Nvidia has told cloud computing providers that “a majority of their clients must be non-Chinese”, the Financial Times reported on 3 November. The bill aimed at cloud access to US-controlled technology was already in the risk factors of eight companies, Nvidia among them.
Our full-text search of SEC EDGAR found the phrase “Remote Access Security Act” in 30 documents filed since 1 April 2025 by eight companies: Cerebras, Csquare, Nscale, DayOne Data Centers, Alibaba, Nvidia, GDS and NICE. Two of them filed some documents under earlier names, which we count once: BIF III US Aggregator (Delaware) LLC for Csquare and DSNS Holdings for Nscale.
The FT said the chipmaker told “cloud computing clients” “in recent months” that they “must now sell at least 51 per cent of”, a sentence that continues behind the paywall. We covered the report and Nvidia’s own filing figures in Nvidia Tells Data Centre Clients to Cut Their China Exposure.
AFP’s account of the FT report, carried by Malay Mail, completes the sentence: clients “must now sell at least 51 per cent of their services to non-Chinese companies”. It adds that “The new rules only affect future contracts and not existing agreements, the report said.” Nvidia neither confirmed nor denied the report to AFP. The readable FT sentence itself is cut off after “at least 51 per cent of”.
Documents filed with the SEC from 1 April 2025 to 3 November 2026 that name the Remote Access Security Act, by company: Cerebras 8, Csquare 6, Nscale 5, DayOne Data Centers 3, Alibaba 3, Nvidia 2, GDS 2, NICE 1; 30 in all. Our count from an exact-phrase SEC EDGAR full-text search run on 3 November 2026; one company per SEC registrant number; draft registration statements included; filings that name the bill only by its number are not counted.
Business Pill · Concentration
An evergreen Business Engineer explainer on concentration: when a few big pieces make the total. It teaches the general idea only and does not discuss Nvidia, the Financial Times report or any company in this story.
The key insight: Nvidia’s cloud clients must sell at least 51 per cent of their services to non-Chinese companies, on new contracts, according to AFP’s account of the FT report; the readable FT sentence stops at “at least 51 per cent of”. By our count, eight companies, Nvidia among them, had already named the Remote Access Security Act in 30 SEC documents, and Nscale says any restriction on serving its customers could have significant negative impacts.
Who Named the Bill
By our count, Cerebras named the bill in 8 documents, Csquare in 6, Nscale in 5, DayOne and Alibaba in 3 each, Nvidia and GDS in 2 each and NICE in 1. The count includes draft registration statements and prospectuses as well as quarterly and annual reports.
By our grouping, AI chip and AI cloud companies account for 15 of the 30 documents, data centre operators for 11 and Alibaba and NICE for 4.
What the AI Cloud Filers Say
Nvidia’s 10-Q for the quarter to 26 July says the act “could prohibit the provision of cloud services to any company with an ultimate parent headquartered in China” and “could have a material impact on our business, operating results, and financial condition”.
Nscale’s S-1, filed on 18 September, says the company is monitoring the bill, “which would provide BIS with authority to restrict remote access to export controlled items, including AI chips, through the cloud”.
It adds: “Since a substantial portion of our revenue is derived from a limited number of customers, any restriction on our ability to provide services to these customers could have significant negative impacts on us”. Its largest customer was 52 per cent of revenue in the six months to 30 June 2026 and 73 per cent in 2025, the filing says.
The same filing says Nscale maintains “partnerships with NVIDIA, including through direct equity investment”. Cerebras’s 10-Q says the act “may impact third party access to our compute infrastructure”.
What the Data Centre and China Filers Say
Csquare’s prospectus says the act “could put restrictions on our customers’ ability to provide remote access to computing resources which would have a negative effect on our business and future prospects”.
DayOne’s F-1, filed on 5 October, says that “Although we generally provide infrastructure for such software and equipment rather than the equipment itself”, such proposals “could affect the demand for our data centers or expand to cover the services that we provide”.
Alibaba’s 20-F and GDS’s 20-F use the same words: the act, “if enacted into law, would further restrict China-based companies’ access to computing resources of service providers powered by advanced U.S. chips”.
NICE’s 20-F says it could restrict its ability “to enable remote cloud access to certain products, if they are made subject to new remote access restrictions”.
As we read the filings, the bill appears in two kinds of risk language. Nvidia, Nscale and Cerebras describe restrictions on access to compute or cloud services; Csquare and DayOne describe effects on their customers and on the demand for their data centers.
As we read Nscale’s S-1, concentration and access rules meet in one sentence: the company links a restriction on serving its customers to the fact that a limited number of customers supply a substantial portion of its revenue.
Nscale Ltd, Form S-1, 18 September 2026
“Since a substantial portion of our revenue is derived from a limited number of customers, any restriction on our ability to provide services to these customers could have significant negative impacts on us”
Three Implications
FOR AI CLOUD PROVIDERS Nscale’s S-1 says its largest customer accounted for 52 per cent of its revenue in the six months ended 30 June 2026. Cerebras’s 10-Q says the act may impact third party access to its compute infrastructure.
FOR DATA CENTRE OPERATORS Csquare says the act could put restrictions on its customers’ ability to provide remote access to computing resources, and DayOne says proposals of this kind could affect the demand for its data centers.
FOR CHINA-BASED COMPANIES Alibaba and GDS both write that the act, if enacted, would further restrict China-based companies’ access to computing resources of service providers powered by advanced U.S. chips.
The framework puts concentration at the centre of the cycle: “The $1T capex cycle is being underwritten by a $1T concentrated demand commitment from two counterparties whose combined free cash flow is deeply negative.”
As we read it, the filings show the same concentration one level down, at single providers: a rule about who may be served lands on revenue that a few customers supply. The framework was published in May 2026 and does not discuss these filings or the FT report.
The filings predate the FT report; the latest was filed on 5 October. The passages quoted here do not mention the rule the FT describes. The part of the FT report we could read does not name the cloud providers, so whether any of these companies received the instruction is not established.
Our count finds only documents that use the bill’s exact name; filings that describe it another way are not counted. The filings quoted here describe the bill as passed by the House or under consideration, not as enacted.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
The readable FT text stops at “at least 51 per cent of”; AFP’s account says the floor applies to services sold to non-Chinese companies. Before that report, eight companies, Nvidia among them, have already named the Remote Access Security Act in 30 SEC documents, by our count. Nscale, whose largest customer was 52 per cent of first-half revenue, says any restriction on serving its customers could have significant negative impacts.
A note on sourcing. The Financial Times report is paywalled; we read only its headline, summary line and opening, and quote those. What the 51 per cent applies to and the future-contracts point are from AFP’s account of the FT report, as carried by Malay Mail. Every company statement is quoted from its own SEC filing. The document and company counts come from our exact-phrase full-text search of SEC EDGAR on 3 November 2026, and the groupings are ours.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
