Executive Summary

Key figures

Four numbers. The first two say what this university bought and what it rented this year. The second two say that this is not one school's story, and where the rules currently stand.

Sources: Taipei Times (Reuters syndication) · unite.ai · US Congress, H.R.2683 actions

The item in the October 21 notice is two H200 cards. The price is 874,700 yuan, about $123,000 in US currency. The buyer is Northwestern Polytechnical University's School of Management and the seller is Shaanxi Bosuan Network Technology. Reuters said it could not find contact details for the supplier. A second notice dated September 4, filed under the same university's School of Cybersecurity, lists two more H200 cards at 796,000 yuan. Put the two notices together and the count is four, though Reuters and most of the outlets that picked the story up counted only the October notice and reported two.

The rental record runs longer. This university signed five contracts for compute this year. The two its School of Cybersecurity signed in January each cover seven months of a server holding eight H200 cards in one box, one listing reinforcement learning as its purpose and the other fine-tuning across several tasks at once. The rest are twelve-month contracts on an A800 server and an A100 server, plus an April contract through which another institute at the same university secured at least twenty-four A100 cards for structural and fluid-dynamics simulation.

▲ The five compute rental contracts Northwestern Polytechnical University signed this year. The two with dated terms carry their start and end dates in the notice itself. Sources: procurement notices compiled by unite.ai · Taipei Times (Reuters syndication)

Change the unit you count in and the size changes with it. Counted in cards, the purchase is two. Counted in contracts, this year alone holds five, and two of those are eight-card H200 configurations. The money runs the same direction. The five add up to 1,969,300 yuan, more than twice what the two cards cost in October.

Put the prices side by side and the pull toward renting becomes visible. Divide the October notice by card and each one runs about 437,000 yuan. Seven months on an eight-card H200 server cost 441,000 yuan in the January contract, so running eight cards for more than half a year costs roughly what owning a single card costs. Reuters reported separately on November 5 that the mainland asking price for that same eight-card H200 server passed 6 million yuan, about $900,000, by late October, around three times its level a year earlier. Some 600,000 H200s are sitting in Hong Kong without entering China, and Beijing has not yet approved imports at scale.

Northwestern Polytechnical University sits in Xi'an and belongs to the Seven Sons of National Defense, the seven Chinese universities the state entrusts with defense research. The US Commerce Department added it to the Entity List in 2001, and in 2019 tightened the restriction to a policy of denial in most circumstances. Being on that list means trade is blocked by who stands on the other side of it, whatever the item happens to be.

US policy loosened once this January. The Trump administration began allowing exports of the H200 and other chips to China under case-by-case review, and the rule carried a condition that listed entities and military end users be walled off from remote access to the exported chips. That easing did not lift the separate restriction resting on an institution like Northwestern Polytechnical. The lock on China as a destination opened a notch; the lock on this school as a counterparty did not move.

Several thresholds remain even on the loosened side. The Commerce Department asked applicants to show that capacity for US customers would not shrink, that the Chinese buyer had export-compliance procedures including customer verification, and that the product had passed performance and security testing by an independent laboratory in the United States. The volume of a given model shipped to China cannot exceed half of what the same model sells inside the United States, and chips made in Taiwan must first enter the United States, clear duty and review, before going out again. That is how narrow the licensed route runs.

For the A100 and A800 listed in the table above, the destination lock never opened at all. Those two chips are barred from export to every Chinese entity, listed or not. The most advanced chip in this university's procurement record is the H200, and yet the ones shut behind two locks are the older cards it rented inside a server.

Nobody answered Reuters. Not the university, not Nvidia, and not the Commerce Department's Bureau of Industry and Security, which enforces the rules. What is confirmed ends at what the notices say, and what research the chips actually went into is not in the record.

US export control is built to catch the event of goods leaving the United States. Who sent what and where it went goes into licenses and declarations, and the enforcing side reads those records. The trade written into this notice contains no such event. The university paid a Chinese company, and the chips were already inside China. Not one new line appears in any American ledger.

Renting sits one step further out. The reading that using compute remotely does not count as goods crossing has held for a long time, and on January 12 the US House passed a bill 369 to 22 that would make remote access something export controls can reach. The bill went to the Senate the next day and was referred to the Committee on Banking, Housing, and Urban Affairs, where it has yet to become law. This blog took up the same gap once before, in Tencent's lease of chips in Oracle's Southeast Asian data centers.

Even so, this case would not be caught the moment that bill passed. What mattered in the Tencent case was the stretch where a Chinese company reaches remotely into chips that left the United States lawfully. Here the party connecting and the party handing over the server are both in China. Writing remote access into the control list still leaves nobody anywhere in the chain who would file a paper with a US agency. What is prohibited is the counterparty, and the company that gave that counterparty a server has no point of contact inside the United States.

It is not that the rules failed to anticipate a trade of this shape. The license requirement written into Northwestern Polytechnical's Entity List entry covers all items subject to the Export Administration Regulations, and that requirement attaches not only when an item leaves the United States but also when it changes hands inside China. Even the January rule that opened case-by-case review left applications for reexport and in-country transfer under a presumption of denial, and it attached a further condition to compute-service providers using licensed chips, requiring that listed entities be kept away from the models trained on those chips. So the place where things come apart is not the reach of the rules. What decides whether they apply is where a chip was made and by what route it arrived, and that is exactly the box the notice leaves empty.

Trace how this came to light and the control regime never once appears. Not customs data, not a license application. It was a winning-bid notice the university posted on its own website under China's public procurement disclosure rules. The notice carried the model name and capacity, the amount, and the supplier's name. Chinese procurement law requires the purchasing agency to verify that a supplier can fulfill an order before announcing a winning bidder and signing a contract. A bid offering prohibited chips made it as far as a published notice, which means it went through that verification. A record built to show where the money went rather than to watch anyone turned out to be the most detailed material there is.

That record is no longer where it was. The October 21 notice Reuters cited came down from the university's website after the story ran. A record left by a disclosure regime also disappears when the party that posted it takes it back.

Read more of the same records and this stops being one school. Reuters reviewed 26 Chinese procurement and corporate records from this year and found universities and research institutes buying Nvidia chips the United States has restricted through domestic suppliers, or renting compute services running on them. Several of those institutions work close to China's defense industry or military research. Shenzhen University bought three H100 cards for 769,800 yuan in September, and Wuhan University of Technology bought a server holding one H100 for 355,000 yuan in June, along with a separate purchase of four A100 cards for 344,000 yuan. Beihang University bought four A800 cards for 489,000 yuan in April, and it too belongs to the Seven Sons of National Defense. Reuters noted that the records held little information on where the chips came from or where the rented servers physically ran. Who used them stayed on the record; where they came from did not.

Some notices are priced in time rather than in cards. Two government procurement notices, one in July and one in September, named suppliers of compute service to the University of Chinese Academy of Sciences running on H800 and A800, both of them barred from export to China. One of the two set the H800 rate at 10 yuan per chip per hour. A separate award in January supplied six A100 cards to a public institution in Shenzhen for 484,800 yuan. The price of one card for one hour is sitting in a public record.

Reuters is not entirely in the dark about how the chips arrived. It has reported before that Chinese institutions received restricted Nvidia chips from domestic resellers with the chips already installed in servers built by Supermicro, Dell and Gigabyte, and it has separately documented a gray market running through overseas inventory and third-country brokers. That route, though, was established by other reporting rather than by these notices. On the notices themselves the box is empty.

A ledger that counts ownership and a ledger that counts use pile up in different places. Licenses and declarations record the moment an item changes owner and crosses a border. Rental contracts and access logs record who used which machine, from when until when. They sit with different institutions and are kept for different lengths of time, and however closely you read one, the other stays invisible. What this case shows is less that the controls were breached than that this trade was never going to be written into the ledger the controls were built to read.

This reaches past export control. What an organization decides to record decides what it will later be able to see. Compute has moved over the past few years from something bought and stacked up into something rented by the hour as it is needed, and the way it gets written down still looks like an asset register. Plenty of organizations hold a list of machines while the record of who ran which job on which machine, and for how long, is scattered.

So an organization that rents compute has three things to write down before signing.

• • Which ledger records the compute we use. Whether it survives only in a purchase requisition, or whether the job, the machine and the hours all stay on the record. Without the second kind there is no way to reconstruct usage afterward.
• • Who stands above the party renting to us. Compute rental is commonly sublet. Whether the counterparty named in the contract owns the machines, or has itself rented them from somewhere else, is hard to establish later unless it is asked at signing.
• • What remains once the contract ends. When access closes, how the training data and checkpoints left on the server are erased, and what evidence confirms the erasure, all belong in the contract text.

From where AI-Ready Data is handled, this reads as a problem of record design. Asking where data came from already has a name, provenance. Where the compute that ran that data came from is not yet written down to the same standard. What one university's notice exposed is that the empty box is bigger than it looks.

References

Reporting

• 1.Reuters / Taipei Times. (2026). "Military-linked Chinese university bought Nvidia H200 chips despite US blacklist, records show." 2026-11-12. A syndication of the Reuters exclusive; the figures and quotations in this article follow this version.
• 2.unite.ai. (2026). "Procurement Notices Detail Four Nvidia H200 Cards at Blacklisted NWPU." Line-item figures for the September 4 and October 21 notices and the five rental contracts.
• 3.cybernews. (2026). "Nvidia H200 AI chips reached blacklisted Chinese university."
• 4.Quartz. (2026). "Military-linked university bought Nvidia H200 chips despite blacklist."
• 5.Reuters. (2026). "Exclusive: Nvidia chips pile up in Hong Kong as China withholds import approval." 2026-11-05. Roughly 600,000 cards waiting in Hong Kong, and an eight-card H200 server asking above 6 million yuan in late October.

Official record

• 6.U.S. Department of Commerce, BIS. "Department of Commerce Revises License Review Policy for Semiconductors Exported to China." 2026-01-13. The three conditions placed on license applications.
• 7.U.S. Department of Commerce, BIS. "Revisions to the Entity List." 81 FR, 2016-09-20. The license requirement on Northwestern Polytechnical University reads "For all items subject to the EAR"; the original listing is 66 FR 24266 (2001-05-14).
• 8.ArentFox Schiff. "BIS Relaxes Export License Review for H200 Chips to China and Macau." That reexport and in-country transfer applications remain under a presumption of denial, and the condition placed on compute-service providers.
• 9.U.S. Congress. "H.R.2683 — Remote Access Security Act." 119th Congress. The House vote and the Senate referral date were confirmed against the actions record.
• 10.U.S. Congress. "S.3519 — Remote Access Security Act." The Senate companion bill.

The original October 21 winning-bid notice had been removed from the university's website and could not be checked directly. The contents of the notice extend only as far as they are quoted in the reporting above.