Nvidia has told cloud computing providers that “a majority of their clients must be non-Chinese”, the Financial Times reported on 3 November, with a floor of “at least 51 per cent”. A bill to bring cloud access under US export controls, the Remote Access Security Act, passed the House 369-22 in January.
Since its referral to the Senate Banking Committee on 13 January, the Congress.gov record lists no further action: 294 days, by our count. That is longer than the 280 days the bill took to pass the House after it was introduced.
The FT said the chipmaker told “cloud computing clients” “in recent months” that they “must now sell at least 51 per cent of”, a sentence that continues behind the paywall. We covered the report and Nvidia’s own filing figures in Nvidia Tells Data Centre Clients to Cut Their China Exposure.
By our arithmetic, a 51 per cent floor leaves room for up to 49 per cent of whatever the rule measures to be Chinese. The part of the FT report we could read does not say what that measure is.
Update, 3 Nov: the measure and the scope, per AFP. AFP’s account of the FT report, carried by Malay Mail, says Nvidia’s cloud computing clients “must now sell at least 51 per cent of their services to non-Chinese companies” and that “The new rules only affect future contracts and not existing agreements”. Nvidia neither confirmed nor denied the report to AFP.
Calendar days per stage of the Remote Access Security Act: H.R. 2683 took 280 days from introduction (7 April 2025) to House passage (12 January 2026, 369-22) and has waited 294 days since its referral to the Senate Banking Committee on 13 January 2026; the Senate version, S. 3519, has been in that committee 321 days. Day counts are our arithmetic from the Congress.gov action dates as of 3 November 2026. Sources: Congress.gov; House Clerk roll call 13.
Business Pill · Sovereign AI
An evergreen Business Engineer explainer on sovereign AI: who controls the model and the data. It teaches the general idea only and does not discuss Nvidia, the Financial Times report or the Remote Access Security Act.
The key insight: The FT reports that Nvidia has told cloud providers that at least 51 per cent of their business must be non-Chinese. The House-passed bill on cloud access has had no recorded Senate action for 294 days, by our count, and its Senate version tests each customer’s headquarters and ultimate parent instead of a share.
What the House Passed
The House-passed text of H.R. 2683 adds remote access to the Export Control Reform Act of 2018. It defines it as access “by a foreign person through a network connection, including the internet or a cloud computing service, from a location other than where the item is physically located”.
The control applies “if the Secretary determines that the use of the item could pose a serious risk to the national security or foreign policy of the United States”. The House roll call on 12 January was 369 yeas to 22 nays: Democrats 202-0 and Republicans 167-22.
In the floor debate, sponsor Mike Lawler said that “physical export controls do not apply to remote access of items”. He said the bill gives the Commerce Department “the authority to regulate controlled items through the cloud”.
What the Senate Version Says
The Senate bill, S. 3519, was introduced on 17 December 2025 by Senator McCormick with Senators Wyden, Cotton and Coons. As we read it, the Senate text is narrower on the activity and more specific about the customer.
It covers access “through a cloud infrastructure service”, defined by the NIST meaning of Infrastructure as a Service. Control applies if the Secretary determines that use “has demonstrated a serious risk”, such as training AI models that lower the barrier to weapons of mass destruction, run offensive cyber operations or evade human control.
Its customer test is a “foreign person of concern”: among others, “an entity located or headquartered in, or the ultimate parent company of which is headquartered in, such a country or region”. The bill names Hong Kong and Macau as regions it covers.
A Customer Test and a Mix Test
As we read the texts, the bill sorts customers one at a time: a customer meets the definition or it does not. The rule the FT describes sets a share across a provider’s business instead, with Chinese clients allowed below the floor.
Nvidia’s own 10-Q describes the bill in customer terms. It says the act “could prohibit the provision of cloud services to any company with an ultimate parent headquartered in China” and “could impose new restrictions on cloud service providers and OEMs”.
Where the Rules Stand
According to the Congress.gov record we read, H.R. 2683 was received in the Senate on 13 January and referred to the Banking Committee; S. 3519 was referred to the same committee on 17 December 2025. Neither shows a later action. By our count that is 294 and 321 days.
On the regulatory side, the Commerce Department said on 13 May 2025 that it was rescinding the AI Diffusion Rule, and its release said “BIS plans to publish a regulation formalizing the rescission and will issue a replacement rule in the future”.
In the House debate, Representative Bill Huizenga said: “you can’t buy it, so you shouldn’t be able to rent it either”.
As we read the texts, the bill and the reported rule draw different lines. The Senate bill asks who a customer is, down to its ultimate parent; the rule the FT describes asks how much of a provider’s business goes to Chinese clients.
As we read the record, the House vote was 369-22 and the Senate committee has listed no action since, so the cloud-access line the FT describes is a supplier’s term, not a statute.
Rep. Bill Huizenga, House floor debate on H.R. 2683, 12 January 2026
“you can’t buy it, so you shouldn’t be able to rent it either”
Three Implications
FOR CLOUD PROVIDERS Under the floor the FT describes, up to 49 per cent of whatever the rule measures could still be Chinese, by our arithmetic. Under the Senate bill’s definition, a customer whose ultimate parent is headquartered in China would be covered whatever its share.
FOR NVIDIA Nvidia’s 10-Q says the act could prohibit cloud services to any company with an ultimate parent headquartered in China and could impose new restrictions on cloud service providers and OEMs.
FOR WASHINGTON H.R. 2683 has waited 294 days in the Senate Banking Committee and S. 3519 321 days, by our count from Congress.gov. The Commerce Department said in May 2025 that BIS will issue a replacement for the rescinded AI Diffusion Rule.
The framework puts the governance layer this way: “Layer 9 answers to geopolitics, not to engineering.” It concludes: “The supercycle has a ceiling now, and the ceiling is political.”
As we read it, this story shows two routes to that ceiling for rented compute: a bill with no recorded Senate action since January and a supplier’s own terms, as the FT reports them. The framework was published before this report and does not discuss it.
The part of the FT report we could read does not link Nvidia’s instruction to the bill, say how Nvidia defines a Chinese company or say what the 51 per cent is measured on. It gives no deadline.
Our day counts rest on the Congress.gov action list as we read it on 3 November; committee work that is not recorded as an action would not show there. Neither bill is law.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
The FT reports that Nvidia has set a floor of at least 51 per cent non-Chinese business for its cloud clients. The House-passed cloud-access bill has waited 294 days in the Senate by our count, and its Senate version tests each customer’s headquarters and ultimate parent rather than a share.
A note on sourcing. The Financial Times report is paywalled; we read only its headline, summary line and opening, and quote those. The bill texts are from govinfo.gov, the action dates from Congress.gov, the vote from the House Clerk and the debate quotes from the Congressional Record. The day counts and the 49 per cent complement are our arithmetic.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
