Question H-3: DOE Asks Whether Industry Should Execute the Bulk-Power Order
By Patrick Miller
DOE's Request for Information on Executive Order 14421 includes one question, H-3, asking whether industry standards bodies and third-party labs can execute the order instead of the federal government. The electric sector ran something close to this before, under the Electric Reliability Organization. This post looks at what changes when the statute is IEEPA, not the Federal Power Act, and what a working precedent outside the sector suggests.
Overview
The Department of Energy (DOE) published its Request for Information (RFI) on Executive Order 14421 on September 9, 2026, and it runs thirty-plus questions across eight sections. Most of them ask industry to describe what it already does. What data fields utilities keep on installed equipment, how sub-tier suppliers are governed, what a bill of materials can and cannot prove. Question H-3 is different. It asks who runs the program.
H-3 wants to know whether industry standards, third-party laboratories, and certification bodies can be leveraged to implement the order, limit the government's role in initial execution, and preserve industry flexibility. That is a delegation question, and the electric sector has already run something close to this experiment.
The order in question, Executive Order 14421, "Declaring a National Emergency to Secure the United States Bulk-Power System," was signed August 26, 2026, and published August 31 at 91 FR 55995. The RFI is 91 FR 57322, pages 57322 through 57328, signed by Andrew McClure, Director of DOE's Office of Cybersecurity, Energy Security, and Emergency Response. Written responses are due October 9. DOE will hold a public webinar on September 16, from 3 to 4 p.m. EDT, and CESER has posted the join details. The session is informational, an overview of the RFI and how to respond to it, so attending is not a substitute for filing. Formal responses go through the methods in the RFI.
Anyone filing a response should note that the RFI's own docket number is inconsistent in the published text. The header and docket page use DOE-2026-HQ-2026-1123, while the ADDRESSES section and the confidential business information instructions use DOE-HQ-2026-1123. File through the docket page under the longer form and reference the shorter form in any email subject line, since that is what each section of the notice actually instructs.
A companion post already walked through the RFI's questions on existing equipment and how DOE might define "foreign-produced." H-3 sits in different territory, since it is not asking what the rule should cover but who runs the program once the rule exists.
The Sector Already Ran This Experiment
The Electric Reliability Organization (ERO) model is the electric sector's working example of delegated federal authority. Under Section 215 of the Federal Power Act, codified at 16 U.S.C. 824o, a private organization, the North American Electric Reliability Corporation (NERC), proposes mandatory reliability standards, and the Federal Energy Regulatory Commission (FERC) certifies NERC as the ERO and approves or remands what it proposes. NERC and its Regional Entities then monitor and enforce those standards under delegated authority, which means the government kept the certification and approval functions and handed the standards development, monitoring, and day-to-day enforcement to a private body it oversees.
That structure has a companion provision that matters here, since H-3 is implicitly asking DOE to build something like it from scratch. Section 215A of the Federal Power Act, 16 U.S.C. 824o-1, added by the FAST Act in 2015, gives DOE its own emergency authority over grid security threats, with implementing procedures at 10 C.F.R. Part 205 since January 2018. That provision sits inside the same statute as the ERO. Executive Order 14421 does not.
Why IEEPA Is Not the Federal Power Act
Executive Order 14421 runs on the International Emergency Economic Powers Act (IEEPA), not the Federal Power Act. IEEPA contains no Electric Reliability Organization provision and no certification mechanism comparable to what FERC and NERC operate under. There is no statute here that hands a private standards body the kind of role Section 215 hands NERC.
That matters for what DOE can plausibly delegate under H-3. The order's core mechanism, at Section 2(a), is a determination by the Secretary of Energy that a transaction involves a Covered Foreign Entity and poses an undue or unacceptable risk. That determination is what triggers a prohibition. I would expect that determination to stay inside the Department rather than move to a standards body or a laboratory, since nothing in IEEPA or the order gives DOE a statutory hook for handing off a national security finding the way Section 215 hands off standards development. I looked for a precedent of an IEEPA-based determination being sub-delegated to a private party and did not find one. The closest comparison, the Treasury Department's Office of Foreign Assets Control, uses banks and other financial institutions as compliance gatekeepers, screening transactions and filing reports, but the designation decision itself stays at Treasury. That is a real distinction, not just an assumption, though it rests on the absence of a counterexample rather than a settled legal holding, and I would not treat it as more certain than that.
So the determination probably stays put. The conformity assessment underneath it, testing whether a given piece of equipment or vendor actually meets whatever criteria DOE sets, is where the delegation question in H-3 actually lives.
What Can Actually Be Delegated
Conformity assessment, laboratory testing, provenance attestation, and supplier declarations of conformity are all things DOE could plausibly hand to third parties without touching the determination itself. Existing schemes already do versions of this work in adjacent spaces. The UL 2900 series covers cybersecurity testing for network-connectable products. ISASecure, run by the ISA Security Compliance Institute, certifies products and processes against the IEC 62443 series for industrial automation and control systems. None of these was built for a national emergency program, and none of them currently maps cleanly onto "foreign-produced bulk-power system electric equipment" as Executive Order 14421 defines it, but they are the kind of technical infrastructure DOE would be borrowing from rather than inventing.
Section 2(e) of the order is the natural home for that borrowed infrastructure. It authorizes the Secretary to establish criteria and procedures for recognizing particular equipment and vendors as prequalified for future transactions, while explicitly preserving the Secretary's authority to prohibit or otherwise regulate a transaction regardless of prequalified status. That is a list, and building it is exactly the kind of technical, ongoing, resource-intensive work that gets delegated in other regulatory schemes.
DOE has tried this before and the list never got built. Executive Order 13920, in 2020, authorized the same kind of pre-qualified vendor list at its Section 1(d). DOE's Office of Electricity ran an RFI on it, announced July 8, 2020, with responses due August 7. The order produced a request for information and, as far as the public record shows, nothing after that. H-3 reads like DOE asking whether someone else can build the list this time.
The Model That Already Works, More or Less
The closest working analogue to what H-3 describes comes from outside the electric sector entirely, from the Federal Communications Commission's (FCC) Covered List, paired with the FCC's equipment authorization program and the Telecommunication Certification Bodies (TCBs) that help run it. The Covered List identifies communications equipment and services determined to pose an unacceptable risk to national security. Equipment on the list cannot receive a new FCC equipment authorization, which in practice keeps new models out of the U.S. market. TCBs are private organizations the FCC recognizes and to which it has delegated specific responsibilities under Section 302 of the Communications Act. They evaluate the documentation and test data a manufacturer submits and issue the certification. Separately accredited test labs perform the underlying testing. The government keeps the list and the underlying national security determination. Private bodies execute the certification and testing layer beneath it.
This is a closer analogue to Executive Order 14421 than it might first appear, and probably closer than the RFI's drafters expected when they wrote H-3, because it is not a hypothetical parallel from a different industry. On July 28, 2026, the FCC added foreign-produced power inverters to the Covered List, following a determination from the Department of War that inverters eligible for certain federal manufacturing incentives posed an unacceptable risk, then narrowed the definition on August 20 after a second determination. Power inverters sit squarely inside the equipment categories the RFI itself asks about in Question A-2, alongside battery energy storage systems and other grid-connected equipment. The model DOE would be borrowing from had already been applied, weeks earlier, to a category of bulk-power system equipment directly, rather than to something from a different industry entirely.
The analogy strains in one place. The FCC's prohibition is binary. Covered equipment cannot be authorized, period, with narrow conditional-approval exceptions tied back to the same national security agencies. Executive Order 14421 builds in a licensing and mitigation regime, Section 2(c) through (f), that the FCC's Covered List does not have an equivalent for. A conformity assessment layer modeled on TCBs would have to sit underneath a more graduated system than the one the FCC operates, which is a harder administrative problem than replicating the Covered List wholesale.
A Tempo Problem
Consensus standards development and an emergency program run on different clocks, and the sector's own supply chain standard is a live example of the mismatch. NERC's Project 2025-06, responding to FERC Order No. 912 (issued September 18, 2025, effective November 24, 2025, in Dockets RM24-4-000 and RM20-19-000), produced Draft 1 of CIP-013-4 and CIP-010-6. The initial ballot closed July 17, 2026.
| Item | Weighted segment approval | Approval threshold | Quorum |
|---|---|---|---|
| CIP-013-4 | 30.64% | Two-thirds | ~90% |
| CIP-010-6 | 64.55% | Two-thirds | ~90% |
| Implementation plan | 31.14% | Two-thirds | ~90% |
CIP-013-4 drew 30.64 percent weighted segment approval against a two-thirds threshold. The implementation plan drew 31.14 percent. CIP-010-6 fared better at 64.55 percent but still fell short. All three ballots ran on roughly 90 percent quorum, so this was not a low-turnout fluke. The sector's own supply chain standard cannot currently clear its own balloting process. Executive Order 14421's Section 3(b) directs the Secretary to publish implementing rules within 120 days, as needed, which puts a deadline of December 24, 2026, on the table. Asking an ecosystem that cannot pass its own supply chain ballot to also execute a federal conformity assessment program on that clock is a plain mismatch, whatever DOE ultimately decides to do with H-3's answers.
Who Pays for Proving Provenance
Question G-6 asks what unique challenges the order presents to small entities, specifically around certification and testing costs and bargaining power with large suppliers. If execution of the technical layer moves to third-party labs and certification bodies, the cost of proving where equipment came from and who built it lands first on suppliers, and suppliers pass costs through to buyers. The entities with the least leverage to negotiate that cost down or absorb it internally are the smallest ones, the same cooperative and municipal utilities that already carry a disproportionate compliance burden under other reliability standards. I've made a version of this argument before, in the main post on the order's supply chain provisions, and the water sector piece on H.R. 2594 walks through what two decades inside a comparable delegated model actually cost participants in practice. Neither post had the FCC precedent to draw on, but the dynamic is the same one that shows up whenever the technical burden of a security regime gets pushed down the supply chain instead of held at the regulator.
The Tell in Section E
Section E of the RFI, covering licensing, mitigation measures, and prequalification, contains exactly one question. Every other lettered section runs from three questions to seven. Section A alone has six. That asymmetry is a fact about the document, not a reading of it, and it sits next to H-3 rather than apart from it. A department with a fully worked-out licensing framework does not usually publish a section with a single open-ended question about what a license application should contain and who should certify it. This looks more like a department that knows roughly where it wants to land on execution, and has not yet decided the mechanics of how to get there.
For Anyone Weighing a Response to H-3
Comments are due October 9. Here is what to have in hand before drafting a response, organized by who is likely reading this.
Utilities and asset owners: check whether your existing vendor risk management program under CIP-003-9 already produces the kind of provenance documentation a conformity assessment regime would ask for, since that gap analysis is faster to do now than after a rule drops.
Manufacturers and standards development or conformity assessment organizations: DOE named you specifically in its list of target respondents, and a response describing what your existing testing or certification infrastructure could and could not absorb is likely to carry weight precisely because so few respondents will be positioned to answer that question concretely.
Small utilities and cooperatives: G-6 is your entry point. A response with real cost and bargaining-power data from your own procurement history will do more than a general statement of concern.
Anyone citing the FCC comparison in a response: cite the actual Covered List updates from July and August 2026 rather than the general Covered List framework, since the power inverter action is the more precise precedent DOE will recognize.
An Open Question
H-3 is one question inside a much larger request for information that reads more as a signal than a decision. Whether DOE moves toward something shaped like the FCC's Covered List and TCB structure, toward a narrower prequalification list under Section 2(e) built with borrowed conformity infrastructure, or toward a licensing apparatus it writes from scratch inside DOE, I don't know, and I don't think anybody outside the Department knows. Section E's single question suggests DOE might not fully know yet either.
Timeline Snapshot
Here is a snapshot from the date of publication of this post capturing some of the relevant items and issues worth tracking. Note that this goes stale quickly, but it is provided to give some context of the related ecosystem.
