Building AI Controls Into Chips Can’t Replace Your Contract Terms

← Back · ACT III · Chapter 22: Embedding Buyer Governance

Enforceability is a property of the terms value is recognized against, not of the metal it runs on or the budget line it hides in.

There is a serious body of research on putting enforcement into the hardware. Proposals for flexible hardware-enabled guarantees would pair an AI accelerator with, in the authors’ words, “an auditable guarantee processor that monitors accelerator usage and a secure enclosure providing physical tamper protection,” so that a rule about how the chip may be used cannot be quietly rewritten by whoever is running it. The fear behind that work is a real one, and this site has argued the same thing in other terms: policy can be edited, software can be bypassed, and a control that depends on one person insisting on it lapses the quarter that person leaves.

What it does is move the binding away from the place where value is judged and into the place where value happens to run. A rule welded into a chip is durable in one sense and fragile in most of the others, because it travels with the machine rather than with the buyer. Change the hardware, the vendor or the deployment, and the enforcement that was paid for is a feature of equipment nobody uses any more.

Mutable Policy Was Never The Enforcement

The critique of soft controls is correct as far as it goes. A rule that lives only in a document holds while someone insists on it and lapses without announcement when they stop. The answer to a rule that can be quietly rewritten is not a rule that can never be touched, though, but a rule that value has to meet before it counts. Being impossible to move is not the same as being binding, and a control can be permanent and still irrelevant if nothing makes value pass through it.

A Standard Binds At The Point Of Recognition

Value governed by a standard is not enforced by the medium it runs on. It is enforced by something simpler: value that does not conform is not recognized as value, so the binding sits at the moment the buyer accepts the result rather than in the substrate where the work executed. That is why a standard does not have to be welded into a chip or defended by a person, and why it does not need to be impossible to rewrite, because the enforcement was never sitting in its text. It sits in the fact that conformance is the condition of being counted at all.

That structural move is no longer an unusual one, and saying so is more useful than claiming it. Bain now tells enterprises to govern agents at the boundary where they reach data and tools rather than inside the model’s reasoning, on the plain ground that “unregistered agents and tools don’t run.” That is the same architecture of enforcement: a gate something has to pass, rather than a property welded into the thing being governed. What is still unoccupied is the object of the gate. Those gates decide what an agent is permitted to do, and none of them decides whether what came out of the other end counts as value. That is the gate the buyer has to hold, and holding it starts with the buyer setting the definition. A standard built this way needs no custodian, because it holds as the reference rather than because someone is standing on it.

Where The Governing Asset Actually Sits

The two rival framings make the same mistake in opposite directions. One of them books the governing asset as software, rented by the month and swapped without much thought, while the other casts it in hardware, owned by welding it into physics. Both put the asset somewhere it can be rented away or carried out of the door with the equipment. The software framing has its own version of this, where the fix is to own the architecture outright, and it relocates custody just as surely. Terms are not rented and cannot be cast: the buyer holds them, conformance is the gate, and the enforcement stays where the buyer put it no matter what metal or vendor is underneath this quarter.

Enforcement that lives in the hardware belongs to the hardware, which is the one part of this arrangement a buyer is certain to replace.

References

James Petrie, Onni Aarne, Nora Ammann and David Dalrymple, “Flexible Hardware-Enabled Guarantees for AI Compute,” arXiv:2506.15093, submitted 18 June 2025, part one of three, which specifies the auditable guarantee processor and the secure enclosure providing physical tamper protection. The companion paper on implementation is “Technical Options for Flexible Hardware-Enabled Guarantees,” arXiv:2506.03409. ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, Edition 1, published 18 December 2023 by ISO/IEC JTC 1/SC 42, the first international management system standard for AI, iso.org. Bain & Company, “Decision 4: Technology Architecture,” in the “How to Win with AI” series, bain.com. All three sources opened and read 13 September 2026.

Keep reading: ACT III · Chapter 22: Embedding Buyer Governance