DoD Seeks Feedback on 9 Areas in the PCB Acquisition Restrictions ANPR

The Department of Defense (DoD) issued an advance notice of proposed rulemaking (ANPR) on July 2, 2026, Defense Federal Acquisition Regulation Supplement: Modifications to Printed Circuit Board Acquisition Restrictions (DFARS Case 2022-D-011) on prohibiting the acquisition of printed circuit boards (PCBs) from certain countries. DoD is requesting input from experts and industry to assist in the development and revision of DFARS. Comments are due August 31, 2026.

Congress established strict sourcing laws in the FY 2021 and FY 2022 National Defense Authorization Acts (NDAAs), prohibiting DoD contractors and subcontractors from acquiring covered PCBs from a covered nation. The prohibition applies to fabricated or partially manufactured PCBs produced by entities located in, or controlled by, the following four covered nations: China, Russia, North Korea and Iran.

Key Statutory Definitions

The term ‘‘covered printed circuit board’’ means any specified type of partially manufactured or complete bare printed circuit board or fully or partially assembled printed circuit board that—

1. performs a mission critical function in any product or service that is not a commercial product or commercial service; or
2. is a component of—
1. a defense security system; or
2. a system, other than a defense security system, that transmits or stores information and which the Secretary identifies as national security sensitive in the contract under which such printed circuit board is acquired.

The term ‘‘specified type’’ means a printed circuit board that is—

1. a component of an electronic device that facilitates the routing, connecting, transmitting or securing of data and is commonly connected to a network, and
2. any other end item, good, or product specified by the Secretary of Defense.

The term ‘‘defense security system’’ means an information system (including a telecommunications system) used or operated by the Department of Defense, by a contractor of the Department, or by another organization on behalf of the Department, the function, operation, or use of which—

1. involves command and control of an armed force;
2. involves equipment that is an integral part of a weapon or weapon system; or
3. subject to subparagraph (B), is critical to the direct fulfillment of military missions.

It does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

What About Commercial Components

DoD relies extensively on commercial products and commercial off-the-shelf (COTS) items, such as servers, displays and communications equipment, that include PCBs. The proposed framework does not impose a blanket prohibition on PCBs. Instead, the requirements only apply to covered PCBs integrated into systems where a compromise could threaten military missions, warfighter safety, or national security. The way we see this is that a computer monitor with a Chinese PCB inside it purchased by DoD for office use in an unclassified area is not likely to have the prohibition applied, while had the same computer monitor been integrated into a major weapon system the prohibition would apply.

Is There a Waiver Process?

Yes, the ANPR includes a proposed waiver process. DoD proposes the Independent Hardware Assurance Framework that utilizes industry standards ISO/IEC 20243, IPC-1782, and IPC-1791. Under this framework, contractors seeking a waiver would need to demonstrate compliance with four pillars. Contractors will be required to provide a comprehensive waiver package to the contracting officer that addresses mitigation measures for supply chain security, data traceability, facility trust and secure handling, and cybersecurity. The government states it will not rely on attestations from suppliers for the waiver. The package must also include a market availability justification, a testing and validation plan to ensure no unauthorized logic, malicious alterations, or counterfeits are present, and a time-phased plan detailing the contractor’s strategy to qualify alternative domestic or allied sources and eliminate reliance on covered nations for future production. The way we see it waivers are going to require extensive effort and be few and far between.

Data Requirements

The proposed framework would require contractors to maintain and provide IPC-1782 manufacturing traceability logs and IPC-1791 independent hardware assurance test reports in a standardized, machine-readable format within a specified timeframe, such as five business days, and grant the Government access to supporting data.

Flowdowns

The proposed framework requires that any contract containing the resulting DFARS clause will include a mandatory flowdown to all subcontracts at every tier, including subcontracts for commercial products and commercial services. Although the requirement flows down, the prime contractor will remain responsible for maintaining valid third-party certifications and traceability data from all lower-tier suppliers prior to integrating PCB into end-item deliverable. Subcontractors are not off the hook, because the prime contractor will require information from subcontractors and lower-tier suppliers to support whether the products include prohibited PCBs as well as collection, verification, and maintenance of valid, third-party certifications (ISO/IEC 20243 and IPC-1791) and complete IPC-1782 traceability data.

DoD Requesting Input Related to Specific Areas

DoD is requesting industry feedback on nine specific areas and questions as detailed in the ANPR. We have summarized these areas as follows:

• Definition Clarity. Whether the three intersecting definitions, covered printed circuit board, specified type, and defense security system, are ambiguous or require refinement.
• Certification Burden. Input on the estimated financial and operational burden of maintaining compliance with the proposed four-pillar Independent Hardware Assurance Framework.
• Certification Timelines. Whether DoD’s estimated timelines, 8-16 months for IPC-1791 certification, and 3-11 months for IPC-1782 and ISO/IEC 20243, are reasonable, and what constitutes a reasonable phase in period, such as 12, 18, or 24 months.
• COTS Item Applicability. To what extent COTS bare board manufacturers can support IPC-1782 Level 3 or 4 data logging requirements without causing severe economic disruption.
• Facility v. Enterprise. Whether DoD’s proposal to apply IPC-1791 at the physical verification facility and ISO/IEC 20243 at the enterprise level creates conflicting obligations for multinational original equipment manufacturers (OEMs).
• Data Sovereignty. How Controlled Unclassified Information will be protected when transmitting manufacturing requirements to a facility located in a covered nation under an approved waiver.
• Data Rights and Inspection. Whether DoD’s proposal to limit its data rights in IPC-1782 traceability logs and IPC-1791 hardware assurance reports strictly to inspection and compliance verification, rather than Government Purpose Rights, adequately protects proprietary manufacturing processes while allowing for Government audits.
• Waiver Mitigation and Section 224 Compliance. Whether independent verification at an IPC-1791 facility, combined with IPC-1782 traceability, satisfies the operational security requirements of Section 224 of the FY 2020 NDAA.
• Market Segmentation. DoD requests that commercial information technology vendors provide the percentage of DoD sales that would fall under the statutory definition of a defense security system.

Takeaways

We strongly recommend government contractors and subcontractors review the ANPR and submit comments by August 31, 2026. DoD is actively seeking industry input on specific requirements and reasonableness of proposed timeframes, and this is a critical opportunity to raise concerns directly with DoD. We previously issued an article, FAR Case 2023-008 Proposed Rule on Prohibiting Certain Semiconductor Products and Services, which addressed prohibition on the use of covered semiconductor products and services. That proposed rule focused on conducting a reasonable inquiry into the supply chain and reporting nonconforming items within 72 hours. It did not cover the full range of documentation, certifications and traceability requirements that the ANPR is addressing.

Although prime contractors will carry the primary burden of collecting, verifying and maintaining third party certifications and traceability data from lower-tier suppliers, subcontractors should also consider providing input. Subcontractors will need to examine their own supply chains and lower-level suppliers to identify any prohibited PCBs and evaluate the burden of any future requirements. Your input to required documentation, timeframes, implementation considerations is important.

Preparing for PCB Sourcing Requirements

Redstone GCI supports government contractors in evaluating how proposed PCB sourcing requirements could affect purchasing practices, subcontract flowdowns, supplier documentation, and internal compliance processes. This can include reviewing contract and subcontract requirements, assessing purchasing system procedures, identifying documentation expectations across the supply chain, and providing training to help contracts, procurement, compliance, and leadership teams understand how future DFARS requirements may affect their responsibilities.