How banned AI chips end up in China

May 15, 2026

AI chips are being smuggled1 into China. How does this happen? That is, how are the smugglers able to do it?

You might, for example, expect that sales of these chips could be vetted, and shipments tracked, by US authorities. But the relevant US agency is badly understaffed: it cannot possibly vet every sale of AI chips, let alone follow up after every sale to ensure the chips have not been smuggled. So enforcement is largely left to the companies that sell and resell the chips. You might then suppose that these companies would vet their customers and monitor their distribution networks to ensure none of their chips are diverted, in order to comply with the law. But they are not strongly incentivized to do the due diligence needed to prevent most smuggling.

In this post, I’ll explain (1) why AI chip smuggling matters, (2) how AI chips and servers are sold and distributed, (3) what due diligence the exporting companies do, and (4) why those efforts often fail to prevent smuggling. In a nutshell, AI chips and servers are distributed through different channels, usually passing through multiple intermediaries across multiple countries. While most companies selling these products perform sufficient due diligence to comply with the law, others are outright negligent, and overall these efforts are not sufficient to prevent most smuggling.

How big a problem is AI chip smuggling?

Smuggling is a pretty big problem, though not serious enough to make the AI chip controls ineffective. In a new report, Epoch AI says that

between 290,000 and 1.6 million H100-equivalents (H100e) were smuggled to China through 2025. Our median estimate of 660,000 H100e would be roughly a third of China’s total compute.

US authorities recently indicted three people, including two insiders at Super Micro, a major American AI server builder, for moving $2.5 billion worth of AI servers to a shell company for diversion to China, the largest-ever export control violation in dollar terms, as far as I can tell. Over the past year, the US has announced six prosecutions for smuggling AI chips to China, totaling about $3 billion worth of NVIDIA products. And before that, there were many reports, rumors, and analyses pointing to large-scale smuggling of AI chips.

Surveillance photos of dummy servers being relabeled with a hair dryer the day before an inspection by a US agent, from the indictment of the $2.5 billion Super Micro insider case.

I don’t think smuggling is a large enough problem to make the AI chip export controls ineffective overall. The controls have likely played a large role in maintaining the US lead over China in AI and may even have widened the gap in frontier performance. For example, a recent benchmark evaluation by the Center for AI Standards and Innovation (CAISI) suggests that Chinese models trail US models by about eight months, with the lag growing by about three months per year.2 And you can make a strong case for prioritizing efforts to shore up semiconductor manufacturing controls over efforts to address AI chip smuggling. But smuggling is still a serious and urgent problem.

According to CAISI, the best Chinese model today is DeepSeek-V4. DeepSeek has reportedly used thousands of smuggled NVIDIA Blackwell chips. I think it’s likely that DeepSeek-V4 was trained on NVIDIA chips.3 If DeepSeek didn’t have access to smuggled NVIDIA chips, it would likely have had to either rely on renting cloud access from chips installed outside China (which is risky from DeepSeek’s perspective because the US government could revoke remote access to those chips) or use indigenously made AI chips like Huawei Ascends to train smaller, weaker models. DeepSeek reportedly tried to train V4 on Ascend chips but abandoned the attempt after a failed training run, reverting to NVIDIA for training while supporting Ascend for inference.4 So even though smuggled chips account for only about 3% of the global compute stockpile, they represent about a third of China’s compute, which is why smuggling still matters.

AI chips are distributed through many intermediaries

The basic smuggling playbook works like this. A smuggler buys AI chips through a shell or front company (often in a third country5 but sometimes in the US), relabels them as some other product, and ships them to China through ordinary shipping services. (For example, in several cases, smugglers appear to have bought AI servers through front companies set up to look like Singaporean, Malaysian, Thai, and Indonesian neoclouds.6) Once a smuggler has the chips, getting them into China seems quite easy, so I’ll focus here on how smugglers get hold of them in the first place.

AI chips routinely pass through multiple actors and countries before they are installed and used in data centers. We can refer to all actors who sell AI chips as “AI chip sellers”. They are:

AI chip designers, such as NVIDIA and AMD. These companies design AI chips, but they do not manufacture anything. NVIDIA holds an estimated 80-95% of the AI chip market share.7

AI server builders (also known as original equipment manufacturers, or OEMs), such as Super Micro and Dell. These companies buy AI chips from AI chip designers and design and manufacture AI servers, each typically containing four to eight AI chips. The servers are shipped to data centers and installed in cabinets. Notable AI server builders include Super Micro (US, about 10% of NVIDIA’s revenue), Dell (US, ~3%), Wiwynn (Taiwan, ~3%), Lenovo (China/US, ~1%), Gigabyte (Taiwan, ~1%), Hewlett Packard Enterprise (US, <1%), and Inspur (China, <1%). (Why do these companies not make up more of NVIDIA’s revenue? That’s because AI chip designers like NVIDIA often sell chips directly to hyperscalers and neoclouds. In such cases, though the servers are assembled by original design manufacturers (ODMs), the transaction occurs directly between NVIDIA and the end customer. Hyperscalers and neoclouds make up about half of NVIDIA’s revenue.)

Distributors, such as TD Synnex and Ingram Micro. These large, multinational companies are intermediaries that handle logistics and warehousing of AI chips and AI servers. The key distributors are TD Synnex (<1% of NVIDIA’s revenue), Ingram Micro (<1%), and Arrow Electronics (<1%), all headquartered in the US but with extensive operations worldwide.8

Resellers. These companies, which are numerous and often small and local, buy AI chips and servers from distributors and sell them to end customers in the country or countries where they operate.

Before being sold, AI chips are made. For example, most of NVIDIA’s AI chips are designed by NVIDIA in the US, fabricated by TSMC in Taiwan, packaged with high-bandwidth memory by TSMC in Taiwan, tested by KYEC in Taiwan, and then either (a) assembled into SXM modules by Foxconn in Taiwan and mounted onto HGX baseboards by Foxconn and Wistron in Taiwan, or (b) assembled into PCIe cards (i.e., accelerators) by Foxconn, and possibly others, again in Taiwan.

From there, the chips9 can get to their end customers in a few different ways:

AI accelerators can be sold to minor end customers through distributors and resellers. In the simplest case, a company like NVIDIA sells AI accelerators to distributors, who in turn sell them to resellers, who then sell them to end customers. The end customer can then use the accelerators however they wish, for example, by installing them themselves in workstations or servers customized to their preferences. However, this pathway is quite rare, as most customers want AI servers ready for installation in data centers.

AI servers can be sold to minor end customers via distributors and resellers. For example, NVIDIA may sell AI chips (usually in the form of SXM modules mounted on baseboards) to Super Micro, which builds AI servers using them and sells these servers to a distributor. The distributor then sells to a reseller, which sells to an end customer.

AI servers can be sold to major end customers directly by AI server makers. Hyperscalers and neoclouds often purchase very large quantities of AI servers directly from server makers, bypassing distributors and resellers. For large orders of NVIDIA servers, this often involves a three-party negotiation among the customer, the server maker, and NVIDIA.

AI servers can be sold to major end customers directly by AI chip designers. In the case of NVIDIA, hyperscalers and neoclouds can buy AI servers directly from NVIDIA instead of from server makers. (The NVIDIA-designed servers are called DGX, while the OEM-designed servers are called HGX.) As mentioned above, these servers are built by ODMs for NVIDIA.

Most AI chips are likely sold to major end customers like hyperscalers, either directly from NVIDIA or directly from AI server makers. However, most smuggling likely involves smaller order volumes, with bad actors buying AI chips and AI servers either from AI server makers or from smaller resellers. So bad actors don’t purchase AI chips directly from AI chip designers like NVIDIA. Of the six cases that have been prosecuted by the US:

Four involved smugglers buying AI servers and HGX baseboards from AI server makers (Super Micro and Lenovo)

One involved smugglers buying AI chips and AI servers (the latter made by Hewlett Packard Enterprise) from an Alabama reseller

One involved intermediaries storing goods from multiple suppliers, including SXM modules from a Massachusetts reseller and HGX baseboards from Lenovo (the same Lenovo purchases mentioned above)

These are all cases in which the smugglers were at least partly based in the US and procured AI chips from US sellers. Most smuggling likely involves actors based abroad who buy from local sellers or import from US sellers, but these cases are harder for US authorities to detect and prosecute.10

How AI chip sellers (try to) vet their customers

AI chips are export-controlled, meaning they cannot be sold to just any customer. For example, it is illegal11 to sell them to companies headquartered in China or listed on BIS-maintained lists, such as the Entity List or the Military End-User List. So when selling AI chips, companies need to conduct due diligence to ensure they are not selling to any such customer.

Most AI chips are likely sold by AI server makers, and a lot of smuggling seems to involve smugglers buying from server makers, so the remainder of this section focuses on them.12 From the point of view of AI server makers, the sales process lasts months and roughly follows these steps:

Talk with the customer about their requirements

Run software tools that gather data about the customer’s environment (i.e., data center)

Negotiate prices (changing server components and/or order volumes if necessary)

Prepare a contract (stipulating who the end customer is, where the servers are to be shipped, and who will install the servers)

Do due diligence

Build, box, and ship the products

Server makers track items at the serial number level using enterprise resource planning (ERP) software (e.g., SAP or Oracle). AI chip designers and distributors likely do too, though I’m not sure to what extent resellers do so (since they are smaller, less resourced, and less well-organized). When an order is placed, the salesperson enters it into the ERP system, and it is then routed to the appropriate factory or factories responsible for assembling, testing, boxing, and (once the order is paid) shipping the hardware to the customer. Server makers also have some visibility into their partner distributors’ inventory, since distributors typically hold a lot of the parts used by server makers. These parts (e.g., AI chips) can then be sent to the server maker for assembly when a customer makes an order via a reseller.13

From a smuggling perspective, we’re mostly interested in the due diligence step of the sales process. First, some definitions:

Compliance is overall adherence to regulations

Due diligenc

[truncated for AI cost control]