Nothing Is Grandfathered: The EO 14421 RFI on Existing Equipment
By Patrick Miller
DOE has opened a 30-day request for information on how it will implement Executive Order 14421, the order restricting foreign-produced bulk-power system equipment. The most consequential questions concern equipment already installed, since the order does not grandfather it, and how DOE will define "foreign-produced" in the first place. Comments are due October 9, with a public webinar on September 16.
Overview
The Department of Energy (DOE) published a request for information (RFI) on September 9 asking industry to help write the rules implementing Executive Order (EO) 14421, the August 26 order declaring a national emergency over foreign-produced bulk-power system electric equipment. I wrote about the order itself here when it came out. This RFI is the next step, and it's probably the one where the actual shape of the rule gets decided.
The docket is DOE-HQ-2026-1123 (RIN 1901-AB79), open under the DOE's Office of Cybersecurity, Energy Security, and Emergency Response (CESER). Comments are due October 9. DOE is also holding a webinar on September 16 from 3 to 4 p.m. EDT to walk through the questions before that deadline, and a transcript goes into the docket afterward. Registration details weren't out as of this writing, and DOE says they'll be posted on the CESER website.
DOE lists a wide roster of who it wants to hear from. Asset owners and operators, independent power producers, original equipment manufacturers (OEMs), component and sub-tier suppliers, software and firmware developers, providers of digital, cloud, maintenance, monitoring, and remote-access services, engineering, procurement, and construction (EPC) firms, distributors and resellers, investors and insurers, standards and conformity assessment bodies, trade associations, and state, local, Tribal, and territorial governments are all named. That's broad enough that if you touch bulk-power equipment anywhere in its lifecycle, you're probably in scope for at least some of the questions.
What the Order Actually Restricts
The mechanics matter here, because they set up why this RFI does. EO 14421 prohibits acquiring, importing, transferring, or installing foreign-produced bulk-power system electric equipment where the transaction involves a foreign country or national with an interest in it, the transaction happened after August 26, and DOE determines the equipment or the entity behind it poses an undue or unacceptable risk. That prohibition reaches beyond the hardware to associated critical components, software, firmware, digital services, maintenance services, and remote-access capabilities tied to a Covered Foreign Entity.
The order isn't a flat ban, though. The Secretary can negotiate mitigation measures as a condition of approval, issue licenses that authorize otherwise-prohibited conduct, and set up a prequalification process so vendors and equipment don't have to clear review one transaction at a time. There's also an anti-evasion clause covering transactions structured to avoid the prohibition, and conspiracies to violate it, so segmentation or relabeling tricks aren't a workaround. DOE has 120 days from the order (so late December) to publish implementing rules, and 180 days (late February 2027) to send FAR Council recommendations for Federal procurement.
Existing Equipment Is Where the Order Has Teeth
Section 2(b) doesn't just restrict new transactions going forward. It lets the Secretary impose conditions on foreign-manufactured or foreign-operated equipment acquired or installed before August 26, including requirements to identify, isolate, monitor, secure, disconnect, replace, or remove it. That's a meaningfully different posture than most supply chain rules, which tend to grandfather what's already installed, though this one doesn't, at least not automatically.
There's a check on that authority, though. Before DOE can direct disconnection, replacement, or removal, it has to consider reliability, safety, the availability of secure replacements, and continuity of essential service, and it can phase compliance in over time. Section D of the RFI is where DOE tries to work out how to apply that check in practice, and it actually splits into four separate asks.
| Question | What it asks |
|---|---|
| D-1 | What data fields asset owners actually maintain on installed equipment (manufacturer, country of manufacture, firmware version, remote-access pathways, support status, replacement lead time), what's commonly missing, and how to estimate or validate origin and risk when it is. |
| D-2 | What measures exist short of full removal, segmentation, monitoring, access restriction, firmware replacement, vendor transition, spares strategy, and how DOE should weigh their effectiveness, cost, and residual risk against each other. |
| D-3 | What reliability, safety, replacement-availability, and continuity factors DOE should evaluate before directing disconnection or removal, and what studies or certifications should support that evaluation. |
| D-4 | How DOE should monitor and verify that mitigation measures stay effective over time, through reporting, testing, attestation, or independent assessment, while still protecting sensitive system information. |
I'd probably put this section ahead of the others if you're deciding where to spend your comment-writing time, though that's just where I'd start. D-1 is the one I'd look at hardest, since it's asking DOE to design a data standard around information a lot of asset owners probably don't have in one place today.
What Counts as Foreign-Produced
The RFI also opens up a definitional question that OEMs and integrators should probably care about more than they currently do. EO 14421 restricts "foreign-produced" equipment, but manufacturing today rarely happens in one country under one label, and DOE is asking how to draw that line.
| Fact pattern | Why it's a question |
|---|---|
| Final assembly and substantial transformation | Where the last meaningful manufacturing step happens may not be where the components originated. |
| Domestic content thresholds | DOE hasn't set a percentage, and a low domestic-content bar could let more equipment through than the order intends. |
| Contract manufacturing and original design manufacturing (ODM) | The brand on the equipment may not be the entity that designed or built it. |
| White-labeling | Similar issue from the buyer's side, the nameplate may obscure the actual manufacturer. |
| Refurbishment, remanufacturing, and repair | Unclear whether reworking existing equipment changes its country-of-origin status. |
| Foreign critical components inside otherwise domestic equipment | A U.S.-assembled product can still carry a foreign-controlled component that does the actual risk-relevant function. |
DOE is asking the same "who's really behind this" question about software, firmware, digital services, maintenance, and remote access tied to the equipment, not just the hardware itself, and it wants to know what records manufacturers, importers, distributors, and purchasers can reasonably produce to substantiate country of origin. If your documentation trail for any of this is thin, you'll probably want to know that before a rule requires you to produce it.
The Rest of the RFI, at a Glance
The remaining sections cover the rest of the framework, though D and the foreign-produced question are where I'd start.
| Section | What it asks |
|---|---|
| B | How far down the sub-tier supply chain asset owners can reasonably trace ownership and firmware provenance, and what should count as a Covered Foreign Entity. |
| C | How DOE should weigh consequence and criticality for a specific piece of equipment, including redundancy, substitutability, and cascading effects. |
| E | Licensing and prequalification, including how DOE should handle time-sensitive situations like an outage or an unavailable secure replacement. |
| F | Domestic manufacturing capacity, secure replacement availability, and Federal procurement preferences. |
| G | Compliance cost data and the avoided-risk benefits DOE should try to quantify. |
| H | A catch-all for anything the earlier sections missed. |
None of this is a proposed rule yet, and DOE says so directly, so it's building the record it needs before it writes one.
Filing Is Voluntary
Nobody has to file. The RFI says participation is voluntary, that responses don't bind DOE or anyone else, and that it isn't a proposed rule or a determination about any country, person, or vendor. There's no penalty for skipping it.
There's still a practical reason to file, though. DOE has to publish implementing rules by late December, and this docket plus the September 16 webinar transcript is most of what it will have to work from. Several of the questions are asking industry to supply numbers and thresholds that DOE will otherwise estimate on its own. A-2 asks what voltage, capacity, connectivity, and criticality thresholds would improve clarity without opening a security gap. Section G asks for compliance cost estimates, labor hours, lead times, and outage costs. G-6 asks specifically what flexibilities would keep the burden off small entities, which is a direct channel for cooperatives and municipals. E-1 asks what license review timelines would actually work, including for imminent outages and emergency restoration, and if nobody describes a real outage window, the eventual timeline may not accommodate one. H-3 asks whether industry standards and third-party laboratories could carry some of the implementation, which is an open invitation to propose something lighter than DOE building the whole mechanism itself.
The usual objection is that the useful detail is sensitive. DOE built two paths around that. Aggregated or anonymized examples are acceptable where transaction-specific information is sensitive, and confidential business information (CBI) goes by email as a marked confidential copy plus a redacted non-confidential copy, not through regulations.gov, since anything submitted through the portal waives the CBI claim. Everything else in the docket is public and posted as received, so assume your filing is readable by your competitors and your regulator.
What to Do Before October 9
Whether or not you plan to file comments, this is a reasonable prompt to start the inventory work now rather than wait for a rule that tells you to. If you don't already have a clean record of manufacturer, country of manufacture or assembly, firmware and software versions, remote-access pathways, and support status for your bulk-power system equipment, Section D is a preview of what you'll probably eventually be asked to produce. The same goes for your documentation on final assembly location and component sourcing if you manufacture or integrate equipment, since Section A-5 suggests DOE hasn't decided yet how much of that chain it expects you to be able to show.
If you do file, reference the question number you're answering. Comments go through regulations.gov under the docket number, or by email to BulkPowerEO@doe.gov with the RFI name in the subject line.
The order is broad, and the RFI is where a lot of the practical edges still have to get drawn. Existing equipment and what counts as foreign-produced seem like the two most likely to land on your desk as actual requirements.
