It'll depend on what law they're restricting it under. The obvious play would be to put it on the Commerce Control List so it's covered by the EAR (Export Administration Regulations). If so, compliance is pretty well-understood, just a giant pain in the ass that'll pretty much limit use of these models to companies that already have EAR/ITAR compliance offices.
Easy. Provide your government issued ID such as US passport before signing up to an AI provider. Issue fines or jail time to anyone who supplies their AI access to a foreign citizen