The Remote Access Security Act, H.R. 2683, would bring the renting of controlled chips over the internet under US export-control law. The House passed it by 369 votes to 22 on 12 January 2026, per the House Clerk’s roll call. Its latest recorded action is a referral to the Senate Banking Committee on 13 January, per congress.gov.
By our count, 305 days have passed since that vote, and 51 days remain before the 119th Congress ends on 3 January 2027. Reuters reported on 12 November that lawmakers are pressing for at least four chip-export bills after Jensen Huang stepped down as Nvidia’s chief executive, and named this one among them.
Business Pill · GPUs Explained
An evergreen Business Engineer explainer on why AI runs on GPUs, the export-controlled chips at the centre of the remote-access debate. It teaches the general idea only and does not discuss this bill.
The key insight: As we read the two texts, the House-passed bill and the Senate version share a name but not a scope: the House text covers any foreign person over any network connection, while the Senate text covers persons of concern using cloud infrastructure and adds a 10-year end date.
US rules restrict exports of Nvidia’s most advanced AI chips to China. A company that cannot import the chips can still rent time on them in a data centre in another country. Reuters described that route on 12 November: “some Chinese firms rent computing power from overseas data centers equipped with Nvidia chips”.
Reuters reported the same day, citing three people familiar with the matter, that Chinese AI companies are trying to rent Nvidia-powered capacity outside China, as we reported. The House bill calls this “remote access”.
Recorded actions on the Remote Access Security Act, from introduction on 7 April 2025 to 13 November 2026. The 305 days since the House vote and the 51 days left in the 119th Congress are our count.
What the House Bill Would Do
The bill amends the Export Control Reform Act of 2018, the law behind US export licences. It defines remote access as access “by a foreign person through a network connection, including the internet or a cloud computing service, from a location other than where the item is physically located”.
That definition applies “if the Secretary determines that the use of the item could pose a serious risk to the national security or foreign policy of the United States”. The bill then adds remote access next to exports, reexports and in-country transfers across the law’s sections on policy, licensing, enforcement and penalties.
The bill does not list chips or countries. The Congressional Research Service summary says it allows the Bureau of Industry and Security “to issue licenses and impose penalties related to remote access of controlled items”. Which chips and which customers need a licence would be set by Commerce Department rules.
The law’s penalty section, 50 U.S.C. 4819, sets criminal fines of up to $1,000,000 and prison terms of up to 20 years, and civil fines of up to $300,000 or twice the value of the transaction, whichever is greater. The bill extends that section to remote access. It also says nothing in it lowers the intent that must be proven for criminal liability.
The Senate Text Is Narrower
The Senate version, S. 3519, was introduced on 17 December 2025 by Sen. David McCormick of Pennsylvania and referred to the Banking Committee, per its bill status file. Six senators have joined it: Ron Wyden, Tom Cotton and Christopher Coons at introduction, Rick Scott in June, and Jim Banks and Elissa Slotkin in August.
By our reading, it covers fewer people and fewer cases. It reaches only a “foreign person of concern”, which includes an entity “located or headquartered in, or the ultimate parent company of which is headquartered in” a listed country, with Hong Kong and Macau named. Access must run through “a cloud infrastructure service”, defined by the NIST meaning of Infrastructure as a Service.
The risk test is also stricter. The use must have “demonstrated a serious risk”, such as training a model that helps design weapons of mass destruction, running offensive cyber operations or evading human control. The Senate text ends the authority 10 years after enactment and asks Commerce for a public report within one year, with an industry roundtable.
The House-passed text of H.R. 2683 and the introduced text of S. 3519, compared on four points. The wording of each cell is our reading of the two bills on govinfo.
Who It Would Hit
Nvidia’s quarterly report for the period ended 26 July says RASA “could prohibit the provision of cloud services to any company with an ultimate parent headquartered in China”. It adds that the bill “could impose new restrictions on cloud service providers and OEMs, and could have a material impact on our business, operating results, and financial condition”.
Eight companies named the bill in 30 SEC documents filed from 1 April 2025 to 3 November 2026, by our earlier count: Cerebras, Csquare, Nscale, DayOne Data Centers, Alibaba, Nvidia, GDS and NICE. They include chip makers, AI cloud operators and data-centre developers in Asia.
Partners that resell or host capacity sit in the same frame. Megaspeed, a Singapore-based Nvidia buyer named in US scrutiny, has denied wrongdoing, as we set out. Singapore has separately charged a fifth person in a server case linked to Nvidia chips, as we reported.
Backers and Opponents
The House vote was bipartisan: Republicans voted 167 to 22 and Democrats 202 to 0, per the Clerk’s roll call. By our arithmetic, the yeas were 94.4% of members voting yea or nay. The Senate text has four Republican and three Democratic senators on it, counting its sponsor.
Nvidia has told investors the bill could have a material impact, in its own filing. SemiAnalysis wrote this month that “NVIDIA and Oracle have been lobbying against it, hard”, citing The Information. Neither company is quoted on that point in the sources we read.
What Has Changed Since the Nvidia Exit
House Speaker Mike Johnson said on 12 November that there is “a developing consensus in Congress” on limiting chip exports to China, Reuters reported, as we reported. A Senate aide told Reuters that Republicans are keen to attach new restrictions to the annual defense authorization bill.
A Reuters explainer the same day said “A Senate version of the legislation already includes several of them, including the AI Overwatch Act,” and that the remote-access bill “passed the House in January and is awaiting Senate consideration”. It did not say the Senate defense bill includes RASA.
Two other routes are in play. The Information reported on 9 November that White House feedback asked for an AI Overwatch Act provision ordering Commerce to close the remote-access loophole, as we reported. On 12 November it reported that Commerce is preparing to finalize a rule on remote access to advanced chips that could be announced this month, as we reported.
OpenAI told Hill offices it backs three other chip bills, Punchbowl News reported; that list did not include RASA, as we reported. Huang is expected to testify before Congress before Thanksgiving, which falls on 26 November, Reuters reported; House Foreign Affairs Chairman Brian Mast said congressional staff had spoken with Nvidia about a date and location.
The Structural Read
As we read the bill, it does not ban anything by itself. It gives the Commerce Department the same licensing and penalty powers over renting a controlled chip that it already has over shipping one, and leaves the list of chips, countries and customers to later rules.
As we read the reports since 12 November, three routes are now in play for the same gap: Senate action on this bill, a remote-access provision in the AI Overwatch Act that the White House asked for, according to The Information, and a Commerce rule The Information says is close. None of the three has been published or voted on.
Nvidia, quarterly report for the period ended 26 July 2026
“If enacted, RASA could impose new restrictions on cloud service providers and OEMs, and could have a material impact on our business, operating results, and financial condition.”
Three Implications
FOR CLOUD OPERATORS Nvidia’s filing says the bill could prohibit cloud services to any company with an ultimate parent headquartered in China; eight companies named it in SEC documents by our 3 November count.
FOR CHINESE AI DEVELOPERS Reuters reported that some are trying to rent Nvidia-powered capacity outside China, citing three people familiar with the matter.
FOR CONGRESS The 119th Congress ends on 3 January 2027, 51 days from 13 November by our count; the Senate text has had no recorded action since its referral.
The framework says: “The digital economy rests on a physical foundation that most people in that economy never see.”
As we read it, remote access is the case where that foundation is rented rather than shipped: the chip stays in a data centre abroad while the user is elsewhere. The framework predates the bill and does not discuss it.
What Is Not Established
No Senate Banking markup of either text has been scheduled in the records we read. The reports do not say whether RASA will be added to the defense bill, how the two texts would be reconciled, or whether Commerce’s reported rule would rest on existing authority or wait for the law. Nvidia, Commerce and the bill sponsors are not quoted in the reports on next steps.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
The Remote Access Security Act would let Commerce license and penalise the renting of controlled chips by foreign users, the same way it controls exports. The House passed it 369 to 22 on 12 January; the Senate has a narrower text and no vote. Reuters reports Congress is weighing chip curbs after the Nvidia exit, with 51 days left in this Congress by our count.
A note on sourcing. Bill texts, actions and cosponsors come from congress.gov and govinfo; the party split from the House Clerk’s roll call; penalties from 50 U.S.C. 4819; Nvidia’s wording from its quarterly report. What has changed since the Nvidia exit is as reported by Reuters, The Information, Punchbowl News and SemiAnalysis. The comparison of the two texts, the 305 and 51 days and the 94.4% share are our reading and arithmetic.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
