KLAC and the Legal Risks of AI Infrastructure Investments

KLA Corporation, traded as KLAC, is a useful test case for AI-infrastructure investment regulation because it does not sit at the soft edge of the AI market. It sells process-control and yield-management systems used in semiconductor manufacturing, and it describes itself as being “on the critical path of AI infrastructure expansion.” That phrase is commercially important, but it is also legally loaded: the same facts that make KLA relevant to AI infrastructure place it near export controls, China sales restrictions, tariff policy, foreign-investment review, SEC disclosure duties, and AI-related securities litigation risk.[1][2]

That does not mean KLA has done anything wrong. The better question is narrower and more useful: when a public issuer is an AI-infrastructure beneficiary because it supplies regulated hardware into advanced semiconductor production, what does the legal stack actually look like? For KLAC, the answer cannot be organized around a single AI statute. The burden comes from overlapping regimes that attach to the same business facts.

Why KLA Is a Better Bellwether Than a Generic AI Stock

A software company can often talk about AI adoption, customer productivity, model risk, privacy, and employment effects without immediately entering national-security trade law. KLA cannot be analyzed that way. Its AI story is tied to semiconductor manufacturing capacity, and semiconductor manufacturing capacity is one of the places where U.S. national-security policy has become operationally specific.

KLA’s own securities filing supplies the reason to start there. In its Form 10-K for the fiscal year ended June 30, 2025, the company reported total revenue growth of 24%, while China revenue fell from $4.2 billion, or 43% of total revenue in FY2024, to $4.0 billion, or 33% of total revenue in FY2025.[1] That is not a theoretical regulatory overlay. It is a change in geographic revenue composition large enough to matter to investors, counterparties, and underwriters.

The same filing also reported a backlog decline from $9.83 billion to $7.86 billion year over year, with the decrease partly tied to export-control-driven order cancellations and customer deposit returns.[1] Backlog is often treated as a demand indicator. Here, it also becomes a trade-compliance artifact. A disclosure committee reading that number has to ask not only whether customers still want the equipment, but whether orders can legally be fulfilled, whether deposits have to be returned, and whether the investor narrative has kept pace with those constraints.

Export Controls Are the Base Layer

For KLA, export controls are not a remote policy risk. They are the first layer because they reach the company’s products, customers, engineers, collaborations, order book, and revenue geography. The U.S. Bureau of Industry and Security tightened controls on advanced semiconductor and AI-related technologies through rules issued in October 2022, October 2023, December 2024, and January 2025, including controls affecting advanced DRAM and additions to the Entity List.[3]

The strongest company-specific evidence is not the rule history itself; it is KLA’s disclosed effects. China revenue declined in absolute dollars even though total company revenue grew, and backlog fell partly because export controls affected orders and deposits.[1] That combination is what separates a general “trade tensions” paragraph from a live issuer-risk issue. A customer can be creditworthy, a product can be needed, and demand can be real, yet the transaction can still be delayed, narrowed, licensed, canceled, or made uneconomic by export-control requirements.

The export-control layer also reaches personnel and engineering access through the deemed-export rule. Under that concept, allowing a foreign-national engineer access to controlled technology can itself be treated as an export, even if no physical equipment leaves the United States.[4] For an AI-infrastructure supplier, that matters to hiring, lab access, R&D location, joint development, customer support, and internal information systems. It is easy for investors to model revenue by region; it is harder, and often more important, to test who can see what controlled technology and where.

This is why export-control diligence should not be confined to a trade-law questionnaire. The relevant file should connect product classification, customer screening, end-use review, license history, backlog assumptions, technical-support workflows, and employee-access controls. If those records live in separate places, the risk judgment will be slower and less reliable precisely when a transaction, earnings call, or customer dispute demands a single answer.

The Cross-Border Layer Does Not Wait for a Merger

Foreign-investment review adds a second layer, but not only in the familiar inbound-acquisition sense. CFIUS remains relevant when foreign persons seek certain rights in U.S. businesses involving sensitive technologies, data, or infrastructure. In parallel, Treasury’s outbound-investment rule, finalized in November 2024, created new diligence obligations for U.S. persons making certain investments involving countries of concern in sectors that include semiconductors and AI.[4]

For an AI-infrastructure company or investor, the practical question is not simply whether a deal is reportable. It is whether a commercial relationship, financing structure, joint venture, minority investment, board right, information right, or technical-assistance arrangement changes the national-security profile of the business. The answer may depend on technology access, governance rights, customer identity, jurisdiction, and the degree to which the target’s products support advanced computing.

Data center projects show how this scrutiny can expand beyond chip and tool manufacturers. Morgan Lewis reported in June 2026 that global data center projects are facing expanding U.S. national-security scrutiny.[5] That is not the same risk profile as KLA’s, and it should not be collapsed into KLA’s facts. But it confirms that AI infrastructure is being reviewed as a system: chips, tools, facilities, power, data, network architecture, and ownership rights can all become legally relevant.

The tariff overlay belongs in the same cross-border file. KLA disclosed that in April 2025, the Commerce Department initiated a Section 232 investigation into semiconductor imports that could result in additional tariffs on semiconductor manufacturing equipment.[1] Tariff risk is often modeled as margin pressure or pricing uncertainty. In this setting, it also interacts with customer location, supply-chain design, delivery timing, and whether orders already under legal pressure remain economically viable.

Disclosure Risk Starts With the Same Operating Facts

KLA’s AI disclosure posture is notable because it does not confine AI to a revenue story. The FY2025 10-K includes a standalone risk factor stating: “AI technology is complex and rapidly evolving, and may subject us to significant competitive, legal, regulatory and other risks.”[1] That sentence matters because it recognizes AI as a legal and regulatory subject, not merely a demand driver.

Still, disclosure risk is not solved by including an AI risk factor. For a company positioned as an AI-infrastructure beneficiary, the harder question is calibration. If public statements emphasize AI-driven demand, capacity expansion, critical-path positioning, or customer urgency, the risk disclosure has to be concrete enough to describe the constraints that may affect realization of that demand. Export controls, customer cancellations, deemed-export limits, tariffs, and national-security review are not separate footnotes if they bear on the same growth narrative.

The pressure is sharpened by securities-litigation trends. Alston & Bird, citing NERA data, reported 18 AI-related securities class action filings in the first half of 2026, already exceeding the 17 filed in all of 2025.[6] The same analysis reported that overall securities filings were on pace for about 236 in 2026, and that the Second and Ninth Circuits accounted for 68% of federal securities filings.[6] Those figures should be treated as second-hand reporting of NERA data, not an independently reviewed dataset here. Even with that caveat, the direction of travel is hard for a disclosure committee to ignore.

The SEC angle is parallel rather than identical. Skadden’s 2026 securities-litigation outlook, discussing the SEC’s fiscal 2025 enforcement results, described AI-washing as a “classic enforcement target.”[7] The D&O Diary likewise warned in February 2026 that companies making public AI statements “should expect those disclosures to receive heightened scrutiny from the plaintiffs’ bar.”[8] Neither source says KLA is an AI-washing defendant, and this article does not suggest that it is. The point is structural: AI claims now create a record that plaintiffs’ lawyers and enforcement staff can compare against operational constraints.

Where AI Regulation Itself Fits, and Where It Does Not

AI-specific regulation is part of the environment, but it is not the main source of KLA’s company-specific legal exposure on the materials available. A vendor-produced 2026 compliance guide reports that the EU AI Act Annex III compliance deadline was extended to December 2, 2027, and that the Colorado AI Act became effective June 30, 2026.[9] Those dates should be checked against official sources before a transaction memo or public-company disclosure relies on them. They are useful here only as a reminder that downstream AI customers may face regulatory obligations that affect procurement, documentation, audit demands, and supplier questionnaires.

For KLA, the more immediate legal map still runs through controlled technology, cross-border access, foreign sales, customer eligibility, tariffs, disclosure, and litigation. That is why a pure AI-governance review would be incomplete. It might cover model documentation and downstream compliance language while missing the export-control facts already visible in revenue and backlog.

An Integrated Diligence File for AI-Infrastructure Exposure

The legal teams most exposed to this problem are not lacking memos. They are usually drowning in specialized memos: export controls in one binder, securities disclosure in another, CFIUS analysis in another, tariff assumptions in finance, and AI-litigation clips in a D&O renewal file. The practical work is to force those materials to answer the same questions about the same facts.

A useful diligence file for an AI-infrastructure issuer or investment should begin with export-control facts, then trace how those facts affect other legal domains. The sequence matters because trade controls often generate the operating consequences that later become disclosure or litigation issues.

• Product and technology map: identify which products, software, technical data, and services may be controlled, how classifications are maintained, and whether classifications have changed after BIS rule updates.
• Customer and end-use map: connect restricted-party screening, end-use review, license requirements, customer location, and customer ownership to actual order and backlog data.
• Personnel-access map: document who can access controlled technology, how deemed-export controls are enforced, and whether engineering collaboration depends on foreign-national access.
• Transaction map: review whether investments, joint ventures, governance rights, information rights, or technical-assistance arrangements trigger inbound CFIUS, outbound-investment, or sanctions-related diligence.
• Disclosure map: compare AI-demand statements, backlog discussion, revenue concentration, risk factors, MD&A language, and earnings-call scripts against known regulatory constraints.
• Litigation and insurance map: test whether AI statements could be characterized later as overstating demand visibility, underdescribing regulatory friction, or omitting known limits on fulfillment.

The value of this framework is not that every risk becomes fatal. Most will not. The value is that it prevents legal teams from answering a securities-disclosure question without the export-control file, or underwriting a D&O risk without understanding how backlog was affected by cancellations, deposits, licenses, and customer eligibility.

Questions That Should Be Asked Together

A single meeting among export-control counsel, securities counsel, the finance team, investor relations, and the D&O broker would likely be more productive than another isolated memo. The questions are interdependent:

• If a customer order is in backlog, what facts support legal deliverability, and what facts could change that assessment?
• If China revenue declines while total revenue grows, has the company explained whether the change reflects demand, controls, customer mix, timing, or some combination?
• If AI infrastructure demand is highlighted in public statements, are export-control constraints described at a level that matches their known operational effect?
• If engineers, customers, or partners need technical access, has the deemed-export analysis been integrated into hiring, R&D, and collaboration plans?
• If an investment or joint venture touches semiconductors, AI, data centers, or controlled technology, has the diligence covered both inbound and outbound national-security review?
• If the company uses “critical path” or similar language, what evidence would be produced if a plaintiff later asked whether management also knew about legal limits on that path?

What the KLA Example Supports, and What It Does Not

The KLA materials support a disciplined conclusion, not a dramatic one. They show that an AI-infrastructure beneficiary can have growth, commercial relevance, and regulatory friction at the same time. They show that export controls can affect revenue mix and backlog. They show that AI-related public statements now sit in a securities-litigation environment where plaintiffs and regulators are attentive to AI claims. They also show why legal diligence has to connect trade, national security, disclosure, and litigation risk before an investment thesis treats AI infrastructure as a clean demand story.

The materials do not support a prediction that KLA will face enforcement, a claim that its disclosures are deficient, or a conclusion that AI-infrastructure exposure is uninvestable. The stronger and safer conclusion is that the legal risk is stacked. In 2026, AI-infrastructure investment diligence cannot be organized around a single AI rule; it has to test how export controls, foreign-investment review, tariff exposure, SEC disclosure, and AI-washing scrutiny interact around the same business facts.

References

1. KLA Corporation Form 10-K for FY ended June 30, 2025, KLA Corporation, 2025.
2. KLA Corporation Reports Fiscal 2026 Fourth Quarter and Full Year Results, KLA Corporation, July 28, 2026.
3. The United States Regulates Artificial Intelligence With Export Controls, The Regulatory Review, September 25, 2025.
4. Investing in AI, Semiconductors, Biotech and Data Infrastructure in 2026: How Immigration, Trade and CFIUS Shape Returns and Deal Certainty, Buchalter.
5. Global Data Center Projects Face Expanding US National Security Scrutiny, Morgan Lewis, June 2026.
6. Securities Class Action Filings Surge, AI-Related Claims Rise in First Half of 2026, Alston & Bird, July 2026.
7. AI-Related Claims and Other Securities Litigation Trends to Watch, Skadden, 2026.
8. Guest Post: AI, the SEC, and the 2026 Reporting Season, The D&O Diary, February 2026.
9. AI Regulation 2026 Business Compliance Guide, Kiteworks.