Tariff and customs classification
Tariff and customs classification for technology and AI products is under active pressure from multiple directions, with the U.S. Customs and Border Protection and the Office of the United States Trade Representative both issuing binding guidance that affects how AI-enabled hardware, semiconductors, and software-bundled devices are classified at the border. The European Commission's enforcement of dual-use export controls under the EU Dual-Use Regulation adds a second classification layer that catches many tech sector importers off guard. Classification errors in this sector carry penalty exposure, not just delayed shipments.
Watch
- USTR Section 301 tariff exclusion renewals for tech components expiring on a rolling basis
- CBP ruling requests on AI-integrated hardware: classification as finished goods vs. parts
- EU Dual-Use Regulation controls on chips with military-adjacent specifications
- Harmonized System 2024 updates reclassifying certain semiconductor subcategories
- Country-of-origin determinations for AI hardware assembled across multiple jurisdictions
Recent material activity in Technology, AI & Competition
A selection of recent published briefs; this is not a complete archive.
US CISA Cybersecurity release pending Cresthaven Analytics full analysis: KEV addition: CVE-2026-87902 — WordPress Core (WordPress Core Remote File Inclusion Vulnerability)
US CISA Cybersecurity published a regulatory release titled 'KEV addition: CVE-2026-87902 — WordPress Core (WordPress Core Remote File Inclusion Vulnerability)'. Cresthaven Analytics' full intelligence brief is pending r…
Read a full sample brief →CISA adds Microsoft SharePoint code injection flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 28 2026
CISA added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint, to its Known Exploited Vulnerabilities catalog on September 25, 2026. The addition triggers mandatory remediation obligations for federal…
Read a full sample brief →CISA adds MikroTik RouterOS behavioral-workflow vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 28 2026
CISA added CVE-2026-67279, an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS, to its Known Exploited Vulnerabilities catalog on September 25, 2026. The vulnerability permits an unauthentic…
Read a full sample brief →Canada Competition Bureau release pending Cresthaven Analytics full analysis: Competition Bureau to publish a call for information on pricing rules in retail grocery
Canada Competition Bureau published a regulatory release titled 'Competition Bureau to publish a call for information on pricing rules in retail grocery'. Cresthaven Analytics' full intelligence brief is pending re-analy…
Read a full sample brief →UK CMA Competition release pending Cresthaven Analytics full analysis: Macquarie Asset Management / Energy Assets Group merger inquiry
UK CMA Competition published a regulatory release titled 'Macquarie Asset Management / Energy Assets Group merger inquiry'. Cresthaven Analytics' full intelligence brief is pending re-analysis; see the source link below …
Read a full sample brief →CMA publishes interim market study update on early years education and childcare services in England
The CMA published a market study update on September 25, 2026, covering evidence gathered since the study launched on July 1, 2026. The update sets out findings to date and signals how the CMA's analytical thinking is de…
Read a full sample brief →China's SAMR publishes antitrust penalty decisions against two Chongqing municipal gas distributors for cartel conduct
The State Administration for Market Regulation published administrative penalty decisions by the Chongqing Municipal Market Supervision and Administration Bureau against two piped-gas enterprises in Jiangjin District. Th…
Read a full sample brief →China's SAMR publishes five administrative penalty decisions against Tibet concrete firms for cartel conduct
The Tibet Autonomous Region Market Supervision and Administration Bureau concluded a monopoly-agreement investigation against five concrete enterprises, including Linzhi Lantian Concrete Co. Ltd. The investigation opened…
Read a full sample brief →CISA adds Adobe Commerce and Magento authorization flaw to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27 2026
CISA added CVE-2026-71362, an incorrect authorization vulnerability in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability allows unauthenticated privilege …
Read a full sample brief →CISA adds WSO2 path traversal vulnerability to Known Exploited Vulnerabilities catalog with federal remediation deadline of September 27, 2026
CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on September 24, 2026. The vulnerability is a path traversal flaw affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gate…
Read a full sample brief →