December 17, 2025
Mr. McCormick (for himself, Mr. Wyden, Mr. Cotton, and Mr. Coons) introduced the following bill; which was read twice and referred to the Committee on Banking, Housing, and Urban Affairs
To amend the Export Control Reform Act of 2018 to provide for control of remote access to items, and for other purposes.
Section 1. Short title
This Act may be cited as the Remote Access Security Act
.
Sec. 2. Control of remote access of items under the Export Control Reform Act of 2018
(a) Definition of remote access
Section 1742 of the Export Control Reform Act of 2018 (50 U.S.C. 4801) is amended by adding at the end the following:
(15) Remote access
(A) In general
The term remote access means access to an item subject to the jurisdiction of the United States and included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations, by a foreign person of concern through a cloud infrastructure service from a location outside the United States and other than where the item is physically located, if the Secretary determines that the use of the item has demonstrated a serious risk to the national security or foreign policy of the United States through the use of software, such as by—
(i)
training an artificial intelligence dual-use model that—
(I)
substantially lowers the barrier of entry for experts or nonexperts to design, synthesize, acquire, or use chemical, biological, radiological, or nuclear weapons or other weapons of mass destruction;
(II)
conducts offensive cyber operations through automated vulnerability discovery and exploitation against a wide range of potential targets of cyber attacks (not including for defensive purposes such vulnerability reporting or mitigation); or
(III)
evades human control or oversight of automated systems through means of deception or obfuscation;
(ii)
accessing capabilities primarily designed for offensive cyberspace operations (not including accessing such capabilities for network defense activities); or
(iii)
conducting surveillance primarily designed to undermine human rights, such as by using spyware (as defined in section 1102A of the National Security Act of 1947 (50 U.S.C. 3232a(a))), location tracking technology, or biometric identification technology primarily designed for such surveillance.
(B) Cloud infrastructure service defined
For purposes of subparagraph (A), the term cloud infrastructure service has the meaning given the term
Infrastructure as a Serviceby the National Institute of Standards and Technology in Special Publication 800–145 (or any successor publication).(16) Foreign person of concern
The term foreign person of concern means—
(A)
the government of—
(i)
a country specified in section 4872(f)(2) of title 10, United States Code; or
(ii)
any region within such a country, including the Macau Special Administrative Region and the Hong Kong Special Administrative Region of the People’s Republic of China;
(B)
an entity located or headquartered in, or the ultimate parent company of which is headquartered in, such a country or region; or
(C)
a person subject to the jurisdiction of a government described in subparagraph (A).
(b) Statement of policy
Section 1752 of the Export Control Reform Act of 2018 (50 U.S.C. 4811) is amended—
(1)
in paragraph (1)—
(A)
in subparagraph (A), by inserting , and provision of remote access to,
after export of
; and
(B)
in subparagraph (B), by inserting , and provision of remote access to,
after export of
; and
(2)
in paragraph (2)—
(A)
in the matter preceding subparagraph (A), by inserting , and provision of remote access to,
after transfer of
; and
(B)
in subparagraph (A), in the matter preceding clause (i), by inserting , or provision of remote access to,
after release of
.
(c) Authority of President
Section 1753 of the Export Control Reform Act of 2018 (50 U.S.C. 4812) is amended—
(1)
in subsection (a)—
(A)
in paragraph (1), by striking and
at the end;
(B)
in paragraph (2)(F), by striking the period at the end and inserting ; and
; and
(C)
by adding at the end the following:
(3)
the provision of remote access to items subject to the jurisdiction of the United States to foreign persons of concern.;
(2)
in subsection (b)—
(A)
in paragraph (6), by striking and
at the end;
(B)
in paragraph (7), by striking the period at the end and inserting ; and
; and
(C)
by adding at the end the following:
(8)
regulate the provision of remote access to items described in subsection (a)(3).; and
(3)
in subsection (c)—
(A)
by inserting , or provision of remote access to,
after in-country transfer of
;
(B)
by striking subsections (b)(1) or (b)(2)
and inserting paragraphs (1), (2), and (8) of subsection (b), as applicable,
; and
(C)
by striking or in-country transfer occurs
and inserting in-country transfer, or provision of remote access occurs
.
(d) Additional authorities
Section 1754 of the Export Control Reform Act of 2018 (50 U.S.C. 4813) is amended—
(1)
in subsection (a)—
(A)
in paragraph (3), by inserting , and provision of remote access to,
after transfers of
;
(B)
in paragraph (4), by inserting , and provision of remote access to,
after transfers of
;
(C)
in paragraph (5), in the matter preceding subparagraph (A), by inserting , and provision of remote access to,
after transfers of
;
(D)
in paragraph (6), by striking United States export control
and inserting United States control
;
(E)
in paragraph (7), by striking export controls
and inserting controls
;
(F)
in paragraph (10), by striking or in-country transferred
and inserting in-country transferred, or accessed remotely
;
(G)
in paragraph (11), by adding at the end before the semicolon the following: or remote access
; and
(H)
in paragraph (15), by striking to export
and inserting for export, reexport, in-country transfer, or provision of remote access
;
(2)
in subsection (b), by inserting , or provision of remote access to,
after transfer of
; and
(3)
in subsection (d)(1)(A), by inserting , or provision of remote access to,
after in country-transfer of
.
(e) Administration of controls
Section 1755 of the Export Control Reform Act of 2018 (50 U.S.C. 4814) is amended—
(1)
in subsection (b)(2)—
(A)
in subparagraph (C), by inserting , and provision of remote access to,
after in-country transfers of
; and
(B)
in subparagraph (E), by inserting , and remote access to,
after in-country transfers of
; and
(2)
in subsection (c), by striking export controls
and inserting controls
.
(f) Licensing
Section 1756 of the Export Control Reform Act of 2018 (50 U.S.C. 4815) is amended—
(1)
in subsection (a), in the matter preceding paragraph (1), by inserting , and provision of remote access to,
after in-country transfer of
; and
(2)
in subsection (b), by inserting , or provide remote access to,
after in-country transfer
.
(g) Compliance assistance
Section 1757 of the Export Control Reform Act of 2018 (50 U.S.C. 4816) is amended—
(1)
in subsection (a), by inserting , or provision of remote access to,
after in-country transfer of
; and
(2)
in subsection (c)(2), by striking export controls
and inserting controls
.
(h) Penalties
Section 1760 of the Export Control Reform Act of 2018 (50 U.S.C. 4819) is amended—
(1)
in subsection (a)(2)(F)—
(A)
in clause (ii), by striking any export control document or any report
and inserting any document or report
; and
(B)
in clause (iii), by inserting , or provision of remote access to,
after in-country transfer of
;
(2)
in subsection (c)(1)(C), by striking or in-country transfer
and inserting in-country transfer, or remotely access
; and
(3)
in subsection (e)(1)(A)—
(A)
in clause (i), by inserting , or remotely access or provide remote access to,
after United States
; and
(B)
in clause (ii), by striking or in-country transfer
and inserting in-country transfer, or remotely access, or provide remote access to,
.
(i) Enforcement
Section 1761 of the Export Control Reform Act of 2018 (50 U.S.C. 4820) is amended—
(1)
in subsection (a)(5), by striking or in-country transferred
and inserting in-country transferred, or remotely accessed
; and
(2)
in subsection (h)(1)(B), by inserting , or provide remote access to,
after in-country transfer
.
(j) Annual report
Section 1765(a)(1) of the Export Control Reform Act of 2018 (50 U.S.C. 4824(a)(1)) is amended by inserting , and provision of remote access to,
after in-country transfers of
.
(k) Effect on other Acts
Section 1767 of the Export Control Reform Act of 2018 (50 U.S.C. 4825) is amended—
(1)
in subsection (a), by inserting , or remote access to,
after reexport of
; and
(2)
in subsection (b)(2)—
(A)
in subparagraph (A), by inserting , and remote access by and provision of remote access to such persons to,
after persons of
; and
(B)
in subparagraph (C), by striking or in-country transferred
and inserting in-country transferred, or remotely accessed
.
(l) Termination
The authority under part I of the Export Control Reform Act of 2018, as amended by this section, to impose controls on remote access to items terminates on the date that is 10 years after the date of the enactment of this Act.
Sec. 3. Consultations with Congress
The Secretary of Commerce shall ensure Congress is kept fully and currently informed of any anticipated promulgation of regulations to control remote access to items under the Export Control Reform Act of 2018, as amended by section 2, including ensuring that Congress is informed, in a classified setting as necessary, on—
(1)
the national security or foreign policy risk that would be addressed by the regulations;
(2)
how the method of the regulations addresses that risk; and
(3)
how the regulations may impact the economy of the United States, including the impact on the competitiveness of United States industry in cloud services and related industries as a result of the regulations.
Sec. 4. Report and recommendations
(a) In general
Not later than 1 year after the date of the enactment of this Act, the Secretary of Commerce shall submit to Congress and make available to the public a report assessing and making recommendations with respect to—
(1)
the implementation of this Act and the amendments made by this Act;
(2)
maximizing the level of privacy, and minimizing compliance costs, for entities seeking licenses relating to remote access to items under the Export Control Reform Act of 2018, as amended by section 2;
(3)
improving the speed at which and consistency with which applications for such licenses are reviewed;
(4)
identifying relevant national security and foreign policy concerns related to remote access to items in the interest of improving certainty for United States businesses;
(5)
increasing cooperation with international partners with respect to remote access to items;
(6)
ensuring export controls relating to remote access to items are consistent, clear, and up to date; and
(7)
recommending amendments to the Export Control Reform Act of 2018 to strengthen the provisions of that Act relating to remote access.
(b) Consultations
In developing the report required by subsection (a), the Secretary shall seek input from the public, including holding a public roundtable with industry participants.