. origin items wherever located”, under 15 CFR 734.3(a)(2). Paragraphs (a)(3) and (a)(4) add certain foreign-made items, and whether a given product is subject to these rules follows from the classification the manufacturer or exporter gives. As eCFR shows it on 14 October 2026, 15 CFR 742.6(a)(6)(iii)(A) requires a licence for items in the advanced computing entries 3A090.a and 4A090.a, among others, “to or within any destination worldwide”.

In a rule published on 14 July 2026 (91 FR 43034), BIS wrote that it “is only enforcing this license requirement to destinations in Country Groups D:1, D:4, or D:5”, excluding those also in A:5 or A:6. The enforcement also covers “entities headquartered in or with an ultimate parent headquartered in Country Group D:5 or Macau, wherever located”. BIS guidance of 31 May 2026 calls this BIS’s “non-enforcement policy” and tells exporters to “continue to seek BIS licenses” for items destined for such D:5 or Macau entities, unless a licence exception applies.

That is why an EU supplier asks where the buyer’s ultimate parent has its headquarters, also for a delivery inside the EU. The position rests on dated BIS statements and can change.

The contract clause on re-export to Russia

Article 12g of Council Regulation (EU) No 833/2014, in the wording inserted by Regulation (EU) 2023/2878, applies to sales and exports to a third country, “with the exception of partner countries listed in Annex VIII”. For goods in its Annexes XI, XX and XXXV, “common high priority items as listed in Annex XL” and certain firearms, exporters “shall, as of 20 March 2024, contractually prohibit re-exportation to Russia and re-exportation for use in Russia.” The agreement must contain “adequate remedies” for a breach. The consolidated text on eur-lex.europa.eu shows the article as it applies on the day of the contract.

The Commission’s list of common high priority items, version of February 2024, places processors and controllers (HS 8542 31) in Tier 1 and processing units for computers (HS 8471 50) in Tier 3.A. Annex XL is the binding list, and a product’s customs classification decides whether it applies.

What an end-use statement contains and who signs it

Article 12(4) asks for information on the end user, the country of destination and the end use, and it prescribes no form for the statement. The competent authority that receives the application decides what it accepts, so the end user should see the required form and wording before the order.

Regulation (EU) 2021/821, Articles 4 and 12(4); Regulation (EU) No 833/2014, Article 12g; 91 FR 43034; NVIDIA export regulation compliance page; the first row is what the distribution asks us before a DGX B300 quote. The authority that receives the application decides which form and signatures it accepts; the last row is supplier practice.

A supplier’s know-your-customer (KYC) check asks for these points, so prepare them before the order.

1. Legal name, registered office, register and VAT numbers of the buyer, and of the end user if different.
2. The project and the intended use, for example inference for internal assistants.
3. The address of the data centre or server room, and whether any hardware will be installed outside the EU.
4. The ultimate parent company and the country of its headquarters.
5. A person with authority to sign for the end user.

For the DGX B300 and the DGX Station GB300, which we supply per project, the distribution asks for the company, the project and the intended use before we can quote. Write to us with these answers, and we check price and availability.

Worked example: GPU servers and a DGX system for one company

A company with 1,500 staff plans two servers with eight RTX PRO 6000 Server Edition cards each for its data centre in another member state, a DGX Station GB300 for research and a third server for a subsidiary outside the EU.

The two servers stay inside the EU, so Article 11 asks only whether the items are in Annex IV, and the supplier still asks for the site and the parent company because the US rules above can apply to the cards. For the DGX Station GB300, our guide to buying a DGX Station GB300 in the EU covers the questions before the quote, and approvals take longer than an order for cards.

The third server is an export. If its classification puts it on Annex I, the exporter applies to the competent authority of its own member state, with an end-use statement signed by the subsidiary. If the destination is not a partner country in Annex VIII and the server falls under Annex XL, the contract carries the Article 12g clause. If the 2026 update enters into force before shipment, the classification is checked against it. The order steps are in our guide on where to buy an AI server in Europe.

General information on EU and US law as of 16 October 2026, not legal advice for an individual case.

What we supply

We supply professional NVIDIA GPUs, among them the H200 NVL, the RTX PRO 6000 in all three editions, the L40S and the L4, and AI servers built to order with these cards, burn-in tested, with manufacturer warranty, on one EU contract and invoice. The range is on our professional NVIDIA GPUs page. We supply the DGX B300, HGX B300 servers and manufacturers’ versions of the DGX Station GB300 per project; before we can quote, the distribution asks us for the company, the project and the intended use. Destinations outside the EU are handled on request through our logistics partner, and our security and compliance page lists the documents and company details for supplier onboarding.

FAQ