AI chip tracking looks cheaper than inspections, but leaves enforcement costs unpriced

• Remote location checks outperform inspections on modeled detections per dollar, but the estimates exclude follow-up enforcement and other costs.
• Tracking would generate investigative leads; it cannot directly prevent smuggling or establish who uses a chip.
• CSET favors a flexible testing period if policymakers pursue tracking, without endorsing a mandate.

Remote checks could make it cheaper to spot diverted AI chips than relying on physical inspections, a September 2026 assessment concludes. But its estimates leave the cost of investigating alerts unpriced—a consequential omission for an export-control regulator already constrained by staffing and resources.

The assessment comes from the Center for Security and Emerging Technology, or CSET, a Georgetown University research center focused on emerging technology and national security policy. Founded in January 2019, it describes influencing policy through evidence-driven analysis as a founding goal in its institutional history. Its findings inform a regulatory choice: CSET explicitly does not recommend whether policymakers should mandate location verification.

The stakes are the effectiveness of U.S. restrictions on advanced computing hardware. The United States began China-wide AI chip export controls in August 2022 to hinder adversaries’ development and deployment of advanced AI capabilities, the report explains. Chips have nonetheless reached unauthorized destinations. The volume remains uncertain, making tracking attractive both as a source of leads and as an additional obstacle for smugglers.

CSET’s modeled annual cost bounds exclude follow-up enforcement, disruption to chip development and security plans, and possible performance losses. Development costs are spread over five years. Source: CSET — Tracking AI Chips full report.

A proposed requirement faces industry resistance

CSET’s full report examines the Chip Security Act, legislation introduced in 2025 that would require mechanisms to verify the location of covered chips. The House Foreign Affairs Committee advanced the bill in March 2026. As described in the report, it allows several approaches, including physical audits, attestations by qualifying U.S.-headquartered entities and ping-based checks; it does not prescribe a single technical implementation.

The report also cites a March statement opposing the bill from the Semiconductor Industry Association, which represents chip manufacturers affected by such requirements. The association argued that mandating costly, unproven security features could undermine trust in American chips and weaken their competitiveness. That is an industry objection, rather than a demonstrated outcome of an operating tracking system.

CSET’s preferred approach, if policymakers proceed, combines ping-based location verification with physical inspections to investigate leads. This is distinct from proposals to remotely disable chips, which the researchers exclude from their assessment because of their controversy and security risks.

CSET illustrates how landmark-server disks bound a chip’s possible location. The overlap depends on the servers’ positions relative to the chip. Source: CSET. Source: CSET — Tracking AI Chips full report.

Remote checks narrow geography, with important exceptions

Ping-based verification measures how long signals take to travel between a chip and trusted reference servers, called landmarks, and back. A reporting server combines those timings to estimate the chip’s location and compare it with its intended destination. Responses must also be authenticated so a substitute device cannot simply answer for a diverted chip.

CSET evaluates methods for verifiability, accuracy, security and repeatability. It finds that ping-based checks and properly conducted physical inspections best meet those criteria. Inspections can produce more detailed evidence and are more likely to prove diversion directly, but require personnel to travel and temporarily disconnect hardware to authenticate it. Looking only at packaging or serial-number labels can be defeated with substitutes.

Other options have useful existing capabilities. CSET says chip designer Nvidia’s Fleet Intelligence software can authenticate GPUs—graphics processing units—and produce signed inventory reports. But an inventory report does not independently establish physical location, and network information such as IP addresses can be spoofed. GPS-based checks face spoofing risks too. CSET nevertheless leaves room for improved alternatives and less stringent checks for highly trusted operators.

For ping-based checks, geography remains approximate. CSET estimates that placing a landmark in every major data center hub outside the United States, China and Russia could give most tracked chips an error-circle radius of 116 miles or less. That estimate depends on short fiber routes and low network latency near those hubs. The report’s definition of “country-level” accuracy permits uncertainty between the expected country and a neighbor; it does not guarantee identification of one country.

Even its best-case estimate is roughly 20 miles for the baseline approach, too broad to reliably distinguish nearby facilities with different operators. Remote sites may need their own landmark servers. More precise methods could improve the estimates, CSET says, at the cost of additional data collection, complexity and potentially expense.

The price estimates cover a system, not the whole enforcement effort

CSET models a network of 39–500 landmark servers. Its annual cost ranges assume firmware updates to chips and include infrastructure, maintenance, and standards and firmware development. The one-time development costs are spread over five years.

The researchers use an estimated fleet of about three million data center AI chips, excluding chips sold to China and those owned by U.S.-headquartered cloud providers or other U.S. hyperscalers. On that denominator, they estimate annual costs of roughly $1–$10 per chip with owned servers and $1–$24 with rented servers. These are modeled costs across the specified fleet, rather than vendor prices or measured deployment expenses. The overlapping ranges do not establish that renting or owning is always cheaper.

Crucially, the estimates exclude follow-up export enforcement, disruption to chip designers’ development and security plans, and possible chip performance losses. CSET expects limited performance degradation if the protocol is designed properly, but does not price those effects. Buyers, sellers or the government could fund the infrastructure; who pays remains a policy decision.

In 10.5 million simulated scenarios, physical inspections never detected more diverted chips per dollar than either version of the ping-based system, CSET says; some scenarios produced ties. The researchers deliberately chose parameters favorable to inspections and report that sensitivity checks did not reverse the result. This supports their comparison of the two methods, but supplies neither a field-tested detection rate nor a complete budget for the combined system and ensuing investigations.

The Bureau of Industry and Security, or BIS, the U.S. export-control regulator that would receive leads, still needs people to investigate them. A larger stream of alerts could include legitimate operational interruptions as well as evidence of smuggling.

Identity and connectivity remain separate weaknesses

A chip can stop responding because it is in transit, in storage, under maintenance or decommissioned. A smuggled chip deliberately disconnected from the internet looks similarly silent. Treating silence as compliance misses diversion; treating every silence as suspicious creates investigative work. CSET recommends collecting expected activation timelines and investigating chips that remain inactive longer than expected.

The report illustrates the problem through a U.S. indictment alleging a 2024–2025 scheme to divert $2.5 billion worth of servers containing AI chips to China. In CSET’s reconstruction, dummy servers and transferred labels defeated inspections. Remote checks could not have located chips while they were switched off in their packaging. They might have provided earlier leads after activation in China, if communications were unobstructed and the system had not been compromised. Investigators would still have had to trace the sales chain.

Authentication creates another vulnerability. A GPU fingerprinting paper, submitted in May and revised in June 2026, warns that attackers with physical access could potentially extract on-chip cryptographic keys. It proposes using hardware fingerprints to identify GPUs instead and reports a proof of concept in small-scale tests. Those results concern recognizing devices; they do not demonstrate secure location verification across a deployed global fleet.

Nor does a genuine device at an authorized location establish a legitimate user. Chips could change ownership within one facility, or an operator could provide remote access without moving them. A September verification paper, adapted from an August Institute for AI Policy and Strategy report, separates location, user and use checks. Its authors assess mechanisms they consider implementable in approximately a year and favor private-sector participation and existing technology given BIS’s resource constraints. That timetable is their assessment, rather than a deployment commitment.

What a trial would need to establish

CSET recommends an initial period of flexible requirements so industry can test competing implementations before BIS decides whether to standardize particular approaches. Its preferred design uses firmware-based signing and focuses on data center chips subject to the strictest licensing requirements. But chips differ in their built-in security features, and retrofitting existing devices requires users to install updates. The researchers warn that majority coverage could take several years.

They also recommend keeping responsibility for each chip’s location with one entity throughout its lifecycle, even as it changes hands, and favor BIS-certified third parties operating the servers to reduce conflicts from chip designers monitoring their own products. Payment and oversight still matter: the report notes other researchers’ concern that powerful chip companies could exert financial leverage over auditors they pay.

CSET favors detecting diversion worldwide, including moves to unauthorized facilities outside China. Extending tracking to chips wholly designed, produced and sold within the United States raises a separate authority question, as well as privacy and national security concerns; the report leaves that choice open and says congressional action may be needed.

The unresolved decision is whether the additional enforcement value justifies the full burden. A useful trial would need to show how often alerts identify real diversion rather than routine disconnection, whether authentication withstands adversarial testing, and how much work each actionable lead creates. The cost comparison alone cannot answer those questions.