Remote Access Security Act
- Sponsor
- Sen. McCormick, David [R-PA]
- Committees
- Banking, Housing, and Urban Affairs Committee (primary)
- Last action
- Dec 17, 2025
Bottom line
This bill expands U.S. export control authority to cover remote access to sensitive technology via cloud services by adversarial foreign entities, aiming to close a perceived loophole in national security safeguards.
What it actually does
This bill amends the Export Control Reform Act of 2018 (ECRA) to expand U.S. export controls to include "remote access" to certain sensitive items by "foreign persons of concern." It defines remote access as access via cloud infrastructure services to Commerce Control List items, particularly when used for developing weapons of mass destruction, offensive cyber operations, or human rights-undermining surveillance. The bill grants the President authority to regulate such remote access and updates various ECRA provisions to integrate this new control.
Proponents argue
Proponents argue this bill is crucial for national security, preventing foreign adversaries from circumventing existing export controls by remotely accessing sensitive U.S. technology, particularly advanced computing and artificial intelligence capabilities, through cloud services. They emphasize the need to adapt controls to modern technological landscapes where physical export is not the only vector for technology transfer, thereby safeguarding critical innovations.
Opponents contend
Opponents might argue that these expanded controls could stifle innovation, create significant compliance burdens for U.S. cloud service providers and technology companies, and potentially lead to a loss of competitiveness if foreign customers opt for non-U.S. cloud services to avoid regulatory complexities. They may also raise concerns about the broad definition of "foreign person of concern" and the potential for overreach in monitoring remote access.
The bill is concise and can be read quickly, but understanding its full implications requires familiarity with the existing Export Control Reform Act and its regulatory framework.
Section 2(a), amending Section 1742 of ECRA
Establishes "Remote Access" Definition
This provision defines "remote access" as a foreign person of concern accessing a U.S.-jurisdiction item on the Commerce Control List via a cloud infrastructure service from outside the U.S. and the item's physical location. It specifically targets uses that pose serious national security risks, such as training AI models for WMD development or offensive cyber operations, or conducting human rights-undermining surveillance. This aims to prevent circumvention of traditional export controls.
Supporters argue
Supporters argue this definition is critical to modernize export controls, addressing the evolving threat landscape where adversaries can access sensitive technology without physical export. It targets specific high-risk uses, ensuring controls are focused and effective.
Critics contend
Critics might contend that the definition is broad and could inadvertently capture legitimate commercial activities, leading to over-regulation. They may also argue that determining "intent" for AI model training or "primary design" for surveillance tools is difficult to enforce, creating ambiguity for businesses.
Tradeoffs
The provision balances national security imperatives against potential impacts on U.S. technological competitiveness and the administrative burden on cloud service providers. It seeks to close a loophole without stifling innovation or legitimate international collaboration.
Section 2(a), amending Section 1742 of ECRA
Defines "Foreign Person of Concern"
This provision defines "foreign person of concern" to include governments of countries specified in 10 U.S.C. 4872(f)(2) (which includes China, Russia, Iran, and North Korea), regions within those countries (like Macau and Hong Kong), entities located or headquartered in such countries/regions, or persons subject to the jurisdiction of such governments. This clarifies the target entities for the new controls.
Section 2(c), amending Section 1753 of ECRA
Expands Presidential Authority to Regulate Remote Access
This section explicitly grants the President the authority to control the "provision of remote access to items subject to the jurisdiction of the United States to foreign persons of concern." It amends existing language to ensure that the President's power to regulate exports, reexports, and in-country transfers now also encompasses remote access, providing the necessary legal basis for the new controls.
Sections 2(b), 2(d), 2(e), 2(f), 2(g), 2(h), 2(i), 2(j), 2(k)
Integrates Remote Access into Existing Export Control Framework
This series of amendments systematically updates various sections of the Export Control Reform Act of 2018 (ECRA) to incorporate "remote access" alongside "export," "reexport," and "in-country transfer." This includes the statement of policy, additional authorities, administration of controls, licensing, compliance assistance, penalties, enforcement, annual reports, and effect on other acts, ensuring remote access is treated consistently within the existing legal framework.
Section 2(l)
10-Year Sunset Clause for Remote Access Controls
This provision stipulates that the authority to impose controls on remote access to items under the amended Export Control Reform Act of 2018 will terminate 10 years after the date of enactment of this Act. This ensures a periodic review of the policy.
Section 3
Mandates Congressional Consultations on Regulations
This section requires the Secretary of Commerce to keep Congress fully informed about any anticipated regulations to control remote access. This includes providing classified information as needed on the national security/foreign policy risk addressed, the method of addressing the risk, and the economic impact on U.S. industry competitiveness in cloud services. This enhances legislative oversight.
Section 4
Mandates Report and Recommendations on Implementation
This section requires the Secretary of Commerce to submit a public report within one year of enactment, assessing and making recommendations on the Act's implementation. Topics include maximizing privacy, minimizing compliance costs, improving license review speed, identifying national security concerns for business certainty, increasing international cooperation, ensuring consistency, and recommending further amendments. The Secretary must also seek public input, including a roundtable with industry.