At Long Last, DoW Signals Rule Implementing PCB Prohibition and Commercial Exemptions

On July 2, 2026, the Department of War (DoW) issued an Advance Notice of Proposed Rulemaking (ANPR) setting out a framework to implement the prohibition on acquisition of covered printed circuit boards (PCBs) from “covered nations”—North Korea, China, Russia, and Iran—enacted under sections 841 and 851 of the National Defense Authorization Acts (NDAAs) for Fiscal Years 2021 and 2022, respectively, and codified at 10 U.S.C. § 4873.  DoW invites industry to respond to specific questions and provide comments on the ANPR by August 31, 2026.

The PCB prohibition was originally enacted as Section 841 of the FY 2021 NDAA, which would have prohibited DoW from purchasing or using other-than-commercial products and services incorporating PCBs from covered nations.  The next year, Section 851 of the FY 2022 NDAA amended the prohibition to cover almost all PCBs integrated into commercial products and services unless DoW issued regulations exempting them, based on the Trusted Supply Chain Security Standards (“TSCSS”) that DoW was to issue under Section 224 of the FY 2020 NDAA.  The PCB prohibition becomes effective on January 1, 2027.

Overview of ANPR

At a high level, the ANPR provides some much-needed clarity regarding the PCB definition and scope of the prohibition and describes the waiver process, but it leaves open important questions about the prohibition’s applicability.  The ANPR clarifies that DoW does not intend the PCB prohibition to “impose unreasonable restrictions on the procurement of commercial products, including [COTS] items.”  Instead, DoW announced its intent, with any final rule, to implement the Trusted Supply Chains Security Standards for Microelectronics under section 224 of the FY 2020 NDAA, which tie to a statutory exception for PCBs in commercial products, commercial services, and COTS items.

Definition of Covered PCBs. The ANPR would adopt the 10 U.S.C. 4873(c) definition of “covered PCBs,” which includes PCBs incorporated into non-commercial products and services, or PCBs incorporated into commercial products and services only when they are components of (1) a “defense security system,” as defined by 10 U.S.C. § 4873 (i.e., a system involved in command and control of the military, weapons systems, or critical to military missions and not used for routine administrative functions) or (2) a system that DoW has identified as national security sensitive in the applicable contract.  This definition indicates that the prohibition on covered PCBs will not apply to all contracts, although the ANPR’s downstream requirements still suggest that all parties in the supply chain whose components could end up in a defense security or national security-sensitive system will bear a compliance burden, even where they are in commercial products and services.

Waiver Process. In the APNR, DoW explains that contractors will be required to submit a multi-faceted waiver request package to their respective contracting officers to support waiver determinations.  DoW anticipates that the package will include: (1) valid, third-party certifications demonstrating compliance with the IHAF; (2) complete IPC-1782 traceability data; (3) a Trusted Assembler verification report; (4) a market availability justification; (5) component identification; (6) a system application and impact assessment; (7) a transition strategy to qualify alternative domestic or allied sources; and (8) the requested waiver scope and duration.  The ANPR states that contractors “may propose alternative mitigation strategies,” but that the current proposed waiver process will hinge on compliance with the IHAF.

Ongoing Compliance Obligations. The ANPR also forecasts that DoW will likely include ongoing recordkeeping and data retention requirements in a final rule.  Contractors must be prepared to provide IPC-1782 manufacturing traceability logs and IPC-1791 independent hardware assurance test reports, if required.  Additionally, the ANPR suggests that contractors and independent verification facilities will be required to retain all verification imagery for 10 years following the final delivery of a PCB, or the operational lifespan of the relevant defense security system, whichever is longer.

Treatment of Proprietary Data. The ANPR would require contractors to allow the government access and use of provenance, traceability, and verification data for inspection, audit, and compliance verification.  The ANPR states that DoW will not use this data for competitive reprocurement and will treat it as proprietary.  Additionally, the ANPR forecasts that contractors will not be allowed to rely on claims of trade secrets or proprietary information to restrict government access.

Flowdown Requirements. The ANPR would impose affirmative obligations on contractors to flow down the requirements of the future implementing clause so as to provide PCBs that “comply with the geographic restrictions and technical standards, ensuring a secure, unbroken, and verifiable supply chain from initial materials to final system integration.”  Contractors will be required to flow down any DFARS clause resulting from the eventual final rule, including into their subcontracts for commercial products and services.  Before integrating covered PCBs into final deliverables, contractors would additionally be required to collect and verify relevant certifications (i.e., ISO/IEC 20243 and IPC-1791) and IPC-1782 traceability data from all suppliers and facilities.

Advocacy Opportunities

DoW is seeking private sector, and specifically defense industrial base and PCB manufacturer, input on key topics.  These topics include the definitional clarity of the ANPR, certification burdens and timelines, the sufficiency of limitations on DoW’s data rights, and data regarding market segmentation.