A Year of Chips Through the Side Door

Commerce posted the guidance on a Sunday.

That's the move you make when you don't want a press cycle. Not because the news is small. Because the news is an admission, and admissions read better with the markets closed.

What the guidance says, in compliance-speak, is that Nvidia's most advanced processors, Rubin and Blackwell, along with AMD's MI350x, can no longer be shipped to the offshore subsidiaries of Chinese AI firms. What it admits, by existing, is that they've been shipping to those subsidiaries for roughly a year.

A year is the part that matters. It's the part the "closing a loophole" framing is built to obscure.

Export controls on advanced chips arrived in October 2022 as a wide net thrown at China-bound shipments. They tightened in October 2023 when the first wave of workarounds — the slightly-detuned A800, the H800 — was named and shut down. Enforcement actions against smuggling networks followed. Each round was announced, each time, as closing the gap. Sunday's posting is the fourth such closure I can count, and it concedes that the third one, which was supposed to handle entity-based circumvention, had a third-country layer the controls never reached.

Why now, and not six months ago? My read is that the surveillance research surfacing this week is the public end of an internal trail Commerce has been walking for a while. The New York Times wrote up new academic work examining how a Chinese predictive-surveillance vendor developed its political-risk modeling under restrictions. The paper's claim, that controls constrained development, needs scrutiny. The researchers don't pin down which hardware actually trained which model in which window. The causal arrow is suggestive, not tight. But the inverse is what Commerce can no longer ignore. Capability that exists today exists in part because of compute that moved through Penang and Cyberjaya while the policy was looking at Shenzhen.

The framework worth naming is this. U.S. export controls are entity-based, but corporate structure is liquid. You can list a parent in Beijing on the entity list and not catch the wholly-owned Malaysian subsidiary that procures, racks, and runs the GPUs on behalf of the parent's research arm. The controls assume entities behave like physical objects with stable locations. They don't. They behave like contracts. The third-country layer isn't an oversight. It's the default behavior of how multinationals operate.

I don't know what percentage of restricted chips actually reached Chinese-affiliated end-use during the gap year. Neither does Commerce, which is the more useful answer. The shipping manifests went to Malaysian companies. The compute output went somewhere harder to trace.

What Sunday's guidance triggers next is the part to watch. Three things. Commerce now has to define "Chinese entity" in a way that includes subsidiaries it previously didn't catch, which means a definition fight with every multinational chip buyer. Enforcement has to move from shipping endpoint to beneficial ownership, which Treasury knows how to do and Commerce does not. And the chip vendors, who have spent two years arguing that compliance with the letter of the rules should be enough, will discover that the letter just got longer.

The chips Commerce stopped on Sunday are the chips that trained the models the surveillance paper describes. Maybe not the exact silicon. The category. A Sunday posting closes the third-country layer. It doesn't recover what walked through.