Congress quietly expands export controls to remote access—with lower criminal thresholds.

What it does

This bill amends the Export Control Reform Act of 2018 to extend U.S. export controls to include remote access of controlled items by foreign persons over the internet or cloud services, not just physical export. It defines remote access as purposeful, knowing, reckless, or negligent access to controlled technology from abroad, and requires the Secretary of Commerce to regulate such access when it poses a serious national security or foreign policy risk. The bill requires the Commerce Department to consult Congress on anticipated remote-access regulations but does not require congressional approval before implementing them.

Why we flagged it

The bill's core function is to extend U.S. export control jurisdiction from physical shipment to remote digital access of controlled technology, closing a regulatory gap identified in national security policy. It is not a carve-out or subsidy but a regulatory expansion with legitimate security rationale.

What the text implies

• The definition of remote access includes 'negligent' access, meaning a U.S. company or researcher could face criminal liability for failing to prevent unauthorized foreign access to controlled technology—shifting liability from the foreign actor to the U.S. entity, even absent intent.
• The bill grants the Secretary of Commerce unilateral authority to regulate remote access with only post-hoc congressional notification (not approval), creating a regulatory blank check for defining what constitutes a 'serious risk' to national security.
• Cloud computing services, SaaS platforms, and collaborative research tools used by U.S. companies may fall under remote-access controls if they store or process controlled items, potentially requiring export licenses for routine business operations.
• The 'reckless' and 'negligent' mens rea standards are lower than typical criminal export-control thresholds, expanding criminal exposure for companies and individuals who fail to implement cybersecurity measures.
• Foreign nationals employed by U.S. tech companies, universities, or research institutions could trigger remote-access liability if they access controlled systems from abroad, chilling international talent recruitment and collaboration.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill addresses a genuine national security gap—preventing foreign adversaries from remotely accessing controlled U.S. technology (semiconductors, AI, defense systems) without physical export. However, the definition of remote access is broad (including 'negligent' access) and enforcement discretion is concentrated in the executive branch with minimal congressional oversight, creating risk of overreach that could chill legitimate business, academic collaboration, and cybersecurity research.

Who stands to gain

• Cybersecurity and export-compliance software vendors
• Defense contractors and aerospace firms (reduced foreign competition risk)
• Semiconductor manufacturers (protection of advanced chip designs)

Named in the bill

Export Control Reform Act of 2018, U.S. Department of Commerce, Secretary of Commerce, House Committee on Foreign Affairs, Senate Committee on Banking, Housing, and Urban Affairs, Foreign persons, Cloud computing services

Where it stands

17 cosponsors: 9 Democrats, 8 Republicans.

• Apr 7, 2025 — Introduced · Congress.gov: “Introduced in House”
• Apr 7, 2025 — Referred to House Committee on Foreign Affairs and Senate Committee on Banking, Housing, and Urban Affairs · Congress.gov: “Referred to the House Committee on Foreign Affairs”
• Apr 9, 2025 — Markup held in committee · Congress.gov: “Committee Consideration and Mark-up Session Held”
• Apr 9, 2025 — Reported out of committee · Congress.gov: “Ordered to be Reported (Amended) by the Yeas and Nays: 51 - 0”
• Jan 12, 2026 — Passed the House · Congress.gov: “On motion to suspend the rules and pass the bill, as amended Agreed to by the Yeas and Nays: (2/3 required)…”
• Jan 12, 2026 — Floor vote scheduled · Congress.gov: “Mr. Lawler moved to suspend the rules and pass the bill, as amended”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

25 lobbying clients named this bill on 30 disclosure filings across 3 quarters, Dec 2025 to Jun 2026. Those filings disclosed $19,435,803 in lobbying spend. A filing names 15 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 97% of bills with at least one filing.

Michael Lawler, the sponsor, reported $2,081,571 in PAC receipts in the 2026 cycle. $5,000 of that came from 1 PAC tied to these lobbying clients.

• Google Client Services LLC — $6,920,000 on 2 filings
• Oracle Corporation — $2,000,000 on 1 filing
• Sap America, Inc. — $1,590,000 on 1 filing
• Information Technology Industry Council — $1,440,000 on 2 filings
• Software & Information Industry Association — $1,396,909 on 1 filing

Lobbying Disclosure Act filings through Jul 21, 2026. A filing shows who paid to lobby on a bill it names, not what changed.