虎嗅

US BIS Investigates Legal Cloud Computing and the Remote Access Security Act (RASA)

原文:美国BIS调查合法云计算与《远程访问安全法案》(RASA)

Summary of Key Points

Recently, the US Department of Commerce (BIS) has begun a systematic review of Chinese AI companies' practice of remotely leasing GPU computing power through third countries such as Southeast Asia, Japan, and the Middle East. This move reflects the US's intention to extend the scope of export controls from the physical transfer of chips across borders to include "remote computing services" and "access to AI models." Previously, remote leasing of computing power was not considered an export (and therefore legal), but the US believes it constitutes a loophole around these regulations. By issuing guidelines, prosecuting cases (such as the Fable incident), and pushing for legislation (the RASA Act), the US aims to gradually turn such "legal transactions" into activities that require permission, potentially blocking Chinese companies' access to overseas computing resources.

1. Why is the US suddenly focusing on third-country leasing of computing power?

US export controls are intended to prevent the physical sale of chips to China. However, Chinese AI companies can lease GPUs from data centers in third countries for remote use (with the chips remaining in those countries), which was not considered an export under previous rules and thus legal. The BIS argues that even if companies cannot purchase chips directly, leasing them still circumvents the controls. Therefore, the BIS is reviewing the locations where these leases take place, collecting evidence to justify potential future legislation or enforcement actions.

2. Guidelines issued on May 31: A "transition period" for data centers, but remote leasing remains unclear

On Sunday (a rare occurrence), the BIS issued guidelines that clarified two key points:

1. The end-user control rule remains in effect: Even if a third-country company is controlled by a Chinese parent firm, using advanced chips still requires a US license. (This rule was previously thought to have been suspended, but it has now been confirmed to be ongoing.)

2. A temporary exemption for data centers that already possess the affected chips: These data centers do not need to stop their operations immediately, but the practice of remote leasing is neither explicitly legal nor illegal—creating a gray area with the possibility of future regulation.

In short, the BIS does not want to shut down all third-country data centers outright (to avoid conflicts with local governments) and is giving them time to adjust to the new rules.

3. The Fable incident: The BIS' attempt to regulate remote access to AI models encounters legal hurdles

In June, the BIS declared that accessing the Anthropic AI model Fable5 via remote means constituted an export, cutting off global users' access to it for the first time. This marks a shift from controlling the physical transfer of chips to regulating "online capabilities." However, there is legal ambiguity: US law does not explicitly define AI models as controlled items, and experts question how the content generated by user interactions with these models should be classified as export technology. Thus, the BIS' action was an administrative gamble without clear legal backing, prompting Congress to address this legislative gap.

4. The RASA Act: Making remote leasing of computing power subject to permission

The House of Representatives has already passed the RASA Act, and a similar version is in the Senate. The core of the act is to equate "remote access to controlled items (such as GPU computing power)" with the export of chips, making such activities subject to US licensing requirements. If approved:

  • Cloud service providers would need to verify whether their customers are Chinese and cannot lease computing power without a license.
  • Although the Senate version targets only AI related to weapons, there is a high likelihood of the act being passed, as both parties support addressing this regulatory gap.

This means that Chinese companies will need to obtain US permission to lease overseas computing resources in the future, which the US is unlikely to grant, effectively blocking this channel.

5. Implications for Chinese companies: Will overseas computing power be cut off?

Short-term: The status of remote leasing remains uncertain, but with the BIS's review, data centers may be hesitant to accept Chinese clients.

Long-term: Once the RASA Act is passed in about a decade, remote leasing will explicitly require permission, and Chinese companies will likely be unable to access advanced overseas computing resources. Although the compliance responsibility lies with overseas data centers, the consequence is that Chinese AI companies will have to rely on domestic chip production and the establishment of their own domestic computing centers.

In summary, the US is expanding export controls from hardware to services and capabilities. Chinese companies should prepare for these changes as soon as possible.