How much US compute is China renting from the cloud?
China is restricted from purchasing advanced US chips, but it can rent liberally from the cloud. Even a modest share of US cloud compute could already be boosting China's AI compute by over 60%.
This is part one of a series on remote access to US compute through cloud services. Subsequent posts will examine regulatory authorities on cloud compute and explore ideas for know-your-customer frameworks.
The US restricts the sale of advanced AI chips to China, and on the whole these controls appear to be working: China’s projected compute ownership in 2026 amounts to less than 5% of the United States’.1 But because compute remains unrestricted through cloud services, Chinese companies can access an unknown additional amount remotely. This post tries to scope how much.
Specifically, NVIDIA Blackwell sales are prohibited to Chinese customers, and NVIDIA H200s are subject to approval, with licenses reportedly capped at 75,000 chips per customer. But there are no customer caps on remote access to compute through the cloud, including on more advanced Blackwells and, in the future, Rubin chips. US hyperscalers, neoclouds, and third-country providers offer rentable AI compute2 through the cloud, and the data center build-out behind these offerings is set to expand massively over the next few years.
Researchers have a reasonably good idea of how much physical compute China produced and acquired in 2025 and how much it will produce and acquire in 2026. What remains unknown is how much AI compute they access from cloud service providers. If providers track this figure, they do not share it publicly or with the US government (as far as I am aware). According to data from Epoch AI, key US-headquartered cloud providers account for around 16 million H100-equivalents3 of the 20 million sold since 2022, amounting to about 80% of total advanced AI compute available worldwide. After accounting for compute rented by US labs, how much of the remaining could China be accessing?4
In this post, I provide rough estimates to establish upper and lower bounds on how much compute Chinese companies could be accessing remotely through the cloud. I estimate this range is between about 9 million H100-equivalents and 670,000 H100-equivalents. This is a broad range—the main takeaway from this post is that it’s not known how much compute is rented to otherwise prohibited users. The upper bound is an outsized number relative to what’s been reported, and it’s likely the actual number is around 670,000, if reports are accurate. In a Monte Carlo simulation, ChinaTalk analysts arrive at a similar estimate of about 1 million H100-equivalents, which would increase China’s compute access by at least 80%.
Below, I synthesize what researchers have gathered from open-source reports, press releases, and earnings calls to estimate how much cloud compute could be available for commercial rent (upper bound) and how much China is known to rent (lower bound). Given that China is renting, or will be renting, a sizable amount of compute in Malaysia, I’ll zoom in on the country’s data center build-out to analyze what capacity is there now and what’s expected to come online in the coming years.
How much US compute could China be renting?
There is a fair amount of open-source information out there to help researchers piece together reliable estimates. Epoch AI tracked revenue statements and earnings calls to estimate AI chip ownership, informing my upper-bound estimate of how much compute is commercially available to rent globally. Investigative journalists confirm that Chinese companies are renting US compute from various cloud service providers, informing my lower bound on how much China is accessing.
An upper bound for cloud compute used by China
I estimate that of approximately 20 million H100-equivalent AI chips sold from 2022 through the end of 2025, about 9 million are commercially available to rent. In the chart below, Epoch AI estimates US compute sales and disclosures for NVIDIA, AMD, Google, and Amazon chips total around 20 million H100-equivalents.5
To trim down this number, I subtract sales to companies that don’t provide cloud services and sales to China. That leaves about 16 million H100-equivalents, accounted for by Google, Microsoft, Oracle, CoreWeave, and a remaining category of chip sales labeled “Other” that I will sort out further below.
Now, subtract the compute set aside for US frontier labs. I include data centers that came online as recently as May 2026, assuming at least three to six months’ time for GPU testing and commissioning.6
After accounting for the AI compute used by frontier labs at cloud service providers, about 11 million H100-equivalents remain.
Epoch AI’s “Other” category accounts for NVIDIA’s remaining customers after accounting for hyperscalers, xAI, and CoreWeave, totaling 3.4 million H100-equivalents. These sales are presumed to consist of NVIDIA’s Sovereign AI program, Tesla, and dozens of neoclouds. I would also add a growing fourth category: enterprise customers. Of the four, only neoclouds offer commercial cloud services. NVIDIA’s Sovereign AI program made up about 15% of the company’s data center revenue in 2025, 16% in 2024, and reportedly zero before then. I estimate it at roughly 2 million H100-equivalents. As noted in Epoch AI’s methodology, Tesla has disclosed about 120,000 H100-equivalents. I don’t have a clear picture of how much of NVIDIA’s sales go to non-frontier lab enterprises, but reporting suggests this number isn’t yet significant.7 The remaining sales are most likely attributed to neoclouds.
After accounting for Sovereign AI sales and Tesla, I estimate that about 9 million H100-equivalents remain available for potential commercial cloud use. Some chips are likely missing from this calculation, including compute that cloud providers use internally for non-frontier-model products like Google Search’s AI Overview, though these figures are probably small. So 9 million H100-equivalents is likely on the high end.
A rough lower bound for cloud compute used by China
Several investigative reports have identified Chinese entities, ranging from big tech companies like Alibaba and Tencent to state-backed universities and labs, that rent compute from various US- and foreign-owned cloud companies. Not all of these reports include chip estimates, but here are the ones I know of.8
Based on the following reports with direct figures, I’m confident that Chinese companies are accessing (or will access this year) at least 145,000 H100-equivalents.
51,000 H100-equivalents. Tencent is renting nearly 5,000 B200s (13,000 H100-equivalents) from Japanese cloud company Datasection in Osaka, and 10,000 B300s (38,000 H100-equivalents) from its data center in Australia.9
91,000 H100-equivalents. ByteDance is working with Singapore-based neocloud Aolani Cloud on an expansion of its data center in Malaysia to rent an additional 36,000 B200s.10 If these B200s were purchased by the end of 2025, this figure belongs here.
2,800 H100-equivalents. Reuters found a collection of tenders requesting access to NVIDIA A100s through cloud service providers. Of these, at least 9,000 A100s were accounted for in fulfilled tenders.
I estimate an additional 520,000 H100-equivalents based on reports of ByteDance’s 2025 budget:
520,000 H100-equivalents. The Information reported that ByteDance planned to spend up to $7 billion in 2025 on remote access to NVIDIA chips. Based on H100-rental pricing at the time, it’s estimated that $7 billion could account for about 610,000 H100s.11 I subtract the 91,000 H100-equivalents counted above from the Aolani cluster. If Aolani didn’t purchase the B200s until after 2025, this budget likely accounts for rental purchases elsewhere.
This figure seems plausible given how much ByteDance rents from data centers in Malaysia alone. DayOne hosts a 390 MW data center in Johor, Malaysia, of which ByteDance is reportedly the largest customer.12 I estimate that a data center this size could serve approximately 156,000 B200s, or about 390,000 H100-equivalents.13 Additionally, ByteDance is reported to be the anchor tenant for Bridge Data Centres’ Johor location, a 110 MW data center that I approximate could serve around 44,000 B200s or about 110,000 H100-equivalents. These data centers in Malaysia alone account for at least half of ByteDance’s 2025 budget.
Researchers tracking data center build-out in Southeast Asia will notice that Oracle’s cloud region in Malaysia is missing. I’ve omitted it because construction won’t be completed until at least the end of 2026, and it’s not clear if GPUs have been sold yet. But its planned build-out is included in the Malaysia dataset in the next section. Once completed, this will account for another 130,000 B200s or approximately 330,000 H100-equivalents, a majority of which is assumed to go to ByteDance or other Chinese customers.14
In total, I estimate that Chinese companies are renting at least around 670,000 H100-equivalents.15 Huawei is estimated to produce about 150,000 H100-equivalents next year. It might illegally fabricate another 7,500 H100-equivalents and smuggle another 75,000. If the US approves the maximum number of H200 and similar licenses, that’s potentially another 890,000 H100-equivalents. So if China were to remotely access 670,000 H100-equivalents in 2026, that would increase its total access to advanced compute by about 60%. If the US does not export H200s, it would increase by almost 4x.
Buildout in Malaysia
Global data center capacity is expected to double to 200 GW between 2026 and 2030. Where is that compute capacity being built?16 The United States will continue to lead significantly in data center capacity, with China close behind and middle powers working to remain competitive. While Malaysia’s AI data center market size is a fraction of other middle powers’, it has the highest projected compound annual growth rate in Southeast Asia and among the highest globally. Though its market share is smaller, the buildout of data centers under former China subsidiary DayOne, other foreign-owned data centers dedicated to China’s customers like Aolani Cloud, and US hyperscaler buildout in the region make Malaysia worth watching as an intermediary for China’s remote access to US compute.
Further, while US cloud providers are now permitted to rent advanced compute to Chinese customers, China may prefer to rent from foreign-owned data centers in the region, where business ties are already established and trusted, and where the US government keeps a less watchful eye. For example, if US authorities start to crack down on cloud controls, it’s likely easier to enforce controls with US companies than with foreign-owned ones.
With this in mind, I look at data center capacity in Malaysia.
Operational and Planned Construction
There is already a lot of buzz about the data center build-out in Johor and Kuala Lumpur. I’ve estimated Malaysia’s operational and planned AI data center capacity in IT megawattage below.17
By collecting press releases and media reports on operational data centers and planned construction, one can get a sense of Malaysia’s current AI compute power and what will come online in the coming years. It’s difficult to get AI chip types and counts for each data center, but for many of them, it’s easy to find the megawattage required to run the data center or how much MW is planned for the future. Still, I don’t have MW estimates for every data center in my dataset, so these numbers could be lower than they should be.18 As it stands, Malaysian data centers running AI compute total about 1 GW of power. Announced plans across a range of companies—US hyperscalers, neoclouds, and many foreign-owned firms—total about 4.5 GW. Out of the additional 100 GW estimated to be built out between this year and 2030, this might not seem like much, but it accounts for almost 20% of the capacity planned outside the United States.19
It’s hard to translate megawattage into chip counts, but consider what this wattage could support, assuming GPUs account for approximately 40% of data center power usage.20 If B200s use 1 kW each, 1 GW could house about 400,000 B200s (1 million H100-equivalents), and 4.5 GW of capacity could host about 1.8 million B200s (4.5 million H100-equivalents). To put this into context, 1 GW alone could increase China’s access to compute by 90% to 430%, depending on how many H200s the US exports to China. Of course, not all of Malaysia’s AI compute capacity will serve Chinese customers, so the figures above represent an extreme upper bound on what could theoretically be available to China, not a forecast.
Because these data centers house an unknown mix of Blackwells, Hoppers, and perhaps some A100-level chips, it’s hard to estimate exact quantities, but this gives an idea of what Malaysia’s data center capacity could house.
Concluding thoughts
What should the US government do with this information? As Congress considers legislation like the Remote Access Security Act, it is useful to know which of the Bureau of Industry and Security’s (BIS) statutory authorities already cover cloud compute and where the gaps are. I think of rented US cloud compute in three transaction categories:
US cloud providers’ sales from domestic data center compute
US cloud providers’ sales from overseas data center compute
Foreign cloud providers’ sales from their foreign-owned data centers abroad21
I will discuss policy approaches in later posts, but in short, the current authorities relevant to governing cloud compute are as follows. Categories (1) and (2) could be covered by BIS’s US persons control, which requires any US individual or company to seek a license for any activity supporting the development of weapons of mass destruction or prohibited military-intelligence end users and uses. To address (3), BIS would need to put licensing conditions on US chips sold to foreign-owned data centers. Legislation like the Remote Access Security Act could simplify these authorities.
Looking at Malaysia alone, many foreign-owned data centers are being built with no US persons involved in their cloud sales. The dataset I put together for this post indicates that roughly 3 GW out of the 4.5 GW in planned IT capacity falls under transaction category (3).
Even with the authorities BIS could use to control cloud compute, no one knows how much compute is actually being rented. The range I estimate, 670,000 to 9 million H100-equivalents, spans more than an order of magnitude, which underscores the main point: no one, including the US government, seems to know how much US compute is being remotely accessed by otherwise prohibited users (though public reports confirm some is). Since cloud providers don’t publicly break down their revenue reports by country, BIS should ask US companies and foreign buyers of US compute to disclose high-level figures of how much is rented from customers in China. I will return to this in future posts.
An analysis by the Institute for Progress estimates US production will reach 6.89 million B300-equivalents in 2026, which can be compared to my colleague Erich’s projection that China will acquire (by means of new H200 sales, production, proxy fabrication, and smuggling) around 320,000 B300-equivalents. Without H200 sales China’s predicted compute volume would only be around 100,000 B300-equivalents.
What I mean by AI compute: BIS license restrictions on advanced US compute to China include AI chips with total processing power (TPP) of 2,400 or over, which is essentially any chip with TPP above the NVIDIA H20. This includes NVIDIA A100s through the latest B300s and expected Vera Rubin chips as well as advanced AMD MI300s, Google’s TPUs, and Amazon’s Trainiums.
Throughout this post, H100-equivalents are calculated by comparing total processing performance (TPP). H200s have a much higher memory bandwidth, but TPP focuses on measuring chips by their FLOPs.
H100-equivalents are calculated by converting various chip counts to match the equivalent TPP of a NVIDIA H100 GPU.
Pre-2022 GPU sales are negligible. The only AI chip on the market (as defined by my BIS definition based on TPP above) was the A100, and sales wouldn’t have been more than in the tens of thousands (H100-equivalents). It’s a very small part of overall AI compute that exists now which is in the tens of millions (H100-equivalents).
Testing and commissioning timeline according to Giga Energy.
From what I can tell this figure isn’t super significant, yet. There are smaller, enterprise-owned data centers like US pharmaceutical company Lilly’s 1,000 B300s and NVIDIA’s own data centers that are likely over 15,000 H100s now. Foxconn, TSMC, and even Disney should have some amount of GPUs as well. In 2026 and onward this figure should grow notably. For instance, at the GTC in Washington last fall, NVIDIA announced new partnerships with South Korean companies for planned orders of over 260,000 Blackwells as well as various partnerships with Palantir, Uber, and others.
See the Financial Times. The 10,000 B300s are scheduled to be delivered to the Australian data center by February 2026 according to DataSection; I will assume they were purchased in 2025.
See the Wall Street Journal. This figure is in addition to an unknown number of H100s they already rent from Aolani.
A ByteDance spokesperson disputed the budget claim, though given other reports that ByteDance’s total AI infrastructure capex for 2025 would be around $20 billion, the $7 billion figure seems reasonable. Tom’s Hardware estimates $7 billion could equate to renting around 610,000 H100s.
Assuming all or most of this compute serves customers in China: reportedly ByteDance is DayOne’s largest customer.
See SemiAnalysis.
Or are about to rent, assuming Aolani’s B200 expansion will be online this year.
See JLL: 2026 Global Data Center Outlook. This does not solely represent AI compute. JLL predicts AI will grow to account for 50% of data center workloads in 2030, up from 25% in 2025.
The dataset includes any data center that either directly states it houses AI GPUs, is described as “AI-ready”, or includes other hints that the data center will be used for AI workloads.
I estimate almost half of the gigawatts that DC Byte projects (see Johor and Kuala Lumpur estimates). The reason for this could be that my dataset does not include MW for new Microsoft, Google, and AWS planned builds as these remain undisclosed (I do include an Oracle estimate). Further, DC Byte is tracking all data centers; I am focused on those that can accommodate AI workloads.
S&P estimates approximately 75 GW in growth from the beginning of 2026 to 2030 and as referenced above JLL estimates around 100 GW of total global growth in that timeframe.
Epoch AI estimates GPUs account for about 40% of power usage in AI data centers. Of course there is likely a degree of variability here, especially considering the variety of companies setting up shop in Malaysia.
There is a fourth category to consider: sales from foreign-owned data centers in the United States, but in terms of BIS authorities this can be lumped in under the US persons control. By being located in the United States, it is inherently under the US persons control.
 | A guest post by
|