2024-08735. Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and Services

AGENCY:

Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA).

ACTION:

Advanced notice of proposed rulemaking.

SUMMARY:

DoD, GSA, and NASA are considering amending the Federal Acquisition Regulation (FAR) to implement paragraphs (a), (b), and (h) in section 5949 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 that prohibits executive agencies from procuring or obtaining certain products and services that include covered semiconductor products or services effective December 23, 2027.

DATES:

Interested parties should submit written comments to the Regulatory Secretariat Division at the address shown below on or before July 2, 2024 to be considered in the formation of the proposed rule.

ADDRESSES:

Submit comments in response to FAR Case 2023-008 to the Federal eRulemaking portal at https://www.regulations.gov by searching for “FAR Case 2023-008”. Select the link “Comment Now” that corresponds with “FAR Case 2023-008”. Follow the instructions provided on the “Comment Now” screen. Please include your name, company name (if any), and “FAR Case 2023-008” on your attached document. If your comment cannot be submitted using https://www.regulations.gov, call or email the points of contact in the FOR FURTHER INFORMATION CONTACT section of this document for alternate instructions.

Instructions: Please submit comments only and cite “FAR Case 2023-008” in all correspondence related to this case. Comments received generally will be posted without change to https://www.regulations.gov, including any personal and/or business confidential information provided. Public comments may be submitted as an individual, as an organization, or anonymously (see frequently asked questions at https://www.regulations.gov/​faq). To confirm receipt of your comment(s), please check https://www.regulations.gov, approximately two to three days after submission to verify posting.

FOR FURTHER INFORMATION CONTACT:

[e-mail] or call 202-969-4075. Please cite FAR Case 2023-008.

SUPPLEMENTARY INFORMATION:

I. Background

Semiconductors are tiny electronic devices that are essential to America's economic and national security. Semiconductors power our consumer electronics, automobiles, data centers, critical infrastructure, and virtually all military systems. These devices power tools as simple as a power adapter and as complex as a fighter jet or a smartphone. They are also essential building blocks of the technologies that will shape our future, including artificial intelligence, biotechnology, and clean energy. For additional information on semiconductors, visit https://www.nist.gov/​semiconductorsandchips.gov. See the section containing definitions in this advance notice of proposed rulemaking for the definition of “semiconductor”.

The National Counterintelligence and Security Center, located in the U.S. Office of the Director of National Intelligence, has identified semiconductors as one of the technology sectors where the stakes of disruption are potentially greatest for U.S. economic and national security. There are numerous opportunities for adversaries and other threat actors to introduce hardware backdoors, malicious firmware, and malicious software into a semiconductor during production. Since semiconductors are key components of U.S. critical infrastructure ( e.g., information technology, communications) and have many military applications, it is vital that these threat vectors are addressed during the production process. Chips are ultimately integrated into end products, so it can be difficult to identify and mitigate risks to semiconductor hardware, firmware, and software.

Due to this significant national security risk, Congress included a prohibition for certain covered semiconductors in section 5949 of the James M. Inhofe National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2023 (Pub. L. 117-263). The statute states that “[t]he head of an executive agency may not (A) procure or obtain, or extend or renew a contract to procure or obtain, any electronic parts, products, or services that include covered semiconductor products or services; or (B) enter into a contract (or extend or renew a contract) with an entity to procure or obtain electronic parts or products that use any electronic parts or products that include covered semiconductor products or services”. However, executive agencies are not required to—

(1) Remove or replace any products or services resident in equipment, systems, or services, prior to the effective date of the prohibition.

(2) Prohibit or limit the utilization of covered semiconductor products or services throughout the lifecycle of existing equipment.

DoD, GSA, and NASA plan to implement section 5949 of the NDAA for FY 2023 in the FAR via FAR Case 2023-008, Prohibition on Certain Semiconductor Products and Services.

A. Prohibition Scope

The statute's prohibition applies to products, parts, and services. The term “products” is currently defined in FAR 2.101 to mean supplies, which in turn includes all types of property including parts, except land and interests in land. Thus, under the FAR's definition, the term “product” already covers “parts” (see FAR 2.101). To avoid redundancy, DoD, GSA, and NASA are planning to use the following language, which removes the term “part”, to implement the statutory prohibition:

• Section 5949(a)(1)(A) of the NDAA for FY 2023 prohibits executive agencies from procuring or obtaining electronic products or electronic services that include covered semiconductor products or services.
• Section 5949(a)(1)(B) of the NDAA for FY 2023 prohibits executive agencies from procuring or obtaining electronic products that use electronic products that include covered semiconductor products or services; however, this prohibition does not apply to electronic products used in systems that are not critical systems.

Section 5949(a)(1)(B) goes beyond the prohibition in section 5949(a)(1)(A) by prohibiting Federal agencies from acquiring electronic products used within critical systems that use electronic products that incorporate covered semiconductor products or services. For example, section 5949(a)(1)(B) could restrict a Federal agency from acquiring a replacement control panel within a critical system that enables an Internet of Things (IoT) device that includes a covered semiconductor product or service and was purchased prior to the effective date of the prohibition.

B. Definitions

DoD, GSA, and NASA are considering incorporating the following definitions that are referenced in section 5949 of the NDAA for FY 2023:

• Covered entity (section 5949(j)(2)).

○ An entity that—

Develops, domestically or abroad, a design of a semiconductor that is the direct product of United States origin technology or software; and

Purchases covered semiconductor products or services from an entity described in the first or third paragraph of the definition of covered semiconductor product or services.

• Covered nation (section 5949(j)(5) and 10 U.S.C. 4872(d))

○ The Democratic People's Republic of Korea (North Korea);

○ The People's Republic of China;

○ The Russian Federation;

○ The Islamic Republic of Iran.

• Covered semiconductor product or service (section 5949(j)(3))

○ A semiconductor, a semiconductor product, a product that incorporates a semiconductor product, or a service that utilizes such a product, that is designed, produced, or provided by Semiconductor Manufacturing International Corporation (SMIC) (or any subsidiary, affiliate, or successor of such entity);

○ A semiconductor, a semiconductor product, a product that incorporates a semiconductor product, or a service that utilizes such a product, that is designed, produced, or provided by ChangXin Memory Technologies (CXMT) or Yangtze Memory Technologies Corp (YMTC) (or any subsidiary, affiliate, or successor of such entities); or

○ A semiconductor, semiconductor product, or semiconductor service produced or provided by an entity that the Secretary of Defense or the Secretary of Commerce, in consultation with the Director of the National Intelligence or the Director of the Federal Bureau of Investigation, determines to be an entity owned or controlled by, or otherwise connected to, the government of a foreign country of concern, provided that the determination with respect to such entity is published in the Federal Register .

• Critical national security interests mean any interests having a critical impact on the national defense, foreign intelligence and counterintelligence, international and internal security, or foreign relations of the United States.

• Critical system (section 5949(j)(4))

○ National security system (see 40 U.S.C. 11103(a)(1));

○ Additional systems identified by the Federal Acquisition Security Council; or

○ Additional systems identified by the Department of Defense, consistent with guidance provided under section 224 of the NDAA for FY 2020 (Pub. L. 116-92).

○ Does not include a system that is used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

• Foreign country of concern (15 U.S.C. 4651)

○ A country that is a covered nation; and

○ Any country that the Secretary of Commerce, in consultation with the Secretary of Defense, the Secretary of State, and the Director of National Intelligence, determines to be engaged in conduct that is detrimental to the national security or foreign policy of the United States.

• National security system (40 U.S.C. 11103(a)(1))

○ A telecommunications or information system operated by the Federal Government, the function, operation, or use of which—

Involves intelligence activities;

Involves cryptological activities related to national security;

Involves command and control of military forces;

Involves equipment that is an integral part of a weapon or weapons system; or

Is critical to the direct fulfillment of military or intelligence missions.

○ This term excludes a system to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

DoD, GSA, and NASA are also considering using the following definitions in the FAR rule:

• Affiliate means associated business concerns or individuals if, directly or indirectly either one controls or can control the other; or a third-party controls or can control both. See FAR 2.101.

• Electronic products means products that include technology, parts, or components that have electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities. See 15 U.S.C. 7006.

• Electronic services means services that use electronic products.

• Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about whether any electronic products or electronic services that are provided to the Government—

(1) Include covered semiconductor products or services; or

(2) Use electronic products that include covered semiconductor products or services.

A reasonable inquiry may reasonably rely on the certifications of compliance from covered entities and subcontractors who supply electronic products or services. This inquiry is not required to include independent third-party audits or other formal reviews but may be required to include other mechanisms of diligence review depending on the facts and circumstances. Diligence review shall be required with regard to entities that are established or operated in foreign countries of concern, even when they certify compliance with this rule.

• Routine administrative and business applications means applications for payroll, finance, logistics, and personnel management applications primarily used for standard commercial practices and functions.

• Semiconductor means an integrated electronic device or system most commonly manufactured using materials including, but not limited to, silicon, silicon carbide, or III-V compounds, and processes including, but not limited to, lithography, deposition, and etching. Such devices and systems include, but are not limited to, analog and digital electronics, power electronics, and photonics, for memory, processing, sensing, actuation, and communications applications. See Creating Helpful Incentives to Produce Semiconductors (CHIPS) Program Office, National Institute of Standards and Technology, Department of Commerce rule published September 25, 2023 (88 FR 65600).

• Subsidiary means an entity in which more than 50 percent of the entity is owned directly by a parent corporation or through another subsidiary of a parent corporation. See FAR 9.108-1.

C. Solicitation Provision

DoD, GSA, and NASA are planning to require a provision in all solicitations that would require offerors to certify, after conducting a reasonable inquiry, to the non-use of covered semiconductor products or services in electronic products or electronic services provided to the Government in accordance with section 5949(h)(1)(A).

D. Contract Clause

DoD, GSA, and NASA are planning to require a clause in all solicitations and contracts that incorporates the prohibitions in section 5949(a)(1)(A) and 5949(a)(1)(B), and the requirements in section 5949(h). The clause would—

(1) Direct contractors to apply the prohibition in section 5949(a)(1)(A);

(2) Direct contractors to apply the prohibition in section 5949(a)(1)(B) unless the agency identified a non-critical system that is not subject to this specific part of the prohibition;

(3) Require contractors to conduct a reasonable inquiry to detect and avoid the use or inclusion of covered semiconductor products or services in electronic products and electronic services;

(4) Require covered entities that are Federal contractors or subcontractors to disclose to direct customers the inclusion of a covered semiconductor product or service in electronic products or electronic services;

(5) Require that any Federal contractor or subcontractor, including any covered entity, who becomes aware, or has reason to suspect, that any product to be used in a critical system purchased by the Federal Government, or purchased by a Federal contractor or subcontractor for delivery to the Federal Government for any critical system, that contains covered semiconductor products or services shall notify appropriate Federal authorities in writing within 60 days;

(6) Require that a contractor or subcontractor that provides a notification under paragraphs (4) and (5) above regarding electronic parts or products that are manufactured or assembled by an entity other than the contractor or subcontractor shall not be subject to civil liability nor determined to not be a presently responsible contractor on the basis of such notification;

(7) State that a contractor or subcontractor that provides a notification under paragraphs (4) and (5) above regarding electronic parts or products manufactured or assembled by such contractor or subcontractor shall not be subject to civil liability nor determined to not be a presently responsible contractor on the basis of such notification if the Federal contractor or subcontractor makes a comprehensive and documentable effort to identify and remove the covered semiconductor products or services;

(8) Provide that a covered entity that is a Federal contractor or subcontractor that fails to disclose the inclusion to direct customers of a covered semiconductor product or service in electronic parts or electronic services shall be responsible for any rework or corrective action that may be required to remedy the use or inclusion of such covered semiconductor product or service;

(9) State that any rework or corrective action that may be required to remedy the use or inclusion of a covered semiconductor product or service is not an allowable cost;

(10) State that contractors and subcontractors may reasonably rely on the certifications of compliance from covered entities and subcontractors who supply electronic products or services when providing proposals to the Federal Government and are not required to conduct independent third-party audits or other formal reviews related to such certifications.

E. Subcontractors

Since section 5949(c) mandates prime contractors to incorporate the substance of these prohibitions and applicable implementing contract clauses into contracts, DoD, GSA, and NASA are planning to require that prime contractors insert the clause developed for FAR Case 2023-008 into all subcontracts for the supply of any electronic products.

F. Applicability to Contracts at or Below the Simplified Acquisition Threshold (SAT) and for Commercial Products (Including Commercially Available Off-the-Shelf (COTS) Items), or for Commercial Services

DoD, GSA, and NASA are planning to require the provision and clause in all solicitations and contracts, including those valued at or below the simplified acquisition threshold, for the acquisition of commercial products and commercial services, and for the acquisition of COTS items, because the prohibitions impact any product or service that uses or provides electronic products or electronic services to the Government. Due to the prevalence of electronic products and services, DoD, GSA, and NASA anticipate this would impact a large majority of contracts and orders. If this prohibition was not included in every solicitation, it would be very difficult for the contracting officer to identify which offerors would not be providing an electronic product or electronic service.

G. Applicability to Micro-Purchases

DoD, GSA, and NASA anticipate applying these prohibitions to micro-purchases. The statute does not exempt micro-purchases and there would be national security risks associated with allowing purchases of covered semiconductors under the micro-purchase threshold. Many electronic products and electronic services are procured under the current micro-purchase threshold that are critical to the mission of the Federal Government, and it is important that this rule address such risks.

H. Means of Identifying Elements and Components

DoD, GSA, and NASA are considering requiring offerors to identify the provenance of the supply chain for the semiconductor components for each electronic product provided to the Government. This information could allow the Government to validate contractor compliance with this prohibition. The required provenance information for semiconductor products could include, but is not limited to, identification of vendors and facilities responsible for the design, fabrication, assembly, packaging, and test of the product, manufacturer codes used for the product, and distributor codes used for the product. DoD, GSA, and NASA plan to assess existing supply chain provenance initiatives ( e.g., Uyghur Forced Labor Prevention Act Operational Guidance for Importers at https://www.cbp.gov/​document/​guidance/​uflpa-operational-guidance-importers) to align any provenance requirements in this rulemaking with current industry practices.

I. Government List of Electronic Products With Prohibited Semiconductors

DoD, GSA, and NASA are considering referencing in the proposed rule a web page or report being considered that could be issued by the Department of Commerce that would identify a list of electronic products and services that include covered semiconductor products or services that utilize such products, such as telecommunications and cloud storage or computing services. As precedent, the Department of Commerce published a report in January 2022 that identified key semiconductor products that were in short supply, and the downstream industries that depended on those products, based on the results of a public request for information. Going forward, such a public list of covered semiconductor products could assist offerors and contractors with identifying electronic products and electronic services that are prohibited.

J. Waivers

DoD, GSA, and NASA are planning to clarify that the waiver authority for the Secretary of Defense, Director of National Intelligence, Secretary of Commerce, and Secretary of Energy allows each of these officials to grant a waiver for any executive agency in accordance with the statutory requirements. The waiver authority would be in addition to the waiver authority granted to the head of each executive agency. See section 5949(b).

K. Impact

DoD, GSA, and NASA anticipate that entities will be impacted by this rule in the following ways:

• Education and training—time to review and become familiar with the rule.
• Time to update existing contractor business policies.
• Time to conduct an investigation to determine whether the entity uses prohibited semiconductors.
• Time to complete the certification.

Given that every unique awardee with electronic products or services would need to conduct a reasonable inquiry, as part of its initial analysis, DoD, GSA, and NASA anticipate using the following assumptions:

• 75 percent of all unique awardees have electronic products or services that will be impacted by this prohibition.
• For impacted contracts, it is estimated that each contract will involve an average of 5 to 15 products with semiconductors.
• For these semiconductors, it is anticipated that an average of 10 to 20 percent of the semiconductors are not currently compliant with the prohibition. While this represents an average across economic sectors, it is recognized that the prevalence of covered semiconductor products and services is higher in certain industries.
• For each non-compliant semiconductor product or service, it is anticipated to cost on average $10,000 to come into compliance by providing an alternative product or service or updating a product or service to remove prohibited semiconductors.

L. Future Rulemaking

While this advance notice of proposed rulemaking is focused on DoD, GSA, and NASA's implementation of the prohibition in paragraphs (a), (b), and (h) of section 5949, DoD, GSA, and NASA anticipate addressing through separate rulemaking the requirements in paragraph (g) for mitigating supply chain risks for semiconductor products and services that are not otherwise prohibited by section 5949. As friendly and allied nations expand their production and the United States continues to build out our domestic semiconductor production capacity through the CHIPS and Science Act and the Department of Commerce's CHIPS for America program, DoD, GSA, and NASA anticipate this additional rulemaking will help ensure that Federal contractors will increasingly have a diverse and more trustworthy source of suppliers that can provide secure and resilient semiconductors.

II. Request for Public Comment

DoD, GSA, and NASA welcome general input from the public on the amendments to the FAR being considered to accomplish the stated objectives when implementing section 5949 of the NDAA for FY 2023. Respondents are encouraged to offer their feedback on the following questions:

(a) Do you have any recommendations for how DoD, GSA, and NASA can further clarify the scope of the prohibition?

(b) Do you have any comments on the proposed definitions being considered for this rule, including the definition for reasonable inquiry?

(c) Are there any definitions that should be added?

(d) Do you have any comments on DoD, GSA, and NASA's plan for requiring a solicitation provision and contract clause?

(e) Are there any details regarding the waiver authority that would be helpful to clarify?

(f) Do you have sufficient visibility into your supply chain to understand whether your supply chain uses any covered semiconductor products or services? What information is normally requested from subcontractors and suppliers about semiconductor provenance?

(g) What procedures do you anticipate using to conduct a reasonable inquiry into your supply chain to understand whether your supply chain uses any covered semiconductor products or services? How do you currently or how do you plan to detect the inclusion of covered semiconductor products and services in your supply chain?

(h) If your organization does use covered semiconductor products or services, how much of an impact will this prohibition have on your organization?

(i) Do you have any comments on DoD, GSA, and NASA's estimated impact of a future rule to implement section 5949?

(j) Are there any categories of products or services you currently provide to the Government for which you anticipate needing a waiver when the prohibition is effective in December 2027? If so, which categories of products or services?

(k) For categories of products or services for which a waiver may be necessary, how long do you anticipate it will take to find alternative semiconductors that are compliant?

(l) What impact will implementation of section 5949 in the FAR have on small businesses, including small disadvantaged businesses, women-owned small businesses, service-disabled veteran-owned small businesses, and Historically Underutilized Business Zone (HUBZone) small businesses? How should DoD, GSA, and NASA best align this objective with efforts to ensure opportunity for small businesses?

(m) What additional information or guidance do you view as necessary to effectively comply with a future rule to implement section 5949?

(n) What challenges do you anticipate facing in effectively complying with a future rule to implement section 5949?

(o) What would be the best method or process for identifying the provenance of the supply chain for the semiconductor components? Are you aware of existing guidelines or best practices for identifying and documenting the provenance of the supply chain for electronic products and electronic services? Do you have any suggestions for how and when the Government should validate supply chain provenance information and documentation?

(p) If the Department of Commerce establishes a public list that identifies electronic products with prohibited semiconductors, would this be helpful for implementing this prohibition?

(q) Do you have any feedback regarding how DoD, GSA, and NASA should incorporate the requirements regarding certification, disclosure, notification safe harbors, and allowable costs in paragraph (h) of section 5949?

(r) What else should DoD, GSA, and NASA consider in drafting a proposed rule to implement the prohibitions outlined in section 5949?

III. Executive Orders 12866 and 13563

Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. This is a significant regulatory action and, therefore, was subject to review under Section 6(b) of E.O. 12866, Regulatory Planning and Review, dated September 30, 1993.

Government procurement.

William F. Clark,

Director, Office of Government-wide Acquisition Policy, Office of Acquisition Policy, Office of Government-wide Policy.