The launch of a new RISC-V security chip by Fraunhofer has renewed discussion around open hardware, digital sovereignty and Europe’s technological independence. While open architectures offer significant advantages for transparency and innovation, they do not automatically create trusted infrastructure. Trust is established through secure engineering, independent validation and continuous assurance across the entire technology lifecycle.

For more than two decades, the cybersecurity industry has promoted a simple but powerful idea: transparency improves security. Open-source software demonstrated that allowing independent experts to inspect code could expose weaknesses, improve resilience and reduce dependence on proprietary systems that few people fully understood. As a result, openness gradually became associated with trust, influencing not only software development but also the wider conversation around digital infrastructure.

That same philosophy is now beginning to influence hardware. The rapid growth of RISC-V has attracted governments, semiconductor manufacturers and research organisations that see open processor architectures as an opportunity to strengthen technological sovereignty while reducing dependence on proprietary instruction sets. Recent developments, including Fraunhofer’s announcement of a German-designed RISC-V security chip, illustrate how open hardware is increasingly being positioned as part of Europe’s long-term digital trust strategy. The assumption is understandable: if the architecture can be inspected, independently evaluated and developed collaboratively, confidence in the resulting technology should naturally increase.

Transparency undoubtedly contributes to trust, but it does not establish trust by itself. Open architectures make it possible to examine processor designs, review implementation decisions and identify potential weaknesses without relying entirely on vendor documentation. They provide researchers with greater visibility, encourage collaboration and reduce the risk of hidden functionality remaining undiscovered. These are important advantages, particularly as Europe seeks to build more resilient and sovereign digital infrastructure. However, visibility is only one part of a much larger trust equation.

Every security processor, secure element or embedded controller must ultimately prove that it behaves exactly as intended under real-world conditions. The silicon must be manufactured correctly, firmware must remain protected throughout its operational lifetime, cryptographic functions must perform reliably and resistance to physical attacks such as side-channel analysis, fault injection and electromagnetic probing must be demonstrated through rigorous testing. Open architectures make these activities more transparent and easier to perform, but they cannot replace the engineering discipline, laboratory evaluation and independent certification required to demonstrate that trust has genuinely been established.

This distinction becomes even more important when considering the role of the root of trust. Whether implemented within a secure element, trusted platform module, hardware security module or integrated security controller, the root of trust provides the foundation upon which every higher layer of digital security depends. Device identity, secure boot, firmware integrity, encrypted communications and trusted software execution all rely on the assumption that this initial foundation can itself be trusted. If confidence at that lowest layer is compromised, every subsequent security mechanism inherits that uncertainty regardless of how sophisticated the surrounding software may be.

For this reason, organisations responsible for protecting critical infrastructure rarely rely on openness alone. They combine transparent architectures with formal verification, penetration testing, independent laboratory evaluation, recognised certification schemes and continuous vulnerability assessment. Trust is therefore built progressively through evidence rather than assumption. Each layer of validation increases confidence that a system will continue to perform securely throughout its operational life, even as threats, software and deployment environments evolve.

Europe’s growing interest in open hardware should therefore be viewed within the broader context of digital sovereignty rather than through the narrower lens of processor design. Ownership of an architecture undoubtedly offers strategic advantages, particularly as geopolitical tensions continue to influence semiconductor supply chains and critical technologies. Yet sovereignty extends well beyond intellectual property. It also requires secure manufacturing, resilient supply chains, long-term software support, cryptographic agility and the institutional capability to verify, maintain and continually improve trusted infrastructure over many years.

As connected systems become increasingly software-defined, autonomous and AI-enabled, confidence in the underlying hardware will become progressively more important. Devices are expected not only to perform reliably but also to establish trusted identities, protect sensitive information and provide verifiable evidence that they have not been altered or compromised throughout their operational lifetime. Open hardware represents an important step towards achieving those objectives because it encourages transparency and independent scrutiny, but transparency should always be understood as the beginning of the trust journey rather than its conclusion.

TQS Insight

The growing adoption of open hardware marks an important evolution in how trusted digital infrastructure is developed, verified and maintained. Transparency provides the opportunity to inspect, evaluate and improve hardware designs, but trust ultimately depends on far more than visibility alone. It is established through the combined strength of secure engineering, independent validation, resilient manufacturing and continuous assurance, all working together to provide confidence in the technologies that underpin the digital trust economy.