1. Home
  2. |Insights
  3. |“(Don’t) Let the Chips Fall Where They May”: FAR Council Previews Proposed Rule Implementing the Covered Semiconductor Prohibition

“(Don’t) Let the Chips Fall Where They May”: FAR Council Previews Proposed Rule Implementing the Covered Semiconductor Prohibition

Client Alert | 16 min read | 05.08.24

On May 3, 2024, the Federal Acquisition Regulation (FAR) Council issued an Advanced Notice of Proposed Rulemaking (ANPR) regarding the prohibition on semiconductors produced by certain Chinese manufacturers, enacted in Section 5949(a)(1) of the James M. Inhofe National Defense Authorization Act (NDAA) for Fiscal Year 2023 (Section 5949) expanding on the prohibition on covered telecommunications equipment and services produced by Huawei, ZTE, and others from Section 889 of the FY 2019 NDAA (Section 889).    

While the ANPR provides terms and prohibitions consistent with Section 5949, along with express safe havens for prompt reporting and remediation, the ANPR also identifies meaningful changes to the standard for “reasonable inquiry,” and it previews the FAR Council’s consideration of additional restrictions or requirements.  Comments and responses to the FAR Council’s questions are due on July 2, 2024.  The statutory deadline for a final rule is December 23, 2025, and the semiconductor prohibition will go into effect on December 23, 2027.  This rulemaking process will be one to watch, as the prohibitions will affect nearly all electronic products and services (as acknowledged by the FAR Council in its commentary), from power chargers to fighter jets.  

I. Prohibition

Section 5949 contains two prohibitions on the purchase or use of “covered semiconductor products or services,” defined as those designed, produced, or provided by Semiconductor Manufacturing International Corporation (SMIC), ChangXin Memory Technologies (CXMT) or Yangtze Memory Technologies Corp (YMTC), and any of their affiliates.  Both prohibitions will apply to all procurements, including commercially available off-the-shelf (COTS) items, and purchases below the micro-purchase threshold:

  • Section 5949(a)(1)(A) (Part A) prohibits agencies from acquiring electronic products or services that include covered semiconductor products or services. Part A is focused on what is delivered to the agency customer and applies to all procurements.
  • Section 5949(a)(1)(B) (Part B) prohibits agencies from acquiring any electronic products or services that use electronic products that include covered semiconductor products or services for use in a “critical system” (even where the agency is not acquiring the semiconductor products or services that are being used). This will likely require contractors to look at how the electronic products or services being acquired by the agency are connecting to, enabling, or leveraging other electronic products.  While Part B only applies if the electronic parts will be used in a critical system, the ANPR proposes to make Part B apply unless an agency says otherwise. 

The ANPR contemplates that solicitations will require a representation concerning the prohibition and that contracts will include a clause with the prohibition, reporting requirements, and a mandatory flowdown for subcontracts supplying any electronic products.

Unlike Section 889, Section 5949 does not prohibit use of covered semiconductor products or services in contractor applications that are unrelated to the products and services furnished to federal agencies.

The proposed contract clause limits exposure to civil liability or suspension and debarment if contractors and subcontractors make a “comprehensive and documentable effort” to identify any potential use or delivery of covered semiconductor products or services, and provide notice to the government within 60 days. 

The proposed contract clause imposes additional requirements on contractors that are “covered entities,” defined as those that develop or purchase semiconductors that are the products of U.S.-origin technology or software.  Covered entity contractors are required to disclose to their direct customers any inclusion of a covered product or service in the purchased electronic product or service, regardless of whether the covered entity is a contractor, subcontractor, or supplier.  If that disclosure does not occur, the covered entity contractor would not be eligible for the limitations on civil liability or administrative remedies, and would be responsible for the unallowable cost of rework or corrective action required to bring the product or service into compliance.

II. Reasonable Inquiry

The statute adopts the “reasonable inquiry” standard for determining whether a contractor uses or provides covered semiconductor products or services, consistent with Section 889, but the ANPR for Section 5949 departs from those established standards.  In particular, while the ANPR expressly states that contractors may reasonably rely on certifications from their subcontractors and suppliers, the ANPR proposed definition of “reasonable inquiry” provides that additional diligence reviews may be required depending on the facts and circumstances and that such additional diligence reviews shall be required with respect to an entity established or operating in “foreign countries of concern,” regardless of whether that entity certified compliance.

The proposed definition does not specify what additional diligence should be taken, although it is reasonable to expect that any additional diligence would be short of “independent third party audits or other formal reviews related to such certifications,” which the statute provides is not required. 

III. Semiconductor Provenance

The ANPR rightly acknowledges the practical challenges of compliance with the Section 5949 prohibitions given the pervasiveness of semiconductors and the opacity of supply chains.  The FAR Council is considering requiring offerors to provide information on provenance of the supply chain for semiconductor components, citing the U.S. Customs and Border Protection’s Uyghur Forced Labor Prevention Act (UFLPA) supply chain provenance initiative as an example of “current industry practices” with which any provenance initiatives under Section 5949 should align.

The FAR Council is also considering providing a public-facing list of known electronic products and services that contain covered semiconductor products or services, although it is not clear how the FAR Council would develop such a list.

IV. Key Takeaways

The ANPR provides contractors with insight into how the FAR Council is currently considering implementing Section 5949, but the 18 separate questions requesting comment show that the FAR Council is still grappling with major questions about how to implement this wide-ranging prohibition.  These questions include requests for specific feedback on supply chain provenance tracking, reasonable inquiry procedures, potential impacts of the rule, and categories for waiver of the restriction.  

  1. Companies should consider submitting comments, questions, and responses by July 2, 2024 to provide input on the broad prohibition in Section 5949 as proposed to be implemented in the ANPR.
  2. Companies should consider evaluating their supply chains and expected future requirements for covered semiconductors against the requirements announced in the ANPR. Companies establishing or investigating alternative sources now, or participating in government efforts to onshore or reinforce semiconductor supply chains through the CHIPS Act funding and other measures, may be better situated when the prohibition goes into effect.

Insights

Client Alert | 11 min read | 05.17.24

FTC Finalizes Modifications to Broaden the Applicability of the Health Breach Notification Rule

On April 26, 2024, the Federal Trade Commission (“FTC”) announced a final rule (“Final Rule”) modifying the Health Breach Notification Rule (“HBNR”). The Final Rule, which largely finalizes changes proposed in a Notice of Proposed Rulemaking published last year (“2023 NPRM”), broadens the scope of entities subject to the HBNR, including many mobile health applications (“apps”) and similar technologies, and clarifies that breaches subject to the HBNR include not only cybersecurity intrusions but also unauthorized disclosures, even those that are voluntary. The Final Rule will take effect 60 days after its publication in the Federal Register....