The concern is that the restrictions would follow the pattern of existing rules around semiconductor equipment and fabricated chips [1].
They are fairly broad and stipulate that US persons cannot transfer technology to any company on an entity list. iirc there was a clarification to the rule that also put a burden on US persons to confirm that they aren't working with a trading front or shell company for the listed entities, which makes any interaction potentially hazardous, because how are you even supposed to check for that?
Note that violations of these rules can "include up to 20 years of imprisonment and up to $1 million in fines per violation, or both" [2]. And the use of "US persons" language means that it's not just companies, it's individual developers too.
If you read the text of the rules, they restrict any kind of technology transfer to these companies. In the case of selling fabrication equipment, that's...fairly clear cut. Don't sell stuff to people on the list, and your deal was probably a few million dollars anyways so you can afford lawyers to research if you're dealing with a shell company.
But the concern is for RISC-V "technology transfer", what happens if you push to a git repository, and...someone from one of these entities pulls your commits? Are you now liable? What if you give a lecture on RISC-V, and someone from one of these entities was in attendance?
Or perhaps you're in charge of crafting an IP strategy for your SoC company. If you pick RISC-V, the ambiguous and changing rules around who you can license your products to is problematic; a client you have today could end up being banned tomorrow. Whereas if you license an ARM core, you don't have to worry about going to jail. It then becomes a no-brainer to just license the ARM core.
Basically, the concern is they will copy/paste the existing rules that are somewhat more tightly confined because they apply to atoms, but instead insert language referring to bits and ideas.
They are fairly broad and stipulate that US persons cannot transfer technology to any company on an entity list. iirc there was a clarification to the rule that also put a burden on US persons to confirm that they aren't working with a trading front or shell company for the listed entities, which makes any interaction potentially hazardous, because how are you even supposed to check for that?
Note that violations of these rules can "include up to 20 years of imprisonment and up to $1 million in fines per violation, or both" [2]. And the use of "US persons" language means that it's not just companies, it's individual developers too.
If you read the text of the rules, they restrict any kind of technology transfer to these companies. In the case of selling fabrication equipment, that's...fairly clear cut. Don't sell stuff to people on the list, and your deal was probably a few million dollars anyways so you can afford lawyers to research if you're dealing with a shell company.
But the concern is for RISC-V "technology transfer", what happens if you push to a git repository, and...someone from one of these entities pulls your commits? Are you now liable? What if you give a lecture on RISC-V, and someone from one of these entities was in attendance?
Or perhaps you're in charge of crafting an IP strategy for your SoC company. If you pick RISC-V, the ambiguous and changing rules around who you can license your products to is problematic; a client you have today could end up being banned tomorrow. Whereas if you license an ARM core, you don't have to worry about going to jail. It then becomes a no-brainer to just license the ARM core.
Basically, the concern is they will copy/paste the existing rules that are somewhat more tightly confined because they apply to atoms, but instead insert language referring to bits and ideas.
[1] https://www.federalregister.gov/documents/2022/10/13/2022-21...
[2] https://www.bis.doc.gov/index.php/enforcement/oee/penalties