A plain-language look at Executive Order 14421, and how to start preparing without overreacting.
On August 26, 2026, President Trump signed Executive Order 14421, declaring a national emergency over foreign-produced equipment in the bulk-power system. The order gives the Department of Energy authority to prohibit or condition transactions in bulk-power system equipment tied to suppliers owned or controlled by sanctioned governments, and it directs DOE to publish implementing rules within 120 days, roughly December 24, 2026. Those rules will also apply to equipment already installed.
Nothing is required of utilities today. No matter how DOE writes the final rule, utilities are likely to face the same first question: what is installed on your system, where did it come from, and what does it communicate with?
If you work at a utility, you have probably already seen the headlines, and someone on your team has probably already asked what this means for operations. The short answer: nothing is on fire.
What the order actually does
This is not the first executive order to take on foreign suppliers in the bulk electric system. EO 14421 builds on and expands EO 13920 (May 2020), which the Biden administration suspended in January 2021 before DOE revoked the implementing prohibition order.
The new order lets DOE block or place conditions on transactions involving foreign-produced bulk-power system equipment when that equipment is designed, developed, manufactured, or supplied by a party owned by, controlled by, or subject to the jurisdiction or direction of a “covered foreign entity.” The order defines that as a government subject to a U.S. arms embargo or an ITAR 126.1 sanctions regime, or any party the Secretary of Energy determines is engaged in conduct detrimental to national security or foreign policy.
If you work in OT, it’s important to note that the equipment list is not just big iron. Alongside transformers, reactors, capacitors, grid-connected inverters, and battery energy storage systems, the order explicitly names industrial control systems, and it spells out remote terminal units, programmable logic controllers, and intelligent electronic devices. It also names distributed control systems, safety instrumented systems, protective relaying, and metering equipment.
Then it goes one step further. Agencies may also weigh associated software and firmware, remote access capabilities, lifecycle maintenance and update mechanisms, and other supply chain dependencies when deciding whether something falls in scope. So the vendor update server and the maintenance connection that reaches your relays are part of this conversation, not just the nameplate on the cabinet.
Scope is transmission level, facilities rated 69 kV and above. Local distribution is out. The prohibition applies to transactions initiated after August 26, 2026, but installed equipment is not ignored. Section 2(b) lets the Secretary impose conditions on equipment already in the field, including requirements to identify, isolate, monitor, secure, disconnect, replace, or remove it. Before directing anything to be pulled out or cut off, the Secretary has to weigh reliability and safety, whether secure replacements are actually available, and continuity of essential service, and may phase compliance. That reliability caveat matters. It is a big part of why this looks more like a process than a recall.
What the order does not do is hand down a finished rulebook. DOE still has to write the regulations that define how risk determinations get made, what documentation utilities need to produce, and what timelines apply. Think of it less like a recall notice and more like a new inspection step added to a permitting process.
The timeline, counting from August 26, 2026:
- 120 days, roughly December 24, 2026. DOE publishes implementing rules and may designate covered foreign entities.
- 180 days, roughly February 22, 2027. DOE submits recommended Federal Acquisition Regulation revisions. The FAR Council then has 90 days to consider proposing amendments for public comment.
- No fixed date. DOE can act on transactions initiated after August 26, 2026, even before rulemaking finishes.
One more provision worth having on your radar. Section 2(e) lets DOE set criteria to pre-qualify specific equipment and vendors and publish that list. If your procurement team wants an early read on where this is heading, that list is the thing to watch for.
For now, the timing and scope are clear; the details are still coming.
Why this does not call for a scramble
Utilities have been managing supply chain and vendor risk for a long time, largely because NERC CIP and years of hard-won operational experience already pushed the industry in that direction. The difference now is who has the hammer: DOE can block transactions outright under IEEPA, which reaches procurement and imports rather than the audit findings and penalties utilities know from NERC CIP.
But it does not ask you to do something categorically new. It asks utilities to answer, with confidence, questions they are already expected to understand: what is connected to the bulk-power system, where did it come from, what does it talk to, and what would happen if a piece of it needed to come offline.
If you can answer those today, you are in reasonable shape to adapt once DOE rules take form. If you cannot, that is the gap worth closing, and it is a gap that existed before this order and will exist after it, regardless of how the compliance mechanics shake out.
Where we can help
When DOE recommends actions on installed equipment, Section 3 names five: identify, inventory, isolate, monitor, or replace. Three of those come down to visibility: knowing what is there, where it came from, and how it behaves over time. Identify, inventory, and monitor are where our team spends most of its time.
Valkyrie and Cygnet are built to give you visibility into what’s actually running in your OT environment and how it’s communicating. That covers identify and inventory, and it’s the record you’d draw on to answer where a given piece of equipment came from. Monitor is the same visibility held over time: knowing when something changes, appears, or starts communicating differently than it did last quarter.
Isolate and replace are yours. Those are engineering and operations calls with reliability consequences, and no tool should be making them for you. What we can do is make sure they’re informed and that you know what a device talks to before you cut it off and what else depends on it before you take it out.
A human analyst is always in the loop on what the tooling surfaces, so you’re getting judgment, not just an alert feed. And the approach is portable: expertise goes where the question is, whether that’s a control room or substation, or a remote site you can’t easily staff.
If your team is starting to ask what documentation or visibility you’d need to have ready once DOE’s rules are finalized, that’s a conversation worth having now, while there’s still time to be deliberate about it rather than reactive. We can walk through what that could look like for your environment, on your timeline.
The bottom line
A national emergency declaration sounds urgent, and the legal mechanism behind it is a serious one. But the practical reality for most utilities is a phased compliance process, not an overnight mandate. The order itself says so: DOE is directed to weigh reliability, safety, and replacement availability before ordering anything disconnected or removed.
In practice, this comes back to the basics: a current asset inventory, a clear view of architecture, and a risk register people actually use. The utilities that handle this well will be the ones that already know their environment well.