A blacklisted university, bought through a middleman
Reuters reported, for the first time by its account, that Northwestern Polytechnical University in Xi'an bought Nvidia H200 chips and rented H200-powered server access despite sitting on the US Entity List since 2001, with restrictions tightened again in 2019. On October 21, the university's management school bought two H200 chips for 874,700 yuan, about 123,000 dollars, according to a procurement record published on its own website. The chips did not come from Nvidia. They came from Shaanxi Bosuan Network Technology, a domestic reseller operating entirely inside China's own commercial channels.
That routing through a third-party seller is the mechanism, not a side detail. Export restrictions on the H200 are built around Nvidia's own sales channel and licensing process, which assumes Nvidia or an authorized distributor is the last link before an end user. A domestic reseller sitting between Nvidia and an Entity List university is exactly the kind of gap those restrictions were supposed to close, and Reuters' reporting suggests it is functioning as a working gap rather than a rare edge case uncovered by accident.
The rentals matter as much as the purchase
Separately, the university's cybersecurity school signed two seven-month rental contracts in January for servers carrying eight H200 chips each, worth 441,700 yuan and 441,000 yuan respectively. Reuters reports these were used for AI model fine-tuning and reinforcement learning training, which is meaningfully more sensitive than general compute access and suggests active model development rather than coursework. The university also rented A100 and A800 chip servers, and its procurement records show five rental contracts in total this year alone, spread across two schools within the same institution.
Rented compute is harder to track than a chip shipment, and that is precisely why it deserves more scrutiny, not less. A purchase leaves a hardware paper trail at a border or a distributor that customs and export officials can, in principle, inspect. A rental contract for remote server access can route through layers of resellers and cloud intermediaries that make it far less visible to export control enforcement, even when the end use, training restricted AI capability on restricted hardware, is functionally identical to an outright chip purchase.
This is not an isolated case
Reuters' review of 26 Chinese procurement and corporate records from this year found the same pattern elsewhere. Shenzhen University bought three H100 chips for 769,800 yuan in September. Wuhan University of Technology bought H100 and A100 chips in June and in a separate purchase later in the year. Beihang University, also on the Entity List, bought four A800 chips for 489,000 yuan in April. None of this required a single large, headline-grabbing transaction. It required a steady drip of smaller purchases spread across months and domestic channels.
That pattern is the real story for anyone assessing chip export policy's effectiveness. A handful of large flagged transactions is relatively easy to police with existing customs and licensing tools. Dozens of smaller purchases spread across universities, resellers, and rental contracts is not, and Reuters' sample of 26 records, pulled from public procurement pages, is almost certainly a fraction of what is actually happening across China's broader research and defense-linked sector.
The policy backdrop that let this happen
Since January, the Trump administration has allowed some H200 exports to China on a case-by-case basis, a policy shift meant to balance commercial interests against national security concerns. That policy does not lift Entity List restrictions, and licenses for controlled US technology are still supposed to be denied to listed institutions regardless of the broader case-by-case opening. Licensing rules also require safeguards against blacklisted entities and military end-users accessing exported chips remotely, which is exactly what the rental contracts, routed through resellers rather than direct sales, appear to route around in practice.
Nvidia did not respond to Reuters' requests for comment, and neither did the Commerce Department's Bureau of Industry and Security or any of the named universities. That silence leaves the gap between policy intent and documented behavior effectively unaddressed on the public record, which is its own kind of answer for enterprises trying to gauge how seriously current enforcement should be taken, and how much weight to put on a vendor's or partner's assurance that it screens for Entity List exposure.
Why this belongs on a CTO's radar, not just a policy brief
If your organization has any AI supply chain exposure to China, through outsourced development, joint ventures, or cloud capacity resold by regional partners, this reporting is a reminder that Entity List status is a weaker guarantee than it sounds. A vendor or partner's compliance claims about not dealing with restricted institutions are only as good as their visibility into where compute actually gets consumed, and Reuters just demonstrated that visibility is thin even for Nvidia and the Commerce Department themselves. Due diligence questionnaires that simply ask whether a partner deals with Entity List institutions are no longer a sufficient control on their own.
This also lands alongside unrelated governance pressure on Nvidia, with three Republican committee chairmen requesting a November 18 briefing with CEO Jensen Huang over reported contacts with an alleged Chinese intelligence operative. Taken together, the chip supply chain that underpins every enterprise AI roadmap is under more scrutiny than it has been in years, from Congress, from journalists, and eventually from auditors, and procurement teams should expect more documentation requirements from hardware vendors, not fewer, over the next two quarters. Building that expectation into vendor contracts now is cheaper than retrofitting it after the next investigation names a supplier you actually use.
