How should contractors prepare for the FAR proposed rule banning acquisition of certain foreign semiconductors? 2026

According to GSA guidelines, contractors must begin immediate inventory and supplier-mapping of semiconductor components to identify any items that match the FAR Council's proposed prohibited list. Per FAR Council publication of the NPRM on February 17, 2026, affected products include specific integrated circuits and finished goods sourced from designated foreign manufacturers; contractors must capture part numbers, manufacturers, and country-of-origin for every semiconductor component across prime and subcontractor tiers. Per FAR 19.502, small businesses can use team arrangements or subcontracting to replace banned components, but they must document substitutions and flow-down compliance. The SBA reports that 78% of small IT contractors rely on single-source suppliers for critical chips, so substitution planning is urgent. Under OMB M-25-21, agencies will update acquisition strategies and source-selection evaluation factors to prioritize verified domestic or allied suppliers; contractors should therefore prepare compliance evidence that agencies can verify during source selection. DoD's CMMC framework requires supply-chain traceability for controlled technical information; contractors expecting DoD work must map semiconductors to CMMC evidence to avoid losing eligibility for sensitive contracts.

According to GSA guidelines, contractors must treat the February 17, 2026 FAR Council NPRM as an immediate procurement risk signal and begin supply-chain audits now. The NPRM implements executive and interagency priorities to restrict acquisitions of certain foreign semiconductors on national-security grounds; Per FAR Council documentation, the rule builds on Commerce Department CHIPS-era guardrails and maps to existing export and investment controls. The regulatory text in the NPRM identifies product classes and references agency lists; contractors must cross-check their BOMs (bills of material) and procurement records against the NPRM's criteria to determine exposure. The SBA has repeatedly advised small firms to use SAM.gov and industry days to find alternate domestic suppliers; Per FAR 19.502, small businesses may form mentor-protégé or joint venture relationships to meet substitution needs, but must document compliance steps. Under OMB M-25-21, agencies will require evidence of vendor vetting and risk assessment in acquisition packages; contractors should pre-assemble supplier attestations, traceability records, and test reports to satisfy agency review. DoD and other national-security agencies will integrate the prohibition with existing CMMC and supply-chain requirements, increasing verification steps at award time.

According to GSA guidelines, contractors must also treat the NPRM as a procurement timeline driver: the FAR Council's publication on February 17, 2026 opens a defined comment window and signals intent to finalize quickly. Per FAR 19.502, small businesses can rely on subcontractors for replacement components, but the prime remains responsible for flow-down clauses and compliance verification; primes should therefore require attestations and right-to-audit clauses from subcontractors. The SBA reports that 78% of small IT and electronics firms have at least one supplier in East Asia, a statistic that underscores substitution risk and potential cost inflation. Under OMB M-25-21, agencies will require cost/price realism analyses that account for supply-chain remediation costs; contractors should be ready to support price adjustments or negotiate equitable adjustments if the final rule demands component replacement after award. DoD's CMMC framework requires documented provenance and incident reporting for covered components; contractors integrating with DoD should align their traceability practices to CMMC Level 2 or higher evidence, depending on contract sensitivity.

According to GSA guidelines, contractors must incorporate the FAR Council's proposed clause(s) into solicitations and contracts once finalized, including requisite representations and certifications from suppliers. Per FAR 19.502, small businesses can leverage subcontracting plans and FAR-subpart flow-downs to manage replacements; however, primes must verify that subcontractors' components meet the final rule's origin and manufacturer restrictions. The NPRM text (published Feb 17, 2026) proposes mandatory supplier attestations, traceability records, and prohibition language that agencies will use in source selection and contract administration. The SBA reports that 78% of small contractors do not presently collect full country-of-origin documentation for chips, so immediate remediation is necessary. Under OMB M-25-21, agencies will require risk-assessments and acquisition plans to document mitigation steps; contractors should be prepared to provide those during proposal evaluation. DoD's CMMC and associated supply-chain risk-management guidance will expect logged provenance and tamper-evidence for hardware used in controlled environments, increasing documentation requirements for DoD primes and their subs.

According to GSA guidelines, contractors must schedule supplier audits and quality-assurance (QA) tests to validate manufacturer provenance before award or during production. Per FAR 19.502, small businesses can partner or subcontract for compliant parts but must ensure flow-down compliance language is present and enforceable; primes should add FAR-like clauses requiring immediate notification if a supplier's sourcing changes. The NPRM calls for agencies to include compliance checks at both pre-award and post-award stages; contractors should therefore retain certificates of conformance, bills of ladings, customs declarations, and ISO or third-party test results for at least three years after contract completion to satisfy audits. Under OMB M-25-21, acquisition officials will demand documented cost impacts; expect requests for cost breakdowns showing $X change orders for replacement components. DoD's CMMC framework requires evidence trails for any covered hardware; contractors planning to sell into DoD programs must map semiconductors to configuration items and CMMC artifacts to avoid eligibility loss.

According to GSA guidelines, contractors must adopt a 'prove-before-procure' discipline: require supplier attestations, integrate country-of-origin checks into procurement systems, and maintain auditable traceability records. Per FAR 19.502, small businesses can use formal teaming agreements to access compliant supply lines; include explicit flow-down clauses that allow contract-level compliance audits. The SBA reports that 78% of firms lack robust provenance systems, so prioritize procurement IT updates and staff training now. Under OMB M-25-21, agencies will ask for documented mitigation plans and cost impacts; prepare a standard cost template that quantifies substitution expenses and schedule impacts. DoD's CMMC and associated RMF activities expect demonstrable chain-of-custody for hardware; maintaining serialized records and third-party validation will reduce verification friction during source selection and contract performance. Combine supplier audits, spot laboratory testing, and blockchain or ledger-based provenance tools where appropriate to reduce audit friction and provide timely evidence to contracting officers.