Chip Security Act
- Sponsor
- Rep. Huizenga, Bill [R-MI-4]
- Committees
- Foreign Affairs Committee (primary)
- Last action
- Mar 26, 2026
Bottom line
The Chip Security Act aims to enhance national security and foreign policy objectives by securing advanced computing hardware exports through mandatory chip-level security features and robust reporting requirements.
What it actually does
This bill mandates that the Secretary of Commerce establish requirements for "chip security mechanisms" on advanced integrated circuit products before they are exported, reexported, or in-country transferred. Initially, these mechanisms must include location verification. The bill also requires the Secretary to assess and potentially implement additional security mechanisms, such as those preventing tampering or modifying functionality, and mandates reporting of diversions or tampering.
Proponents argue
Proponents argue that the bill is crucial for protecting U.S. technology from diversion and unauthorized use, especially in the context of global competition and national security threats. They believe it will strengthen export controls, foster goodwill with allies by providing secure advanced computing capabilities, and potentially allow for greater flexibility in export policies by mitigating risks.
Opponents contend
Opponents might raise concerns that mandatory chip security mechanisms could increase manufacturing costs, potentially hinder innovation, introduce new vulnerabilities if not implemented perfectly, or make U.S. products less competitive globally. They might also argue about the feasibility and effectiveness of such mechanisms against sophisticated adversaries and potential privacy implications of location tracking.
The bill is concise and can be read and understood by an informed reader within a short timeframe.
Section 4(a)(1)
Mandatory Location Verification for Covered Integrated Circuit Products
This provision requires the Secretary of Commerce to mandate that all "covered integrated circuit products" (advanced chips and computers, identified by Export Control Classification Numbers) be outfitted with chip security mechanisms that implement location verification. This requirement applies before these products are exported, reexported, or transferred within a foreign country. The Secretary must issue these requirements within 180 days of the bill's enactment.
Supporters argue
Proponents argue this provision is a foundational step to prevent diversion and unauthorized use of critical U.S. technology, directly supporting national security and export control objectives by ensuring visibility into the location of sensitive hardware.
Critics contend
Opponents might contend that implementing such mechanisms within 180 days is challenging, potentially costly for industry, and could impact product performance or introduce new security risks if rushed. Foreign customers might also have privacy concerns regarding location tracking.
Tradeoffs
This provision balances the imperative of national security and effective export controls against potential industry burden, increased product costs, possible impacts on product performance, and international market acceptance due to privacy concerns.
Section 4(a)(2)
Mandatory Reporting of Product Diversion or Tampering
This provision requires any person who has received a license or other authorization to export, reexport, or transfer a covered integrated circuit product to promptly report to the Under Secretary of Industry and Security. This report is triggered if the person obtains credible information that the product is in an unauthorized location, used by an unauthorized user, or has been subjected to tampering, including attempts to disable or circumvent security mechanisms.
Section 4(b)
Assessment and Implementation of Advanced Chip Security Mechanisms
This section mandates the Secretary of Commerce to conduct an assessment within one year to identify additional chip security mechanisms beyond location verification. These mechanisms would aim to enhance export control compliance, prevent unauthorized use, identify smuggling, and achieve national security objectives. The assessment must examine feasibility, reliability, costs, benefits, and susceptibility to tampering. If additional mechanisms are identified, the Secretary must implement them within two years of completing the assessment, with a priority on confidentiality.
Section 4(c)
Enhanced Enforcement and Tracking Capabilities
This section grants the Secretary of Commerce explicit authority to verify the ownership and location of covered integrated circuit products that have been exported, reexported, or transferred within a foreign country. It also authorizes the Secretary to maintain a record of these products, including their location and current end-user, and to require any licensed person to provide the necessary information to maintain this record.
Section 4(d)
Ongoing Review and Adaptation of Security Mechanisms and Export Controls
This section requires the Secretary of Commerce to conduct an annual assessment for three years, starting two years after the bill's enactment, to review new chip security mechanisms developed in the preceding year. The Secretary must then submit a report to Congress evaluating whether any of these new mechanisms should be added to or replace existing security requirements. The report must also include recommendations for modifying export controls to allow for more flexibility with countries that implement products with advanced security mechanisms.
Requires the Secretary to prioritize confidentiality when implementing requirements for secondary chip security mechanisms.
Section 4(b)(3)(B)
Why it matters:This is standard legislative practice to include caveats or guiding principles for implementation. It's not necessarily evasive but could be missed by a casual reader focusing on the primary mandates.
Case for: Supporters would argue this demonstrates a commitment to balancing security needs with privacy concerns, potentially easing industry and international partner apprehension about data collection and government surveillance.
Case against: Critics might argue that "prioritizing confidentiality" is vague and doesn't provide concrete, enforceable protections, potentially allowing for broad data collection under the guise of security without sufficient oversight.
Estimated impact: Potentially significant for data privacy and trust with foreign partners, but its actual impact depends heavily on how "confidentiality" is defined and implemented in practice by the Department of Commerce.