Open ISA, closed chip: what “open” actually buys you
Ask is RISC-V open source and you get a yes, a no and a lecture, usually in that order. The truthful version: the instruction set is open and free to implement, while the chip in your hand might be every bit as closed as anything Arm ships. For anyone building IoT hardware, knowing which half is open is the difference between a cheaper bill of materials and a false sense of security.
The short version nobody puts on the slide
“Open source” is doing a lot of heavy lifting in that question, and most of it in the wrong place. RISC-V is not a program you download and run. It is a specification: a written definition of how a processor is supposed to understand instructions. The closest everyday comparison is a dictionary. A dictionary tells you what words mean and how to use them. It does not write your novel, and it certainly does not run on your laptop.
So the accurate answer has two parts. The specification is open. Any given implementation of that specification may or may not be. Conflating the two is how the confusion starts, and it is a confusion worth clearing up before you spec a single board.
What is genuinely open: the ISA itself
The RISC-V instruction set manual is published under a permissive CC-BY 4.0 licence. You can read every page, build a processor that implements it, and ship that processor in a product, without asking anyone’s permission and without paying a per-core royalty to a licensor. There is no equivalent of Arm’s architecture licence fee and no royalty meter running on every unit you sell.
That is the genuinely radical bit, and it is the bit that matters most to IoT. The base integer ISA plus the standard extensions (the RV64GC flavour you will see on Linux-capable parts, or the leaner profiles on a microcontroller) are a common target that anyone can build against. The specification being free is what lets a dozen vendors, a research group and a lone engineer with an FPGA all produce compatible silicon without a gatekeeper in the middle.
Where “open” quietly stops: the implementation
Here is the part the enthusiasm tends to skip. An open ISA does not oblige anyone to open the design built on top of it. A vendor can take the free specification, spend two years and a lot of money designing a core, and keep every line of that design firmly shut. That is not a loophole. It is explicitly allowed, and it is what most commercial RISC-V silicon actually does.
Which means a proprietary RISC-V microcontroller is, from where you sit as a buyer, about as much of a black box as an Arm one. You get a datasheet, a reference manual and a binary blob or two, not the register-transfer logic. The freedom RISC-V hands you at the ISA layer does not automatically extend to the chip. You can read a CVA6 core over a wet weekend if you fancy it. You cannot read what is inside most shipping RISC-V MCUs, and nobody is required to let you.
| Question | The RISC-V ISA (the spec) | Open-source cores | Commercial cores |
|---|---|---|---|
| Licence | CC-BY 4.0, free to read and use | Open hardware licence (e.g. Solderpad) | Closed, commercial terms |
| Royalty to implement the ISA | None | None | None |
| Can you read the design (RTL)? | N/A, it is a specification | Yes | No |
| Can you audit or modify the silicon? | N/A | Yes | No |
| Examples | The manual itself | Rocket, BOOM, CVA6, SHAKTI | SiFive, Andes, StarFive |
| Still “real” RISC-V? | Yes | Yes | Yes |
One ISA, two kinds of chip
The clean way to hold all this in your head: there is a single open ISA underneath, and everything sits on it. What sits on top splits into two camps. Open-source cores publish their design so you can inspect, modify and simulate it. Proprietary cores keep the design closed and sell you the finished product. Both are legitimate RISC-V. A few vendors straddle the line, publishing some open work while selling closed flagship cores.
The openness lives at the ISA layer, not the chip layer. RISC-V frees you from licensing the instruction set. It does not, on its own, hand you an auditable piece of silicon. If you need the second thing, you have to go and choose it.
Why this distinction matters for IoT specifically
Two practical consequences, and they pull in different directions. The first is commercial. Because there is no royalty on the ISA and no single licensor, RISC-V lets you drive cost out of a high-volume, thin-margin IoT bill of materials, roll your own core if you have the appetite, or pick from a widening field of vendors without one company holding the keys. For anyone shipping millions of sensor nodes, that freedom is the headline, and it is a big part of why RISC-V matters for IoT at all.
The second is security, and it is where the open-source-core option earns its keep. In security-critical IoT, a secure element, a root of trust, a device that has to be trusted in the field for a decade, “open” stops being a licensing perk and becomes an audit trail. With an open-source RISC-V core you can, in principle, inspect exactly what the silicon does. That option genuinely exists in RISC-V, and it does not meaningfully exist on the Arm side. But it only helps if you actively select an open implementation. Buy a closed RISC-V MCU and you have bought a black box with a nicer licence attached.
Rule of thumb: choose RISC-V for freedom from the ISA royalty and vendor lock-in. Choose an open-source RISC-V core when you also need to verify what the hardware is doing. They are two separate decisions, and the second one does not come free with the first.
The trademark sting in the tail
One last wrinkle, and it connects to who actually owns RISC-V. You are free to implement the ISA and sell the result. Using the RISC-V name and logo commercially is a different matter: that requires a trademark licence, granted to members of RISC-V International for compliant designs. So the model is free to build, not entirely free to badge. The instruction set is open. The word on the box is governed. Keep the two apart and the whole “is it open source” question stops being a debate and becomes a straightforward map of what you can and cannot rely on.
Last updated 6 August 2026. Sources: RISC-V International FAQ and brand guidelines (ISA is free and open under a permissive licence; implementations may be open or fully closed; trademark use requires a member licence); the RISC-V Instruction Set Manual, released under CC-BY 4.0; CVA6 (OpenHW Group) published under the open-source Solderpad Hardware Licence.
