House-Passed Remote Access Bill Awaits Senate Committee Action as Chip Licensing Rules Set Conditions

The current Export Administration Regulations add application-level detail. Under Part 748, Supplement 2, paragraph (dd), an applicant seeking case-by-case treatment must certify the absence of listed military, military-intelligence and weapons uses or users, the absence of restricted transaction parties, and no restricted-party remote access. The ultimate consignee must provide Know Your Customer procedures. The applicant must identify intended Infrastructure-as-a-Service remote users in eight jurisdictions—Belarus, China, Cuba, Iran, Macau, North Korea, Russia and Venezuela—or entities headquartered there or with an ultimate parent headquartered there. That disclosure is meant to prevent unauthorized remote access; it does not by itself declare every listed user barred. Where IaaS is offered, the applicant must verify that the consignee or IaaS end user will not move trained model weights to undisclosed recipients or without BIS authorization, and will not give restricted parties direct or indirect access to algorithms developed using the chips. A testing lab needs U.S. headquarters, freedom from control by a D:5 or Macau entity, no financial stake in the deal and relevant expertise. BIS may revoke a lab’s qualification at any time, suspending case-by-case availability for exporters using it until a qualified replacement is named. [2] [3]

These provisions are bounded to a particular license path, not a general declaration that every remote-computing arrangement is banned or allowed. The current EAR edition also does not prove that identical wording governed earlier transactions. A physical GPU shipment and remote cloud access raise different factual and legal questions. Whether a deal was permissible depends on the rule, hardware, destination, end user, end use and license in force at the time. Hardware can be assessed under rules for a shipment; cloud access can raise separate questions about who uses the chip, for what purpose and under which license terms. The record supports neither a claim that all commerce with China is illegal nor one that all remote access is legal. A current rulebook cannot substitute for the rulebook in force years earlier. [2] [3]

On November 11, 2026, Senator Michael Bennet sent an oversight letter that attributed intelligence claims about Alice Huang, also called Huang Le, to New York Times reporting. The letter separated alleged physical chip diversion from remote computing access. Bennet cited reports that Malaysian and Indonesian subsidiaries of Megaspeed bought at least $4.6 billion in NVIDIA products from 2023 onward, and that a late-2024 BIS inspection found boxed hardware, which he described as a possible diversion indicator rather than proof. He also pointed to reports that Southeast Asian data centers were offering remote access to Chinese clients and called that a regulatory gap. Bennet requested an investigation update by November 24, consideration of Entity List action, information on interagency intelligence sharing and coordination with Singapore, Malaysia and Indonesia. These are allegations and requests; neither proves a shipment violated the law nor validates every remote transaction. [4]

Also on November 11, 2026, Senators Elizabeth Warren and Christopher A. Coons asked Howard Lutnick at Commerce, Marco Rubio at State and Stephen Miller at the White House to preserve NVIDIA-related export and intelligence records. They sought written confirmation by November 17 that preservation instructions had been issued, plus congressional briefings. The requested categories included license decisions, diversion investigations, enforcement, intelligence assessments, interagency deliberations, communications with NVIDIA, inventory verifications and choices to transfer, suspend or terminate investigations. Their narrative ascribed suspected intelligence activity and possible diversion to newspaper reporting published October 29, November 6, November 8 and November 9; those are source-report dates, not dates of Cali Reporter publication. A preservation demand does not itself prove wrongdoing. [5]

The legal backdrop is layered. The Export Control Reform Act of 2018 became law as part of the fiscal 2019 National Defense Authorization Act bearing John S. McCain’s name and is codified at 50 U.S.C. 4801-4852. The January BIS rule cites ECRA as authority for regulating exports, reexports and transfers, for the control list and for license requirements. Section 1753 covers regulation of exports, reexports and transfers; Section 1754 covers the control list and licensing; Section 1762 allowed the changes by final rule without prior notice and comment. The rule also cites authority to inform the public of policy and regulatory changes and to take other necessary action. H.R.2683’s summary would apply that framework to networked and cloud access. That remains a proposal, not a statement of current law. [1] [3]

A claim that rules leave a gap does not confer immunity, and it does not show that any specific company met its obligations. H.R.2683 remains a proposal, not an enacted statute. Existing export rules carry end-user, end-use and license conditions, and the January rule created a conditional path rather than an open door. A senator’s gap concern may identify a policy issue that physical-export controls do not fully reach remote access; it is not an adjudication that no other authority applies. Nor does it establish that a shipment or cloud transaction violated the law. The public record supports neither sweeping conclusion. A policy gap can be real without proving misconduct in a particular case, and a company’s compliance is a separate factual question. [1] [2] [3] [4]

Several questions remain unresolved in the public record. What specific intelligence underlies the claims that Bennet’s letter attributes to newspaper reporting? Did the late-2024 inspection lead to an enforcement action, and if so, what action? Will Commerce act on the requested Entity List consideration? Will the Senate Banking, Housing, and Urban Affairs Committee take up H.R.2683, and will the bill reach the Senate floor or become law? What will the requested records preservation and briefings produce? The public documents do not include the underlying intelligence assessment or inspection report. Lack of public evidence in this record is not proof that no classified evidence exists. The documents establish requests and allegations, not answers. [1] [4] [5]

Specific markers will show whether the policy and oversight questions move. The next Senate action on H.R.2683 beyond the January 13 referral, and any committee or floor step that changes its Passed House status, will indicate whether the proposal advances. BIS implementation of the January rule and the paragraph (dd) certification process will show whether applicants disclose IaaS remote users and whether the agency grants, denies or conditions licenses. Bennet’s November 24 response deadline and the Warren-Coons November 17 confirmation request are concrete oversight dates. Later public documents could show Entity List action, briefings, enforcement findings or no change; the record does not predict which will occur. [1] [3] [4] [5]

Sources

Congress.gov H.R.2683 Remote Access Security Act, status and summary

BIS Export Administration Regulations Part748, current retrieved edition

BIS January2026 final rule as published in Federal Register

Senator Bennet oversight statement and allegations

Senate Banking minority records-preservation request

Prepared with AI assistance from the cited sources.