New Cloud Regulation Framework Under Consideration by US Department of Commerce

The U.S. Department of Commerce’s Bureau of Industry and Security is considering new export control regulations to block a workaround that allows Chinese artificial intelligence development companies to remotely utilize advanced U.S. semiconductors via overseas data centers. Reported by foreign media on August 28, 2026, the draft is expected to be presented to relevant companies and industry associations as early as September 2026, with a public comment period to follow. Under the current export control regime, authorities have successfully blocked the physical shipment of cutting-edge semiconductors, such as those from NVIDIA, to the Chinese mainland. However, a situation has persisted where it is legally impossible to restrict domestic Chinese developers from accessing servers in data centers located in third countries—such as Thailand, Singapore, Indonesia, and Japan—via the internet and renting their computing power in a cloud format. This new regulatory proposal goes beyond the framework of traditional physical export restrictions, focusing primarily on limiting the ability of Chinese companies to substantially train and operate state-of-the-art AI models.

National Security Challenges Posed by the Mismatch Between the Borders of Physical Goods and Computing Power

Past U.S. government export controls were designed with the premise of managing the movement of physical products, such as semiconductor chips. However, the advancement of cloud technology has created a new challenge—the cross-border flow of computing power—enabling vast computational capabilities to be accessed remotely without physically owning the hardware. Even if high-performance GPUs remain installed in a Southeast Asian data center, as long as the engineers or entities using them to train models and process data are located in mainland China, de facto circumvention of regulations becomes possible. This reality functions as a critical national security loophole, exposing the limitations of traditional border control measures focused on the physical location of products. What the U.S. Department of Commerce aims to achieve is an institutional transition from semiconductor product management to cloud border control, monitoring who is accessing how much computing performance and from where. In the AI era, where the physical movement of goods and the means of intelligence production are decoupled, a new question is being thrust upon us: how can nations control this power? Please refer to the figure below.

Growing Circumvention Routes and the Reality of Chinese AI Enterprise Development

High-performance GPU rental agreements spreading across Southeast Asia and Japan

Transactions involving renting high-performance GPUs via the cloud to circumvent physical restrictions are already functioning as a massive, practical business based in Asian countries. As a representative example, it has been revealed that INFTech, a Shanghai-based artificial intelligence startup, leased approximately 2,300 (to be exact, 2,304) of NVIDIA’s latest Blackwell semiconductors operating in an Indonesian data center in November 2025, using them to train financial AI models and advance R&D in the field of drug discovery. This infrastructure was built with an investment of approximately $100 million by local telecommunications operator Indosat. Additionally, in December 2025, Chinese tech giant Tencent signed a three-year access agreement totaling over $1.2 billion with Data Section, a Japanese cloud provider, securing the computing power of 15,000 Blackwell processors. These transactions are conducted entirely within the scope of current laws, illustrating the mainstream adoption of a mechanism whereby Chinese entities utilize US-restricted chips without importing them into mainland China.

Moonshot’s Kimi K3 Development and US Government Concern

The rapid advancement of discussions regarding regulations on cloud-based remote access was triggered by issues surrounding Kimi K3, an open-source model released in 2026 by Moonshot, a leading Chinese AI company. U.S. security officials have pointed out that Moonshot utilized NVIDIA servers installed in Thailand to distill and train Fable—a top-tier closed AI model developed by the U.S.-based Anthropic—thereby successfully developing the high-performance Kimi K3. The data center in Thailand was equipped with NVIDIA’s latest Blackwell system, the GB300, and advanced training was executed through remote access to these server clusters. The fact that a Chinese company efficiently acquired intelligence approaching that of advanced U.S. closed models without owning the physical hardware has become a matter of utmost concern from a security perspective. Because the current legal framework cannot define such rental practices as illegal, the U.S. government is facing a situation where it is forced to move toward the prompt closing of these loopholes.

Moves Toward Legislation and the Paradox Facing the Market

Deliberation on the Remote Access Security Act (RASA) in Congress

In the U.S. Congress, work is simultaneously underway to develop the Remote Access Security Act, which would grant the Department of Commerce clear legal authority to directly regulate remote access on the cloud. This bill (H.R. 2683) redefines the act of utilizing remote cloud computing power itself as an export subject to Export Administration Regulations, imposing strict obligations on service providers. It was passed in the House of Representatives on January 12, 2026, with overwhelming bipartisan support of 369 votes in favor and 22 against, but it is currently stalled in the Senate Banking Committee and has not yet officially become law. As a result, the current Department of Commerce is exploring enforcement through an indirect approach: requiring local operators, as a condition for granting semiconductor export licenses for overseas data centers, to pledge that they will not allow Chinese companies to use them remotely. Such measures taken by the executive branch amid delays in the bill’s enactment represent a rapid expansion of jurisdiction over intangible services and carry the risk of leading to legal disputes and litigation with the industry.

The Reality of Mandatory Know Your Customer (KYC) and the Risk of Declining US Technological Dominance

If the proposed new regulations are introduced, U.S. cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud will be mandated to conduct extremely strict Know Your Customer (KYC) checks at their overseas operations. However, even if the registered entity is a local subsidiary in a place like Singapore, if its ultimate beneficial owner or primary user is a Chinese parent company or engineers, completely tracking brokers and resale routes is practically extremely difficult. There are also growing concerns over the risk of over-compliance, where cloud providers, fearing hefty penalties for regulatory violations, might excessively weed out even legitimate, ordinary customers. Furthermore, if using U.S.-made GPUs entails complex audit costs and sanction risks, it could trigger overseas data center operators to avoid adopting U.S. products and shift toward non-U.S. alternative semiconductors and proprietary cloud infrastructure that fall outside the reach of the regulations. This harbors a profound paradox: regulations designed to enhance national security may, in the long run, undermine the global market dominance of U.S. semiconductors and cloud services. Please refer to the enforcement scheme diagram below.

Reference Page

• 【Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities – Federal Register】https://www.federalregister.gov/documents/2024/01/29/2024-01580/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-malicious

【#USChinaTensions #ExportControls #EconomicSecurity #DataCenters #CloudServices #Semiconductors #TrumpAdministration】