Export Controls
Public CHERI material supports an open global ecosystem, but organisations must assess export controls before sharing non-public technology or commercial products.
The Export Controls and CHERI Technology page on cheri-alliance.org is the current approved source and takes precedence if this page differs.
The CHERI community works across many countries. Export-control rules vary according to the jurisdiction, organisation, technology, recipient, and proposed use. This information raises awareness and is not legal advice.
Public CHERI technology
The Alliance views the core architecture, openly released specifications, and public software as part of an ecosystem intended for wide implementation and distribution. Examples include public architecture and CHERI-RISC-V specifications, academic publications, technical reports, source repositories, and educational resources.
When material has been lawfully published and is freely available without onward-distribution restrictions, it may fit concepts such as public information, public-domain material, or fundamental research under relevant regimes. The terminology and conditions differ by jurisdiction.
The Alliance encourages publication under recognised open licences where appropriate, including Creative Commons for documentation and Apache 2.0 or similarly permissive terms for software.
Non-public information needs care
An intention to publish later does not normally give unpublished material the same treatment as information already available to the public. Review is particularly important before sharing:
- private repositories and unreleased source code;
- access-controlled collaboration material;
- proprietary implementation documents;
- internal engineering discussions;
- confidential designs;
- customer-specific development.
Publication and international transfer are not necessarily the same act. Sharing draft material with collaborators, reviewers, funders, or other recipients before publication may still need an export-control assessment. Publication must not be used to route restricted technology to a particular recipient while avoiding legal controls.
Standards and international collaboration
The ecosystem depends on international work through universities, industry, open-source projects, and standards bodies such as RISC-V International and ETSI. Participation in one of these bodies, a research programme, or an Alliance activity does not automatically create an exemption from export-control, sanctions, or other legal duties.
The Alliance’s membership process asks prospective members to confirm that sanctions, restricted-party rules, export prohibitions, or other legal restrictions do not prevent their participation. Each member must still assess non-public sharing and obtain advice from its own legal or compliance specialists when uncertain.
Commercial products and services
Using CHERI does not decide the export classification of a processor, semiconductor IP block, tool, software product, service, or complete system. The applicable result may depend on implementation, functions, destination, end user, end use, and current regulations.
The organisation developing, selling, or exporting the product remains responsible for compliance. The Alliance does not classify products, assign export-control classification numbers, obtain licences for members, certify export compliance, or provide legal advice.
Organisation-specific responsibility
The European Union, United States, United Kingdom, and other jurisdictions use different legislation, definitions, exemptions, and guidance. A rule applicable to a university may not apply in the same way to a commercial business, standards organisation, or non-profit body.
Every organisation must determine its own obligations and obtain qualified advice. The source page links relevant EU dual-use rules, research compliance material, US public-information and fundamental-research guidance, and UK guidance for academic research and publication.
Disclaimer
This page is general information only. It is not legal, regulatory, or export-control advice, and it makes no determination about a particular organisation, product, technology, or activity. Comply with all applicable rules and seek independent professional advice.