The US AI Export Control Paradox: Selling H200 Chips While Suing Over Distillation

Two Contradictory Moves in the Same Month

February 2026 produced one of the most striking US technology policy contradictions in recent memory. On one hand, the US Commerce Department's Bureau of Industry and Security approved Nvidia H200 GPU shipments to China — 82,000 chips starting mid-February, 6x more powerful than the H20 chips previously permitted, with full CUDA ecosystem support. The 25% revenue tax and compliance requirements (independent US testing, customer screening) are significant conditions but did not prevent approval.

On the other hand, on February 12 — the same month those H200s begin shipping — OpenAI sent a formal memo to the House Select Committee on China accusing DeepSeek of using "obfuscated third-party routers" and "automated API queries" to extract model outputs for distillation. White House AI adviser David Sacks stated there is "substantial evidence that what DeepSeek did here is they distilled the knowledge out of OpenAI's models."

Cross-referencing the Tom's Hardware H200 reporting, the Bloomberg OpenAI memo coverage, and the Nature Machine Intelligence Densing Law paper reveals why this contradiction is structural, not political — and why it matters for every practitioner making model procurement and deployment decisions.

The Hardware Layer: Why H200 Approval Is Strategically Incoherent

The strategic logic behind H200 approval appears to be: permit access to second-tier hardware to slow China's domestic chip independence (particularly Huawei's Ascend 910C development) while keeping the true frontier (Blackwell, Rubin architectures) restricted. The dependency argument: if Chinese AI labs become reliant on Nvidia H200s, Nvidia retains supply-chain leverage and US authorities retain visibility into compute purchases.

This logic has a structural flaw, and CSIS documents it clearly: hardware export controls assume AI capability is compute-constrained. Restrict the chips, restrict the capability. But DeepSeek's R1 distillation demonstrates that capability can be compressed 20x at the software layer — from 671B parameters requiring a multi-GPU cluster to 32B parameters running on a single consumer RTX 4090.

The math is unfavorable for hardware controls:

• Hardware restriction gap: 6x (H200 vs restricted Blackwell performance)
• Software compression gain: 20x (671B to 32B via distillation)
• Densing Law rate: capability density doubles every 3.5 months

Software efficiency gains are already larger than the hardware restriction gap, and the Densing Law means this ratio worsens each quarter. At current rates, the effective value of hardware-layer restrictions declines by roughly 50% every 3.5 months as compression techniques improve. The Council on Foreign Relations analysis frames this as a question of strategic intent versus technical reality: the intent is to maintain hardware-level AI advantage; the technical reality is that advantage is being eroded from the software layer faster than hardware restrictions can compensate.

The Software Layer: Why the Distillation Accusation Comes Too Late

OpenAI's Congressional memo frames distillation as IP theft. The accusation is politically legible but technically contested. Distillation — supervised fine-tuning on outputs from a teacher model — is a well-established technique in the ML literature. The DeepSeek team used approximately 800,000 synthetic reasoning samples generated from the teacher model to train the 32B distilled model. This is standard knowledge distillation methodology.

Whether this constitutes "theft" depends on legal frameworks that have not been applied to AI outputs. OpenAI's terms of service prohibit using API outputs to train competing models — but whether that prohibition is legally enforceable, and whether DeepSeek violated it, is unresolved. The Rest of World reporting notes that China's Fourth Plenum in October 2025 elevated AI as central to national modernization, and new Cybersecurity Law amendments formalize state support for foundational AI research — suggesting Chinese legal frameworks do not treat this as a restriction.

More practically: 1.13M monthly HuggingFace downloads of the MIT-licensed model represent knowledge diffusion that cannot be reversed. The architecture is documented. The training methodology is reproducible. Falcon H1R 7B — developed by the Technology Innovation Institute in the UAE, not China — independently demonstrates the same efficiency inversion pattern (beating models 7x its size on reasoning tasks). This is not a China-specific capability. Any competent ML team with sufficient compute can replicate the distillation approach regardless of what happens to DeepSeek's specific model.

The regulatory strategy may delay adoption in regulated industries but cannot reverse the technical diffusion.

The Underaddressed Layer: Data Sovereignty

The medical AI comparison provides an unexpected analytical lens. Prima, the brain MRI foundation model, was trained on 220,000 MRI studies from the University of Michigan Health System — a proprietary institutional dataset that cannot be distilled from API outputs, replicated by a foreign lab, or reproduced without access to US healthcare infrastructure.

This points to what may be the most effective but entirely unaddressed AI containment strategy: data sovereignty. Hardware controls target compute infrastructure. Distillation accusations target model outputs. Neither policy instrument addresses the most strategically valuable AI asset: the proprietary institutional training datasets that give domain-specific models their performance advantage.

A healthcare AI model trained on 20 million US clinical records has a data moat that no amount of H200 chips or distillation can replicate — because the underlying clinical data is not accessible to foreign actors through any means short of physical breach. Financial transaction records, industrial IoT sensor data, and legal document corpora create similar durable moats. The enduring US AI advantage may rest more in institutional data access than in chip performance or model architecture.

The current policy framework does not reflect this. There is no export control regime targeting training data. There is no regulatory framework requiring data sovereignty as a condition of AI research funding. The gap between where policy is focused (hardware, model outputs) and where durable advantage actually exists (institutional training data) is the most important unaddressed dimension of the US-China AI competition.

What This Means for Practitioners

The policy contradiction creates asymmetric risk for different types of practitioners:

For non-regulated use cases: DeepSeek-R1-Distill-Qwen-32B is immediately deployable, MIT-licensed, and offers competitive reasoning performance at consumer hardware cost. The 1.13M monthly downloads reflect real deployment demand. The policy uncertainty is a medium-term risk (6-12 months for Congressional action) that does not change the current legal and technical reality.

For regulated industries (defense, finance, healthcare, critical infrastructure): The compliance question is urgent and unresolved. Organizations in these sectors should assess three specific risks now:

1. Export Administration Regulations (EAR): If distillation is classified as IP derived from controlled US technology, downstream use may be restricted. Get legal assessment before deploying in classified or sensitive environments.
2. Data security and provenance: MIT-licensed models with unknown training data provenance create audit complexity. Build model procurement policies that track training data origin.
3. Retroactive restriction risk: If Congress acts on OpenAI's distillation accusations within the next 6-12 months, usage restrictions could be retroactive. Architecture for model substitutability now reduces switching cost later.

# Model substitutability pattern — hedge against policy changes
from typing import Protocol

class AIModelProvider(Protocol):
    """Abstract interface for any AI model — enables swapping providers
    without rewriting application logic if regulatory environment changes."""
    def complete(self, prompt: str, **kwargs) -> str: ...
    def model_name(self) -> str: ...
    def provenance(self) -> dict: ...  # Training data origin, license, restrictions

class ModelRouter:
    """Route requests to appropriate model based on task, cost, and compliance requirements."""
    
    def __init__(self, providers: dict[str, AIModelProvider], compliance_level: str):
        self.providers = providers
        self.compliance_level = compliance_level  # "regulated" | "standard" | "low"
    
    def complete(self, prompt: str, task_type: str = "general") -> str:
        if self.compliance_level == "regulated":
            # Only use models with verified provenance in regulated contexts
            safe_providers = [
                name for name, p in self.providers.items()
                if p.provenance().get("us_origin", False)
            ]
            provider_name = safe_providers[0] if safe_providers else "gpt-5"
        else:
            # Cost-optimize for non-regulated use cases
            provider_name = "deepseek-32b" if task_type in ["math", "code"] else "gpt-5"
        
        return self.providers[provider_name].complete(prompt)

The broader structural insight: the US-China AI competition is not a clean hardware-level arms race. It is a multi-layer contest where software efficiency gains are outpacing hardware controls, knowledge diffusion via open-source release is irreversible, and the most durable competitive advantages are in institutional data access rather than model architecture or chip performance. Policy that does not account for all three layers will continue to produce paradoxes like the simultaneous H200 approval and distillation accusation of February 2026.