Defense Supply-Chain Waivers Tighten on January 1, as FASCSA Orders Hit DeepSeek and Acronis

Key takeaways

Executive Order 14415 of July 20, 2026, directs that, on January 1, 2027, the Secretary of War and the military departments shall cease to issue waivers under 10 U.S.C. 4872(c)(1) for covered materials, except where the prime contractor or subcontractor submits a formal mitigation plan that the Secretary or a designee accepts, as provided in the order.
Within 180 days of the order — January 16, 2027 — the Secretary must develop policy and implementation guidance requiring all prime contractors and subcontractors at any tier to map and illuminate critical supply chains, from raw materials to end-use products, for Department of War acquisitions that support, implicate, or relate to U.S. national security. Implementing regulations are to be promulgated within 90 days after that policy is completed.
DHS Exclusion and Removal Order #2026-01, original release date July 24, 2026, requires civilian executive branch agencies (other than national security systems) to exclude DeepSeek products and affiliates from procurements immediately after issuance and to remove covered products immediately or seek an exception. The signed order was published as a Federal Register notice on October 20, 2026 (91 FR 66346).
DHS Exclusion and Removal Order #2026-02, original release date July 31, 2026, requires immediate exclusion of Acronis covered articles and removal from agency information systems within 180 calendar days of issuance (January 27, 2027), or an exception. The order applies to federal information systems, including systems used or operated by an agency or by a contractor of an agency. The notice was published October 30, 2026 (91 FR 68528).
FAR Part 25, as published on Acquisition.gov, sets the Buy American domestic-content test at 65 percent for items delivered in calendar years 2024 through 2028 and 75 percent for items delivered starting in calendar year 2029.
DHS issued a final HSAR rule on Make PPE in America Act restrictions, effective October 19, 2026 (91 FR 59066).

Findings

Executive Order 14415, “Securing America’s Defense Supply Chains and Ensuring Domestic Acquisition of Critical Materials,” was signed July 20, 2026, and published in the Federal Register on July 23, 2026. Section 2 restricts waivers under 10 U.S.C. 4872. On January 1, 2027, the Secretary of War and the Secretaries of the military departments shall cease to issue waivers under 10 U.S.C. 4872(c)(1), except as provided in subsection (b). Subsection (b) allows a waiver that would otherwise be prohibited if the prime contractor or subcontractor submits a formal mitigation plan, accepted by the Secretary or a designee, that identifies the noncompliant source and meets the order’s other stated conditions. Waivers under 10 U.S.C. 4872(e) are also limited as provided in the order, including a path that runs through a request to the Assistant to the President for National Security Affairs.

Section 3 sets the mapping mandate. Within 180 days of the date of the order, the Secretary shall develop policy and implementation guidance to require all prime contractors and subcontractors at any tier to map and illuminate critical supply chains for Department of War acquisitions that support, implicate, or relate to United States national security, from raw materials to the end-use products those contractors deliver. Within 90 days of completion of that policy, the Secretary shall promulgate implementing regulations, which are to seek to avoid unduly burdening small businesses, non-traditional defense companies, and new entrants. The proposed regulations are to require a complete indentured bill of materials tracing components, parts, equipment, software, and materials back to the origin of raw materials; written procedures to vet suppliers and subcontractors for financial risk, foreign ownership, control, or influence, and manufacturing and supply risk; and, subject to a stated exception, a prohibition on using covered material supplied by an “unreliable foreign supplier” as defined in the order. After vetting, contractors must implement and track mitigation, notify the Department of significant risks within 15 days, submit a confidential corrective-action plan within 45 days, and submit a closeout report. Section 4 separately directs the Secretary, within 180 days, to initiate regulatory action to identify national-security-related acquisitions and to require contractors who rely on unreliable foreign suppliers in those supply chains to qualify and use alternative sources as soon as possible, consistent with law, safety, mission requirements, and existing contracts. The order also directs the Secretary, within 90 days of the order, to develop a strategy to accelerate testing and qualification of new sources and materials. This report does not treat a public release of that 90-day strategy as confirmed, because no official strategy document was located.

Two Federal Acquisition Supply Chain Security Act exclusion and removal orders are now in the official record. Exclusion and Removal Order #2026-01, signed by Secretary of Homeland Security Markwayne Mullin, has an original release date of July 24, 2026. It applies to federal civilian executive branch agencies except for their national security systems and secure compartmented information systems. Required actions are to exclude DeepSeek, DeepSeek-affiliated entities, and their products from civilian agency procurements, effective immediately after issuance — including from agency-approved products lists, service-provider equipment lists, e-commerce markets, and similar procurement functions — and to remove products provided by DeepSeek and affiliates, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems immediately after issuance, or to seek an exception. Exception requests must be submitted in writing within 60 days of issuance. The Secretary is to review the order within one year and annually thereafter. DHS published notice of the order on October 20, 2026, at 91 FR 66346, including the signed order as an official appendix, which is the text opened for these operational details.

Exclusion and Removal Order #2026-02, also signed by Secretary Mullin, has an original release date of July 31, 2026. It directs civilian executive branch agencies to exclude Acronis AG and all affiliated entities, and any covered articles directly or indirectly supplied by them, from agency procurement actions immediately after issuance, and to remove Acronis covered articles from agency information systems within 180 calendar days of issuance, or seek an exception. Exception requests are likewise due in writing within 60 days. A footnote in the signed order states that the order applies to federal information systems, including systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. One hundred eighty calendar days after July 31, 2026, is January 27, 2027. DHS published notice of the order on October 30, 2026, at 91 FR 68528.

Domestic-content rules already in the FAR continue on a published schedule. FAR Part 25, as opened on Acquisition.gov, provides that the domestic-content test for a domestic end product is 65 percent for items delivered in calendar years 2024 through 2028 and 75 percent for items delivered starting in calendar year 2029, unless an alternate percentage is established for a contract in accordance with FAR 25.101(d). Components of unknown origin are treated as foreign.

DHS also issued a final Homeland Security Acquisition Regulation rule, “Make Personal Protective Equipment in America Act Restrictions on Foreign Acquisition” (HSAR Case 2024-003), published September 18, 2026, and effective October 19, 2026 (91 FR 59066). The rule amends HSAR parts 3025 and 3052 to codify how DHS complies with the Make PPE in America Act for specified types of personal protective equipment.

What it means for contractors

Bid strategy

Defense bids that rely on a 10 U.S.C. 4872 waiver should treat January 1, 2027, as a hard change in official policy: new (c)(1) waivers are to cease except where an accepted mitigation plan is in place, as the order provides. Offerors whose bills of materials include covered materials from sources that would need a waiver should plan either a compliant source or a mitigation plan the Department will accept. The mapping and indentured-BOM requirements are not yet a published FAR or DFARS clause; they are a directive to the Secretary to issue policy by January 16, 2027, and regulations within 90 days after that policy is completed. Solicitations may still begin to preview that direction, but the official contract language will be in the forthcoming policy and rules.

Compliance cost

All-tier mapping, an indentured bill of materials back to raw materials, supplier vetting for financial, FOCI, and manufacturing risk, and the 15-day / 45-day notice and corrective-action clocks will be a substantial documentation and subcontract-management cost once the implementing regulations appear, including for small businesses the order says the rules should not unduly burden. On the civilian side, FASCSA orders already have immediate procurement consequences for DeepSeek and Acronis products, and the Acronis order’s 180-day removal clock includes contractor-operated federal information systems. Buy American content at 65 percent is already the rule for deliveries through 2028; 75 percent applies to deliveries starting in 2029 and should be priced into multiyear production now. DHS PPE purchases are under the new HSAR restrictions as of October 19, 2026.

Execution

Companies supplying civilian agencies should confirm that DeepSeek models, DeepSeek-derived third-party tools, and Acronis covered articles are out of agency-facing offerings and, for Acronis, off contractor-operated federal systems by January 27, 2027, unless an official exception applies. The agency exception windows (60 days from each order’s issuance) have already closed. Defense suppliers should inventory 4872-covered materials, identify any current waivers, and prepare mitigation plans or alternate sources before January 1, 2027, and should be ready to produce indentured bills of materials when the Section 3 policy is issued.

Watch next

January 1, 2027: date in EO 14415 on which most new 10 U.S.C. 4872(c)(1) waivers are to cease, except as the order provides.
January 16, 2027: date that is 180 days after EO 14415, by which the Secretary is to develop the all-tier mapping policy and implementation guidance, and to initiate the Section 4 regulatory action on alternative sources.
January 27, 2027: date that is 180 calendar days after the July 31, 2026, Acronis exclusion and removal order, by which covered articles must be removed from covered agency information systems, or an exception obtained.
Calendar year 2029: FAR Part 25 raises the Buy American domestic-content test to 75 percent for items delivered starting in that year.

Implementing regulations under EO 14415 Section 3 are due 90 days after the mapping policy is completed; that follow-on date is not fixed until the policy itself is issued.

Sources

Executive Order 14415, “Securing America’s Defense Supply Chains and Ensuring Domestic Acquisition of Critical Materials,” July 20, 2026, 91 FR 46693 (July 23, 2026) (FR Doc. 2026-15003). Official FR text.
Department of Homeland Security, Exclusion and Removal Order #2026-01 (DeepSeek), original release date July 24, 2026, published as a notice at 91 FR 66346, October 20, 2026 (FR Doc. 2026-21447). Signed order opened from the official Federal Register / GovInfo PDF appendix. govinfo.gov PDF.
Department of Homeland Security, Exclusion and Removal Order #2026-02 (Acronis), original release date July 31, 2026, published as a notice at 91 FR 68528, October 30, 2026 (FR Doc. 2026-22215). Signed order opened from the official Federal Register / GovInfo PDF appendix. govinfo.gov PDF.
FAR Part 25, Foreign Acquisition, Acquisition.gov, domestic-content test at 65 percent for deliveries in calendar years 2024–2028 and 75 percent starting in calendar year 2029. acquisition.gov/far/part-25.
Homeland Security Acquisition Regulation, Make Personal Protective Equipment in America Act Restrictions on Foreign Acquisition, final rule, HSAR Case 2024-003, 91 FR 59066, September 18, 2026, effective October 19, 2026 (FR Doc. 2026-19207).

← Back to Supply Chain