Two bipartisan U.S. lawmakers on Friday, 26 June introduced the Cloud Security Act, legislation designed to close a significant gap in American export controls that critics say allows China and other adversaries to access advanced artificial intelligence computing power through U.S.-based cloud service providers — bypassing restrictions on physical chip sales entirely.

The Loophole at the Centre of the Bill

Congressman Josh Gottheimer and Congressman John Moolenaar, Chairman of the House Select Committee on China, argued that existing U.S. export controls effectively restrict the direct sale of advanced AI chips to countries and entities of concern — but do not cover the rental of computing capacity powered by those same chips via cloud platforms.

Under current rules, a foreign actor barred from purchasing a restricted semiconductor can still rent remote access to equivalent processing power from a major American cloud provider, without ever taking ownership of the hardware. The proposed legislation targets precisely that enforcement gap.

What the Legislation Proposes

The Cloud Security Act seeks to amend existing law to allow cloud computing providers to voluntarily report to the U.S. Department of Commerce any suspected misuse of their services by customers linked to U.S. adversaries. Currently, companies face legal uncertainty because existing statutes restrict the disclosure of customer content or records to government authorities — leaving firms that suspect foreign exploitation with limited recourse.

The bill also proposes that cloud platforms verify the identity of their users, creating a baseline accountability layer that proponents say is absent from the current framework.

What the Lawmakers Said

'We can't let our adversaries — especially China — dodge our export controls by simply renting what they can't buy,' Gottheimer said. He added that the bill gives American companies 'the legal clarity they need to do the right thing and report when bad actors are trying to use our own cloud infrastructure to threaten our national security.'

Moolenaar framed the issue in broader strategic terms, saying China 'will buy what it can and steal the rest,' and is 'actively trying to get backdoor access to U.S. data centres and train its AI models via cloud computing.' He argued that U.S. cloud platforms have a direct role in countering China's AI buildup, which he described as fuelling its 'military and surveillance ambitions.'

Why This Matters for the AI Race

The bill arrives at a moment of intensifying competition between the United States and China over AI capabilities. Washington has steadily tightened chip export controls — most recently through restrictions on Nvidia's advanced processors — but enforcement has consistently lagged behind the ingenuity of workarounds. Cloud-based access represents one of the most structurally difficult gaps to close, given that the underlying hardware never crosses a border.

Notably, major American cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud operate global infrastructure, raising complex questions about jurisdictional enforcement and customer verification at scale. The bill's voluntary reporting framework is designed to provide legal cover for firms that currently risk liability by proactively flagging suspicious usage.

What Comes Next

The Cloud Security Act will now move through the legislative process. Its bipartisan backing — spanning both sides of the aisle on the politically sensitive question of China — is considered an asset, though technology industry groups are likely to scrutinise provisions around user verification and disclosure obligations. The Department of Commerce has not yet issued a formal response to the bill.