U.S. Pivots AI Export Controls to Target Cloud Access, Not Chips

The United States is fundamentally reshaping its approach to limiting China's artificial intelligence capabilities, moving beyond physical chip export restrictions to target cloud-based access to advanced computing hardware.

According to reporting by The Information, the Trump administration's Commerce Department is drafting a rule that would restrict Chinese AI companies from renting Nvidia GPU compute through data centers located in third countries such as Thailand, Singapore, Malaysia, and Japan. A draft could circulate to industry groups as early as September.

The policy shift represents a tacit acknowledgment that four years of export controls focused on blocking chip shipments have not achieved their intended effect.

Why it matters

This marks a fundamental evolution in technology export policy—from controlling physical goods to regulating digital access. The move exposes a critical gap in existing law and signals that future tech competition will be fought through data center contracts and compliance systems rather than customs enforcement. It also places private companies like Nvidia in the uncomfortable position of serving as de facto border guards for U.S. national security policy.

The catalyst: A Chinese model trained abroad

The immediate trigger was Moonshot AI's July release of Kimi K3, a 2.8-trillion-parameter model that performed comparably to leading American systems. White House Office of Science and Technology Policy director Michael Kratsios publicly alleged that Moonshot trained the model by accessing Nvidia GB300-equipped servers in Thailand, using a sophisticated internal platform to distill U.S. models while switching between access channels to avoid detection.

Moonshot has not publicly responded to the accusations, but the strategic implications are clear. Chinese hyperscalers including ByteDance, Alibaba, and Tencent have reportedly accessed Nvidia compute through data centers across Southeast Asia and Japan. The existing export control regime governed where chips could be shipped but said nothing about who could remotely access them once installed.

Legal authority remains uncertain

Export control attorneys widely acknowledge that the Commerce Department likely lacks statutory authority to regulate remote chip access under current law. The Remote Access Security Act, which would explicitly grant the Bureau of Industry and Security jurisdiction over cloud-based access, passed the House 369–22 in January but has stalled in the Senate Banking Committee.

The administration is proceeding with rulemaking anyway, hoping legislative authorization will follow. This approach mirrors previous policy attempts that collapsed under legal challenges or industry pressure, including the Biden-era AI Diffusion Rule that was rescinded in May 2025.

Nvidia becomes private enforcer

Facing the threat of statutory action, Nvidia has constructed its own compliance apparatus. The company now operates a customer whitelist across Asian markets, and the Financial Times reports that more than half of existing Asian customers were removed from approved-buyer lists under tightened reviews. Neocloud providers—companies whose business model centers on renting AI compute—were hit hardest.

Nvidia employees are reportedly conducting in-person visits to customer data centers to verify facilities and end users. The most consequential AI export enforcement is now being conducted by a private company's compliance team rather than government officials.

Enforcement actions are accelerating elsewhere. Taiwanese prosecutors this month indicted nine people, including an Nvidia employee and current and former Supermicro associates, over 130 B300-equipped servers falsely declared for use in Taiwan, with 74 reaching China before interception. California prosecutors charged ALX Solutions operators with buying more than 200 H100 chips while declaring fictitious end customers in Singapore and Japan.

China's asymmetric response

China's reaction has been strategic rather than reactive. One day after news of the Commerce rule leaked, Tencent open-sourced Hy4-preview, a 770-billion-parameter mixture-of-experts model with a one-million-token context window, available for free download. Beijing's Ministry of Commerce is simultaneously consulting Alibaba, ByteDance, Zhipu, and other domestic firms on adding AI model weights, training data, and chip designs to China's own export control list.

The approach suggests China is optimizing for efficiency on available compute, pursuing global adoption through open models, and building legal barriers around its own technology—a mirror image of Washington's strategy.

With AI expected to dominate next month's U.S.–China summit agenda, the cloud-access rule will arrive as Washington formally acknowledges that technological power in the AI era resides not in hardware ownership but in controlling access, architecture, and integration terms.

These details were first reported by Vivian Toh in Forbes.