The EO declares a national emergency under IEEPA and the National Emergencies Act. It generally prohibits (after the order date) acquisition, importation, transfer, or installation of certain foreign-produced bulk-power system (BPS) electric equipment—or associated critical components, software, firmware, digital services, maintenance, or remote-access capabilities—where the Secretary of Energy determines the transaction involves equipment from a “Covered Foreign Entity” and poses undue risks of sabotage, unauthorized access, supply disruption, catastrophic effects on critical infrastructure/economy, or other unacceptable national-security risks. It covers BPS facilities (transmission ≥69 kV and related generation/control systems) but explicitly excludes local distribution. The Secretary of Energy must issue implementing rules/regulations within 120 days and can impose conditions (identify, isolate, monitor, secure, disconnect, replace, or remove) on pre-existing equipment, with consideration of reliability, safety, replacement availability, and phased compliance. Pre-qualification of vendors/equipment and mitigation measures/licenses are also authorized.
Here are ten prioritized steps:
1. Stand up an internal EO compliance task force immediately
Assign a cross-functional team (legal, procurement/supply chain, operations/engineering, cybersecurity/IT/OT, risk/compliance, finance, and regulatory affairs). Designate an executive sponsor and single point of contact for DOE inquiries. Brief the board and C-suite on scope, timelines (rules due ~late December 2026), and potential reliability/cost impacts.
2. Map and inventory all in-scope BPS equipment and associated digital elements
Catalog transformers, utility-scale/grid-connected inverters, battery energy storage systems, UPS supporting critical infrastructure, generators, voltage regulators, circuit breakers, reactors, capacitors, reclosers, instrument transformers, protective relays, metering, industrial control systems (RTUs, PLCs, IEDs), distributed control systems, safety systems, generation turbines, and all associated software/firmware, remote-access capabilities, and lifecycle maintenance/update mechanisms. Distinguish BPS (≥69 kV transmission and related) from pure distribution assets. Document manufacturer, origin, ownership/control, installation date, serial numbers, and any remote connectivity.
3. Screen the supply chain against Covered Foreign Entity criteria
Identify equipment designed, developed, manufactured, or supplied by persons owned/controlled by or subject to the jurisdiction/direction of a Covered Foreign Entity (countries/persons under U.S. arms embargo/sanctions under ITAR 22 C.F.R. 126.1, or those the Secretary determines are engaged in conduct detrimental to U.S. national security/foreign policy). Flag high-risk sources (notably those historically dominant in transformers, inverters, and batteries). Track contracts initiated after August 26, 2026, separately from legacy ones.
4. Pause or tightly control new acquisitions, imports, transfers, and installations of potentially covered equipment
Place holds on pending RFPs, POs, and installations involving foreign-produced items until DOE rules clarify Covered Foreign Entities, prohibited classes, pre-qualification lists, and licensing/mitigation pathways. Require enhanced origin and ownership certifications from vendors. Document any legitimate continuity-of-service needs that may later support exception requests.
5. Assess existing installed equipment for risk and prepare mitigation readiness
Prioritize high-criticality assets with remote access, firmware update mechanisms, or known foreign provenance. Evaluate options for identification, isolation, enhanced monitoring, securing, disconnection, replacement, or removal. Model reliability and cost impacts of phased actions. Begin preliminary engineering studies and contingency plans so the utility can respond quickly if the Secretary imposes conditions.
6. Engage vendors, OEMs, and domestic alternatives aggressively
Notify key suppliers of the EO and request detailed origin, ownership, and cybersecurity documentation. Explore pre-qualification pathways once DOE establishes criteria. Accelerate qualification of U.S.-manufactured or non-Covered alternatives (transformers, inverters, storage, controls). Monitor related federal actions (e.g., DPA authorities, domestic content incentives) that may expand secure supply.
7. Strengthen cybersecurity, OT segmentation, and monitoring for foreign-sourced or remote-capable assets
Review and harden remote-access pathways, firmware/software update processes, and maintenance services. Increase anomaly detection and logging on ICS/SCADA interfaces involving potentially covered equipment. Ensure any temporary continued use of higher-risk assets includes compensating controls pending formal DOE direction.
8. Update procurement, contracting, and compliance policies and training
Revise vendor qualification, origin-of-goods, and cybersecurity clauses to incorporate EO prohibitions and future DOE rules. Train procurement, project management, and field teams. Establish internal approval gates for any BPS equipment transactions. Prepare documentation systems that will support future licensing, mitigation agreements, or audits.
9. Model financial, reliability, and regulatory impacts; engage stakeholders
Quantify potential capital and O&M costs of replacements or mitigations, effects on project timelines (especially renewables/storage interconnects), and rate impacts. Coordinate with reliability coordinators, ISOs/RTOs, state PUCs, and trade associations. Prepare comments for the upcoming DOE rulemaking and any related FAR revisions for federal procurement.
10. Establish ongoing monitoring, reporting, and adaptive processes
Track DOE rulemaking (due within 120 days), Covered Foreign Entity designations, pre-qualified lists, licensing procedures, and any specific directives on existing equipment. Maintain a living inventory and risk register. Plan for periodic re-assessments, board updates, and rapid response to new determinations or phased compliance schedules. Coordinate with legal counsel on IEEPA enforcement risks (evasion, conspiracy, etc.).
These steps position a utility to comply with the prohibitions on new transactions, respond effectively to conditions on legacy equipment, minimize reliability disruptions, and participate constructively in the implementation process. Rules and specific Covered Foreign Entity lists will provide further clarity; utilities should treat the period until those rules as a critical preparation window. Consult specialized legal and regulatory counsel for application to specific assets and contracts.
