Bipartisan 'Cloud Security Act' Targets Major Loophole Allowing Adversaries to Rent Restricted AI Compute

For the past three years, the United States has waged a quiet, high-stakes campaign to restrict foreign adversaries from acquiring the physical hardware necessary to build frontier artificial intelligence.[4]

Through a series of escalating export controls, the Department of Commerce effectively banned the shipment of advanced semiconductors—like Nvidia’s highly coveted H100 and Blackwell chips—to nations deemed national security risks, primarily China.[4]

The strategy relied on a 20th-century model of trade enforcement: if you can stop the physical box from crossing a border, you can stop the technology from proliferating.

But the artificial intelligence boom is inherently a 21st-century phenomenon, built not just on physical hardware, but on the cloud.

A glaring loophole quickly emerged in the regulatory framework. While a Chinese tech firm or military contractor could no longer purchase and import a server rack of advanced American AI chips, they could simply log onto the internet and rent that exact same computing power by the hour.

Major American cloud providers—Amazon Web Services, Microsoft Azure, and Google Cloud—maintain massive data centers packed with restricted silicon. Because renting cloud compute does not involve the physical export of a good, it fell outside the traditional boundaries of export control laws.[1]

On June 26, 2026, a bipartisan coalition in the U.S. House of Representatives introduced the "Cloud Security Act" to finally close this digital backdoor.[2]

Co-led by Rep. Josh Gottheimer (D-NJ) and Rep. John Moolenaar (R-MI), Chairman of the Select Committee on China, the legislation represents a fundamental shift in how the U.S. views technology exports.[1]

"We can't let our adversaries—especially China—dodge our export controls by simply renting what they can't buy," Gottheimer stated upon the bill's introduction, highlighting the absurdity of the current enforcement gap.

The core mechanism of the Cloud Security Act is designed to solve a complex legal bind that has paralyzed American cloud providers.

Under existing U.S. privacy laws, cloud companies are generally prohibited from disclosing customer content, usage records, or server activity to the government without a subpoena or warrant.

This created a chilling effect: even if a cloud provider's internal security team noticed a foreign entity spinning up massive clusters of AI compute for suspicious model training, alerting the Department of Commerce exposed the provider to severe legal liability.

The Cloud Security Act establishes a legal "safe harbor," amending current law to allow cloud compute providers to voluntarily report suspected misuse of their services by customers associated with U.S. adversaries.[1][2]

Furthermore, the legislation pushes for robust "Know Your Customer" (KYC) protocols for the cloud industry, mirroring the identity verification standards long required in the banking and financial sectors.[2]

Cloud providers will be expected to verify the true identity and geographic origin of entities renting massive swaths of AI compute, stripping away the anonymity provided by shell companies and VPNs.

This new bill acts as the enforcement mechanism for the "Remote Access Security Act," a related piece of legislation passed overwhelmingly by the House in January 2026.[3]

While the January bill gave the Commerce Department the statutory authority to regulate remote access to controlled technology, the Cloud Security Act gives the industry the actual tools and legal cover to report the violations.

For the cloud computing industry, the transition will require significant investment in compliance infrastructure, shifting their operational model from frictionless, self-serve compute to a more vetted, security-conscious onboarding process.[4]

However, the clarity provided by the safe harbor provision is largely welcomed by an industry that has found itself caught between maximizing global revenue and inadvertently powering the military AI ambitions of foreign states.

By modernizing export controls for the cloud era, the United States is acknowledging that in the artificial intelligence race, computing power is the ultimate strategic resource—whether it sits in a server room in Beijing or is accessed remotely from a data center in Virginia.[2]