Nvidia's AI Factory Software Carries a Price: $2,000 Per GPU Per Year and a New Safety Stack

Jensen Huang told an audience at GTC Berlin's closing question-and-answer session on October 22 that running Nvidia's full AI-agent software stack on what he calls AI factories costs approximately $2,000 per GPU per year — the most specific figure the company's CEO has offered for the software subscription business he has signaled is becoming material to Nvidia's revenue model. The remark was not accompanied by a product launch or a formal price sheet, but it arrived alongside a substantially more complete picture of the technical infrastructure Nvidia intends to license: a kernel-isolated agent runtime, a hardware-separated security watchdog, and a die-counting policy reversal that makes Vera Rubin deployments cheaper to license than earlier Nvidia statements implied.

A Licensing Signal Without a Product Launch

Huang's comments came on the final day of GTC Berlin, a three-day conference at STATION-Berlin from October 20 to 22, with a keynote delivered at the Tempodrom the previous evening. "Software licensing will become increasingly a major part of our company's business," Huang said. "The way that we license will be — for example, it's about $2,000 per GPU per year to run all the software that Nvidia provides that runs agents on these AI factories."

The figure is notably lower than Nvidia's existing commercial AI software subscription, NVIDIA AI Enterprise, which carries a list price of $4,500 per GPU for a one-year term or $18,000 per GPU for a five-year commitment. Nvidia has not clarified whether the $2,000 figure describes a new agent-specific product, a volume-discount target, or a different framing of AI Enterprise for the agent era. No formal product accompanied the number.

What the comment confirmed is the general architecture of Nvidia's software ambition: a recurring per-GPU subscription attached to its AI factory platform, covering agent runtime, security enforcement, orchestration, and the related infrastructure software Nvidia has built and packaged over the past year.

OpenShell's Four-Component Architecture Is the Technical Foundation for the Pricing Pitch

The product most directly underlying that subscription case reached its first versioned release — OpenShell v0.1.0 — on October 21 at the GTC Berlin keynote. The runtime first appeared at GTC in March 2026; the Open Agent Safety Platform, which bundles OpenShell with the Sentry security service, launched September 28 with more than 100 declared partners.

OpenShell's architecture separates agent execution into four components, each designed to prevent an agent from gaining access it was not explicitly granted. The Gateway manages sandbox lifecycles and enforces policies at the boundary between an agent and the systems it can reach. The Supervisor intercepts all outbound requests from inside the sandbox and handles credentials separately — the sandboxed agent never directly holds long-lived API keys or service tokens, closing a common privilege-escalation vector. The Sandbox is kernel-isolated with no direct network access; every outbound connection passes through the Supervisor. The Policy Prover is what distinguishes OpenShell from most agent governance frameworks: rather than asking a second language model whether a given request is safe — an approach vulnerable to prompt injection and inconsistent reasoning — the Policy Prover uses formal verification to check that combined permissions across the entire agent fleet stay within the ceiling an operator has set.

Ali Golshan, Nvidia's senior director of AI software, described the Policy Prover as deterministic and approximately two orders of magnitude faster than an LLM-based judge. The practical significance is that formal verification eliminates the recursive trust problem (one AI deciding whether another AI is safe), removes latency overhead on every tool call, and closes the adversarial surface for injection attacks.

Sentry Adds Hardware-Level Enforcement That Operates Outside the Host

For deployments needing stricter enforcement, Nvidia offers Sentry — a watchdog service running on BlueField-4 data processing units in a hardware trust domain separate from the host CPU and GPU. Sentry routes an agent's model endpoint through a DPU proxy, allowing it to observe reasoning traces without relying on the agent or host to self-report. If an anomaly is detected, Sentry can sever network access within milliseconds — independently of the agent's cooperation.

The hardware architecture maps onto three layers of Nvidia's server design: Vera Rubin GPUs handle foundation model inference; Vera CPUs (36 per NVL72 rack alongside 72 Vera Rubin GPU modules) execute agent workloads inside OpenShell sandboxes; BlueField-4 DPUs run Sentry in the separated trust domain. Justin Boitano, Nvidia's vice president of enterprise AI, described Sentry as optional for most use cases — OpenShell software controls are sufficient for standard access control — with the DPU layer recommended primarily for high-risk cases such as red-teaming with guardrails removed.

Sentry is not yet generally available. Nvidia has indicated the service is targeted for early 2027 availability.

Die Counting Reversal Reshapes the Per-Server Licensing Math

A separate GTC Berlin disclosure with direct financial implications concerns how Nvidia counts GPU units for licensing. Earlier in 2026, Huang indicated Nvidia had considered counting each silicon die inside a multi-die GPU module as a separate license unit — an approach that would effectively double the license count for server-grade accelerators built on multi-chip packages. At GTC Berlin, Huang confirmed Nvidia is reverting to whole-module counting for the Vera Rubin generation.

At 72 modules per NVL72 rack, the difference between die-level and module-level counting could represent tens of thousands of dollars per rack per year at the $2,000 per-unit figure Huang described. The two moves — a favorable die-counting policy and a software-licensing pitch — are strategically linked: reducing hardware-licensing friction for Vera Rubin adoption while building the case for a software subscription layer above it. The structure mirrors how enterprise software companies have operated for decades: predictable platform costs, recurring software margin on top.

No cloud provider offers a comparable hardware-isolated containment architecture. AWS Bedrock Guardrails, Microsoft Azure Content Safety, and Google Vertex AI Agent Builder all enforce agent governance at the software layer, without a DPU-separated trust domain or formal-verification policy engine. Nvidia's integration of inference silicon (Vera Rubin), agent execution (Vera CPUs), and network security enforcement (BlueField-4) into a single reference architecture is a configuration only Nvidia can bundle natively.

Read more: Schneider Electric, HPE, and Nvidia Deploy AI Agents for Factory Operations at the Edge

OpenShell's partner list includes Anthropic, whose Claude Managed Agents runtime integrates with the framework; ServiceNow, which is integrating OpenShell into its enterprise agent platform; and security vendors CrowdStrike, Palo Alto Networks, Zscaler, and Check Point. BBVA and Santander are evaluating the platform for financial-services agent governance.

Material Questions Remain Unanswered Ahead of Q3 Earnings

Nvidia has not specified what software bundle the $2,000 figure covers, how pricing differs between on-premise AI factories and cloud-hosted deployments, or how agent licensing interacts with existing hyperscaler agreements. No launch date has been set for a formal product at that price point.

Nvidia reported $96.2 billion in quarterly revenue in its most recent earnings period, with $89 billion from data center — a figure driven by hardware sales. The company's Q3 FY2027 earnings call, expected around November 18, will be the earliest opportunity to determine whether Nvidia has formalized the licensing tier Huang described, or identified the volume of agent-software deployments already running under that model. At one million licensed GPU units, the $2,000 figure generates $2 billion in annual recurring software revenue. The architecture to collect it now has a versioned runtime and a hardware enforcement layer. The product that formally charges for it has not yet launched.