Cloud Security Act

Key Points

• The bill creates a new legal exception letting cloud companies share customer communications and records with the Commerce Department without violating federal privacy law, but only when they suspect a foreign entity is using their service to dodge export controls.
• It defines 'covered cloud product' broadly to include any cloud infrastructure, platform, or software service that provides computing power equivalent to what's needed to build advanced AI models using high-end chips.
• The bill sets detailed technical thresholds (processing speed, memory bandwidth) to define which computer chips count as 'covered,' matching the type of advanced AI chips already restricted from export to certain countries, and lets Commerce update this definition later.
• Cloud providers are protected from liability when they report suspected misuse in good faith, but they can only share the specific information needed to back up the report, not unlimited customer data.
• The rules apply specifically to 'specified foreign entities,' a term borrowed from federal tax law, generally referring to entities the government has flagged for national security or trade concerns.