H.R. 9546: Cloud Security Act

The bill would create an exception to certain federal privacy rules so that cloud service providers can share limited information with the U.S. Department of Commerce, or a Commerce-designated government representative, when the information is needed to carry out export-control laws and regulations.

What the bill changes

• It amends federal law governing when providers of electronic communications and stored customer records may disclose information.
• It adds a new allowed disclosure to the Department of Commerce for reports, notifications, referrals, verifications, or similar information related to export-control compliance.
• The provider must in good faith believe the communication or record involves use of a covered cloud product by a specified foreign entity, or by someone acting for or on behalf of such an entity.
• Any disclosure must be limited to what is reasonably necessary for the compliance purpose.

New terms the bill defines

• AI model: an artificial intelligence model trained on broad data, generally using self-supervision, with at least 1 billion parameters, and usable in many different contexts.
• Covered cloud product: certain cloud computing services used to develop or deploy advanced AI models using covered chips, including services that function like infrastructure-as-a-service even if marketed differently.
• Covered integrated circuit: certain advanced chips and related products, including products classified under specified export-control categories or functionally similar products, as well as chips meeting certain performance or bandwidth thresholds.
• The bill states that these terms can be further modified by the Secretary of Commerce after 24 months.
• Specified foreign entity: it uses a definition from the Internal Revenue Code.

Practical effect

In plain terms, the bill would make it easier for cloud providers to report certain foreign-related activity to the Commerce Department when they believe it may involve advanced AI systems, sensitive chips, or export-control concerns. It is aimed at helping enforce restrictions involving foreign entities and advanced computing technology.

Relevant Companies

• AMZN — Amazon Web Services could be affected if customers using its cloud services are subject to new export-control reporting or compliance expectations.
• MSFT — Microsoft Azure could face similar reporting or compliance obligations for advanced AI and cloud computing customers.
• GOOGL — Google Cloud could be affected by new disclosures related to cloud use tied to advanced AI models and covered chips.
• ORCL — Oracle, as a cloud provider, could be subject to similar compliance and reporting requirements.
• CRM — Salesforce could be affected to the extent its cloud offerings are treated as covered cloud products under the bill's definitions.
• AMD — Advanced AI and data center chip products could be relevant to the bill's covered integrated circuit definitions.
• NVDA — Nvidia's data center AI chips are likely to be directly relevant to the categories of chips described in the bill.
• INTC — Intel could be affected if any of its chips or related products fall within the bill's covered integrated circuit definitions.