The Rule That Decides Whether Your Customers Can Buy From You

The Law Behind Your Customers' New Questions

On December 23, 2022, President Biden signed the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 into law.

It's over 4,400 pages and covers almost everything the Department of Defense does in a given year.

Buried inside it, a few paragraphs with nothing to do with ships or personnel: Section 5949.

Section 5949 and You

Section 5949 bans federal agencies from procuring anything that contains a semiconductor from a specific set of restricted manufacturers.

Your customers, the manufacturers and integrators who buy from you, are the ones who have to certify this to the government. They can only do that if you can tell them where your parts actually come from.

Why This Impacts Every Supplier in the Chain

If your customer's mission touches, or is ever likely to touch, a federal agency, directly or through a prime, this impacts what they can buy from you, whether or not they've asked you about it yet.

The restriction names three companies specifically: Semiconductor Manufacturing International Corporation (SMIC), ChangXin Memory Technologies (CXMT), and Yangtze Memory Technologies Corporation (YMTC), along with their subsidiaries and affiliates.

All three were already under separate export-control scrutiny before this statute, part of a broader U.S. policy response to state-subsidized competition and supply chain dependency in critical semiconductor manufacturing.

The Detail That Catches You Out

This is the detail that catches most suppliers off guard: the restriction attaches to the semiconductor die itself. Not the part number. Not the distributor. Not the country the box shipped from.

Your own datasheet tells you electrical characteristics. It almost never tells you where the die was actually fabricated, because packaging, testing, and fabrication are frequently three different companies in three different countries, and you may be several of those steps removed from the actual fab yourself.

And getting this wrong isn't just a paperwork problem.

Most government-facing contracts include flow-down clauses: the compliance obligation your customer owes the government passes down to you by contract. If you can't document your own sourcing, you can be contractually on the hook, for indemnifying your customer's losses, for breach of contract, and in some structures, for direct exposure if you're the one who supplied the information your customer relied on to certify.

The Bigger Implication

In practice, this cuts wider than it first looks.

If you can't identify and document where your parts come from, you're locked out of selling to any customer who might eventually sell into a federal agency, not just the ones who tell you that's what they're doing.

And it doesn't stop at your finished part. It reaches into the components, and potentially the materials, that your own suppliers use to build what you sell.

What Happened in February 2026

For three years, Section 5949 sat as a statute with no enforcement mechanism, real, but distant.

That changed on February 17, 2026, when the FAR Council, the body that writes the actual procurement regulations, published its proposed rule implementing it.

That's the document that turned this from a law your customers might eventually ask about into a compliance regime they're building right now, and bringing straight to you.

The New Deadline

The statute set enforcement at December 23, 2027, sixty months after it was signed into law on December 23, 2022.

As of today, that's roughly 14 months away, and your customers are locking in their qualified-supplier lists well before that deadline hits, not after.

Why This Is a Challenge

You're probably not the one submitting a certification to the federal government, your customer is. That doesn't mean you're clear, and it doesn't make this easy.

You may buy die, wafers, or finished components from a foundry or distributor yourself, and you may not fully control, or even see, where they source from either. Your own upstream suppliers switch fabs, re-source under shortage pressure, and get acquired, often without telling you, the same way you might not think to tell your own customer.

And you don't have one customer asking this question, you have several, each wanting it in a different format, on a different timeline, and at a different level of detail. This is a documentation function you now have to run account by account.

Your Options

Realistically, three paths from here, and only one of them actually resolves anything.

Do nothing. Not a strategy, a bet that your customers won't ask, or won't notice when you can't answer. That bet doesn't just cost you one deal, it costs you standing with every customer watching how you handle it.

Build the capability internally. The honest, defensible option, and expensive in a way that doesn't show up until you're already inside it. Someone has to trace your own sourcing through every tier, document it in a form each customer will actually accept, and keep it current. That's a standing function most component suppliers don't have today.

Have this done by people who already do it. The documentation burden doesn't disappear, tracing, formatting, maintaining, someone still does all of it. It just stops being yours to carry, account by account.

This Goes Wider Than Compliance

Even without Section 5949, being able to answer where your components come from is becoming a competitive advantage, not just a compliance requirement.

The suppliers who already have this ready aren't winning deals because their parts are better. They're winning because they're faster to trust, and because a clean, credible answer removes friction from every RFQ instead of adding it.

Section 5949 is the reason this is urgent right now. It won't be the last reason it matters.

This Isn't a One-Off Task

An answer built once and filed away goes out of date the moment any of that instability upstream changes the facts. This has to be something you maintain continuously, not something you complete once and hand over.

We're Launching Provenance Tracker

That's why we're launching Provenance Tracker.

It maps your own component sourcing tier by tier, documents what's confirmed and what isn't with a stated confidence level for each finding, and keeps that record current as your suppliers and their own sourcing change, instead of going stale the moment it's produced.

You get one standardized, credible record you can hand to any customer who asks, instead of rebuilding your answer from scratch every time a new RFQ demands the same information in a slightly different shape.