Assessing Outcomes of H200 Exports to China

Following a January rule on semiconductor exports from the Bureau of Industry and Security (BIS), it is expected that hundreds of thousands of Nvidia H200 GPUs and their equivalents will be sold to customers in China. The rule caps exports to China at 50 percent of sales to U.S. industry, therefore, if domestic sales of H200s and AMD MI325X chips were a little under two million last year, it's estimated that the rule would allow for the sale of about 890,000 GPUs to China. Nvidia said it is moving forward with H200 manufacturing for Chinese customers, a sign that the company could easily meet the 890,000 cap if BIS approves the license applications. This brief concludes that these H200 exports stand to seriously boost Chinese frontier AI capabilities, and that because end-user access and end uses cannot be feasibly controlled, sales to China will also contribute to AI developments for prohibited military users. 

1. Access to H200-level compute would significantly boost Chinese frontier AI development and enable deployment at a scale not currently available to Chinese labs. At the maximum export cap, China’s total processing power would increase by over 250 percent relative to its projected 2026 baseline, with an even greater boost for inference compute when accounting for high bandwidth memory. For a lab like DeepSeek, the compute gap with leading U.S. data centers would close considerably. Access to just 280,000 H200s would put DeepSeek on par with xAI’s Colossus 2 as of March this year, and at the full export cap DeepSeek’s compute approaches projected U.S. 2026 individual data center buildouts. Increased compute directly affects model deployment capacity at levels that are currently out of reach for Chinese labs. Looking at estimated token throughput per GPU, with 100,000 H200s DeepSeek could theoretically serve over 800 million users per month which is on par with OpenAI’s reported user base. 

2. It is unfeasible to delink H200 customers from China’s military apparatus. Beijing’s Military Civil-Fusion doctrine blurs the line between China’s commercial AI sector and its military, and the People’s Liberation Army’s (PLA) procurement behavior confirms this in practice. Scholars document dozens of PLA tenders for tools built on DeepSeek models, and public procurement records further reveal the military’s aim to incorporate AI capabilities for command and control, surveillance, battlefield decision support, and deepfake generation for psychological operations. 

3. Verification of end users and end use of U.S. compute is nearly impossible once chips are exported to China. Physical security of chips cannot be confirmed once inside China’s borders as chips can be quietly redirected or accessed by unauthorized parties without U.S. exporter knowledge. Likewise, U.S. exporters cannot guarantee that China’s cloud service providers implement Know-Your-Customer protocols and enforce prohibitions on unauthorized end users. Further, even if exporters could ensure these end user processes, it is not feasible to monitor and control GPU end uses.