> How exactly is that going to be enforced?

Flow chart:

1. Is your company run by fuckwits? If no: they will not try to trick the US government about whether they are using prohibited models when the government asks. Your CISO will block access. We're done. If yes, continue to #2.

2. Are they the specific brand of fuckwits who would try to trick the US government about whether they are using prohibited models? If no: They will probably still not let you use those models, but maybe they'll be bad at enforcement. If yes: this is probably not the kind of company that it will serve your long term interests to work for, but have fun with the prohibited models.