This memo was coauthored by Erich Grunewald and Hamish Low.
The United States controls its most advanced semiconductors to restrict China’s frontier AI development and deployment. Effective export controls are critical for U.S. national security, providing the U.S. a capability lead and allowing for the hardening of critical infrastructure and government systems against AI-enabled cyber threats. However, the export control regime requires additional measures to cover gaps in the rules and their enforcement. Chip smuggling, remote access to cloud compute, H200 exports to China, and gaps in allied controls on semiconductor manufacturing equipment allow prohibited entities to access advanced capabilities.
The U.S. government should address these gaps and strengthen export controls by prioritizing four areas: remote access to chips, chip smuggling, H200 exports, and semiconductor manufacturing equipment (SME).¹
Prohibit Remote Access to Chips
Chinese entities legally rent growing amounts of overseas, otherwise prohibited, semiconductors through cloud services. Reports in 2024 found a handful of entities renting H100-equivalents² in the thousands, but now journalists are uncovering deals in the tens of thousands to one-hundred thousand. Researchers estimate Chinese entities will rent approximately 1 million H100-equivalents in 2026, and will rent an estimated 2.8 million by the end of 2027. IAPS forecasts remote access will be the largest source of compute for a Chinese firm developing the country’s next leading frontier model.
The Remote Access Security Act (RASA) would amend Commerce authorities to cover remote access for items on the Commerce Control List. Policymakers should ensure the bill’s definition of cloud services is not limited to Infrastructure-as-a-Service transactions, and includes any comparable cloud service that lets customers train, fine-tune, or run inference on an AI model.
The Bureau of Industry and Security (BIS) could publish a cloud compute rule. RASA would make BIS authorities more straightforward but if it does not pass, BIS can still act using existing authorities. At minimum, BIS should prohibit Chinese companies from renting chips used to train frontier models or for large-scale AI inference, and require stronger customer verification methods.
Stop Chip Smuggling
Researchers estimate China will have accumulated 1 million smuggled H100-equivalent chips by the end of 2026, reaching 1.6 million in 2027. Policymakers can limit, if not end, chip smuggling by implementing location verification mechanisms and whistleblower incentives.
The Chip Security Act would require location verification on exported chips. Delay-based verification, which measures a chip’s response time to trusted servers, relies on attestation features already on NVIDIA chips and could be active within a year.
The Stop Stealing Our Chips Act, would pay whistleblowers 10% to 30% of penalties from a fund financed by violators. IAPS has proposed some targeted changes to strengthen the bill.
Limit Licensing of H200 Exports to China
BIS’s January rule changed NVIDIA H200 and AMD MI325X chip exports to China from a presumption of denial to a case-by-case review, capped at 50% of sales to U.S. industry, or an estimated 890,000 H100-equivalents. The rule added conditions that Chinese customers must have security plans and provide no remote access to prohibited users. However, once chips are exported to China, these conditions cannot be verified.
The AI OVERWATCH Act would require Commerce to notify Congress at least 30 days before selling a covered chip to a country of concern and allows Congress to block a license by joint resolution, while prohibiting licenses for Blackwells and more advanced chips.
BIS could lower the cap on H200 sales to China. The current cap on U.S. sales is too high and risks adding roughly 90% of what China’s own chipmakers are projected to produce in 2026. Adding limits like 75,000 chips per customer might seem useful, but once the chips are exported to China the U.S. cannot guarantee that entities will not share access with others.
Work with Allies to Close Equipment Control Gaps
Export controls on semiconductor manufacturing equipment (SME) have significantly limited China’s ability to make its own advanced chips. China will produce only 1% to 2% as many advanced chips as U.S. companies will in 2026. However while the U.S. stopped sales of some of its most advanced equipment sold by Applied Materials, Lam Research or KLA, U.S. allies have not fully followed. Japan licenses advanced tools on a case-by-case basis, and the Netherlands still ships large volumes of less advanced but crucial ASML lithography tools to China, fueling their chip build out and attempts to make up for U.S. quality with quantity.
The MATCH Act would restrict sales of advanced SME to China and require licenses to service equipment at covered facilities operated by China’s leading chip makers. The act gives U.S. allies 150 days to adopt equivalent controls before BIS applies the Foreign Direct Product Rule to relevant advanced equipment.
Endnotes:
China is also closing the capabilities gap by distilling U.S. frontier models through unauthorized API access. Congress should pass the Deterring American AI Model Theft Act with IAPS’s proposed amendments.
H100-equivalents (H100e) express a quantity of AI chips in terms of total processing performance of Nvidia’s H100 GPU so that different types of AI chips can be compared on one scale. For scale, Nvidia CEO Jensen Huang said GPT-6 Astra was trained on more than 100,000 Grace Blackwell GPUs, which would amount to at least 250,000 H100e.