U.S. Power Grid: Executive Order 14420 Declares National Emergency Over Foreign Supply

On August 26, 2026, the President of the United States signed Executive Order 14420, declaring a national emergency over the "unusual and extraordinary" threat posed by foreign-supplied electric equipment for the bulk-power system. The move marks a shift in protecting the U.S. electric grid: no longer just software vulnerability hunting, but control over provenance, design, and the supply chain of transformers, relays, industrial control systems, and critical components.

What the Order Establishes: Scope and Definitions

Executive Order 14420 applies to the bulk-power system, defined as the set of interconnected transmission infrastructure and generation resources needed for grid reliability. It includes transmission lines with voltage of 69 kV or higher. Local electric distribution infrastructure serving residential users and small businesses directly is excluded.

The text covers a broad list of equipment and technologies. These include transformers, generators, inverters, energy storage systems or batteries, protective relays, meters, and high-voltage circuit breakers. The order also includes industrial control systems: remote terminal units (RTU), programmable logic controllers (PLC), intelligent electronic devices (IED), distributed control systems (DCS), and safety instrumented systems. It does not stop at hardware: software, firmware, digital services, maintenance services, and remote access capabilities associated with covered equipment are also in scope.

No specific vendor is named. These are product categories, not identified companies. The order does not name any country, although its structure closely recalls a 2020 measure that led to a ban on entities associated with China, later rescinded after a Biden administration review.

Not a Blanket Ban: The Assessment Mechanism

The order does not impose a blanket ban on all foreign-made equipment. Instead, it creates a framework allowing the Secretary of Energy to determine whether specific foreign entities, suppliers, countries, or equipment pose an unacceptable risk to national security, foreign policy, or the economy. Transactions to acquire, import, transfer, or install foreign-made bulk-power equipment initiated after August 26, 2026 are prohibited only if they involve a "Covered Foreign Entity" and if the hardware or software is deemed at risk of sabotage, subversion, unauthorized access, malicious remote action, or disruption of the power system and its supply chain.

The definition of "Covered Foreign Entity" is deliberately broad. It includes governments subject to certain U.S. embargoes or sanctions regimes and entities that relevant authorities deem engaged in conduct harmful to national security or foreign policy. The Secretary of Energy may also grant licenses for otherwise prohibited transactions, introducing flexibility for specific cases.

The mechanism does not apply only to individual components. The order allows evaluating and restricting entire classes of transactions, aiming to intervene before a potentially compromised component enters the grid.

Impact on Already Installed Equipment

The order does not apply only to new acquisitions. For foreign-made or foreign-managed equipment already installed before entry into force, the Secretary of Energy may impose conditions and, based on risk, require operators to identify, isolate, monitor, secure, disconnect, replace, or remove certain components.

Before imposing isolation or replacement, officials must consider reliability, safety, availability of secure substitutes, and continuity of essential services. Removing a component without an adequate substitute can create an operational problem in itself. For this reason, progressive compliance and negotiated measures are provided for instead of immediate removals.

The pre-qualification framework aims to avoid supply chain bottlenecks. The Secretary of Energy may establish criteria for pre-qualified equipment and suppliers exempt from baseline restrictions. Pre-qualification, however, does not prevent the government from later reviewing or restricting a transaction if circumstances require.

Timeline and Next Steps

The order sets precise deadlines for implementation. Within 120 days of signing, the Secretary of Energy must issue implementing rules or regulations, including procedures for identifying covered entities, equipment, and countries and for granting licenses for otherwise prohibited transactions.

Within 180 days, the Department of Energy must develop recommendations for changes to the Federal Acquisition Regulation (FAR) that give greater weight to national security risks and favor energy infrastructure manufactured in the United States. The FAR Council will then have 90 days to assess whether to propose amendments for public comment.

Energy authorities may also negotiate mitigation agreements or publish an official list of pre-qualified equipment and suppliers exempt from baseline prohibitions. The Department of Energy said in August 2026 that it wanted to increase domestic production of critical grid components, in response to rapid electricity demand growth and the need to strengthen the supply chain.

A Strategic Shift: From Vulnerability Hunting to Supply Chain

Executive Order 14420 is not tied to a single technical vulnerability. There are no CVEs or severity scores. The assessment is strategic: electric grid security is addressed as a problem of procurement, production, and supply chain control.

The official rationale cited by the White House is the rapid growth of data centers, artificial intelligence, advanced manufacturing, and defense production. This growth has increased U.S. dependence on the reliability of the electric grid. An outage that could once be treated primarily as an energy problem can now affect defense operations, critical infrastructure, emergency services, and large parts of the economy.

The order marks a shift toward mitigating upstream supply chain risks and embedded hardware backdoors. While attention often focuses on active attacks by state-sponsored actors against U.S. power grids, the new measure intervenes upstream, before a potentially compromised device is installed. It is no longer enough to know whether a device has a vulnerability today: you also need to know who made it, who controls the supplier, where software and firmware come from, who can access it remotely, and what happens if the supply chain becomes unavailable.

What Operators Need to Do

For U.S. bulk power system operators, the order creates new potential obligations. The Department of Energy may impose security controls and measures to identify, isolate, monitor, secure, disconnect, or replace covered equipment, while ensuring continuity and safety of service.

Companies purchasing or installing foreign-made bulk-power equipment must check whether the supplier falls among designated or covered entities and whether the hardware or software presents the risk factors set out in the order. Pre-qualification can offer a way to continue procurement without incurring prohibitions, but it does not eliminate the possibility of later review.

The absence of an initial list of prohibited countries or suppliers leaves room for interpretation. The implementing rules expected within 120 days will clarify the concrete procedures. Until then, operators must prepare for a regime in which supply chain provenance and control become an integral part of risk assessment, alongside traditional cybersecurity measures.

Executive Order 14420 does not introduce new patches to install. It introduces a new way of thinking about electric grid security, moving the line of defense from the cyber perimeter to the supply chain. Its effectiveness will depend on the implementing rules and on the Department of Energy's ability to balance security and operational reliability.