The CHERI Alliance is a global community of organisations and individuals working to advance secure computing through CHERI technology.
CHERI research, specifications, software and standards activities are conducted across multiple jurisdictions, each with its own export-control framework. As a result, export-control obligations can differ significantly depending on the country, organisation, technology, recipient and intended use.
This page provides general information about export-control considerations relevant to CHERI-related research, standards activities, open-source projects and commercial products. It is intended to raise awareness only and does not constitute legal advice.
In general, the CHERI Alliance considers the core CHERI architecture, publicly released specifications and publicly available software to be part of an open technology ecosystem that is intended to be widely disseminated and implemented.
Examples include:
Where these materials have been lawfully published and made broadly available without restriction, they are generally consistent with concepts such as public-domain information, publicly available information or fundamental research recognised in various export-control frameworks. Relevant source materials are listed in the References section.
The CHERI Alliance strongly encourages members to publish CHERI-related specifications, documentation and software under recognised open licences whenever appropriate, including Creative Commons licences for documentation and Apache 2.0 (or similar permissive licences) for software. The Alliance believes that openly licensed and publicly accessible technology accelerates adoption, enables interoperability and reduces uncertainty about what information has already been publicly disclosed.
However, publication-related exemptions generally rely on information already being publicly available. The intention to publish at a later date is typically not sufficient, and members should exercise particular care when handling unpublished materials, private repositories, proprietary implementations or confidential technical information.
Many export-control frameworks distinguish between information that is publicly available and information that remains restricted.
Additional care should be taken with:
Information stored in private or restricted repositories may not benefit from the same treatment as information that has already been openly published. In many jurisdictions, publication-related exemptions depend on information being genuinely available without restrictions on further dissemination.
The CHERI Alliance therefore encourages members to publish specifications, software and research outputs openly whenever appropriate and consistent with their intellectual-property obligations.
A key principle across multiple jurisdictions is that publication and international technology transfer are not necessarily the same thing.
The fact that a research paper, specification, report or software project will eventually be published does not automatically remove export-control obligations before publication. Sharing unpublished technical information with collaborators, reviewers, funders or other third parties may still require careful assessment.
Similarly, publication should not be used as a mechanism to transfer otherwise restricted technical information to specific recipients while attempting to avoid export-control requirements.
The CHERI ecosystem relies heavily on international collaboration through academia, industry, open-source projects and standards organisations, including bodies such as RISC-V International and ETSI.
Standards organisations provide important governance frameworks that support international participation and open technical discussion. However, participation in a standards body, research project or CHERI Alliance activity does not automatically exempt participants from export-control, sanctions or other legal obligations.
The CHERI Alliance also incorporates compliance measures within its governance processes. As part of the membership application process, prospective members are required to confirm that they are not subject to applicable sanctions, restricted-party lists, export-control prohibitions or other legal restrictions that would prevent participation in Alliance activities. This helps support the Alliance’s commitment to responsible international collaboration.
Members should nevertheless take particular care before sharing non-public technical information with organisations, individuals or jurisdictions that may be subject to sanctions, export restrictions or other government controls. Where uncertainty exists, organisations should seek advice from their own legal and compliance teams.
Many CHERI Alliance members develop their own processors, semiconductor IP, software products, development tools, security solutions and commercial services based on CHERI technology.
The fact that a product uses CHERI does not determine its export-control status. Export-control obligations typically depend on the specific implementation, functionality, destination, end user, end use and applicable regulations.
Export-control compliance for commercial products remains the responsibility of the organisation developing, marketing or exporting those products.
The CHERI Alliance does not:
Export-control requirements vary significantly between jurisdictions.
For example:
The guidance available to a university, standards body, commercial company or non-profit organisation may differ, and rules are not identical across countries.
Accordingly, every organisation is responsible for obtaining its own export-control advice and determining its own compliance obligations. The CHERI Alliance cannot provide definitive export-control guidance on behalf of its members.
This page provides general information and is not legal, regulatory or export-control advice. The CHERI Alliance makes no representation about the application of export-control regulations to any particular organisation, technology, activity or product. Members and third parties should obtain independent professional advice and comply with all applicable laws and regulations.