Cloud Compute: A Policy Escalation Framework
This report was coauthored by Onni Aarne.
The United States Bureau of Industry and Security (BIS) prohibits exports of advanced AI compute to countries of concern to protect national security. However, a substantial and growing volume of U.S.-designed compute remains legally available to rent to customers otherwise prohibited from purchasing it.
Reporting indicates that Chinese model developers and hyperscalers remotely access the United States’ most advanced semiconductors through cloud service providers (CSPs) outside China. In one recent case, Tencent reportedly signed a five-year lease for roughly 100,000 advanced AI chips across Oracle data centers in Southeast Asia.¹ We have previously estimated that rented U.S. compute will add at least 60% on top of the compute China acquires in 2026 alone.² As AI data center construction accelerates across Southeast Asia and around the world, Washington needs a clear strategy to address national security risks posed by remote access to its most advanced compute.
Chinese AI companies’ continued access to cloud compute will likely be their largest source of compute to train China’s first Mythos-level model, which IAPS estimates will be developed by around February 2027.³ For now, China’s top-performing frontier models trail leading U.S. models by roughly four to eight months, depending on the model and domain. Maintaining the lead in capabilities is essential to ensure the United States and its allies can harden critical infrastructure networks and build defenses before adversaries with access to new models can exploit vulnerabilities, whether those attacks are launched by the People’s Republic of China (PRC) or by other foreign adversaries using Chinese models. Continued access to cloud compute also enables widespread deployment of China’s leading models, which scales firms’ users, revenue, and training data that feeds back into model development.
To address these national security concerns, BIS should publish a cloud compute rule. This report offers an escalation framework with four policy levels for U.S. policymakers to consider to address China’s access to cloud compute. Level 1 would implement a reporting requirement to assess how much AI compute Chinese entities are renting, while Levels 2 through 4 are varying levels of a cloud compute rule, sorted by escalating prohibition and enhanced customer verification measures. To publish a rule, BIS could rely on new authorities from the Remote Access Security Act if the bill becomes law, but it could also rely on its existing statutory authorities if needed.
Figure 1: An Escalation Framework With Four Policy Levels
Level 1: Implement Reporting Requirements
If policymakers find that there is not enough public information to decide whether to publish a new cloud compute rule now, BIS could implement reporting requirements to U.S. CSPs that would deliver more well-defined figures. CSPs already collect basic customer contact information that indicates where the customer is located. Using BIS authorities under the Defense Production Act to conduct industry surveys, BIS could require CSPs to report high-level information indicating how much AI compute is rented by companies in or under the jurisdiction of the PRC, or other prohibited countries. This information could include, for example, the number of customer accounts located in or controlled from the PRC and the aggregate number of AI chips rented within a year.
Level 2: Prohibit Remote Access to AI Compute at or Above Frontier-Scale Thresholds
If policymakers have already concluded that China’s continued legal remote access to advanced U.S. compute is a national security concern, BIS should publish a new cloud control rule. Levels 2, 3, and 4 in this framework outline three options for such a rule. Level 2 involves BIS publishing a rule that prohibits entities under the jurisdiction of the PRC and/or other countries of concern from renting advanced U.S. compute above a defined threshold that could be used to train frontier models or conduct large-scale model inference. Customers that trigger certain thresholds —identified in this report as cluster capacity per instance, cumulative floating-point operations (FLOP) per customer, data ingress and egress, and customer spending—will be subject to an enhanced Know-Your-Customer (KYC) verification process and restricted from renting AI compute if identified as a customer under the jurisdiction of a prohibited country. Beyond the basic contact and billing information CSPs already collect, enhanced KYC would include verifying the customer's identity through live checks with sales representatives and investigation teams to verify an entity’s beneficial ownership structure before releasing further compute. Customers that do not trigger the threshold would be able to continue to rent AI compute with no restrictions.
Level 3: Prohibit All Remote Access to AI Compute, With Enhanced KYC for Flagged Customers
If policymakers find that covered customers are evading Level 2’s thresholds by spreading training or inference workloads across numerous sub-threshold accounts, they can extend the prohibition to all AI compute for prohibited countries. All Chinese entities or entities from other prohibited countries could be automatically prohibited. However, conducting an enhanced KYC scheme on all customers to ensure they are not from a prohibited country could be a heavy lift for CSPs and result in lots of false flags. Instead, this approach would rely on two tiers of customer verification. Like Level 2, customers that trigger one of the thresholds would be subject to enhanced KYC. All other customers would be subject to the customer verification process CSPs already have in place.
Level 4: Prohibit All Remote Access to AI Compute, With Enhanced KYC for All Customers
If policymakers conclude that prohibited actors can still produce shell companies and fraudulent accounts cheaply and quickly enough to aggregate meaningful compute below signal thresholds and evade standard customer verification processes, they can require CSPs to run enhanced KYC on every customer, regardless of how much compute they rent. This approach might appear to offer the most robust enforcement options. However, there are a significant number of legitimate customers at this scale, and the approach could add a notable cost to both CSPs and legitimate customers.
Policy Recommendation
There is enough public reporting that shows China’s model developers and hyperscalers are renting frontier-scale U.S. AI compute. Therefore, we recommend BIS should not wait for the results of Level 1’s industry survey and should prepare a cloud control rule for publication now. At minimum, BIS should adopt Level 2 to cut off China’s model developers and hyperscalers from training frontier models and running large-scale inference on U.S. compute.
When considering Level 3, policymakers should take into account the potential escalatory effects of extending the prohibition to all Chinese customers. For example, civilians will lose access to U.S. compute for things like research on societal benefits like healthcare and environmental science. By cutting ordinary businesses off from U.S. AI compute, this level also effectively contributes to the economic containment of China, making it more escalatory. However, if BIS finds that Chinese companies are offloading large-scale inference onto significant numbers of small accounts below the KYC threshold, it would be beneficial to move to Level 3.
Level 4’s extension of enhanced KYC to all customers may appear more robust; however, the compliance burden on CSPs and the chances of flagging thousands of false positives and negatives in the KYC process likely make it unworkable at this stage. As CSPs build up their compliance teams and begin to incorporate new AI tools for customer verification, BIS could lower the enhanced KYC thresholds over time to bring more customers into the process.
Endnotes:
See Wu, “China’s Tencent leases 100,000 chips from Oracle to accelerate AI push.”. The lease is reportedly worth about $7 billion, with roughly 30% paid upfront. Neither Tencent nor Oracle has confirmed the report.
King, “How much US compute is China renting from the cloud?”
Low, “China will likely have its own Mythos-like model around February 2027.”