Chip Security Act

Summary

Requires covered integrated circuit products to include location-verification chip security before any export, reexport, or in‑country transfer, and directs the Department of Commerce (through BIS) to assess, adopt, and periodically re-evaluate additional chip security mechanisms. Licensees and authorized exporters must report diversions or tampering; Commerce may collect and maintain ownership and location records and must report findings and implementation plans to Congress on set timelines.

• Requires location-verification chip security on covered integrated circuit products before export, reexport, or in‑country transfer within 180 days.
• Directs Commerce (BIS) to assess additional secondary chip security mechanisms within 1 year, report to Congress, and implement selected mechanisms within 2 years after assessment.
• Licensees and authorized exporters must promptly notify BIS if products are diverted, off‑location, or tampered with.
• Commerce may verify and maintain records of product ownership, location, and end‑users and can require information from licensees/exporters to do so.
• Annual reviews of new chip security mechanisms are required starting 2 years after enactment and continuing for 3 years, with reports and export‑control recommendations to Congress.
• Applies to integrated circuits and computing products defined by specific ECCNs and successor, substantially similar classifications.
• Prioritizes confidentiality of selected security mechanisms and allows classified annexes to congressional reports.
• Does not appropriate funds or change tax law; implements regulatory requirements through the Department of Commerce and BIS.