Washington targets remote access loophole in Nvidia chip crackdown

The Commerce Department is moving to block Chinese entities from remotely controlling Nvidia hardware located outside Chinese borders. Physical export controls have always rested on one premise: stop the chip from crossing. Cloud computing broke that premise, since a company can rent processing power from a foreign data center and run workloads on it without a single crate of hardware ever entering China. Washington now wants that treated as an export too.

The push builds on licensing guidance the department clarified in May 2026, which already requires China-headquartered firms to obtain licenses for GPU chips, including Nvidia's Blackwell and H200 models, even when those chips sit abroad. That guidance took aim at overseas subsidiaries, with Malaysia specifically flagged: a Chinese parent could in theory reach hardware through a Malaysian subsidiary that the parent itself was barred from buying. The rules are shifting from where a chip is to who is using it.

Congress is running parallel. The House passed the Remote Access Security Act in January 2026 by a 369-22 vote, expanding the definition of an export to include cloud-based access to restricted hardware — so logging into a restricted chip from a distance could count the same as having it shipped. As of early November 2026, investigations were still ongoing into chip diversion through Southeast Asian intermediaries and into approvals granted to Chinese firms linked to restricted entities. Lawmakers are also pursuing chip tracking requirements in the FY2027 defense authorization bill.

Roughly 600,000 Nvidia H200 chips were reported stockpiled in Hong Kong as of November 2026, reportedly waiting on import approval from mainland China. That bottleneck sits on the Chinese side of the process, not the American one.

For Nvidia, every new rule narrows the set of customers who can run its most advanced products without government sign-off. Cloud providers carry a particular kind of exposure: if remote access counts as an export, data center operators outside China may have to verify customers far more carefully, tracing corporate ownership back through subsidiaries.

Three things to watch: whether the Remote Access Security Act clears the rest of the legislative process and becomes binding law, which chip tracking provisions survive the defense authorization bill, and how the investigations into approvals for firms tied to restricted entities land. The wider shift is in the definition of an export itself — hardware location used to be the whole story, and control and ownership are increasingly what regulators care about.