IAPS Urges US to Close Cloud Loophole Giving China Access to AI Chips

The gap in current export controls

BIS prohibits exports of advanced AI compute to countries of concern to protect national security. According to the IAPS report, written by Cassia King and coauthored by Onni Aarne, a substantial and growing volume of U.S.-designed compute nonetheless remains legally available to rent to customers who cannot buy it.

The report cites reporting that Chinese model developers and hyperscalers remotely access the most advanced US semiconductors through cloud service providers (CSPs) outside China. In one case, Tencent reportedly signed a five-year lease for roughly 100,000 advanced AI chips across Oracle data centers in Southeast Asia. A footnote says the lease is reportedly worth about $7 billion, with roughly 30% paid upfront, and that neither Tencent nor Oracle has confirmed the report.

IAPS says it previously estimated that rented U.S. compute will add at least 60% on top of the compute China acquires in 2026 alone.

Why IAPS sees a national security risk

The report argues that continued cloud access will likely be Chinese AI companies' largest source of compute for training China's first Mythos-level model, which IAPS estimates will be developed by around February 2027. For now, China's top-performing frontier models trail leading US models by roughly four to eight months, depending on the model and domain.

IAPS says keeping that lead matters so the United States and its allies can harden critical infrastructure networks and build defenses before adversaries with access to new models can exploit vulnerabilities. Those attacks could come from the People's Republic of China or from other foreign adversaries using Chinese models. Cloud access also enables wide deployment of China's leading models, which scales users, revenue and training data that feed back into model development, according to the report.

The four-level framework

The report says BIS could rely on new authorities from the Remote Access Security Act if the bill becomes law, or on its existing statutory authorities if needed.

• Level 1: A reporting requirement. Using Defense Production Act authorities for industry surveys, BIS could require CSPs to report how much AI compute is rented by companies in or under the jurisdiction of the PRC or other prohibited countries, such as the number of customer accounts and the aggregate number of AI chips rented within a year.
• Level 2: A ban on renting advanced US compute above defined thresholds. The thresholds are cluster capacity per instance, cumulative FLOP per customer, data ingress and egress, and customer spending. Customers who trigger them face enhanced Know-Your-Customer (KYC) checks, including live checks with sales representatives and investigations of beneficial ownership. Customers below the thresholds could rent without restrictions.
• Level 3: A prohibition on all remote access to AI compute for prohibited countries, with enhanced KYC only for flagged customers. All other customers would go through the verification CSPs already use. This responds to evasion by spreading workloads across many sub-threshold accounts.
• Level 4: The same prohibition, with enhanced KYC for every customer. IAPS says this could appear the most robust but would add notable cost for CSPs and legitimate customers.

What IAPS recommends

IAPS argues there is already enough public reporting to act, so BIS should not wait for the results of a Level 1 survey and should prepare a cloud control rule now. At minimum, it says, BIS should adopt Level 2 to cut off China's model developers and hyperscalers from training frontier models and running large-scale inference on US compute.

On Level 3, the report cautions that policymakers should weigh escalatory effects. Civilians would lose access to US compute for research in areas such as healthcare and environmental science, and cutting off ordinary businesses would effectively contribute to the economic containment of China. Still, IAPS says moving to Level 3 would be beneficial if BIS finds Chinese companies offloading large-scale inference onto many small accounts below the KYC threshold.

Level 4 is likely unworkable at this stage, in IAPS's view, given the compliance burden and the chance of thousands of false positives and negatives. As CSPs build compliance teams and adopt new AI tools for customer verification, BIS could lower the enhanced KYC thresholds over time to bring more customers into the process.

What it means for cloud providers and policymakers

The report puts cloud providers at the center of any future rule, since they would carry the verification work. Its graduated design is meant to let regulators tighten controls only when evidence of evasion appears, while limiting the burden on legitimate customers. For policymakers, the message is that the main debate is no longer whether remote access is a gap, but how far a rule should reach and how much collateral impact on civilian users is acceptable.