Robyn N. Burrows and Samarth Barot ●
In December 2022, we discussed the passage of Section 5949 of the Fiscal Year 2023 National Defense Authorization Act (“NDAA”), which introduced prohibitions on certain semiconductor products and services from designated Chinese manufacturers. At the time, the statute’s scope remained unclear, particularly regarding whether the restrictions would apply only to federal sales or extend to contractor “use” of covered technologies, similar to Section 889’s Part B prohibition. On February 17, 2026, the Federal Acquisition Regulatory (“FAR”) Council released a proposed rule that provides important clarity on these questions and establishes a compliance framework for government contractors.
Background and Scope
Section 5949 prohibits executive agencies from procuring or obtaining electronic parts, products, or services that include “covered semiconductor products or services.” The statute reflects Congress’s concern that adversaries and threat actors can introduce “hardware backdoors, malicious firmware, and malicious software” into semiconductors during production.
The proposed rule implements two related prohibitions under Section 5949. Part A prohibits federal agencies from procuring or obtaining any electronic parts, products, or services that include “covered semiconductor products or services.” Part B goes further, prohibiting federal agencies from procuring or obtaining electronic parts or products for use in “critical systems” that incorporate covered semiconductor products, even where the agency is not directly obtaining or procuring the covered components.
Notably, Part B of Section 5949 is significantly narrower than its counterpart under Section 889, which broadly prohibits agencies from contracting with any prime contractor that “uses” covered telecommunications equipment or services—effectively requiring contractors to remove covered telecom from their entire enterprise operations, regardless of whether those operations relate to government contracts. By contrast, Section 5949’s Part B does not impose a blanket prohibition on contractor “use” of covered semiconductors.
The proposed rule implementing Section 5949 would apply to all procurements, including acquisitions at or below the simplified acquisition threshold, micro-purchases, and commercially available off-the-shelf (“COTS”) items. This broad applicability means virtually all federal contracts involving electronic products or services will be subject to the rule’s requirements.
Covered Semiconductor Products and Services
The proposed rule defines “covered semiconductor products or services” to include semiconductors, semiconductor products, or services designed, produced, or provided by Semiconductor Manufacturing International Corporation (“SMIC”), ChangXin Memory Technologies (“CXMT”), or Yangtze Memory Technologies Corp (“YMTC”), including their subsidiaries, affiliates, and successors. Additionally, the definition captures semiconductor products or services produced by any entity determined by the Secretary of Defense or Secretary of Commerce to be owned or controlled by, or otherwise connected to, the government of a “semiconductor foreign country of concern.” Such countries include North Korea, the People’s Republic of China, Russia, and Iran, as well as any country determined by the Secretary of Commerce to be engaged in conduct detrimental to U.S. national security or foreign policy.
The rule contemplates the Department of Commerce maintaining a public website listing entities determined to fall within the prohibition, which contractors may consult when conducting supply chain due diligence.
Compliance Requirements
The proposed rule introduces several compliance obligations, summarized below:
- Reasonable Inquiry and Certification
Before submitting an offer, entities must conduct a “reasonable inquiry” to determine whether their electronic products or services include covered semiconductor products or services. This inquiry requires entities to assess their offerings and identify the source of semiconductor components. Acceptable due diligence methods include consulting the Department of Commerce website, reviewing supplier and manufacturer information, or using supply chain illumination tools. The FAR Council expects most entities to conduct a comprehensive review of their electronic offerings rather than assessing compliance on a solicitation-by-solicitation basis.
Notably, and as with Section 889, a reasonable inquiry need not include independent third-party audits or other formal reviews. Where an entity cannot confirm that a product or service is free of covered semiconductors, it may rely on supplier certifications. Entities acting in good faith may reasonably rely on lower-tier subcontractor certifications unless they discover discrepancies or have reason to doubt the accuracy of the certification. Upon completing the reasonable inquiry, offerors must certify that they have conducted a reasonable inquiry and that they will not provide electronic products or electronic services that include covered semiconductor products or services to the government.
- 72-Hour Reporting Requirement
The proposed rule establishes a stringent post-award reporting requirement for contractors who identify or suspect the presence of covered semiconductors during contract performance. Contractors must notify the contracting officer in writing within 72 hours if they identify, suspect, or are notified by a subcontractor at any tier or any other source that any covered semiconductor product or service has been provided to the government during contract performance—regardless of whether an exception applies. This 72-hour deadline is significantly shorter than the 60-day ceiling authorized by the statute. The FAR Council determined that this compressed timeframe is appropriate given the significant national security risks associated with covered semiconductors and the need to ensure appropriate awareness of covered semiconductor products and services within federal information systems and networks.
- Non-Federal Customer Disclosures
The proposed rule extends certain disclosure obligations beyond government transactions. Contractors and subcontractors that qualify as “semiconductor covered entities” must disclose the inclusion of covered semiconductors in electronic products or services sold to non-federal customers. A “semiconductor covered entity” is defined as an entity that develops a design of a semiconductor that is the direct product of U.S.-origin technology or software and purchases covered semiconductor products or services from SMIC or an entity determined to be owned or controlled by a semiconductor foreign country of concern. The FAR Council views this requirement as essential to enhancing supply chain visibility across the broader U.S. semiconductor market and to allowing non-federal customers to make informed decisions and risk assessments regarding their own purchases.
Exceptions, Waivers, and Safe Harbors
Exceptions. The proposed rule includes several exceptions. First, federal agencies are not required to remove existing equipment acquired before December 23, 2027, nor are agencies required to prohibit the use of covered semiconductors throughout the lifecycle of existing equipment. Second, commercial products or services for which no alternative sources are available are excepted until December 23, 2028, providing industry additional time to identify compliant alternatives. Third, the prohibition does not apply to commercial service procurements except for IT and telecommunications services, nor does it apply to electronic services incidental to contract performance. Note, however, that the government—and not contractors—is responsible for determining whether an exception applies.
Waivers. Agency heads may grant waivers for renewable periods of up to two years upon determining, in consultation with the Secretary of Commerce, that no compliant product or service is available at reasonable prices, and that the waiver would not compromise critical national security interests. The Secretary of Defense, Director of National Intelligence, and other senior officials may also provide waivers in the critical national security interests of the United States. However, the FAR Council has emphasized that exceptions and waivers are intended as a “bridge to near-term compliance with the rule, not an indefinite reprieve from it.”
Safe Harbor. The proposed rule incorporates statutory safe harbors protecting offerors and contractors from civil liability and adverse responsibility determinations when they provide timely disclosures regarding covered semiconductors in products manufactured by other entities, or when they make comprehensive and documentable efforts to identify and remove covered semiconductors.
Next Steps
For contractors, preparing for compliance will require careful evaluation of their supply chains in advance of the effective date of December 2027. Contractors must evaluate not only whether their supply chains include covered semiconductors under Part A, but also—under Part B—whether the electronic products they provide for critical systems depend on or incorporate other electronic components that may themselves contain covered semiconductors. Companies that have not already begun this process should get a head start on their “reasonable inquiry” and identify alternative sourcing options as needed. Indeed, despite the long lead time to the rule’s effective date, many subcontractors should expect that prime contractor customers may soon reach out to inquire about their ability to comply with the rule.
Comments on the proposed rule are due by April 20, 2026. Contractors with concerns about implementation should consider submitting comments. We will continue to monitor developments as the rulemaking progresses.