AI chip smuggling is the default, not the exception

On January 13, 2025, in the final days of the Biden administration, the US Department of Commerce announced sweeping new AI chip export restrictions.

Among other measures, the new “diffusion” rule placed a cap on exports to “destinations that present a risk of diversion or misuse”. Such destinations include several Southeast Asian countries where weak enforcement has enabled a black market for American AI chips destined for China.

The rule immediately drew fire from multiple quarters. An executive at US tech giant Oracle argued that concerns about diversion “are unfounded, as [AI chip] supply chains are tightly controlled”. The EU also expressed concern, while China’s Ministry of Commerce issued a strong condemnation.

Following the release of the new, highly popular reasoning model by Chinese AI company DeepSeek, some commentators even argued the AI chip controls are fundamentally misguided. Others, meanwhile, contend that DeepSeek represents an urgent need to strengthen the AI chip controls and their enforcement.

Which side has it right?

While AI chip companies have taken steps to prevent smuggling, it is simply not the case that their downstream supply chains are tightly controlled. As a result, large quantities of banned AI chips were likely smuggled into China during the past year. Whether DeepSeek benefitted from this smuggling remains unclear, but other Chinese companies almost certainly have.

As of February 2025, the diffusion rule remains in effect, though its future is uncertain. In January, President Trump directed the State and Commerce Departments to review the US export control system. One of the issues likely to come up in that review is AI chip smuggling.

How to smuggle AI chips

Say you’re a Chinese AI start-up determined to buy a few thousand cutting-edge AI chips. How would you go about it? You can’t just import them, because the ban prevents anyone in China, and Chinese-owned companies anywhere, from buying them. As a result, you need to smuggle them. How do you do that?

The first hurdle is obtaining the chips. To do this, you go to a “third country” where importing them remains legal. Japan, South Korea, and Taiwan are good candidates – they’re major shipping hubs near China where AI chip purchases are common, and they’re not subject to the new country caps on AI chip exports.

Once you’ve settled on a third country, you (1) create a shell company, (2) create a digital presence, including a website and email addresses, (3) fabricate financial records, and (4) establish a relationship with a local chip reseller who partners with a major AI chip distributor.

Setting up a shell company is straightforward, often achievable online in days for a few thousand dollars. The reseller, or their contractor, will perform some due diligence, but probably not too much. AI chip resellers are often small businesses, the US government is far away, and the order would boost their quarterly sales nicely.

With the AI chips secured, the next step is moving them to China – but this is the easy part. You contact a logistics company, probably one that ships by air. To minimize scrutiny, you can remove the products from their original packaging and repack them in different crates. On the customs forms you list them as unrelated items, like hard drives or even toys or tea.

Within weeks, the chips are in China. When the trade is done it could well have earned you tens of millions of dollars.

In reality, AI chip smuggling is more complicated and varied than this description. But it undeniably happens:

[In spring 2024], an electric appliance company in eastern China put in a $120 million order for 300 servers powered by eight of Nvidia’s cutting-edge H100 chips. The order was for chips that U.S. export rules bar from sale in China.

To get around those rules, the company didn’t go to one of Nvidia’s authorized distributors but to a chip broker in Malaysia. The broker arranged for the Chinese buyer to establish a shell company in Malaysia, concealing any link to the parent company in China.

He also helped set up a corresponding corporate website and corporate email addresses to enhance the fake company’s legitimacy. The broker even rented space in a Malaysian data center to temporarily house the servers when they arrived, as a way of fooling Nvidia staffers who wanted to check if such a larger order of servers was installed properly.

In a matter of weeks, the servers were in China, having first passed through Malaysia, according to the broker, who gave his first name as William and who didn’t want to be identified by his full name.

William is not alone. The same reporting by The Information documents a separate, $230 million shipment of 600 servers containing 4,800 NVIDIA H100s from US server builders Dell and Supermicro that were sold to Chinese buyers. (For reference, frontier large language models are now being trained on over 100,000 chips.) The New York Times reported a sale of 2,000 NVIDIA H100s to a Chinese company for $103 million. The Wall Street Journal found that the “flow of [banned] NVIDIA chips is so steady that most [Chinese vendors] take preorders and promise delivery in weeks”. According to Bloomberg, 8,900 NVIDIA H100s were smuggled into Russia through an Indian pharma company, despite sanctions. A Chinese start-up founder estimated there are more than 100,000 NVIDIA H100s in China. All these reports, by the way, are from the past nine months.

The implications of DeepSeek

Recent debates around America’s AI chip controls have intensified following the explosive popularity of DeepSeek's R1 reasoning model. Critics have seized on this development to make two main arguments opposing the controls.

First, they argue that DeepSeek’s models demonstrate Chinese companies can acquire enough computational power (“compute”) to be at the AI frontier. Second, that DeepSeek’s ability to train its models with relatively few AI chips proves compute is no longer a critical driver of AI progress. Neither argument is sound.

Let’s take the first argument. It’s not clear whether DeepSeek has acquired smuggled chips, but its recent models were likely trained on legally imported NVIDIA H800s. The H800, designed to skirt the thresholds put in place in October 2022, nearly matches the performance of the state-of-the-art H100. DeepSeek could import H800s for several months before they were banned in October 2023.

Allowing the H800 to be exported to China well into 2023 was a mistake by the Biden administration, delaying the AI chip controls’ impact by a year. As a result of this error, and due to the time needed to build compute infrastructure and develop new models, the AI chip controls simply have not had time to have a substantial effect on Chinese AI models.

Whether the chip controls can slow Chinese AI development will become clear in the next two or three years. However, early signs suggest they are limiting Chinese companies’ access to compute.

When DeepSeek’s founder was asked about the company’s financing plans in July 2024, he responded that the problem DeepSeek faces “has never been about money, but rather the export ban on high-end chips”. While American companies are investing hundreds of billions into compute infrastructure, there are no signs yet of similar large-scale Chinese investments.

The second argument against AI chip controls relates to DeepSeek’s ability to achieve strong model performance using relatively few AI chips. If fewer chips are needed for the same performance, Chinese companies – it is argued – could rely on small quantities of smuggled chips or domestically produced alternatives.

The problem with this thinking is that AI companies aren’t satisfied with achieving the same performance – they are racing to build ever more capable AI systems. Without export controls, DeepSeek could have trained its models with far more chips, yielding even more powerful models.

As Dario Amodei, co-founder and CEO of leading US AI company Anthropic, writes, “the economic value of training more and more intelligent models is so great that any cost gains are more than eaten up almost immediately – they’re poured back into making even smarter models for the same huge cost we were originally planning to spend”.

It is not that DeepSeek’s emergence is not significant. Its engineers have demonstrated an impressive ability to invent new efficiency improvements and convert those into cost-effective AI models. Still, they are constrained by a lack of AI chips, and AI chips remain key to AI progress. As a result, export controls remain a critical policy lever – provided they can be effectively enforced.

How many AI chips are smuggled?

In a forthcoming Center for New American Security working paper, Tim Fist and I extrapolate from known cases to roughly quantify the extent of AI chip smuggling. We estimate it's more likely than not that over 100,000 export-controlled GPUs were smuggled into China last year, though the true number could range from tens of thousands to one million, depending on underlying assumptions.

We’ve been surprised by the prevalence of AI chip smuggling. In 2023, our estimate was in the tens of thousands, though we noted that “a concerted smuggling effort could yield anywhere from hundreds to hundreds of thousands of chips per year”.

This robust black market in AI chips exists because of strong demand in China for restricted chips, coupled with a low risk of detection and punishment.

The demand comes from the performance gap between American AI chips and domestic Chinese alternatives. Given the limited supply of sought-after AI chips in China, this “sanctions arbitrage” is highly lucrative.

Meanwhile, the US Bureau of Industry and Security (BIS), the Commerce agency responsible for administering these controls, faces challenges in enforcing them. This is largely due to its limited resources, outdated methods, and the difficulties of trying to enforce US law on foreign soil.

The companies best positioned to curb smuggling – including AI chip makers like NVIDIA, server builders like Dell, and distributors like TD Synnex – are often not liable for these diversions, provided they conduct the necessary due diligence on their direct customers.

Further down the supply chain, resellers typically lack the capacity and incentive for thorough due diligence, as they often lack any US oversight, have limited resources, and are easily replaced. Furthermore, even if BIS identifies a violation, it must go through diplomatic channels to fine or prosecute the violator.

Resellers aren’t the only problem. Some US server builders also seem lax in their due diligence.

In August 2024, a short-seller report alleged that Supermicro, NVIDIA’s largest server builder by revenue share, was “evading sanctions and export restrictions” by supplying products worth millions of dollars to a Russian distributor.

According to The Information, NVIDIA recently asked Supermicro and Dell to “conduct spot checks of its customers in Southeast Asia [...] to verify that those customers still possess the servers equipped with Nvidia chips they bought”. The request came after BIS asked NVIDIA why their chips kept ending up in China. According to the same report, five smugglers claimed to have “so far [evaded] detection during recent inspections by Supermicro”.

The entire system operates on trust. Each major company carefully vets a direct customer and then trusts the customer to adhere to all contractual agreements. A former employee at a major server builder told me that its salespeople would get new customers to sign affidavits absolving the server builder of legal responsibility should the products be illicitly traded. These AI chip companies do generally meet the legal requirements, but they rarely know when and where diversion occurs, who is responsible, or how often it happens.

Export control enforcement is hard

If companies aren’t effectively identifying diversion, is the government stepping in? Could BIS not, in theory, vet each AI chip sale outside the US and conduct follow-up inspections?

As it turns out, that’s not what’s happening. BIS has only one export control officer responsible for investigations, inspections, and outreach in the whole of Southeast Asia and Australasia.

In 2024, BIS’s annual export enforcement budget was $86 million – a tiny fraction of the value of AI chips exported and resold abroad these days. Over the past year, NVIDIA earned an incredible $63 billion of profit, much of it through exports.

Instead of comprehensive verification, BIS depends on companies to vet customers, monitor shipments, and self-disclose violations, while BIS provides guidelines and oversight. But a regulator can’t effectively monitor a company when its primary source of information is the company itself, especially if the company is unaware of violations involving its products. Because exporters aren’t liable for violations happening after the immediate sale, they have little incentive to monitor product flows down the supply chain. As an NVIDIA spokesman said last year, it “cannot track products after they are sold”.

Holding AI companies strictly liable for all export violations involving their products, even with appropriate due diligence, would be unduly burdensome – it would require them to closely monitor downstream supply chains and vet not just their customers but also their customers’ customers.

So, how can enforcement be improved?

One obvious idea is to increase BIS's meager budget, currently less than one percent of that of Customs and Border Protection. Although this would enable more investigations, inspections, and audits, even a well-funded BIS would face two fundamental constraints.

First, actual export violations often happen abroad, and investigating and penalizing foreign companies involves a complex diplomatic process. While the diffusion rule may reduce smuggling through export caps and obligations imposed on importers, smugglers would still have options. They could obtain smaller quantities of chips from countries subject to caps and larger quantities from countries without them, notably Japan, South Korea, and Taiwan.

Second, BIS has not significantly updated its enforcement methods in decades, leaving ample room to modernize its approach.

What this means for policy

AI chip smuggling is a relatively new problem and differs from other forms of export control violations in key ways.

First, the AI chip supply chain is highly concentrated. NVIDIA alone holds an 80-95% AI chip market share, while only a handful of companies build most AI servers and distribute the products. This concentration means that improving due diligence and chip flow monitoring would be substantially easier than in other supply chains.

Second, AI chips are computers, meaning mechanisms to detect export violations can be built into the products themselves.

One promising area for improvement is for BIS to better leverage modern technologies. Instead of relying on web searches and spreadsheets to evaluate buyers and detect diversion, it could employ advanced data analytics and machine learning tools. Such a modernization effort would require initial funding, but could save money in the long run through increased productivity.

Another approach involves modernizing BIS's monitoring systems. For example, it could maintain an up-to-date register of all exported AI chips subject to restrictions by mandating that the chip owners report any change of location or ownership outside the US. This would allow regulators to verify a chip’s location or, better yet, require the chip owner to digitally prove the chip is not in prohibited locations.

One way to do this would be to ask AI chip makers to implement a software-based location verification feature on controlled chips. To be able to import more restricted AI chips under the diffusion rule, companies outside the US and partner countries must now show that they can verify that their chips are still in the authorized location. Several other proposals of such hardware-enabled mechanisms could also help enforce export controls.

Despite the enforcement gaps, AI chip controls are clearly having a substantial impact. In an industry where computing power is of supreme importance, Chinese AI companies are compute-starved relative to their American counterparts. This matters because the compute an AI model is trained with has historically been strongly correlated with that model’s benchmark performance

Understanding this, American companies are now investing hundreds of billions into new compute infrastructure buildouts. There are no reports of equivalent investments into compute in China.

Still, there are real security gains to be had at a relatively low cost, or perhaps even at a positive return. A penalty levied for just one diversion of 1,400 AI chips would suffice to cover BIS’s entire annual export enforcement budget.

If the US is serious about outcompeting China in AI, it needs to strengthen, not weaken, its AI chip export regime. A crucial first step is eliminating the widespread occurrence of AI chip smuggling.