A Purchase Hidden in Plain Sight
On October 21, a routine procurement notice appeared on a university website in the Chinese city of Xi’an. It listed two computer chips, a price of 874,700 yuan, and a little-known local supplier. Nothing about it looked remarkable.
But those two chips were Nvidia H200s — among the most powerful AI processors on the planet — and the buyer was Northwestern Polytechnical University, an institution the United States has blacklisted for more than two decades over alleged missile and military research.
According to Reuters, which reviewed the procurement records, the purchase went ahead anyway. The chips were bought not from Nvidia directly, but through a domestic intermediary, Shaanxi Bosuan Network Technology.
The revelation lands at an awkward moment for Nvidia. Its chief executive, Jensen Huang, is already facing mounting scrutiny in Washington over his lobbying for looser chip export rules — and over reports that he was targeted by an alleged Chinese spying operation.
The University on Washington’s Blacklist
Northwestern Polytechnical University is no ordinary buyer. Based in Xi’an, it conducts research linked to military aircraft, missiles and satellites, and it belongs to China’s “Seven Sons of National Defense” — a group of elite universities with deep defence ties.
The US Commerce Department added the university to its trade blacklist, known as the Entity List, in 2001 over its alleged involvement in missile-proliferation activities and military research. In 2019, Washington tightened the restrictions further, making licences for exports of controlled US technology to the university subject to a policy of denial in most circumstances.
That is what makes this purchase so striking. The H200 is subject to US export licence approvals, and those licences are normally denied for blacklisted institutions such as Northwestern Polytechnical. Yet the chips arrived anyway.
Reuters said it could not determine contact details for Shaanxi Bosuan Network Technology. Northwestern Polytechnical, Nvidia and the US Commerce Department’s Bureau of Industry and Security, which oversees export controls, did not respond to requests for comment.
How the Nvidia H200 Chips Slipped Through
The outright purchase was only part of the story. Procurement records show the university also rented access to powerful Nvidia hardware throughout the year, sidestepping the need to own the chips at all.
In January, its cybersecurity school awarded two seven-month contracts — worth 441,700 yuan and 441,000 yuan — for access to servers containing eight H200 chips each. The contracts covered fine-tuning AI models and reinforcement-learning training, the kind of work that builds advanced AI systems.
The same school also rented servers containing eight Nvidia A100 chips and eight A800 chips. Both the A100 and A800 are banned from export to all Chinese entities, making their presence in the university’s computing pipeline just as significant as the H200s.
And in April, another institute at the university bought computing services requiring at least 24 A100 chips in a 375,000-yuan contract, for structural and fluid-dynamics simulations.
The pattern is clear: when buying the hardware outright is blocked, renting the computing power behind it offers another route in. The records offered scant information about where the processors originated or where the rented servers operated.
Nvidia H200 Chips in China: A Wider Market
Northwestern Polytechnical was not an isolated case. A Reuters review of 26 Chinese procurement and corporate records from this year found universities and research institutions buying US-restricted Nvidia chips, or renting access to Nvidia-powered computing services through domestic suppliers. Several had close links to China’s defence industry or military research.
Shenzhen University bought three H100 processors — another high-end Nvidia AI chip banned by the US — for 769,800 yuan in September. Wuhan University of Technology bought a server containing an H100 chip for 355,000 yuan in June, plus four A100 chips in a separate 344,000-yuan purchase.
Beihang University, another of the Seven Sons of National Defense with close ties to China’s aerospace and defence industries, bought four A800 processors for 489,000 yuan in April.
Two government procurement announcements in July and September named suppliers selected to provide computing services using Nvidia H800 and A800 chips — both restricted from export to China — to the University of Chinese Academy of Sciences. One listed H800 access at just 10 yuan per chip-hour.
A separate January procurement award named a supplier of six A100 chips worth 484,800 yuan for a Shenzhen-based public institution. Under Chinese law, public procurement agencies must verify that suppliers can fulfil orders before announcing winning bidders and signing contracts.
Reuters has previously reported that Chinese institutions acquired restricted Nvidia chips embedded in servers made by Super Micro, Dell and Gigabyte through domestic resellers. It has also documented an underground market in China for restricted Nvidia chips sourced from overseas inventories and third-country intermediaries.
Last week, Reuters reported that small quantities of H200 chips had reached China through indirect routes while Beijing withheld approval for large-scale imports. The new records suggest those indirect routes are busier than anyone admitted.
Why Washington Can’t Plug the Gaps
The export-control system was never designed to catch every chip. It was designed to make the most advanced hardware hard to get — and on that measure, it has slowed China down without stopping it.
The Trump administration began allowing some H200 exports to China on a case-by-case basis in January. But that policy did not lift the separate restrictions applying to Entity List organisations such as Northwestern Polytechnical.
The January licensing rules also require safeguards to prevent blacklisted entities and military end-users from remotely accessing chips exported under the policy. The new records raise an obvious question: how effective are those safeguards when a blacklisted university can simply buy or rent the hardware through domestic suppliers?
Huang has argued that continued US sales to China would preserve American technological leadership and keep Chinese customers reliant on US technology. But some US lawmakers say access to Nvidia’s most powerful AI chips can speed China’s development of AI systems for weapons design, intelligence analysis and military modernisation.
Both Democrats and Republicans in Congress have urged stronger controls on China’s access to advanced AI chips, including chip-tracking requirements and greater congressional oversight of exports. Three Republican congressional committee chairmen have requested a briefing with Huang on November 18 over his reported contacts with an alleged Chinese intelligence operative.
The timing is uncomfortable. Nvidia’s shares have already been under pressure this week — Nvidia shares fell 4.3% on Monday, wiping roughly $190 billion from its market value, as a shareholder lawsuit followed reports about the alleged spy affair.
The H200 revelations add a fresh layer of political risk to a company already at the centre of Washington’s China debate.
What Happens Next
The immediate question is what Washington does with this evidence. Chip-tracking requirements — long discussed, never implemented — are likely to return to the agenda with new urgency when Huang meets the committee chairmen next week.
There is also the question of enforcement. The Bureau of Industry and Security oversees export controls, but tracking chips that change hands through layers of domestic resellers is a very different task from approving or denying a licence application. The records show a market that adapts faster than the rules written to contain it.
Meanwhile, the AI chip race itself is not standing still. Google’s new TPU 8tx and 8i Max chips are aimed squarely at Nvidia’s dominance, and TSMC has just committed $1 billion to Anthropic and OpenAI — a reminder that the world’s most advanced AI hardware is built on supply chains that span the globe.
For now, the two H200 chips in Xi’an tell a simpler story. A blacklist is only as strong as its enforcement, and somewhere between a factory, a reseller and a university procurement office, the world’s most powerful AI chips keep finding their way through.
According to Reuters, the records are the first public proof of it — and they are unlikely to be the last.
