AI Capital Is Becoming a Controlled Input

The Short Version

The United States is extending the logic of AI export controls from chips and models to capital.

On October 26, the Treasury Department published a proposed rule implementing the Comprehensive Outbound Investment National Security Act, or COINS Act. It would prohibit some U.S. investments and require notification for others in AI, semiconductors, quantum technology, high-performance computing, hypersonics, and biotechnology in countries of concern.

The rule is not final. The existing outbound-investment rules remain in force, and comments on the proposal are due December 7.

But the direction is clear.

Washington is treating venture capital as more than money. An investment can bring board access, strategic advice, technical credibility, recruiting help, customer introductions, and a path to the next round. In that theory, capital is another input that can accelerate a military or intelligence capability.

The surprising part is how far the AI definition travels.

It does not stop at frontier models.

It reaches ordinary AI software, applications built on third-party models, agent harnesses, and embodied AI systems.

The AI stack now includes the cap table.

"Super intelligence" does not mean superintelligence

Treasury calls the covered category an "SI system," following terminology required by an executive order.

Do not let the name do the reading for you.

The proposed definition is not limited to a hypothetical system smarter than every human. It covers a machine-based system that generates content, predictions, recommendations, or decisions. Treasury says that can include software, hardware, applications, tools, agent harnesses, and embodied systems such as robots.

The rule is unusually specific about agents.

An application built around a third-party model can count as developing an AI system when its harness extends the model through autonomous action loops, memory or context management, intermediate reasoning, or self-correction.

That is a much broader product boundary than "trains a foundation model."

A startup does not need its own pretraining cluster to fall inside the analysis. It may be enough to turn somebody else's model into a system that can plan, remember, act, and correct itself.

This matters because the proposal would make the development of any covered AI system a prohibited technology activity in a country of concern. The model's benchmark score is not the first question.

What the company is building, where it is building it, who owns it, and how the investor participates all come first.

The controlled export is the relationship

The policy premise is not that a U.S. dollar has secret technical knowledge embedded in it.

It is that an investment creates a relationship.

The proposal covers more than a straightforward equity check. It can reach contingent equity, some debt with profit or governance rights, joint ventures, greenfield projects, acquisitions of assets or operations, certain limited-partner interests, and U.S. persons who direct transactions by non-U.S. persons.

Its definition of development is broad too. High-level oversight, direction, approval, conceptual input, and strategic planning can count before a product reaches serial production.

That combination is the real policy move.

Export controls traditionally ask whether a chip, model weight, design, or piece of equipment crossed a border. Outbound-investment controls ask whether American capital and influence helped a covered company become more capable.

For venture investors, the useful question is no longer only, "What does this company sell?"

It is also:

• Which entities and affiliates perform the technical work?
• Where are the engineers and operations located?
• Does the product merely call a model, or does its harness create new agentic capability?
• What board, governance, information, or profit rights come with the transaction?
• Could a planned pivot move the company into covered activity after closing?

That is product diligence, ownership diligence, and national-security diligence in the same data room.

This is not a ban on every investment

The proposal is broad, but it is not a blanket ban on American money touching every company in China or another country of concern.

It includes exceptions for publicly traded securities, index funds, mutual funds, exchange-traded funds, certain derivatives, and some limited-partner interests. A qualifying limited partner can use a committed-capital threshold of $2 million or contractual assurances that the fund will not use the capital for prohibited or notifiable transactions.

There are also exceptions for some intracompany funding, prior commitments, employment compensation, ordinary business services, and complete buyouts that remove the target from covered ownership.

One number is especially easy to misread.

The proposed $50,000 threshold applies to the notification requirement. It does not turn a prohibited AI investment into a permitted one.

Public-market exceptions also do not make the underlying policy narrow. The proposal is aimed most directly at private transactions where the investor can provide the nonfinancial benefits Treasury is worried about.

Passive exposure is treated differently from a relationship that can influence the company.

That is not an accidental distinction.

It is the point.

Due diligence becomes a product feature

The proposal uses a knowledge standard that includes actual knowledge, awareness of a high probability, and facts a reasonable and diligent inquiry would have found.

That makes "the founder did not mention it" a poor compliance system.

Investors may need evidence about ownership chains, subsidiaries, principal places of business, engineering teams, technical roadmaps, model dependencies, agent architecture, and the intended use of the product. U.S. companies may also need reasonable controls over foreign entities they manage or own.

The hard cases will not be the obvious ones.

They will be companies with a U.S. parent and a covered-country engineering subsidiary. Funds with indirect exposure through another fund. Robotics companies whose AI layer was added after the original investment. Applications that begin as thin wrappers and become autonomous agents. Debt that quietly carries governance or profit rights.

The proposal does offer a path to confidential, non-binding Treasury feedback and a national-interest exemption process. That is useful.

It is not preclearance.

The parties still own the classification and the diligence behind it. Notifications would generally be due within 30 days, supporting records would need to be retained for ten years, and later discovery of relevant facts could trigger a new reporting obligation. Violations can bring civil penalties and, for prohibited transactions, compelled divestment.

So the practical product is not a legal memo written once.

It is a living map of entities, technology, transaction rights, and changes after the deal closes.

The policy risk is overbreadth

Treasury's security theory is coherent.

American investors do not only transfer cash. They can make a company easier to hire for, easier to trust, easier to sell, and easier to finance again. If the government already controls advanced chips and technical assistance, ignoring the acceleration supplied by capital would leave a large opening in the same strategy.

But a coherent theory can still produce an overbroad rule.

The AI definition covers an enormous range of modern software. It can reach products far from frontier training or military use. The agent-harness example is technically sophisticated, but it also means a product architecture decision can change the regulatory status of an investment even when the underlying model stays the same.

That creates three risks.

First, investors may avoid ambiguous companies rather than pay to classify them.

Second, companies may move ownership, engineering, or fundraising structures to avoid U.S. capital without reducing the underlying capability.

Third, a rule designed around national-security technologies may become a general restriction on ordinary AI entrepreneurship in covered jurisdictions.

The policy question is not whether capital matters.

It does.

The question is whether the final rule can distinguish capital that materially accelerates a security-relevant capability from capital that merely owns a small piece of ordinary software.

The cap table is now part of the architecture

Founders and investors should not wait for the final rule to begin mapping the exposure.

They should know:

• the jurisdiction, ownership, and control of every relevant entity
• where covered technical work actually happens
• whether the product trains a model or extends one through an agent harness
• which governance, information, conversion, and profit rights the transaction creates
• whether an exception applies and what evidence supports it
• how future product changes or corporate restructurings will be reviewed

Treasury estimates roughly 150 investors and 200 potentially covered transactions a year, while acknowledging that its underlying deal data may miss activity. The exact number matters less than the operating model the proposal creates.

Chips are controlled inputs.

Compute is a controlled input.

Models, data, and technical talent are increasingly governed as strategic inputs too.

Now Washington is adding capital and investor influence to the list.

The next AI compliance review may begin with the product architecture.

It may end with the cap table.