A workable blueprint for a chip licensing regime

The problem: Compute fuels the AI race

Frontier AI development runs on compute. A simple formula is that more chips make more powerful models. In the AI race between the US and China, we can think of compute as the fuel. Operating under the premise that China narrowing the gap in AI capabilities with the US would be destabilizing, chips smuggled into China are a problem.

US officials claim DeepSeek trained a model on several thousand smuggled Blackwell chips at a data center in Inner Mongolia. They allege that the chips traveled inside servers initially sold to approved countries, then crossed the border in pieces. While Nvidia has denied this happened, nobody can actually prove it which is a symptom of the broader problem.

The solution: Licensing enforced by the chip itself

Imagine that every chip ships with a hardware device that enforces a compute budget that counts down as the chip runs. Renewing this budget would require a cryptographic signature “key” from an authorized party. If you don’t obtain a new key, your chip stops working. This is the licensing mechanism.

In this way, it doesn’t matter how many times the chip switches hands or where in the world it happens to be. Using the chip with no way to get a new license is like driving a car with a proprietary fuel cap you can’t open.

The plan: Leveraging the export carrot

The two sides are talking past each other. Nvidia has said no backdoors, no kill switches, no spyware. That’s the literal title of their press release. It knows customers bristle at the idea of losing any amount of control of their chips. They know attaching strings of any sort, no matter the privacy and security guarantees, is incredibly unpopular. Washington, meanwhile, won’t widen access to chips that can just walk across borders without a care in the world.

Here’s how to break the stalemate. The Commerce Department has the authority to publish a license exception. It could create a streamlined process where chips with certified hardware guarantees may be exported to the Gulf states, Southeast Asia, and the forty-odd countries treated as transshipment suspects. Ungoverned chips would face the same restrictions they face today. China remains a separate decision for later, perhaps under some broader agreement.

There is precedent for this bargain with middle countries. Nations that want civilian nuclear technology accept safeguards and inspections as the price of entry. In many ways, compute is this era’s nuclear material: beneficial in the right circumstances but potentially dangerous without safeguards.

An astute reader would point out a problem mentioned earlier: this technology does not exist beyond prototypes. The strategy is that the new export rule creates a massive incentive for a chipmaker to develop the compliant chip and reap the rewards of an expanded market. Nvidia data center GPUs, for example, already contain per-chip identity keys and telemetry capability, the basic building blocks flexHEG requires. This approach aligns incentives, capability, and resources in a compelling way.

Here’s another carrot. Chipmakers are already experimenting with hardware as a service. Nvidia recently launched a revenue-sharing cloud program with initial commitments of up to 210,000 GPUs. It has spent years blurring the line between selling chips and renting them, from DGX Cloud’s training-as-a-service model to subscription software like AI Enterprise. Chip licensing is a tempting opportunity: lower upfront prices for customers in exchange for a recurring revenue stream.

Without the significant research and development capacity of chipmakers behind the effort, progress is uncertain. Researchers behind the flexHEG estimate that a secure, on-chip version is a multi-year engineering effort beyond the capacity of philanthropy alone. These efforts have produced early prototypes funded by roughly $4 million in grants, and a pilot or two, but more is needed.

Creating the standard

Rather than inventing a standard from scratch, Commerce can adapt the design requirements already laid out in the public flexHEG and RAND research, which specify auditable, open-source mechanisms. A published rule need only establish the required capabilities and the testing regime, with certification performed by independent evaluators under the same third-party framework BIS uses for its most recent export licenses.

None of this needs new law or a vote in Congress. Commerce wrote and enacted its last major chip rule in five weeks, and it already conditions export licenses on independent third-party testing.

Existing ungoverned inventory

The millions of ungoverned GPUs already in the field are indeed a challenge. One potential solution would be to buy them out of circulation. Commerce and chipmakers could pair the license exception with a trade-in program, swapping old hardware for discounted governed chips with more compute and continued support. This could be better than retrofitting governance onto less valuable hardware never designed for it, retains customers in the chipmakers’ ecosystem, and steadily shrinks the pool of chips susceptible to smuggling.

Potential challenges

The following are load-bearing assumptions whose failure would compromise the plan’s likelihood of success.

• Tamper resistance against state-level adversaries is unproven. Chip enclosures that can be defeated to steal keys compromise the entire licensing regime.
• Middle countries must keep preferring governed American compute to ungoverned Chinese compute, a prospect that diminishes over time as Chinese compute performance improves.
• Buyers may reject a renewable budget signed abroad as a foreign off-switch on mission-critical national infrastructure.
• Chipmakers won’t commit multi-year engineering budgets to a license exception the next administration or news cycle can jeopardize.
• Whoever signs renewals holds real power over other countries’ compute. Credible key governance plans may need to include multi-party quorums and open-source auditability.
• A trade-in program can shrink but not eliminate the ungoverned compute supply, which remains a smuggling and agglomeration risk for the useful life of those chips.

More information would decrease uncertainty along many of these dimensions. However, one clear constant working against the effort in general is time. Capabilities progress, ungoverned chip proliferation, and geopolitical dynamics will all continue to advance, perhaps in unpredictable or unexpected ways. All factors that favor taking action sooner than later.

The flexHEG future

Someday, after a capability jump or a warning shot, governments, frontier labs, and society might want better control over the world’s AI compute. A US-China agreement to slow down is not entirely out of the picture. The feasibility of such an agreement depends on creating a foundation of compute verification. This plan outlines one possible strategy to make this possible.

About the author

Edward Paulino writes about government, technology, and building a better future. Views expressed are my own.