On August 26, US President Trump issued an executive order declaring a national emergency regarding risks associated with foreign-produced equipment used in the US bulk-power system. The order cites potential cyber, remote access, sabotage, and supply disruption risks, noting that growing electricity demand increases the consequences of potential attacks on the electric grid.
The order establishes a framework for the review, prohibition, or conditioning by the US Department of Energy (DOE) for certain foreign-produced bulk-power system electric equipment, excluding distribution networks and transmission below 69 kV. Under the regulations directed by the order, it may be impossible to use certain types of transmission and generation equipment imported from "Covered Foreign Entities," which includes default countries subject to embargoes or sanctions under the International Traffic in Arms Regulations, a list DOE can augment. Of those countries, only China is generally understood to be a major supplier of this equipment. The resulting regulation must also consider conditioning the use of already-imported equipment, which could result in the inability to install Chinese-manufactured equipment already in the US.
Risk-Based Framework
The order authorizes DOE to prohibit an acquisition, importation, transfer, or installation initiated after August 26, 2026, where it determines that the transaction involves equipment or associated critical components, software, firmware, digital services, maintenance services, or remote access capabilities provided by persons connected to a Covered Foreign Entity and presents specified national security, cybersecurity, infrastructure, or supply disruption risks. DOE has 120 days to issue the regulations implementing the order.
The term "Covered Foreign Entity" means a country or any person owned by, controlled by, or subject to the jurisdiction or direction of a government of a foreign country that is subject to a United States arms embargo or sanctions regime, under the International Traffic in Arms Regulations (22 CFR 126.1), or that the Secretary of Energy, in consultation with the Secretary of War, the Director of National Intelligence, and the Assistant to the President for National Security Affairs, has determined is engaged in conduct that is detrimental to the national security or foreign policy of the United States. The order specifies that particular countries or persons are a Covered Foreign Entity exclusively for the purposes of the order.
The framework applies to transactions by persons subject to US jurisdiction and uses its own definition of the bulk-power system instead of the definition in the Federal Power Act at 16 USC § 824o, although the two definitions are similar. The framework's definition includes transmission facilities rated at 69 kV or more and generation needed to maintain electric-system reliability, but excludes facilities used in local distribution. Covered equipment encompasses a wide range of substation, control room, generation, inverter, battery storage, protection, metering, and industrial control equipment.
The order also reaches equipment acquired or installed before August 26, 2026. DOE may require that such equipment be identified, isolated, monitored, secured, disconnected, replaced, or removed. Before requiring the more disruptive measures, DOE must consider reliability and safety, the availability of secure replacements, and continuity of essential service, and may allow phased compliance.
Similarities to Existing Rules
Applicable industry participants are likely to have supply chain cybersecurity programs already in place covering a much narrower set of equipment as a result of NERC reliability standard CIP-013-2, but nothing under those existing rules prohibited any particular imports based on country of manufacture. Instead, that standard focuses on analyzing supply chain risks and addressing them in a systematic way.
The executive order also goes beyond even the more stringent requirements applied in Texas under the Lone Star Infrastructure Protection Act, which while it also targets certain electrical equipment from many of the same countries, is focused primarily on remote access to those assets, rather than the use of that equipment in bulk-power system facilities generally.
In that respect, the scope of the executive order is better understood as part of a broader federal trend toward guarding against supply chain risks posed by designated foreign adversaries, more closely resembling the Department of Commerce's connected-vehicle rules (see our February 2025 Report) and the Federal Communications Commission's recent action on foreign-produced power inverters and advanced robotic devices (see our August 3, 2026 LawFlash). Like those frameworks, the executive order favors restrictions on the acquisition or use of critical technologies based not simply on the characteristics of the product itself, but on where it is produced and the jurisdiction, ownership, or control of the entities involved in its supply chain.
Preparations for Implementation
While awaiting the implementing regulations to come from DOE, industry participants should consider initial steps to prepare for these new requirements, including:
- Map potentially covered assets and transactions. Companies should start assessing their existing assets, including whether completed and planned transactions involve equipment subject to the order.
- Prepare for expanded equipment and supplier diligence. Review existing supply chain and procurement processes to determine if they already have controls in place to identify this equipment or whether these controls should be supplemented to capture more granular information regarding where equipment is manufactured, produced, or assembled and the relationships between suppliers and subcontractors to meet the broad scope of the order.
- Assess regulatory risk allocation in supplier contracts. Review existing and pending contracts to determine how regulatory and change-in-law risk is allocated and if the new restrictions could affect the sourcing, operation, or continued use of covered equipment under those contracts.
- Prepare for mitigation or replacement of installed equipment. Because the order allows DOE to review transactions and installations prior to August 26, 2026, owners and operators should assess whether potentially affected equipment can be identified and if interim mitigation controls are available. They should also consider the possibility that DOE could ultimately require certain legacy equipment to be disconnected or replaced—effectively creating a targeted "rip and replace" obligation—and evaluate whether alternatives would reasonably be available. That assessment should account for procurement lead times, outage requirements, replacement costs, and potential regulatory approvals that may be required.
Open Issues
DOE has 120 days to publish implementing rules or regulations as needed. Key issues that the industry should monitor include:
- Whether DOE will act through determinations, conditions, mitigation measures, licenses, and other directives before that process is complete
- How DOE identifies Covered Foreign Entities
- How DOE administers licenses and pre-qualified equipment and pre-qualified vendor lists, including review and revocation of pre-qualification
- How DOE will address already installed equipment under the authority, which could include everything from the imposition of new controls through replacement or removal
- How DOE will determine whether components, subcomponents and services will be covered, as the executive order applies to "any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment"
- Whether DOE's implementing rules and regulations will provide exemptions, safe harbors, phase-in periods, or other forms of relief that could mitigate potential liability or compliance burdens
- How DOE will address companies that have degrees of ownership by "persons owned by, controlled by, or subject to the jurisdiction or direction of a Covered Foreign Entity"