The New York Times has laid out how Inspur, the state-owned server maker that has been on the US entity list since 2023, keeps getting access to advanced AI chips. The mechanism is not exotic. It is corporate structure: a spread of freshly incorporated subsidiaries and partner firms that are not themselves listed, and that can therefore buy what the parent cannot.
This is the oldest gap in the entity list model. Restrictions attach to named legal persons. Creating a new legal person costs a filing fee and a week. Unless enforcement moves at the speed of company registration, which it does not, the list is always chasing an entity that has already spawned its replacement.
Why servers, and why Inspur
Inspur matters because it sits where the chips become useful. A GPU on its own is inventory. A GPU integrated into a rack, cooled, networked, and delivered to a Chinese data center operator is capacity. Inspur is one of the few firms with the volume to do that at national scale, which is exactly why it was listed.
The affiliate structure also muddies the paperwork on the seller’s side. A distributor in a third country receiving an order from a company with no listing history, clean documents, and a plausible end-use statement has limited ability to see through to the beneficial owner. Some of those distributors are not trying very hard. Others genuinely cannot tell.
What enforcement would have to change
Closing this requires ownership-based rules rather than name-based ones, which is the direction the fifty percent rule in the Treasury sanctions world already points. Applying that logic to export controls would sweep in unnamed affiliates automatically, and it would also impose a real diligence burden on every distributor in the chain.
That is the trade. Broader rules catch more evasion and cost the compliant more money. Washington has been reluctant to make US and allied vendors carry that cost. Until it does, stories like this one will keep repeating with a different company name in the headline.