US Moves to Block China's Remote AI Chip Access

The next front in the US–China chip war is not a chip at all — it is the network cable that reaches one. According to multiple reports, the Commerce Department’s Bureau of Industry and Security (BIS) is drafting a rule that would, for the first time, restrict Chinese firms from remotely renting US-made GPU compute housed in data centers in third countries such as Thailand, Singapore, and Malaysia. Officials are said to be preparing to circulate a draft to industry stakeholders as early as September.

The move targets a gap that has quietly undercut two years of export controls: Washington can stop the physical shipment of an advanced accelerator to China, but it has no clean mechanism to stop a Chinese company from logging into that same accelerator over the internet when it sits in a rack in Southeast Asia.

The loophole, in plain terms

US export controls are built on a specific legal definition. Under the Export Administration Regulations, Section 734.2 defines an “export” as the physical transfer of hardware or technology across a border. Renting cloud capacity — submitting a training job to a server you never touch and never own — does not meet that definition. The chip never moves; only the workload does.

That distinction has become a highway. Reporting indicates that Chinese hyperscalers including ByteDance, Alibaba, and Tencent have tapped Nvidia compute through providers in Thailand, Malaysia, and Japan, running the workloads that domestic access to top-tier accelerators would otherwise enable. Because the accelerators themselves were lawfully sold to operators in those countries, and because the Chinese customers only ever reach them remotely, the arrangement has sat outside the reach of shipment-based controls.

The scale, where it has surfaced, is not trivial. In documented cases cited by analysts, one Chinese firm reportedly rented roughly 2,300 Blackwell GPUs through an Indonesian data center, while Tencent was said to have secured about $1.2 billion in contracts for some 15,000 Blackwell processors via a Japanese provider. Those are cluster-scale commitments — enough compute to train and serve frontier-class models — routed entirely around the physical-shipment regime.

What BIS is reportedly drafting

The draft rule is described as an attempt to put remote access on the same footing as a physical export: if a controlled accelerator would require a license to ship to a Chinese entity, then granting that entity remote use of the same accelerator abroad would trigger similar licensing and enforcement. In practice, that would push obligations onto the data-center operators and cloud providers in the intermediary countries, requiring them to police who is actually running jobs on their US-sourced silicon.

This is not the administration’s first attempt to reach cloud compute. The prior AI Diffusion Rule took limited steps toward restricting remote access as part of a broader framework governing where advanced chips and their compute could flow. The second Trump administration suspended that rule before it took effect, favoring a more bilateral, case-by-case approach to licensing — including the recent, contested decisions to allow some H200 shipments into China and renewed export licenses for AMD under revenue-sharing arrangements. The new draft is, in effect, an attempt to close the one door those bilateral deals leave open: even a tightly licensed physical-export regime accomplishes little if the same compute is freely rentable offshore.

The authority problem

There is a catch that could blunt the rule before it lands: BIS may not have the statutory authority to enforce it. Export-control lawyers have repeatedly noted that the EAR’s physical-transfer definition is not something the agency can rewrite by regulation alone — closing the remote-access gap durably requires an act of Congress.

That act exists, but only halfway through the process. The Remote Access Security Act (RASA) would explicitly place “remote access” on a similar legal footing to a physical export, giving BIS clearer authority to require licenses and impose penalties when controlled technology is reached over a network. The bill passed the House on January 12, 2026, by a 369–22 margin — a rare bipartisan supermajority — and now sits with the Senate Banking, Housing, and Urban Affairs Committee. Until the Senate acts, a BIS rule that leans on the existing statute could face immediate legal challenge on the grounds that the agency is regulating something the law does not yet cover.

The result is a familiar Washington sequence: an executive branch moving to act quickly against a fast-moving workaround, and a legislative track that has the votes but not yet the finish. If the draft circulates in September as reported, industry comment will almost certainly focus less on whether the loophole should be closed and more on whether this instrument can close it without being struck down.

Why the third countries matter

The geography is not incidental. Southeast Asia and parts of East Asia have spent the AI boom positioning themselves as neutral compute hubs, courting Western chipmakers and cloud operators with power, land, and favorable terms. That build-out is real and largely legitimate — but it also created dense pools of top-tier accelerators in jurisdictions without US-grade export enforcement, physically close to the largest blocked market in the world.

For the host countries, the draft rule is a genuine bind. Their data-center operators have signed lawful contracts for US chips and lawful contracts with paying customers; being asked to interrogate the ultimate nationality and intent behind every remote workload is both technically hard and commercially unwelcome. China, meanwhile, has been pouring resources into domestic AI infrastructure and homegrown lithography precisely to reduce this dependence — but frontier training still leans on the leading-edge accelerators that only a handful of foreign suppliers can provide, which keeps the offshore-rental route valuable for now.

What it means

The remote-access rule marks a philosophical shift in export policy: from controlling things to controlling use. That is a far harder problem. A chip has a serial number and crosses a border once; a cloud workload is ephemeral, obfuscatable, and reroutable across providers in minutes. Enforcing intent at that layer pushes the compliance burden onto foreign operators and, ultimately, onto the accounting of who is logged in — a standard that is easy to state and very hard to prove.

Who is squeezed. In the near term, the pressure lands on the intermediary data centers in Thailand, Singapore, Malaysia, and Japan, which face the prospect of policing their own customers or losing access to US silicon. Nvidia and its peers sit uncomfortably in the middle: every closed loophole narrows a real, paying source of demand, even as it protects the long-term integrity of the controls that keep their most advanced parts strategically valuable.

The gating factor is the Senate. A regulation built on contested authority invites litigation, and the cleanest path to durable enforcement runs through RASA. Watch whether the Senate Banking Committee moves the bill this fall; if it stalls, BIS is left enforcing a rule on shaky legal ground, and Chinese firms retain every incentive to keep renting compute a border or two away. If it passes, the offshore-cloud route narrows sharply — and the contest moves to the next seam, wherever compute can still be reached without being owned.

The broader signal is that the compute war is maturing past silicon. As physical controls tighten and bilateral licensing deals proliferate, the strategically decisive question is no longer only who can buy the chip but who can log into it — and that is a question the old rulebook was never written to answer.