US FPGA supply chain faces China-linked availability and security risks

The US FPGA supply chain lacks security and resilience against disruption; Chinese legacy-node semiconductor expansion increases both availability and security risks across defense, telecom, and AI sectors.

Field-programmable gate arrays (FPGAs) are specialized, reprogrammable semiconductor chips critical to US military systems (F-35, Javelin missile), cloud infrastructure (Microsoft Azure), automotive (Volvo EX90), and 5G telecommunications. Unlike leading-edge logic chips, FPGAs have 20+ year product lifecycles and operate at legacy process nodes (16–28nm), making them fundamentally different from the semiconductors addressed by recent US policy like the CHIPS Act. The Atlantic Council report identifies three primary supply chain risks: cost (vendors prioritizing price over security), availability (geographic and supplier concentration, potential disruption from Taiwan-based foundries, PRC regulatory decisions), and security (complexity enabling hardware/gateware tampering, insufficient security investment). US firms prioritize cost minimization, significantly underinvesting in security resilience. China's ongoing buildout of legacy-node manufacturing capacity will reduce costs but introduce additional availability and security risks, particularly given PRC control over production and potential for supply restriction or compromised hardware. The report recommends four policy interventions: establish a government data-sharing hub for FPGA supply chain intelligence, invest in long-term FPGA security measures, stockpile critical FPGAs for military and commercial use, and conduct cross-sector supply disruption planning coordinated by DoD or Commerce.

Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/report/to-secure-reprogrammable-chips-the-us-must-address-supply-chain-risks