US lawmakers have introduced the Chip Security Act, a sweeping legislative proposal that would require manufacturers of high-performance graphics cards and advanced Artificial Intelligence processors to integrate geotracking capabilities into their products. Announced on May 12, 2025, by Senator Tom Cotton of Arkansas, the act empowers the Commerce Department to mandate location verification features in any device subject to US export controls. Targeted hardware includes a wide range of devices defined under specific export control classification numbers, from sophisticated Artificial Intelligence accelerators and datacenter-scale servers to selected consumer graphics cards, such as NVIDIA´s GeForce RTX 5090.
The act stipulates a compliance deadline of six months after the bill´s passage for manufacturers to embed hardware or firmware that can securely transmit each device´s location to a centralized US government registry. Exporters must also alert the Bureau of Industry and Security immediately if they detect that a regulated unit has been diverted, tampered with, or found at an unauthorized location. These measures aim to prevent advanced technology from falling into the hands of adversarial entities and to enhance post-export accountability for each chip-enabled system subject to US export rules.
Recognizing the continual evolution of security threats, the Chip Security Act calls for a joint study by the Commerce Department and the Department of Defense over one year to assess the effectiveness of tracking mechanisms and recommend further safeguards. Afterward, an annual review process will occur for three years, during which time the agencies may propose additional rules. If changes are deemed necessary, regulators would have up to two years to develop and present an updated compliance roadmap to Congress. Industry leaders such as NVIDIA have commented that their current architectures do not support post-sale tracking, highlighting that compliance could delay product launches and increase engineering costs. Similarly, AMD and Intel would have to overhaul complex intellectual property and supply-chain operations to meet geotracking requirements, signaling substantial industry impact if the act becomes law.
