Sovereignty over your AI is impossible while you do not control the foundation it runs on. Every article in this series has circled that sentence from a different angle: who owns the code, who owns the model weights, who gets to call a licence "open." This is the last one, and it goes one layer further down than any of the others, because at the hardware layer the escape hatch that has protected the open source community since the 1980s does not exist. You cannot fork a foundry.
That is not a metaphor. It is the structural fact this article sets out to prove, using two dates nine months apart in 2019: one company that lost its chip architecture overnight, and one standards body that moved its legal address to avoid the same fate.
The day the architecture was withdrawn
[BOOK IMAGE: row 122 - HiFive1 board, sovereign hardware]
On 22 May 2019, the BBC reported that ARM, the British chip designer whose instruction set architecture powered most of the world's mobile devices, had instructed staff to halt all active contracts, support entitlements, and pending engagements with Huawei. The internal memo described the situation as "unfortunate." Earlier that month, the US Department of Commerce had added Huawei to its Entity List. ARM Holdings had been acquired by Japan's SoftBank in 2016, but its designs incorporated US-origin technology, so the export restrictions applied regardless of who owned the company.
HiSilicon, Huawei's semiconductor subsidiary in Shenzhen and China's largest domestic integrated-circuit designer, built virtually its entire product line, from Kirin consumer processors to Kunpeng server chips, on ARM technology. Overnight, thousands of engineers lost access to the architecture they had spent years mastering. Not because their employer had failed a technical standard. Because a jurisdiction had decided it should.
The move to neutral ground
Six months later, a different organisation made the opposite move for the same reason. On 27 November 2019, the board of the RISC-V Foundation voted to relocate the organisation's legal incorporation from Delaware to Switzerland. RISC-V is an open instruction set architecture, published in 2010 by Krste Asanović, Andrew Waterman and Yunsup Lee at the University of California, Berkeley, released under a BSD licence that lets anyone implement it without asking permission or paying a royalty. CEO Calista Redmond framed the relocation as governance neutrality. The operational calculation sat underneath that framing: an American legal domicile would have made a future export restriction on RISC-V specifications possible, in much the way the Entity List had already reached ARM's designs. Swiss incorporation placed the renamed RISC-V International Association beyond any single government's export controls.
[BOOK IMAGE: row 126 - specifications crossing borders as information]
The distinction is the whole argument in miniature. ARM licenses its architecture: a contract a licensor can suspend, the way it suspended Huawei's. RISC-V publishes its architecture: a specification that, once released under a permissive licence, cannot be un-published. An instruction set crosses a border as information, not as a physical product, and a specification cannot be embargoed at a port the way an advanced lithography machine can.
Four countries, one dependency
That distinction is also why four governments reached for the same open standard as an instrument of independence, and each became bound to a commons that none of them controls alone.
[BOOK IMAGE: row 123 - ESP32-C3, China's RISC-V board]
China invested at the largest scale. By 2025, twelve of RISC-V International's twenty-four premier members were China-based, and China's Ministry of Industry and Information Technology had committed to fifty per cent of global RISC-V shipment volumes and procurement guidance for critical infrastructure. Russia issued Decree 166, compelling domestic Linux migration after the software exodus of February 2022. The European Commission paired the Cyber Resilience Act with two hundred and seventy million euros in RISC-V silicon funding.
[BOOK IMAGE: row 124 - SHAKTI processor, India's quiet build]
India built quietly, end to end, including the IRIS space-application processor developed with the Indian Space Research Organisation. Four different governments, four different postures toward the same open standard, and the same paradox underneath every one of them: the instrument each reached for in the name of digital sovereignty is itself a product of international interdependence. None of the four built RISC-V alone. None of them could have.
[BOOK IMAGE: row 125 - the digital sovereignty race, three strategies]
Washington tried to slow the same current from the demand side. The AI Diffusion Rule, an interim final rule issued by the outgoing administration on 15 January 2025, attempted to tier export controls on AI chips by destination country. It never took effect. On 13 May 2025, two days before the rule's own compliance deadline, the Bureau of Industry and Security announced it would not enforce it and began the process of rescinding it, citing diplomatic cost and a chilling effect on American exporters, with a replacement rule promised but not yet published as this article goes to publication. Whichever rule eventually lands, it will be enforcing controls on chips: physical shipments that cross a port and can be inspected there. An instruction set does not.
What cannot be forked
[BOOK IMAGE: row 137 - why hardware forks do not work]
Chapter 23 of this book makes the structural point that closes the argument. A software fork costs developer time: unhappy with a licence change, a community copies the code and continues under new terms, the way this series has already traced through Unix's 1983 pricing dispute and the licence rebellion of 2023 to 2024. A hardware fork costs a tape-out, one to ten million dollars, and fabrication at an advanced node, fifty to five hundred million dollars at minimum. No volunteer community has ever raised that. The escape mechanism that saved open source in every licensing dispute this series has covered does not transfer to hardware.
[BOOK IMAGE: row 139 - a semiconductor fabrication cleanroom]
Open RISC-V designs still require proprietary fabrication. TSMC's advanced process nodes are available only to firms committing billions of dollars in wafer purchases in advance, whatever the licence terms on the design itself say. The most valuable processors in 2025 are AI accelerators, Nvidia's GPUs and Google's TPUs, running on proprietary software stacks, CUDA and JAX, and a single Nvidia H100 sells for twenty-five to forty thousand dollars. Open source's core advantage in software, that code is infinitely reproducible at near-zero cost, does not apply to silicon. Manufacturing is controlled by an oligopoly, and if a fabrication company restricts a customer's access, that customer's community cannot build an alternative foundry. In software, the fork is the last resort. In hardware, governance, of the standard, of the fabrication relationship, of the interfaces to the accelerator, is the only resort there is.
The board consequence
The mechanism underneath every date above is a licensing choice, not a policy choice. ARM licenses its architecture, a contract a licensor can suspend, the way it suspended Huawei's on 22 May 2019. RISC-V publishes its architecture under a BSD licence: any company, in any country, can implement it without asking permission or paying a royalty, which is exactly why China, India and the European Union could each build a RISC-V roadmap without ARM's consent, and why RISC-V International itself had somewhere to go when the same exposure reached the standard's own legal address. This series has traced that licence-as-control-surface pattern from Unix's 1983 pricing war to Red Hat's subscription model to the Open Source AI Definition's four elements. RISC-V International's move to Switzerland is the same mechanism, reaching the architecture underneath the chip itself for the first time.
The defence and sovereignty implication is the one this whole article has been building toward, so state it exactly rather than widen it. An instruction set can relocate beyond a single government's reach: RISC-V International moved its legal domicile from Delaware to Switzerland on 27 November 2019, precisely so that no government could restrict a specification the way the Entity List addition had already reached ARM's designs seven months earlier. A fabrication process cannot make the same move. TSMC's advanced process nodes stay available only to firms able to commit billions of dollars in wafer purchases in advance, and a company cut off from that access, the way HiSilicon was cut off from ARM overnight, has no community fork to fall back on, because no community can build an alternative foundry. That is the floor every open hardware strategy eventually reaches: at the metal, governance is the only resort.
Sovereignty is a substrate question. I have spent more than three decades governing critical infrastructure and presenting cyber and architecture risk at board level, and the conclusion above is a position I hold from that chair, not an observation made from a distance. The substrate is contested at every layer this series has covered, and the escape hatch that has protected the open source community since the 1980s does not exist at the metal: you cannot fork a foundry. What remains at the hardware layer is governance, of standards, of fabrication access, of the interfaces between accelerators, and nothing else.
That is where Free as in Theft ends its diagnosis. The pattern this series has traced runs from a 1956 consent decree to a 2024 licensing definition to a 2019 corporate address change, a repeating cycle of openness, adoption and enclosure resisted, and open source won the infrastructure argument in software: the operating system on the GPU clusters, the satellites and the Mars rovers is Linux. What comes next in this project turns from diagnosis to practice, what a practitioner actually verifies, line by line, once a vendor's word is not enough to trust by default. That is the V.E.R.A. Saturday build, starting soon.
Look at the hardware your own organisation depends on today. If the company that licenses it to you withdrew access tomorrow, the way ARM withdrew from Huawei, what would be left for you to govern, and what would already be gone?
This is one of seven weekly series in The Hamberger Report. Subscribe on LinkedIn and the next one arrives in your feed.
The views expressed in this article are entirely my own, informed by morethan 30 years of professional experience in architecture, security, andtechnology leadership in New Zealand. I write as director of Te PonoLimited; the views are personal and do not represent the position of anyclient, any government agency, or the New Zealand government. My commentaryon legislation and policy is analytical, drawing on publicly availablesources and my professional expertise in architecture, security, and AIgovernance, and it is politically neutral.
Andreas Hamberger is a New Zealand-based enterprise architect and technology strategist. Over 30 years, he has moved from compiling kernels on a 486 to leading cloud, cyber, and AI transformation programmes across government, banking, transport, and aviation. He founded Yoper Linux, served as a technology specialist for Novell during the Linux Wars, and is the author of "Generative AI: Skynet or Heaven" and "Space Mafia." He can be reached at andreas@thehambergerreport.com. His latest book, Free as in Theft: The Hidden History of Open Source Software, traces the cycle of openness, adoption, enclosure and resistance that runs from IBM's 1956 consent decree to the AI licensing disputes of today. This article closes the Free as in Theft series.
This article was produced with AI assistance under my direction. Research,drafting and images pass through a pipeline I built and govern: automatedgates for source verification, forbidden language and political neutrality,and my own review before anything is published. The tools include Claude,Gemini and Openart. The frameworks, arguments and editorial judgements aremine and are the same discipline I apply to the AI systems I audit forclients. AI accelerated the work; the thinking, and the responsibility forit, are mine.
References
[1] Hamberger, Andreas. "Free as in Theft: The Hidden History of Open Source Software." Te Pono Limited, 2026. ISBN 978-0-473-78455-3. (Primary source for all Chapter 21 and Chapter 23 facts: the 22 May 2019 BBC report of ARM halting contracts with Huawei, the memo wording, HiSilicon, Kirin and Kunpeng, and the May 2019 Entity List addition; ARM's 2016 SoftBank acquisition; the RISC-V Foundation's 27 November 2019 board vote to relocate from Delaware to Switzerland, RISC-V's 2010 Berkeley publication and authors, its BSD licence, and Calista Redmond's framing; the four-nation pattern and its figures, China's RISC-V International premier-member share and shipment commitment, Russia's Decree 166, the European Commission's Cyber Resilience Act and RISC-V funding, and India's SHAKTI and IRIS processors; the AI Diffusion Rule's 15 January 2025 finalisation and the structural non-enforceability point; the fabrication-dependency and hardware-cannot-be-forked points, the tape-out and fabrication cost figures, the TSMC and AI accelerator facts, and the Nvidia H100 price; the closing spine connecting the book's chapters.)
[2] US Department of Commerce, Bureau of Industry and Security. "Department of Commerce Announces Rescission of Biden-Era Artificial Intelligence Diffusion Rule, Strengthens Chip-Related Export Controls." 13 May 2025. https://www.bis.gov/press-release/department-commerce-announces-rescission-biden-era-artificial-intelligence-diffusion-rule-strengthens