Grid supply-chain risk becomes a prohibition, and the inventory bill lands on utilities

The clause worth reading twice is the escape hatch. The White House fact sheet says purchases and installations can be "appropriately" conditioned to address risk rather than blocked outright [c3b]. Those are two very different compliance regimes wearing one policy. A prohibited-equipment list is finite and auditable: you check nameplates against a list and you are done. A conditions regime is a standing obligation on the operator, re-triggered by every firmware push and every remote support session from the vendor. Which of the two the Energy Department writes determines whether this costs a procurement review or a permanent function.

The stated basis is cyber. The order cites malicious cyber activities as an impetus ^[5] and warns that foreign-produced equipment "might have digital backdoors built into their systems that allow a foreign country to access that equipment remotely" ^[7]. The most concrete public grid-targeting evidence in the record here points somewhere else: in 2024, then-FBI Director Christopher Wray told Congress that hackers prepositioning in small office and home routers had the electricity grid among their targets should China and the United States go to war ^[13]. Consumer and small-business routers are not bulk-power system equipment, and they do not pass through utility procurement. An instrument aimed at transformers and their firmware does not reach that access path, whatever else it does.

Then the sequencing. Roughly four months of rulemaking sit between the emergency declaration and any published criteria ^[12]. During that window the phrase "significant national security risk" has no operational test, so anyone starting discovery now is guessing which attribute will be dispositive: country of final assembly, ownership of the vendor, or the origin of the code running on the device. Those three answers do not select the same equipment, and an inventory built against the wrong one is work that has to be redone.

That is the practical output of the first four months: someone has to be able to say what is installed and what it can reach. Producing that answer takes longer than writing the rule that will demand it, which is the part of the timeline nobody controls.