Know-Your-Customer Rules for AI Compute

In January 2024, the US Department of Commerce released a notice of proposed rulemaking requiring US Infrastructure-as-a-Service providers — AWS, Google Cloud, Microsoft Azure, Lambda, CoreWeave, and others — to verify foreign customers' identities and report large AI training runs. The rule was finalized in January 2025 as the IaaS rule.

What it requires

• Verify identity of foreign customers opening new accounts (name, address, ID documents)
• Retain records for five years
• Report to Commerce when foreign customers train models above specific compute thresholds
• Report transactions that could enable cyberattacks
• Certify CIP (Customer Identification Program) annually

Why this is contested

1. 1Compliance cost falls hardest on small cloud providers
2. 2Definition of 'training run' is technical and can be circumvented with chunked jobs
3. 3Enforcement relies on providers knowing what customers are doing with the compute
4. 4Privacy and civil liberties concerns from international customers
5. 5Coordinated action needed with EU, UK, Singapore to avoid arbitrage

“If you can buy unlimited compute anonymously, no frontier model regulation is enforceable.”

The big idea: governments are treating compute like a strategic resource on par with uranium or semiconductors. Expect the rules to keep tightening and keep changing.