Last month Jensen Huang, the boss of Nvidia, landed in Beijing with a clear message: the maker of the world’s leading artificial-intelligence (AI) chips planned to “unswervingly serve the Chinese market”. America would rather it didn’t. A few days earlier the Trump administration had introduced new controls that, in effect, banned the company from selling its H20 microprocessor to China.

Over the past few years America has sought to hobble its main rival in the AI race by controlling access to its advanced semiconductors. The performance of an AI processor depends mostly on two factors: computing power (how fast a chip processes data) and memory bandwidth (how quickly it moves data between processor and memory). In October 2022 the Biden administration barred sales to China of American chips that exceed a threshold on both fronts. Nvidia responded with the H800, a made-for-China model engineered to stay just under the limits. A year later, America tightened the regulations again, banning any chip with too much computing power, regardless of memory bandwidth. Nvidia’s answer was the H20.

Last month Jensen Huang, the boss of Nvidia, landed in Beijing with a clear message: the maker of the world’s leading artificial-intelligence (AI) chips planned to “unswervingly serve the Chinese market”. America would rather it didn’t. A few days earlier the Trump administration had introduced new controls that, in effect, banned the company from selling its H20 microprocessor to China.

Over the past few years America has sought to hobble its main rival in the AI race by controlling access to its advanced semiconductors. The performance of an AI processor depends mostly on two factors: computing power (how fast a chip processes data) and memory bandwidth (how quickly it moves data between processor and memory). In October 2022 the Biden administration barred sales to China of American chips that exceed a threshold on both fronts. Nvidia responded with the H800, a made-for-China model engineered to stay just under the limits. A year later, America tightened the regulations again, banning any chip with too much computing power, regardless of memory bandwidth. Nvidia’s answer was the H20.

The trouble for America is that restricted Nvidia chips continue to make their way into the hands of Chinese AI developers. A shadowy supply chain has emerged, designed to work around sanctions. Some customers lease access to offshore data centres; others buy chips through murky intermediaries. A new round of restrictions, due to come into effect on May 15th, aims to tighten the net further still. The new rules target not just hardware, but also the cloud providers offering access to it. Yet they will probably fail, too.

To see why it is so difficult to restrict access to AI chips, consider Johor, a part of southern Malaysia once better known for its palm-oil plantations. Located just across the border from Singapore, the region has become a hub for data centres. Land and electricity are cheap, and permits easier to obtain than in the city-state. All the big American cloud providers—Amazon, Google, Microsoft and Oracle—have set up shop. According to Knight Frank, a property consultancy, Johor’s total data-centre capacity (built, under construction or planned) grew from 10 megawatts in early 2021 to more than 1,500 megawatts by 2024.

Johor also provides a convenient back door into China. Big Chinese firms such as ByteDance, the owner of TikTok, have rented capacity there. Leasing cloud capacity in Malaysia allows companies like it to gain access to chips that cannot be imported into China. SemiAnalysis, a consultancy, estimates that nearly half of Johor’s projected data-centre capacity in 2027 will incorporate AI processors such as Nvidia’s. Malaysian data-centre operators insist they comply with American export regulations and do not provide capacity to blacklisted entities. Yet workarounds are straightforward. A lawyer advising firms in the region says it is relatively easy for Chinese companies to get hold of restricted AI chips by setting up local subsidiaries.

Figures on trade flows support this. Nvidia’s high-end chips are produced by TSMC, the world’s biggest chipmaker, in its Taiwanese factories. In the first quarter of this year Taiwan exported $3.6bn-worth of graphics-processing units—the kind used to train AI models—to Malaysia, nearly matching the total for all of 2024 (see chart 1). In March alone shipments more than tripled from the previous month to reach almost $2bn.

Then there are the smugglers who traffic chips directly into China. These are typically diverted through third countries not covered by American restrictions. A source familiar with the practice says goods often pass through several jurisdictions and front companies to obscure their origin. Export papers are doctored; restricted products are mislabelled to slip past customs. Erich Grunewald of the Institute for AI Policy and Strategy, a think-tank based in San Francisco, estimates that last year smuggled American chips made up between one-tenth and one-half of China’s ai-model-training capacity.

Before the first round of export controls in 2022, China accounted for about 22% of Nvidia’s revenue (see chart 2). That share has since fallen to 13%. At the same time, sales to Singapore—a city with few end-users—have more than doubled, and now make up nearly 18% of the total, making it Nvidia’s second-largest market after America. The company says the shift is routine: many clients invoice through Singapore but ship to permitted destinations. Fewer than 2% of chips sold there are delivered locally.

In February, however, Singaporean police arrested three men over the sale of $390m-worth of servers that incorporated Nvidia chips. Prosecutors allege these were first sent to Singaporean firms, then re-exported to Malaysia. Whether that was their final stop remains unknown. What is clearer is the incentive: demand has turned the grey market into a gold mine. According to one industry executive, banned Nvidia chips now sell at a 30-50% markup through intermediaries.

China is not the only destination. In October America placed several Indian companies under sanctions for re-exporting restricted chips to Russia. Among them was Shreya Life Sciences, a pharmaceutical firm based in Mumbai. According to figures from The Trade Vision, a data provider, the company exported $322m-worth of tech goods to Russia in 2024, much of it Dell servers containing Nvidia chips.

All this puts Nvidia in a difficult position. The company insists it complies with American export rules. But its operations are vast: it expects to sell more than 6m AI chips this year and it sits several steps removed from the end user. Nvidia supplies processors to cloud giants such as Google and Microsoft, and to equipment-makers like Dell and Supermicro, which integrate them into servers. From there, responsibility for compliance is diffuse. Cloud providers and hardware firms are expected to vet their customers. Nvidia itself conducts periodic audits. But oversight is uneven, and servers often change hands quietly after passing initial checks. One executive at a server manufacturer says properly verifying all end users is “practically impossible”.

America’s government has responded by introducing ever tighter regulations. In January the Biden administration unveiled its “AI Diffusion Framework”, which splits the world into three tiers: 18 trusted countries including Britain and Japan face no restrictions; a second tier of 120 countries including Singapore and India are subject to quotas; and a final tier including China and Russia are barred outright. The rules also prohibit American cloud providers from offering services powered by restricted chips to Chinese customers. The Trump administration is reportedly planning to tinker with the regulations before they come into effect—perhaps tying access to chips into wider trade negotiations—but it is yet to announce any changes.

The chip has sailed

Any new controls will encounter familiar problems. The Bureau of Industry and Security (BIS), the agency tasked with enforcing tech export controls, is severely understaffed. Mr Grunewald notes that it has just one export-control officer responsible for all of South-East Asia and Australasia—a region central to the shadow trade in AI chips. And just as the regulatory web grows more intricate, BIS is being stretched even more: it faces a cut to its budget of 12% this year.

Some pundits have proposed technical solutions, such as disabling chips used in prohibited locations. Nvidia argues that such hardware-level controls would introduce dangerous vulnerabilities and are unworkable. Instead, it suggests that software-based tools could transmit limited telemetry—including information on location and system configuration—back to the company to confirm that the chips are where they are supposed to be.

Even better enforcement has its limits, however. Nvidia cannot trace every chip. BIS cannot inspect every server. Smugglers will continue to find loopholes. If America wants to keep ahead of China in the AI race, it will need to innovate faster, rather than clamp down harder.