Commerce expected to finalize AI cloud KYC rule this week, tightening checks at AWS, Microsoft, Google
Enzo Reno ·
The US Department of Commerce is preparing to issue the final rule that will force American infrastructure cloud providers to verify foreign customers and report certain large scale AI training activity, according to people familiar with the process. The measure, rooted in Executive Order 14110 and a January 2024 Commerce proposal, could be published in Washington as soon as this week, affecting Amazon Web Services, Microsoft Azure, Google Cloud, Oracle Cloud, and IBM Cloud.
The timing matters because legal and security teams will need to adjust account onboarding, procurement, and cross border R and D workflows quickly once the rule drops. Commerce indicated in 2024 that implementation windows would be tight, and civil penalties would apply for noncompliance.
What the rule will cover
Commerce’s 2024 notice proposed a know your customer regime for US infrastructure as a service, including identity verification for foreign persons, record keeping, and suspicious activity reporting when customers spin up compute for advanced model training. It also floated reporting obligations for training runs above defined compute thresholds, linking the requirement to national security risks, according to the Department of Commerce.
Cloud market leaders will carry the brunt of the work. Synergy Research Group estimates AWS held about 31 percent of global IaaS and PaaS spend in the first quarter of 2026, Microsoft had about 25 percent, and Google about 12 percent. All three urged Commerce in 2024 comments to narrow scope and protect customer privacy while supporting targeted safeguards.
Enterprises with globally distributed AI teams should expect stricter identity checks for foreign subsidiaries and contractors, added friction for credit card based self service accounts, and potential notifications to Commerce when training large models on US clouds. General counsels will likely revisit data residency and vendor terms, especially where model weights and research collaborators span geographies.
Why it is arriving now
The rule is the policy follow through to constraints on advanced chips and remote access announced since 2023. Commerce Secretary Gina Raimondo has repeatedly argued that controls on compute and cloud access are essential complements to export rules on GPUs, and lawmakers on the Senate Intelligence Committee have pressed for faster action to curb malign foreign use of US infrastructure.
EU and UK counterparts are moving in parallel. The European Commission’s AI Office is standing up codes of practice for general purpose AI and will add binding obligations for models designated as systemic risk, while the UK is piloting safety evaluations through its AI Safety Institute. Multinationals will face overlapping regimes that demand more transparency about training runs and incident reporting.
For the broader technology sector, a finalized US cloud KYC and reporting rule would accelerate compliance spending, favor larger providers that can absorb verification overhead, and push some sensitive AI training to sovereign or non US clouds, while raising the bar for how model development activity is monitored at scale.