Commerce Drafts Rule to Block China's Remote AI Chip Access in Thailand and Singapore, But May Lack Power to Enforce It

A Rule With No Teeth, Coming in September

The Commerce Department is preparing to circulate a draft export control rule to industry trade groups as early as September that would make it illegal for Chinese companies to remotely rent Nvidia GPU computing time through data centers in Thailand and Singapore, according to The Information, whose reporting was picked up by Tech Times, BigGo Finance and Tom's Hardware. According to all three outlets, the Bureau of Industry and Security (BIS) probably can't enforce it.

An attorney at Baker McKenzie told The Information it is "widely acknowledged" within the export-control bar that Commerce cannot enforce a rule targeting remote compute access under existing law. The department's traditional authority covers the physical transport of goods across borders. It does not cover a Chinese company logging into a server farm in Bangkok and running a training job on a chip that never leaves Thailand.

The Catalyst: Kimi K3

The immediate trigger for the draft rule is Kimi K3, an open-source model released by Chinese AI startup Moonshot AI. Michael Kratsios, director of the White House Office of Science and Technology Policy, wrote on X in July that Moonshot built Kimi K3 by distilling and training on America's own AI models, routing the work through Nvidia-equipped servers located in Thailand, according to BigGo Finance and Tom's Hardware. BigGo Finance also reports that Chinese tech giants Alibaba and ByteDance have been cited as leaning on similar Southeast Asian server capacity.

Where the Loophole Actually Came From

Tech Times frames the September rule as Commerce closing a hole the administration widened itself by scrapping the Biden-era AI Diffusion Rule's know-your-customer requirements in early 2025. That framing is only part of the picture.

The deeper legal gap predates any Trump administration decision. It comes from BIS advisory opinions issued in 2009, 2011 and 2014 that gave the cloud-computing industry a foundational assurance: when a provider makes computing capacity available to a foreign customer and the hardware itself never crosses a border, no "export" has occurred under 15 CFR § 734.2. That ruling is what made the modern Software-as-a-Service industry viable. It's also what lets a Chinese lab send training jobs to an Nvidia cluster in Bangkok without triggering U.S. export law today, regardless of who's in the White House.

Congress Is Trying to Fix the Statute Directly

The House has passed the Remote Access Security Act, which would redefine remote cloud access to controlled chips as an "export" and impose know-your-customer obligations on cloud providers, according to BigGo Finance. The bill has not cleared the Senate. Tech Times reports that until it does, BIS likely lacks the statutory authority to enforce whatever draft rule it shares with industry this fall, meaning Commerce could publish something in September that has no legal force behind it.

Commerce rescinded the Biden-era AI Diffusion Rule in early 2025, though Tom's Hardware notes the rule technically remains on the books, with Commerce simply declining to enforce it. In March, Commerce floated a tiered licensing structure for advanced AI chip exports, then revoked it roughly a week later after pushback from the U.S. AI industry. Meanwhile, House members have separately pressed the administration to just enforce the export controls Biden put in place before leaving office, rather than draft new ones, per Tom's Hardware.

Enforcement Elsewhere: Taiwan and a Lawsuit in D.C.

While Washington drafts, Taiwan has been acting. An Nvidia employee was detained in Taiwan in July on suspicion of falsifying documents related to chip shipments, and Taiwanese authorities have indicted nine people connected to Supermicro servers allegedly smuggled to China, according to Tom's Hardware.

Separately, ChangXin Memory Technologies (CXMT), China's largest memory chipmaker, filed a lawsuit in Washington, D.C. federal court against the Department of Defense, according to BigGo Finance. CXMT is challenging its designation as a Chinese military-linked company, arguing the label is arbitrary and that it produces only civilian and commercial DRAM chips. That case is unrelated to the remote-compute rule but lands in the same broader fight over how far U.S. export restrictions on China should reach.

The Fair Objection From the Cloud Industry

Cloud providers and export lawyers have a legitimate concern here, separate from whether Chinese labs are exploiting the current gap. Redefining remote compute access as an "export" could unwind the legal foundation cloud computing has operated under since those 2009-2014 BIS opinions, potentially sweeping in ordinary foreign commercial customers of Amazon Web Services and other providers, not just PRC-linked front companies. That's the compliance nightmare Baker McKenzie's attorney is pointing to when calling Commerce's authority into question, and it's a reason Congress, not just BIS, may need to act for any rule to hold up.

No rule has been finalized, no enforcement action has been filed, and RASA remains stalled in the Senate. Whether Commerce publishes a rule in September that survives a legal challenge, or whether the Senate moves first on RASA, remains an open question with real consequences for how China's AI labs access American chips going forward.