On May 3, 2024, the federal government took steps to ban federal purchases of semiconductor products from certain U.S. foreign adversaries in a proposed rule that would affect the majority of federal contracts. The proposed rule would amend the Federal Acquisition Regulation (FAR) to implement section 5949 of the 2023 National Defense Authorization Act (Pub. L. 117-263) (NDAA). The rule was proposed in response to a finding by the U.S. Office of the Director of National Intelligence that semiconductors are one of the technology sectors where the stakes of disruption are greatest for U.S. economic interests and national security. Threats include hardware backdoors, malicious firmware, and malicious software that can be introduced into semiconductors that are incorporated into critical infrastructure, military applications, and other end products. If approved, the rule would go into effect on December 23, 2027.
In its current form, the proposed rule will bar the purchase of semiconductors, semiconductor products, products that incorporate a semiconductor product, and/or a service that utilizes such a product made by companies designated as being owned or controlled by the Chinese, Russian, North Korean, or Iranian governments. The proposed rule also specifically prohibits purchasing new products or services that use semiconductor chips made by the Chinese companies Semiconductor Manufacturing International Corp., ChangXin Memory Technologies, and Yangtze Memory Technologies Corp. and their affiliates.
Under the proposed rule, a contractor will be required to notify the contracting agency within 60 days of the date that they become aware, or have reason to suspect, that any product to be used in a critical system purchased by the federal government, or purchased by a contractor or subcontractor for delivery to the federal government for any critical system, contains covered semiconductor products or services. There is a safe harbor from civil liability for contractors that make these disclosures if the contractor documents its efforts to identify and remove covered products or services. However, the rule would impose liability on entities found to violate the rule, including requiring the entity to be responsible for any rework or corrective action if it fails to disclose a covered semiconductor product.
The proposed rule would also require federal contract bidders to utilize an extensive certification process in which they would have to conduct a "reasonable inquiry" into the components of the products they offer to try to detect and avoid use of prohibited semiconductor products or services in the electronic products or electronic services they sell to the federal government. The proposed reasonable inquiry would permit contractors to reasonably rely on appropriate certifications of compliance from subcontractors and other entities, but may require them to include other mechanisms of affirmative diligence review. Contractors would also be required to disclose whether their products include any covered semiconductors or services. The proposed rule contemplates that agencies may grant waivers if deemed necessary in certain circumstances, such as when any alternative product is deemed unreasonably expensive or if the proposed semiconductor product or service is not considered a security risk.
The FAR Council anticipates this rule will impact a large majority of federal contracts and orders due to the prevalence of electronic products and services. The rule applies to subcontractors by mandating that prime contractors incorporate these prohibitions into subcontracts for the supply of any electronic products. The rule will also apply to micro-purchases and commercial off-the-shelf products because the prohibitions impact any product or service that uses or provides electronic products or electronic services to the federal government.
The FAR Council asked for public comments on 16 specific questions, including, among others:
- How to further clarify the scope of the prohibition
- How to define the "reasonable inquiry" that an entity must make
- Whether an entity has sufficient visibility into its supply chain to determine whether the supply chain uses covered semiconductor products or services
- What impact this rule may have on an entity
- Whether an entity anticipates needing a waiver when the prohibition goes into effect in December 2027 and, if so, how long the entity anticipates it will take to find alternative semiconductors to be compliant
- Whether the Department of Commerce should establish a public list to identify electronic products with prohibited semiconductors
Any industry stakeholder may submit a public comment about this proposed rule. A commenter may attach files (maximum of 20 files up to 10 MB each), and choose whether to identify itself as an individual or an organization or submit anonymously. Information entered on the web form may be viewable publicly. Note the comment period ends at 11:59 p.m. ET on July 2, 2024.
Additionally, due to the complexity of changes that may be required for contractors to comply with this rule by the December 23, 2027 effective date, contractors should immediately implement plans to identify proscribed products and services that are used in their offerings and should execute plans to replace products and services that would be prohibited by the proposed December 23, 2027 effective date. Where a contractor does not believe that such products and services can be eliminated by the December 23, 2027 deadline, contractors should consider making comments on the proposed rule to raise potential impracticability or impossibility of compliance with the proposed rule, and/or to identify areas where the government should consider clarifications, exceptions, or waivers.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.