U.S. House votes 369-22 to close AI chip cloud loophole with China

The U.S. House of Representatives passed the Remote Access Security Act on January 12, 2026, by a lopsided 369-22 vote, extending American export-control law to a channel that had let Chinese companies tap the country's most advanced AI chips without ever owning them: cloud rental. Existing rules already blocked the sale or physical transfer of top-tier Nvidia and AMD processors to China, but said nothing about a Chinese company simply renting a server abroad and running its workloads on hardware it never imported.

How companies rented their way around the ban

The gap had already been exploited at scale, according to reporting cited by Tom's Hardware. The Shanghai-based startup INF Tech reportedly gained access to 2,300 export-banned Nvidia GPUs by renting 32 Nvidia GB200 servers from an Indonesian telecommunications company, in a deal worth an estimated $100 million — signed, according to the same reporting, after the Chinese client was already secured. Alibaba and ByteDance have separately been accused of training their Qwen and Doubao large language models on Nvidia chips accessed by renting data center capacity across Southeast Asia. The Register reports that Chinese cloud platforms, including Alibaba and Tencent, have offered similar remote access to export-controlled GPUs since at least 2023, at times through mainstream services such as Amazon Web Services.

What the new law actually changes

The Remote Access Security Act amends the Export Control Reform Act so that remote access to a controlled item — not just its sale or physical possession — falls under U.S. export-control jurisdiction. The bill's cosponsor, Representative John Moolenaar (R-MI), chairs the House Select Committee on the Chinese Communist Party, which announced the bill's passage.

The CCP's AI ambitions are being fueled by its access to American chips housed in data centers located outside of China. This bill brings our laws into the digital age and makes it clear that cloud compute is subject to U.S. export control law, just like physical chips. Closing these loopholes will strengthen U.S. national security and protect American innovation.

Bill sponsor Representative Mike Lawler (R-NY) put the stakes more bluntly: "Our export controls are only as strong as the weakest link, and right now, the CCP has a real tool to sidestep these prohibitions," he said, according to The Register. For the bill to become law, it still needs to pass the Senate and be signed by President Trump — neither of which is guaranteed.

• 369-22: the House vote that passed the Remote Access Security Act on January 12, 2026
• The bill amends the Export Control Reform Act to cover remote access, not only sales or physical transfers
• Reported case: INF Tech's rental of 32 Nvidia GB200 servers from Indonesia, covering 2,300 GPUs, for about $100 million
• Alibaba and ByteDance have been accused of training Qwen and Doubao on chips accessed via Southeast Asian data centers
• The bill still needs Senate approval and a presidential signature to take effect

A parallel push from the Commerce Department

The legislative move sits alongside separate action at the Commerce Department's Bureau of Industry and Security (BIS). On January 13, 2026, BIS eased one part of the export regime, saying it would review license applications for Nvidia's H200 and AMD's MI325X on a case-by-case basis, following President Trump's December 2025 decision to allow sales of these chips to approved Chinese customers under strict conditions — including independent U.S. testing of the hardware and customer-screening commitments from the buyer.

Months later, BIS tightened a different part of the same regime. According to TrendForce, citing Reuters, the agency moved in late May 2026 to require a license before Nvidia's Blackwell and Rubin chips, or AMD's MI350X, can be shipped to any company whose ultimate parent is headquartered in China — even when the recipient entity itself sits outside the country, in places such as Malaysia. Sources told Reuters the volume involved could run to hundreds of thousands of chips.

The loopholes that remain

Neither move closes every gap. BIS's subsidiary guidance does not force data centers that already operate the chips to stop using or servicing them, and former State Department official Chris McGuire told Reuters it still does not require chipmaker TSMC to check whether the advanced processors it manufactures for other customers ultimately get routed to Chinese-linked intermediaries. Enforcement of pure remote access faces a similar limit today: BIS currently lacks explicit statutory authority to police cloud rental on its own, which is exactly the hole the Remote Access Security Act is designed to plug.

For cloud providers and data center operators outside China — in Indonesia, Malaysia and across Southeast Asia — the practical effect is a heavier compliance burden: verifying not just who rents a server, but who ultimately owns the company doing the renting. For Nvidia and AMD, it narrows, at least on paper, one of the channels that kept Chinese demand for their top-end silicon alive despite the ban on direct sales. And for Beijing, the tightening reinforces a strategy already under way: pushing domestic AI labs and cloud operators toward homegrown chips rather than relying on access — owned or rented — to American hardware that Washington can restrict at will.