Most contractors read "bulk-power system" and stop. That is a mistake. The executive order behind this rulemaking defines "procurement" in federal-acquisition terms, tasks the FAR Council with a rule, and reaches installation services — which is to say, it reaches contractors.
On September 9, 2026, the Department of Energy published a Request for Information implementing Executive Order 14421, "Declaring a National Emergency To Secure the United States Bulk-Power System," with responses due October 9, 2026. The RFI (Docket No. DOE-HQ-2026-1123, RIN 1901-AB79, 91 FR 57322) was issued by DOE's Office of Cybersecurity, Energy Security, and Emergency Response, and DOE will hold a public webinar on September 16, 2026, from 3 to 4 p.m. EDT.
A note on the citation: the White House website labels the order 14420. The Federal Register, which assigns and publishes official executive order numbers, published it as Executive Order 14421 of August 26, 2026, at 91 FR 55995 (Aug. 31, 2026), and DOE's implementing notice cites 14421 throughout. Use 14421.
What the Executive Order Prohibits
E.O. 14421 invokes the International Emergency Economic Powers Act (50 U.S.C. § 1701 et seq.) and the National Emergencies Act (50 U.S.C. § 1601 et seq.). Section 2(a) prohibits any acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment by any person subject to U.S. jurisdiction where the transaction involves property in which a foreign country or national has any interest — expressly including "through an interest in a contract for the provision of the equipment" — the transaction was initiated after August 26, 2026, and the Secretary of Energy determines both a Covered Foreign Entity link and an undue or unacceptable risk.
Three features of the order deserve a contractor's attention:
- It is not limited to transformers. Section 5(b) defines covered equipment to include industrial control systems (remote terminal units, programmable logic controllers, and intelligent electronic devices), distributed control systems, safety instrumented systems, protective relaying, metering equipment, battery energy storage systems, grid-connected inverters, backup generators, and uninterruptible power supply systems supporting critical infrastructure — plus associated software, firmware, and remote-access capabilities.
- It reaches equipment already installed. Section 2(b) authorizes DOE to impose conditions on existing equipment, up to requirements to identify, isolate, monitor, secure, disconnect, replace, or remove it, with phased compliance available.
- Existing contracts are not grandfathered. Section 2(d) states the prohibitions apply "notwithstanding any contract entered into or any license or permit granted prior to the date of this order."
Section 5(e) defines "Covered Foreign Entity" by reference to governments subject to a U.S. arms embargo or sanctions regime under the International Traffic in Arms Regulations (22 C.F.R. § 126.1), or as otherwise determined by the Secretary. Section 2(e) authorizes DOE to publish a list of pre-qualified equipment and vendors exempt from the prohibition — an approved-products-list mechanism that will matter enormously to anyone selling into this space.
The Federal Procurement Hook
Section 4 is the provision that moves this from an energy-sector story to a government-contracting one. Within 180 days of the order — approximately February 22, 2027 — DOE must develop and submit to the FAR Council recommended revisions to the Federal Acquisition Regulation "to ensure that national security risks are adequately considered in any Federal procurement concerning energy infrastructure and to prioritize the acquisition of United States-manufactured energy infrastructure." Within 90 days of receiving them, the FAR Council "shall consider proposing for notice and public comment" implementing amendments.
Section 5(g) then defines "procurement" in conventional federal-acquisition terms: acquiring by contract with appropriated funds, including installation services, by and for the use of the federal government. Separately, Section 3(b) directs DOE to publish implementing rules within 120 days — approximately December 24, 2026.
If that sequence looks familiar, it should. It is the same architecture as Section 889 and the ICTS rules: a national-security determination first, a covered-entity definition second, a FAR clause and a flowdown third. Contractors who lived through 889 representations know the pattern — see our explainer on cybersecurity flowdown obligations and the parallel FAR-rule timeline in EO 14412's post-quantum cryptography directive.
What the RFI Is Actually Asking
The RFI is not a proposed rule, and DOE says so expressly. But its questions telegraph the compliance architecture. Section B asks how far into sub-tier supply chains firms can trace ownership, manufacturing location, and software and firmware provenance; what procurement contract language, audit rights, incident notification, and termination provisions are used to govern sub-tier vendors; and what software, firmware, and hardware bill-of-materials capability exists. Section F-4 asks how federal procurement can prioritize U.S.-manufactured energy infrastructure "while preserving competition, reliability, safety, quality, interoperability, timely delivery, and value," and what transition periods, exceptions, waivers, alternate-source requirements, or emergency procedures should govern. Section G-6 asks specifically about disproportionate burden on small entities.
Those are the questions whose answers become clause text. A contractor that wants a workable waiver process, a realistic transition period, or a small-business flexibility has one month to say so on the record.
What to Do Now
Decide whether you are in scope before you decide whether to care. Read the Section 5(b) equipment list against what you supply, install, integrate, or maintain — including on federal installations and at federally owned generation and transmission facilities. Construction, facilities, energy-services, and microgrid contractors are more likely to be captured than they expect. Find My Requirements helps map the obligation set already attaching to your contracts.
Inventory now, not after the rule. DOE's Section D questions ask which data fields asset owners maintain — manufacturer, model, country of manufacture or assembly, supplier, integrator, firmware versions, component provenance, remote-access pathways, replacement lead time. That inventory is the compliance artifact for any regime built on this order, and it takes months to assemble. The checklists library is a starting point.
Comment by October 9. Small and mid-size suppliers are the entities least able to trace sub-tier provenance and most exposed to a prequalification list. Silence in the record is not neutral.
Do not tell customers you are compliant. There is no rule yet, no Covered Foreign Entity list yet, and no prequalification criteria yet. Section 7(c) creates no private right of action, but a premature compliance representation in a proposal is its own risk — the enforcement page covers where cybersecurity representations have gone wrong.
Key Takeaways
- Executive Order 14421 (Aug. 26, 2026; 91 FR 55995) prohibits acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment linked to a Covered Foreign Entity, reaches equipment already installed, and applies notwithstanding contracts entered into before the order.
- DOE's implementing Request for Information (91 FR 57322; Docket No. DOE-HQ-2026-1123) closes October 9, 2026, with a public webinar on September 16, 2026; DOE implementing rules are due roughly December 24, 2026.
- Section 4 requires DOE to deliver recommended FAR revisions on federal energy-infrastructure procurement by roughly February 22, 2027, after which the FAR Council must consider a proposed rule — meaning a FAR clause and flowdown are the predictable endpoint, and the equipment inventory you build now is the evidence you will need then.
This article is educational information about cybersecurity and government contracting requirements. It is not legal advice, and it does not create an attorney-client relationship. Contract-specific obligations depend on the clauses in your award.