The H20 Problem: Inference, Supercomputers, and US Export Control Gaps

Summary

The United States is on the verge of repeating a critical strategic error. Despite having the legal authority and technical tools to constrain China’s access to advanced AI chips, the US government is failing to enforce existing export controls or adapt them to new threats. As a result, Chinese firms are exploiting loopholes to acquire powerful US hardware, undermining America’s lead in frontier AI.

The most immediate risk is the pending export of over 1.3 million NVIDIA H20 chips, worth more than $16 billion, to Chinese tech giants including ByteDance, Alibaba, and Tencent.¹ These chips — optimized for AI inference — are likely to be used in Chinese supercomputers, violating US export controls. At least one of the buyers, Tencent, has already installed H20s in a facility used to train a large model, very likely in breach of existing controls restricting the usage of chips in supercomputers exceeding certain thresholds. DeepSeek’s supercomputer used to train their V3 model is also likely in breach of the same restrictions.

This failure is part of a broader pattern:

• Huawei stockpiled restricted chip components, including chip dies and high-bandwidth memory (HBM), before controls took effect.²
• TSMC has facilitated production of over three million cutting-edge chip dies directly for Chinese firms for Chinese AI efforts, sometimes in violation of US rules.³
• DeepSeek, a Chinese lab, trained state-of-the-art models using American chips sold legally due to delayed restrictions.⁴

The rationale behind export controls remains sound: AI models trained and deployed on the most advanced chips pose national security risks. But the administration of export controls is failing to keep pace with new developments in the field. Inference — once seen as secondary — has become central to training, fine-tuning, and increasing the capabilities of deployed models. The H20, a chip specialized in inference, is already 20% faster than the H100 (a currently banned chip) for inference tasks.⁵

To avoid another preventable failure, the US must act now. We recommend that:

1. BIS should immediately block the H20 shipments using its existing authority under 15 CFR § 744.23.
2. NVIDIA must investigate and halt transactions that raise legal red flags under its “Know Your Customer” obligations.
3. BIS should update export controls to cover inference chips.
4. The White House should empower a technical team — ideally within the AI Safety Institute (AISI) at NIST — to forecast AI threats and proactively shape control policy.
5. BIS should track chips once exported to high-risk locations by incentivizing industry adoption of chip geolocation features.

The US retains its technological edge — but its advantage is shrinking, and its policy posture is reactive. Without better foresight and enforcement, American technologies will continue fueling China’s ascent in AI.

Background

One of America’s advantages in AI leadership over China is its ability (in collaboration with allies) to produce and control the sophisticated semiconductors necessary to develop AI models, as well as the tools necessary for making them. However, America’s inability to enforce controls fully and update them quickly has led to Chinese companies advancing their capabilities and reducing the size of the US lead. 

The rise of Chinese firm DeepSeek caught many American policymakers by surprise, with some calling it a “Sputnik moment” for AI.⁶ Even more shocking to some was the fact that DeepSeek’s recent R1 and V3 models were largely trained with chips made by NVIDIA, an American company. The vast majority were NVIDIA’s H800 and H20 chips, which we sold freely to Chinese firms.⁷ H800s (a slightly modified version of NVIDIA’s popular H100 chip) were available on the market for nearly 7 months before the US blocked their sale, and H20s are still available for purchase in China now.⁸

The US has also struggled to effectively update regulations to control China’s access to key components for chip production. The US government recently learned that Huawei has bought over two million advanced chip dies through shell companies, in direct violation of US export controls. Although a $1 billion fine is being assessed for TSMC, the chip die provider, this lack of oversight has already given Huawei a sizable stockpile of advanced chip components.⁹ A new regulation — the foundry due diligence rule — was put into effect earlier this year to prevent similar issues in the future. In another case, the plans to impose export controls on high-bandwidth memory (HBM) were leaked nearly 6 months before they were enacted in December 2024, allowing Huawei to stockpile a year’s worth of HBM in advance.¹⁰

In each case, earlier intervention could have prevented strategic setbacks to American AI leadership. But despite these oversights, the rationale behind export controls is sound. While NVIDIA’s H20s and H800s are more powerful, they are still less powerful than the H100s and the Blackwell series chips that NVIDIA sells in the US.¹¹ Chinese firms would likely have been able to develop powerful models much more quickly if they had full access to leading American chips. DeepSeek’s CEO put it best: “Money has never been the problem for us; bans on shipments of advanced chips are the problem.”¹²

The solution to these problems is not to weaken export controls and allow Chinese firms to purchase even more of America’s powerful AI hardware, but rather to forecast and plan better for the future, enact more effective controls, and update them more quickly.

Our current mistake: continuing to export H20 chips

The United States is about to make another strategic mistake: Allowing three Chinese firms to receive over $16 billion in orders for NVIDIA H20 chips, amounting to over 1.3 million chips.¹³ This order is over six times the size of Colossus, the largest compute cluster in the world.¹⁴ It would more than double China’s entire existing stock of H20 chips.¹⁵ If these chips are delivered, they will dramatically increase Chinese firms’ ability to develop frontier AI models and deploy them at scale. 

NVIDIA’s H20 chips, mostly exempt from US export controls, are powerful GPUs optimized for AI inference.¹⁶ Our current controls were put in place at a time when AI inference was not a large part of frontier AI development. But recent breakthroughs have made AI inference — and therefore inference chips — critical to developing frontier models. These chips are used to generate synthetic data to train models, and to conduct newly important training techniques like reinforcement learning. After a frontier model has been trained, inference can now be used to increase model performance while performing tasks. The newest available models, including OpenAI’s o1 and DeepSeek’s R1, can use vast amounts of computational resources to increase the quality of their reasoning.¹⁷

Until recently, inference was not critical for frontier AI development. Now, it is, and its importance will likely continue to increase.¹⁸ But export controls have not yet caught up to this fact. While the H20 is not particularly fast when used to train AI models, it is 20% faster than the H100 (a banned chip) at inference.¹⁹ The H20 is also far more powerful at inference than any chips available for sale in China from non-US companies (see Appendix 1 for more detail). 

The Bureau of Industry and Security (BIS) can halt these shipments immediately, but even if it does not, it is likely that these orders are illegal under existing end-use controls.²⁰ These controls are described in 15 CFR § 744.23, paragraph (a)(1), which forbids the export of H20s destined for China if they will be used in a “supercomputer.”²¹ These H20 chips are very likely to be used in computing clusters that violate this restriction. There are two key pieces of evidence that support this conclusion (see Appendix 3 for details):

• The massive size of the order: The $16 billion order corresponds to about 1.3 million H20 chips. To stay under the supercomputer performance thresholds, the Chinese companies would have to build around 500 data centers, each with fewer than ~2,700 H20 chips.²²  Because AI data centers benefit massively from centralization and scale, this is unlikely to be the case.
• Evidence of a past breach of the supercomputer rule: At least one of the three buyers, Tencent Holdings, has likely already created supercomputers with H20 chips. According to its own reports, Tencent used H20 chips to train its AI model “Hunyuan-Large.”²³ While Tencent has not disclosed how long it took to train this model, we calculate that training it while staying under supercomputer thresholds would have taken at least 4 months.²⁴  For comparison, the DeepSeek V3 model was of a similar size, and it was trained in four months, on a cluster that also likely breached the supercomputer end-use rule.²⁵  This makes it very likely that Tencent already has a cluster of H20s large enough to qualify as a supercomputer.²⁶

It is theoretically possible that no Chinese company has used the roughly 1 million H20 chips already in the country to build a restricted supercomputer, and that none of the roughly 1.3 million H20 chips of the current order will be used to do so either. But our default expectation should be that Chinese firms are building restricted supercomputers. We discuss this further in Appendices 2 and 3. 

Crucially, NVIDIA is supply-constrained, not demand-constrained. Several firms are willing to buy each chip NVIDIA produces.²⁷ NVIDIA’s CEO Jensen Huang has stated that manufacturing capacity is the real constraint,²⁸ and Oracle’s Larry Ellison described a 2024 dinner with Huang and Elon Musk as “begging for GPUs.”²⁹ Halting these orders will reallocate NVIDIA’s (and TSMC’s) production capacity to other buyers: Every chip slot allocated to China’s $16 billion in H20 orders is capacity that could instead be used to manufacture H100s, B200s, or other cutting-edge chips for US buyers and allies. Demand is not dying down: The world’s largest cloud providers — Microsoft, Alphabet, Meta, and Amazon — plan to spend $320 billion on AI infrastructure in 2025, up from $230 billion in 2024.³⁰

Frontier AI models are quickly becoming capable in domains critical to national security.³¹ Allowing 1.3 million H20s to go to Chinese firms enables them to build dangerous AI capabilities faster, and directly reduces the amount of chips available to US firms. The US government must take action on these orders immediately, and close the gap on inference chips in export controls. More broadly, we must improve our strategic awareness to reduce future gaps in export control design, monitoring, and enforcement, in order to prevent China from developing advanced AI capabilities using American technology.

Recommendations

1. BIS should stop the H20 shipments

BIS should send an “is informed” letter to NVIDIA.³² An “is-informed” letter would immediately stop these planned H20 shipments to ByteDance, Alibaba, and Tencent by informing NVIDIA of their likely violation of supercomputer end-use restrictions described in 15 CFR § 744.23, paragraph (a)(1).³³ See Appendix 2 for further details.

Alternatively, BIS could send NVIDIA a “red flag” letter, directing them to investigate the red flags raised by this transaction.³⁴ Although such a letter would not itself halt the transaction, it would give NVIDIA (1) definitive “knowledge” that the red flags exist, thus giving it a duty to investigate the red flags; and (2) “knowledge,” as in “reason to believe,” that the supercomputer end-use restrictions will be violated, which is needed for the supercomputer end-use rule to apply.³⁵. 

2. NVIDIA should ensure its compliance with supercomputer end-use restrictions

The size of the H20 orders and evidence of a past breach raise “red flags” as described in The Bureau of Industry and Security’s (BIS) “Know Your Customer” Guidance and Red Flags.³⁶ The same BIS supplement adds that if there are “red flags,” exporters have “a duty” to inquire and not self-blind.³⁷

Orders for almost 500 supercomputers worth of chips for Chinese firms are a red flag that a supercomputer may be built. After the inquiry, the exporter can either: 

(A) determine that the red flags can be explained/justified, in which case they may proceed with the transaction; or 

(B) determine that they can’t be justified, in which case they must refrain from the transaction or “advise BIS and wait.” 

NVIDIA’s inquiry should include an investigation into whether the recipient companies have already violated the supercomputer end-use rule.³⁸ This past compliance information should be supplemented with active oversight mechanisms to monitor whether the supercomputer end-use rule is violated in the future.³⁹

3. BIS should issue a new rule strengthening export controls on inference chips

While an “is informed” letter can address the immediate threat, BIS needs new regulations to control inference chips in the longer term. To close this gap, BIS should issue an interim final rule to amend the Export Administration Regulations.

BIS already controls the export of high-bandwidth memory (HBM) components sold individually, but it does not control chips co-packaged with HBM.⁴⁰ New controls on such chips are a natural extension of current export controls. 

Reports suggest that new regulations covering H20 GPUs may already be ready to be implemented.⁴¹ While BIS will be best-placed to determine how inference chips should be controlled, we suggest two possible implementations:

1. Restrict the export of any AI chips designed or marketed for use in a data center that are co-packaged (or permanently affixed) with high-bandwidth memory that is otherwise export-controlled as a standalone component. 
2. Use memory bandwidth as an export-control parameter, adding it to our current parameters of total processing performance and performance density.⁴²

Implementation (A) would allow thresholds and definitions for export control to be reused, simplifying regulations. But it would be less flexible than (B), which would allow thresholds to be set and updated with ease. Ideally, BIS should create controls that can be regularly updated to keep pace with developments in AI technology. 

4. The White House should set up a team to monitor and respond to the rapidly changing threat environment 

To research scientists and engineers working in the AI industry, it was apparent almost a year ago that inference chips such as the H20 would be crucial for frontier AI development. The US government needs a technically competent team able to provide this kind of situational awareness to policymakers. 

Such a team could have helped avoid loopholes in US export controls, warned key US government officials about the growing importance of AI inference compute, and alerted policymakers to the rise of DeepSeek when it became clear to the technical community.

The US AI Safety Institute (AISI) within NIST is the natural home for this capacity. NIST has flexible hiring authorities and high pay scales compared to much of the government, allowing it to more easily hire the competitive technical talent needed. NIST also enjoys the trust of industry and specializes in measurement and evaluation, providing an ideal home for this kind of research. However, NIST’s mission is not focused on national security. The administration, acting through the Secretary of Commerce or National Security Council, should directly task AISI with a clear national security mission, consisting of:

• Making sense of the forthcoming capabilities of American and adversary models and chips based on technical information (such as unreleased model weights, research insights, and foreign chip specifications and manufacturing capabilities).
• Using this information to predict national security implications and producing regular reports on demand for national security decision-makers in the US government.
• Providing expert guidance and recommendations on policy decisions (such as defining the technical parameters used in export controls).

5. BIS should track chips after they have been exported

For more details, see Recommendation 10 in “An Action Plan for American Leadership in AI.⁴³”

Another reason the US has been slow to respond to challenges is that we currently have no effective oversight over where AI chips go after being exported, which has resulted in the development of virtually unchecked AI chip smuggling networks.⁴⁴ Thankfully, solutions have been developed that could be implemented immediately:⁴⁵ delay-based location verification⁴⁶ is an on-chip mechanism that would allow country-level geolocation to detect and deter AI chip smuggling.⁴⁷ This promising mechanism is both privacy-preserving and resistant to spoofing, and it would not need additional hardware to be incorporated into advanced AI chips.⁴⁸

Leading US chip firms have not taken the lead on implementing such mechanisms largely because of a lack of incentives to do so. These firms indirectly profit from chip smuggling,⁴⁹ but the US government has so far not given an unambiguous signal that those incentives will be changed, by exempting chips with geolocation capabilities from further expansions of export controls. There is one exception: BIS included chip location verification capabilities as a requirement to access the National Validated End User (NVEU) authorization, explicitly mentioning delay-based location verification as a possible implementation.⁵⁰ This kind of conditional access to export markets could be expanded to other areas of the US export control regime. Doing so would create clear incentives for chip firms to implement features that help reduce the risk of smuggling, while also helping chip firms retain their current market access.

BIS should create clear incentives for US chip firms to implement chip geolocation and other on-chip mechanisms that improve oversight and enforcement. One way to do this is through conditional export controls.

In the case of AI chips, this would involve creating a difference in the degree of restrictiveness of export controls, depending on whether chips have security-enhancing mechanisms like chip geolocation. For example: if a chip does not have geolocation capabilities, then it faces higher export restrictions for countries suspected of being smuggling hotspots.⁵¹ This would create strong incentives for chip firms to increase on-chip security to access less onerous restrictions, thus giving BIS the ability to use country-level chip location data to detect smuggling and focus its enforcement efforts.

If well-executed, conditional export controls could allow us to have our cake and eat it too: By incentivizing security-enhancing R&D from the private sector, this approach would help US industry maintain export access in allied or neutral countries while better achieving short- and long-term national security objectives. The result would be protections against technology misuse and smuggling that do not compromise American technological competitiveness.

Technical appendices

Appendix 1: Can Chinese companies acquire foreign AI chips that are competitive with H20s?

Not currently. Huawei’s newest chip in the Ascend series, the 910C, would be the most advanced chip sold by a Chinese company.⁵² It will reportedly have around ~60% of NVIDIA’s H100 performance at AI inference (itself slower than H20 chips). 

Even if their performance matched the H20s, Huawei faces serious production capacity issues. Some key components needed to produce Huawei Ascend 910C chips were sourced in violation of US export controls, by purchasing over two million AI chip dies manufactured by the Taiwan Semiconductor Manufacturing Corporation (TSMC) through shell companies. Huawei also stockpiled more than a year’s worth of production of high-bandwidth memory (HBM) components after the announcement of upcoming restrictions on their sale to China. Chinese companies are not currently able to manufacture these advanced components in-house at scale, and a recent foundry due diligence rule should ensure that Huawei can’t source TSMC chip dies through shell companies anymore.⁵³

This means that Huawei may only have enough stockpiles to produce a limited number of Ascend 910C chips (around one million), after which it may be forced to rely on outdated technology before it can catch up.⁵⁴ Even if stockpiles of components could last several years, production bottlenecks will most likely cause demand by Chinese AI firms to far outstrip Huawei’s supply.

Current BIS regulations provide that “Foreign availability exists when the Secretary determines that an item is comparable in quality to an item subject to US national security export controls, and is available-in-fact to a country, from a non-US source, in sufficient quantities to render the US export control of that item or the denial of a license ineffective” (15 CFR 768.2). The facts above make clear that the criteria of “sufficient quantities” will not be met by the Ascend 910C.

Appendix 2: A short-term solution to prevent H20 exports

The current $16 billion in orders of H20 inference chips by Chinese firms ByteDance, Alibaba Group, and Tencent Holdings are likely in breach of current export controls. BIS has the authority to prevent this, which this technical appendix explains. Longer-term, BIS should strengthen current export controls by controlling AI chips with permanently-affixed (or co-packaged) HBM that is otherwise export-controlled; or it should add total memory bandwidth as an export control parameter.

Authority: BIS can halt large orders of NVIDIA H20 chips through existing end-use controls for supercomputers described in 15 CFR § 744.23, paragraph (a)(1). 

This paragraph forbids the export of certain items destined for arms-embargoed countries (those in BIS Country Group D:5), including China, if they will be used in a “supercomputer.”

To use this authority to restrict the sale of H20 GPUs, three things must be true:

1. The H20 GPUs are included in the list of items in scope for this regulation.
2. The GPUs are destined to a Group D:5 country or Macau.
3. The GPUs will be used in a “supercomputer,” as defined in the Export Administration Regulations (EAR).

The rest of Appendix 2 shows that points (1) and (2) above are true, and Appendix 3 provides evidence that point (3) above is very likely to be true.

2.1 Evidence

1. H20 GPUs are subject to this regulation

§744.23(a)(1)(i) states that the following are items in scope for this regulation: 

1. An integrated circuit (IC) subject to the EAR and specified in ECCN 3A001, 3A991, 4A994, 5A002, 5A004, or 5A992; or 
2. A computer, “electronic assembly,” or “component” subject to the EAR and specified in ECCN 4A003, 4A004, 4A994, 5A002, 5A004, or 5A992.

H20 GPUs are included either in the Export Control Classification Number (ECCN) 3A991⁵⁵ or 4A994 mentioned above.⁵⁶ 4A994 includes computers containing integrated circuits if at least one of these meets or exceeds the limits of ECCN 3A991.p:

ECCN 3A991 includes, among other items:

p. Integrated circuits, n.e.s., having any of the following:

p.1. A processing performance of 8 TOPS or more; or

p.2. An aggregate bidirectional transfer rate over all inputs and outputs of 150 Gbyte/s or more to or from integrated circuits other than volatile memories.

The integrated circuits in H20 GPUs fulfill condition (p)(1), as their processing performance is “296 TFLOPS of INT8, 148 TFLOPS of FP16, 74 TFLOPS of TF32, 44 TFLOPS of FP32.” Although only one condition needs to be met for H20s to be included in ECCN 3A991, they also fulfill condition (p)(2), since they support 4th-generation NVLINK connections of up to 900 GB/s.

2. The H20 GPUs are destined to China, which is a D:5 country

§744.23(a)(1)(ii) states that the following destinations and end-uses are in scope:

1. The “development,” “production,” operation, installation (including on-site installation), maintenance (checking), repair, overhaul, or refurbishing of a “supercomputer” located in or destined to Macau or a destination specified in Country Group D:5 of supplement no. 1 to part 740 of the EAR; or
2. The incorporation into, or the “development” or “production” of any “component” or “equipment” that will be used in a “supercomputer” located in or destined to Macau or a destination specified in Country Group D:5.

The specific $16 billion orders in question were reportedly placed by ByteDance, Alibaba Group, and Tencent Holdings, all of which are headquartered in China (Beijing, Hangzhou, and Shenzhen, respectively). Of course, China is in Country Group D:5, a group of US arms-embargoed countries that corresponds to “Tier 3” in BIS’s Framework for AI Diffusion.

3. The GPUs will be used in a “supercomputer,” as defined in the Export Administration Regulations (EAR)

BIS’s definition of “supercomputer” includes both a performance and a volume limitation: a compute cluster within a 41,600 ft³ envelope with performance over 200 (single-precision) petaflop/s is a supercomputer.⁵⁷

Appendix 3 provides our detailed analysis on why it is very likely that the H20 chips in this order will be used in supercomputers.⁵⁸ In summary, the primary evidence is as follows:

• The massive size of the order: The Chinese companies would have to build over ~500 different clusters with less than ~2,700 H20s each to stay below the 200 PFLOP/s performance limit.
• Evidence that Tencent, one of the three buyers, may have already built a supercomputer with H20 chips. This is based on the 1 million H20 chips already in China, the fact that they indicate they trained their language model Hunyuan-Large on H20 chips, and that doing so while staying under the 200 PFLOP/s limit would have taken them at least 4 months.
• If the buyers follow standard practice in how they arrange their data centers, 200 PFLOP/s clusters made entirely of H20 chips will occupy an estimated volume of ~15,000 ft³ — well within the supercomputer threshold.

[See Appendix 3 for further analysis.]

2.2 Conclusion

The evidence strongly suggests that these latest orders by ByteDance, Alibaba Group, and Tencent Holdings, totaling over $16 billion in NVIDIA H20 GPUs, may violate existing end-use controls on supercomputers in US arms-embargoed countries (of which China is part).Although this evidence raises red flags on its own merits, justifying an inquiry by NVIDIA prior to fulfilling the order (as described in BIS’s “Know Your Customer” Guidance and Red Flags), BIS should preemptively halt the order by delivering NVIDIA an “is informed” letter, as described in the recommendations.

Appendix 3: Evidence that GPUs will be used in a “supercomputer”

“Supercomputer” is defined in 15 CFR 772.1 as follows:

A computing “system” having a collective maximum theoretical compute capacity of 100 or more double-precision (64-bit) petaflops or 200 or more single-precision (32-bit) petaflops within a 41,600 ft³ or smaller envelope.⁵⁹

Below, we provide analysis and calculations that make clear that it is very likely that the recently ordered H20s will be used in supercomputers, as defined by BIS regulations above.

3.1. The GPUs will be used in a cluster exceeding the 200 PFLOP/s threshold

As specified above, the H20 GPUs have a TF32 performance of 74 teraflop/s (TFLOP/s) and FP16 performance of 148 TFLOP/s. 

So to reach a supercomputer triggering the end-use rule of 200 or more single-precision (32-bit) petaflop/s (PFLOP/s), one would need ~2,700 H20s (calculation in footnote).⁶⁰

Reports say that ByteDance, Alibaba, and Tencent have placed “at least $16 billion in orders for Nvidia’s H20 server chips.” At an average price of roughly $12,000 per H20 chip, this amounts to ~1.33 million H20 chips.

There are two reasons to believe that these chips will be used to create a cluster that will exceed ~2,700 H20 chips (200 PFLOP/s), making them “supercomputers” according to the definition above, and thus a generally prohibited end use in China.

Reason 1: The massive size of the orders

1.33 million advanced GPUs is a massive amount. For comparison, the first stage of Project Stargate will see the construction of a data center that will eventually be able to house 400,000 NVIDIA chips. xAI’s Colossus data center in Memphis, Tennessee, recently doubled in size to 200,000 GPUs, keeping the title of “the world’s biggest supercomputer.”

To avoid creating at least one “supercomputer” (of over 200 PFLOP/s), the three Chinese companies would have to create at least 494 clusters of less than 2,700 H20s each (calculations in footnote).⁶¹ In the United States, companies rarely build many small compute clusters if they could simply build bigger ones. This is because bigger clusters with highly interconnected chips are more efficient (for example, by enabling large-scale AI model training with minimal efficiency loss). Unless these companies are specifically trying to comply with supercomputer end-use controls, we should expect them to build supercomputers by default.

The size of the order alone should raise “red flags.” According to 15 CFR Supplement No. 3 to Part 732—BIS’s “Know Your Customer” Guidance and Red Flags, two red flags are:

17. The customer is “known” to “develop” or “produce” items for companies located in Macau or a destination specified in Country Group D:5 that are involved with “supercomputers.”

18. The exporter has “knowledge” indicating this customer intends to “develop” or “produce” “supercomputers” or integrated circuits in the future that would otherwise be restricted under § 744.23(a)(1)(i) or (a)(2)(i). 

The same supplement adds that “Commerce has developed lists of such red flags that are not all-inclusive but are intended to illustrate the types of circumstances that should cause reasonable suspicion that a transaction will violate the EAR.” 

If there are “red flags,” Commerce states that industry has “a duty” to inquire and not self-blind.⁶² Clearly, orders totalling almost 500 supercomputers for Chinese firms should be a red flag that a supercomputer may be built in violation of the EAR. After the inquiry, the exporter can either (A) determine that the red flags can be explained/justified, in which case they may proceed with the transaction; or (B) determine that they can’t be justified, in which case they must refrain from the transaction or “advise BIS and wait.” 

Notably, continuing with the transaction despite not being able to explain or justify the “red flags” puts the exporter at risk of having “knowledge” that would make the transaction a violation of the EAR.⁶³ And “knowledge possessed by an employee of a company can be imputed to a firm so as to make it liable for a violation,” meaning that even employees’ (even if not senior officials) awareness of a high probability that these H20s may be used in supercomputers can make NVIDIA liable for potential EAR violations.⁶⁴

Reason 2: Past evidence of Chinese companies building supercomputers with H20 chips

Tencent, one of the three buyers in this $16 billion transaction, has most likely created supercomputers with H20 chips already, in violation of the EAR. The evidence is shown below.

If Tencent trained its Hunyuan-Large AI model with H20 GPUs, they would have needed to use less than ~2,700 GPUs to not trigger the supercomputer end-use restrictions. A GitHub repository by Tencent (this is a copy of the original, which has since been deleted) mentions the use of H20s for training Hunyuan-Large, which was confirmed by an independent analysis of Hunyuan-Large training procedures.

Tencent’s Hunyuan-Large model has reportedly been trained on 3.5E24 FLOP. To train such a model on less than ~2,700 H20 GPUs, Tencent would have had to spend between 4 to 9 months (depending on how efficiently they are able to utilize the H20s) training Hunyuan-Large, though the real minimum is probably much closer to 9 months than 4.⁶⁵ For comparison, the DeepSeek V3 model was about the same size, and it was trained in less than 2 months.⁶⁶ This makes it very likely that Tencent already has a cluster of more than 2,700 H20s, which would be consistent with the vast number of H20s that Chinese companies have already bought to date (NVIDIA has produced at least one million China-specific H20 GPUs in the last year).

3.2. The cluster in which the GPUs are housed will likely stay below the 41,600 ft³ volume threshold for every 200 PFLOP/s, classifying as a “supercomputer”

To count as a supercomputer, the >200 PFLOP/s cluster needs to be in a 41,600 ft³ envelope or less (including empty floor space between racks). The calculations below estimate that a 200 PFLOP/s cluster made entirely of Nvidia H20 chips can comfortably fit within a 41,600 ft³ envelope. This is not meant to be an exact calculation.

• As established above: ~2,703 H100s are ~200 PFLOP/s.
• 2,703 H20s divided by 8 chips per DGX server: 337.875 DGX units (meaning 338 or more DGX servers within the allowable volume would violate the end-use rule)
• Each DGX server (assuming the same DGX server dimensions is used for the H20 as for the H100) measures 14x19x35.3 in., or 9,389.8 in³, or ~5.43 ft³.
• NVIDIA recommends 4 DGX servers per rack.⁶⁷ Therefore, total racks needed for 2,703 H20s is: 338 / 4 = 84.5 (85 rounded)
• Each recommended rack is 32 x 48 inches of floor space and 84 inches (48U) tall for proper cable management and airflow (although this could be lower). 
• 32x48x84 is 129,024 in³, or roughly 75 ft³ of volume per rack.
• 75 ft³ x 85 racks is 6,375 ft³ total volume occupied by the racks, not including floor space.
• Assuming seven-tile aisle pitch (see diagram below) to include floor space, dimensions are:
  • Width: 2×4 ft (cold aisles) + 3 ft (hot aisle) + 2×4 ft (two rows of racks times 4ft depth) = 19 ft
  • Length: 85 racks / 2 rows * 2.67 ft width per rack ≈ 115 ft
  • Height: at least 7 ft (84 inches; 48U) for racks, incl. Airflow.
  • Total volume: 19x115x7 ft = 15,295 ft³ (including floor space).

The server rack layout in the calculation above assumes two rows of 43 racks, each with a 3 ft hot aisle between them and 4 ft cold aisles on their back-side. A different configuration could have four rows of ~22 racks each. This would increase the width and decrease the length of the data center, but the volume would remain constant.

The estimated 15,295 ft³ envelope is significantly less than the 41,600 ft³ threshold, making it likely that a >200 PFLOP/s cluster of H20 GPUs would qualify as a “supercomputer” (and thus be restricted in US arms-embargoed countries) by default.

This calculation should only be taken as a rough estimate. BIS’s definition of “supercomputer” does not specify important details like whether cooling systems should be included in volume calculations, how much floor space is reasonable to include, and more. This estimate shows that a compute cluster full of H20 GPUs exceeding performance limits can comfortably fit within the volume threshold, assuming standard recommended practices.