FAR Council Issues Notice of Proposed Rulemaking to Implement Prohibition on Acquisition of Certain Semiconductors

By Michael Wagner, Susan B. Cassidy, Ryan Burnette & Eunsun Cho on February 26, 2026

On February 17, 2026, the Federal Acquisition Regulatory Council released a Notice of Proposed Rulemaking, proposing amendments to the FAR to implement Section 5949 of the FY23 National Defense Authorization Act (“NDAA”). Section 5949 prohibits executive agencies from obtaining semiconductor parts, products, or services traceable to certain named Chinese companies – currently, Semiconductor Manufacturing International Corporation (“SMIC”), ChangXin Memory Technologies (“CXMT”), and Yangtze Memory Technologies Corp (“YMTC”) – subject to limited exceptions. In accordance with the statute, the proposed amendments to the FAR would become effective on December 23, 2027. The proposed rule is not yet final and is open for public comment until April 20, 2026.

Prohibition and Definitions

The proposed rule builds upon an Advanced Notice of Rulemaking (“ANPRM”) from May 2024, which we discussed in a previous post. As expected, the proposed rule would implement two prohibitions under Section 5949(a)(1), Part A and Part B:

Under Part A, executive branch agencies may not procure or obtain any electronic parts, products, or services that include covered semiconductor products or services; and

Under Part B, which applies only to critical systems, executive branch agencies may not procure or obtain an electronic product or service that uses any electronic products that include covered semiconductor products or services.

“Covered semiconductor product or service” is defined to include semiconductors, products that incorporate a semiconductor product, or services that utilize a semiconductor product, that are designed, produced, or provided by SMIC, CXMT, YMTC, or any of their affiliates, subsidiaries, or successors. In addition, the Secretary of Defense or the Secretary of Commerce, in consultation with the Director of National Intelligence or the Director of the FBI, can prohibit semiconductors that are designed, produced, or provided by other companies upon a determination that those companies are owned, controlled by, or otherwise connected to the governments of so-called “semiconductor foreign countries of concern.” Currently, “foreign countries of concern” include North Korea, China, Russia, and Iran. According to the proposed rule, the Department of Commerce will publish a list of any such newly designated entities in the Federal Register. No entities other than SMIC, CXMT, and YMTC have yet been designated.

The proposed rule is notable for its scope. The rule would apply to procurements below the Micro Purchase Threshold (i.e., below $15,000). The rule also would apply to commercial products, including commercially available off-the-shelf (COTS) items, and to commercial IT and telecommunication services. The combination of these two scoping decisions, which the FAR Council indicated were made in the interests of national security, means that the rule is likely to apply to a broad swath of procurements by executive branch agencies.

Notwithstanding the generally broad application of the requirements, the rule does contain a meaningful carveout for commercial services contracts, except commercial IT and telecommunications services. In explaining this carveout, the FAR Council specifically noted the potential for overly broad application of the requirements in contexts where covered semiconductors present relatively limited risk to the Government and where the Government may only represent a fragment of the overall market. Additionally, as discussed further below, there is a meaningful grandfathering provision for covered semiconductors present in existing equipment prior to December 23, 2027.

Although Part B has the potential to reach further into the supply chain than Part A, Part B is limited only to “critical systems.” The proposed rule does not further define “critical systems” beyond a citation to the underlying statute, which defines a critical system to be the same as a “national security system” in 40 U.S.C. § 11103.[1] The proposed rule provides two illustrative examples of use cases that would be prohibited under Part B: (1) “a control panel within a critical system that enables an Internet of Things (IoT) device that includes a covered semiconductor product or service,” or (2) “an unmanned aircraft ground control station that controls an unmanned aircraft that includes a covered semiconductor product or service.” The first example appears to be a modified version of what was contemplated in the ANPRM, while the second example is entirely new. The proposed rule also provides that contracting officers are required to identify any requirements associated with critical systems in a relevant solicitation.

Notable Aspects

Other notable aspects of the proposed rule include the following:

Reasonable Inquiry and Offeror Certification: Offerors would need to conduct a reasonable inquiry to determine whether the electronic products or electronic services they provide to the Government include covered semiconductor products or services, or (for critical systems) use electronic products that include covered semiconductor products or services. The inquiry must be intended to uncover any information in the offeror’s possession, including information from external sources. The proposed rule explains that this inquiry may involve identifying the source of semiconductor products or services, consulting the Department of Commerce list of entities determined to be owned or controlled by the government of a semiconductor foreign country of concern, searching supplier websites, or using other supply chain due diligence tools. The proposed rule also notes that contractors may reasonably rely on the certifications of compliance from covered entities and subcontractors who supply electronic products or services, and that a reasonable inquiry does not require an independent audit or formal review. Offerors would also be required to certify that they have conducted a reasonable inquiry and that they will not provide products or services prohibited under the proposed rule. The FAR Council determined that offerors will not need to submit proof of compliance with the requirements at this time, such as by providing a bill of materials to the Government.

Disclosure and Safe Harbor Provision: The proposed rule provides a safe harbor provision for contractors or suppliers that provide a disclosure regarding covered semiconductor products or services in electronic products that are manufactured or assembled by an entity other than the offeror or lower-tier supplier. This disclosure would shield contractors and suppliers from civil liability and present responsibility risks that relate to the disclosure.

Flowdown: Prime contractors will be required to flow down the prohibitions in all subcontracts for the supply of any electronic products and services.

Exceptions and Waivers

However, the proposed rule provides the following exceptions and waiver authorities:

Grandfathering exception: The prohibition does not require a contractor to remove or replace any products or services resident in existing equipment, systems, or services, that were acquired before December 23, 2027, and proposed as part of performance of the contract. Contractors are also not required to prohibit or limit the utilization of covered semiconductor products or services throughout the lifecycle of existing equipment that was acquired before December 23, 2027, and proposed as part of performance of the contract.

Waiver process: Heads of agencies can issue a two-year renewable waiver of the prohibition through interagency process, based on (1) a determination that no compliant product or service is available at U.S. market prices or at a price not prohibitively expensive, or (2) a determination that the waiver could not reasonably be expected to compromise critical national security interests. In addition, select agency heads can issue a waiver for any executive agency upon determining that a waiver is in the critical national security interests of the United States.

Limited and temporary exception for commercial items: For commercial products or commercial IT and telecommunication services, the proposed rule does not apply until December 23, 2028 if there are no available alternative sources. The rule does not clarify how this determination will operate in practice or who will make the availability determination.

Takeaways

If adopted, the proposed rule will impose significant new compliance requirements on contractors. At the same time, the proposed rule reflects several clarifications of the ANPRM, which offer guidance on best practices for implementation. These include new illustrative examples of the Section 5949(a)(1)(B) prohibition, clarification that contractors have no affirmative obligation to provide proof of compliance, and exceptions for many types of commercial services. Still, there are aspects of the proposed rule that raise questions or otherwise may be susceptible to more than one interpretation.

Interested parties who wish to be heard on these points are encouraged to submit comments by April 20, 2026, to be considered in the final rulemaking process.

We will continue to monitor the development of this rule. If you have any questions concerning the material discussed in this post, please contact the members of our Public Policy, Cybersecurity, and Government Contracts groups.

[1] The term “national security system” means “a telecommunications or information system operated by the Federal Government, the function, operation, or use of which – (A) involves intelligence activities; (B) involves cryptologic activities related to national security; (C) involves command and control of military forces; (D) involves equipment that is an integral part of a weapon or weapons system; or (E) subject to paragraph (2), is critical to the direct fulfillment of military or intelligence missions.”