NVIDIA GB300 End-User Certificates: Why Suppliers Need to Know Where Your AI Server Will Be Installed

Suppliers ask where your NVIDIA GB300 system will be installed, who will use it and what it will run because the end-user certificate covers a place and a purpose, not just a company. US export controls follow US-origin advanced computing hardware after it leaves the US. US guidance tells sellers to treat an unknown installation address as a red flag, and to check that a data centre can actually host the equipment. A precise answer, such as "our server room at this address, used by our analytics team for internal model training", lets the order proceed. A vague one, such as "Singapore, for AI", invites questions. The answer gets more involved when the system goes into a colocation facility, will be shared with other companies, has users overseas, or might move later. This guide works through those cases. The other fields on the form are explained in our GB300 KYC and EUC explainer.

Why does the installation address matter to a supplier?

The US Export Administration Regulations attach to the item, so obligations can arise when it is re-exported or transferred within a country to a new end user or end use. The Bureau of Industry and Security (BIS) guidance of 13 May 2025 on advanced computing chips lists, among its red flags, a customer whose "ultimate delivery or installation address" is unknown. It also flags a data centre that cannot confirm it has the power, cooling or space for the servers. It recommends that sellers get a written attestation from the data centre that the end user is authorised to operate there and that the facility can support the equipment. Sellers are to apply extra scrutiny to data centres of more than 10 MW. A supplier asking for your exact site is following that guidance.

Singapore takes the issue seriously too. In a 2025 Singapore case, individuals were charged with fraud over alleged false representations to server suppliers about the end user; the case is before the courts. Second Minister for Trade and Industry Dr Tan See Leng told Parliament on 18 February 2025 that Singapore expects companies here to take other countries' export controls into account, and will act under its own laws against deliberate circumvention.

How should you describe the site in common situations?

Source: BIS "Industry Guidance to Prevent Diversion of Advanced Computing Integrated Circuits" and policy statement on IaaS and AI model training (both 13 May 2025); NVIDIA DGX Station specifications for power. Requirements vary by supplier and case. Facts as of 9 Nov 2026.

What changes when the system sits in a colocation data centre?

You become the end user at someone else's address. Suppliers will usually want the facility's details and some evidence that you have space there, and that it can deliver the power and cooling. For a deskside DGX Station that is simple. For an NVL72 rack at about 132–142 kW (per OEM figures), the facility's written confirmation becomes central. Our data-centre pre-quote pack lists what to gather.

What if other companies will use the compute?

Then you are offering infrastructure as a service, and the supplier needs to know. BIS's 13 May 2025 policy statement says exports, re-exports and in-country transfers of these chips to infrastructure-as-a-service providers may need authorisation where there is knowledge the provider will train AI models for, or on behalf of, parties headquartered in Country Group D:5 or Macau. Expect to be asked who your customers are and how you screen them. Saying "internal use" when you plan to rent out capacity is the kind of misstatement end-user forms exist to prevent.

Do overseas users count?

They can. If staff or partners outside Singapore will log in, describe who they are and how access is controlled. A regional team working for the same company is a different case from an unrelated third party. The supplier, not you, decides whether more checks are needed, so give the facts plainly and let your trade-compliance adviser assess them.

What if the system might move later?

Say so now. Moving a system out of Singapore is an export from Singapore and, for US-origin items, a re-export under US rules. Neighbouring countries have their own requirements: Malaysia, for example, has required a Strategic Trade Permit and 30 days' notice for exports, transhipments and transits of US-origin high-performance AI chips since 14 July 2025 (MITI). Check the current rules before any move. Even a move between your own Singapore sites is worth telling your supplier about, so the records stay accurate.

The installation address on an end-user certificate is a promise about where the hardware will be. Make it one you can keep.

How should you describe the workload?

The end use needs to make sense for your line of business, and it must not be a restricted one (such as military, weapons-related or certain supercomputer end uses). Compare these:

• Too vague: "AI", "research", "data processing", "general computing".
• Good: "Fine-tuning and serving internal language models for customer-service teams in Singapore; about 40 staff users; no external customers."
• Good, research: "Training and evaluating medical-imaging models within the university's radiology department; users are faculty and enrolled students."
• Good, service provider: "GPU compute rented to Singapore-incorporated business customers for inference workloads; customers screened before onboarding."

Once the paperwork is settled, the physical site still needs checking. Our DGX Station GB300 office installation checklist covers power, heat and access, and what happens when a DGX Station sits under an office desk covers noise and cooling. For why companies keep AI on their own premises at all, see sovereign AI for Singapore SMEs. The commonest paperwork errors are in seven documentation mistakes that hold up GB300 orders, and the wider rules are in our overview of export controls and AI hardware in Singapore.

This article is general information, not legal advice; confirm requirements for your situation with your legal or trade-compliance adviser.

Buying in Singapore

When you ask SourceIT for a GB300 quotation, we'll ask where the system will go and who will use it, so the end-user information is ready alongside the quote. We help you word it accurately and pass it to the manufacturer or distributor; they and, where relevant, regulators make the decisions. We list DGX Station GB300 systems from ASUS, Dell, HP, MSI, GIGABYTE and Supermicro, each supplied through the OEM's channel and all price on request. SourceIT does not list GB300 NVL72 racks. For data-centre projects, ask us to source through our partners; we will confirm availability, lead time and facility requirements rather than assume stock. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Can we give our registered office as the installation address? Only if that is where the system will actually run. Suppliers need the real installation site. An address that is only a virtual office or a corporate-services office is one of the red flags BIS lists.

We're putting the system in a colocation facility. What do we need? Usually the facility's name and address, evidence you have space there, and its confirmation that it can supply the power and cooling.

Can we let a partner company use the system? Tell your supplier first. Providing compute to another company changes the end user and end use, and may need a fresh declaration.

Do we need to declare the exact AI models we'll run? Generally not model by model, but the description should be specific enough to show what the system does and who uses it.

What if we later relocate the system to an overseas office? Treat it as a new export. Tell your supplier, take trade-compliance advice and check the destination country's rules before moving it.