IAPS Urges Four Fixes to Close Gaps in US AI Chip Export Controls

Remote access and smuggling

According to the IAPS memo, written by Cassia King and coauthored by Erich Grunewald and Hamish Low, Chinese entities legally rent growing amounts of overseas semiconductors through cloud services, chips they could not otherwise obtain. Reports in 2024 found a handful of entities renting H100-equivalents in the thousands. Journalists are now uncovering deals in the tens of thousands to one-hundred thousand.

Researchers estimate Chinese entities will rent approximately 1 million H100-equivalents in 2026 and an estimated 2.8 million by the end of 2027. IAPS forecasts that remote access will be the largest source of compute for a Chinese firm developing the country's next leading frontier model.

The memo points to the Remote Access Security Act (RASA), which would amend Commerce authorities to cover remote access for items on the Commerce Control List. IAPS says the bill's definition of cloud services should not be limited to Infrastructure-as-a-Service transactions and should include any comparable service that lets customers train, fine-tune, or run inference on an AI model. If the bill does not pass, the Bureau of Industry and Security (BIS) can still act under existing authorities. At minimum, IAPS says, BIS should bar Chinese companies from renting chips used to train frontier models or for large-scale AI inference, and require stronger customer verification.

On smuggling, researchers estimate China will have accumulated 1 million smuggled H100-equivalent chips by the end of 2026, reaching 1.6 million in 2027. IAPS says policymakers can limit, if not end, smuggling through location verification and whistleblower incentives. The Chip Security Act would require location verification on exported chips. Delay-based verification, which measures a chip's response time to trusted servers, relies on attestation features already on NVIDIA chips and could be active within a year, according to the memo. The Stop Stealing Our Chips Act would pay whistleblowers 10% to 30% of penalties from a fund financed by violators.

H200 exports to China

BIS's January rule moved NVIDIA H200 and AMD MI325X exports to China from a presumption of denial to case-by-case review, capped at 50% of sales to US industry, or an estimated 890,000 H100-equivalents. The rule added conditions: Chinese customers must have security plans and provide no remote access to prohibited users. IAPS argues that once chips are in China, these conditions cannot be verified.

The memo says the current cap is too high and risks adding roughly 90% of what China's own chipmakers are projected to produce in 2026. It suggests BIS could lower the cap. Per-customer limits such as 75,000 chips might seem useful, but IAPS says the US cannot guarantee that entities will not share access with others after export.

The AI OVERWATCH Act would require Commerce to notify Congress at least 30 days before selling a covered chip to a country of concern. It would let Congress block a license by joint resolution and prohibit licenses for Blackwells and more advanced chips.

Manufacturing equipment and allies

IAPS says export controls on semiconductor manufacturing equipment (SME) have significantly limited China's ability to make its own advanced chips. China will produce only 1% to 2% as many advanced chips as US companies will in 2026. But while the US stopped sales of some of its most advanced equipment from Applied Materials, Lam Research and KLA, allies have not fully followed. Japan licenses advanced tools case by case, and the Netherlands still ships large volumes of less advanced but crucial ASML lithography tools to China, which the memo says fuels China's chip build-out and its attempt to make up for US quality with quantity.

The MATCH Act would restrict sales of advanced SME to China and require licenses to service equipment at covered facilities run by China's leading chipmakers. It gives US allies 150 days to adopt equivalent controls before BIS applies the Foreign Direct Product Rule to relevant advanced equipment.

Model distillation and what it means

In an endnote, IAPS adds that China is also closing the capabilities gap by distilling US frontier models through unauthorized API access. It urges Congress to pass the Deterring American AI Model Theft Act with IAPS's proposed amendments.

The memo frames effective export controls as critical for US national security, giving the country a capability lead and time to harden critical infrastructure and government systems against AI-enabled cyber threats. For policymakers, the message is that the rules need additional measures on both coverage and enforcement. Several of the bills it names are pending in Congress, and for others BIS could act with its existing authorities.