President Trump signed Executive Order 14420, “Declaring a National Emergency to Secure the United States Bulk-Power System,” on August 26, 2026. The order invokes the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.), the National Emergencies Act (50 U.S.C. 1601 et seq.), and Section 301 of Title 3, and declares that foreign cyber and security threats to the American electric grid constitute an unusual and extraordinary threat to national security.

The operative prohibition: no acquisition, importation, transfer, or installation of any foreign-produced bulk-power system electric equipment where the Secretary of Energy determines the transaction involves equipment from a Covered Foreign Entity and poses undue risk of sabotage, unauthorized access, supply disruption, or catastrophic effects on critical infrastructure.

What counts as bulk-power system equipment

The scope is broad and deliberately physical. The order covers items used in substations, control rooms, or generating stations, specifically naming:

  • Transformers
  • Inverters
  • Battery storage systems
  • Circuit breakers
  • Generators
  • Industrial control systems
  • Associated software and firmware with remote access capabilities

That final category is the one doing the real work. A large power transformer is a passive lump of steel and copper — the concern with foreign transformers has always been the embedded monitoring and control electronics, not the windings. Inverters and battery storage systems are almost entirely software-defined, network-connected, and frequently maintained through vendor cloud platforms that reach into the device over the internet by design.

A “Covered Foreign Entity”

The order defines a Covered Foreign Entity as one from a country subject to U.S. arms embargoes or sanctions, or one the Secretary of Energy determines is engaged in conduct detrimental to U.S. national security or foreign policy.

The second clause is where the discretion lives. It is not a fixed country list; it is a delegation to DOE to designate. That structure gives the order reach beyond the obvious targets and creates real uncertainty for utilities and developers trying to plan procurement two to four years out — which is the normal lead time on grid-scale equipment.

The retroactive piece

The novel element is that EO 14420 does not stop at the border. The Secretary of Energy is authorized to impose conditions on equipment already installed and operating inside the United States.

This is a substantially more aggressive posture than a forward-looking import ban, and also a more realistic one. There is an enormous installed base of foreign-manufactured grid equipment in American substations and behind-the-meter storage sites. Ordering wholesale removal would be economically impossible and would itself destabilize the grid. Conditioning continued operation — network segmentation requirements, disabled remote access, mandated firmware inspection, monitoring obligations — is the only tool that touches existing risk without triggering the very disruption the order is meant to prevent.

The design decision is sound. The execution burden falls on utilities, and the order does not appropriate money to help them carry it.

Timelines

The order sets three deadlines:

  • 120 days — the Secretary of Energy publishes implementing rules and regulations
  • 180 days — the Secretary develops recommended revisions to the Federal Acquisition Regulation
  • 90 days after that — the FAR Council considers the amendments

The Secretary is also authorized to establish criteria recognizing equipment and vendors as “pre-qualified” and to publish an approved list — while retaining authority to prohibit transactions with vendors on that list.

That last carve-out matters. A pre-qualification list that can be overridden case by case gives DOE flexibility and gives industry very little certainty. Vendors will find their way onto the list; procurement officers will still not be able to treat inclusion as safe harbor.

This has been tried before

Trump declared a materially similar emergency in May 2020 with Executive Order 13920, also titled “Securing the United States Bulk-Power System.” The Biden administration suspended it in January 2021, and it was allowed to lapse. The intervening five years produced no durable statutory replacement.

EO 14420 is therefore the second attempt at the same problem, and it arrives with the same structural weakness: an executive order declaring an IEEPA emergency can be reversed by the next executive order. Utilities making twenty-year capital decisions are being asked to plan around an instrument with a four-year design life. Industry has been asking Congress for a statutory framework since 2020 and has not received one.

Why now

The administration’s stated rationale points to demand growth — advanced manufacturing, data centers, artificial intelligence and defense production — expanding the grid’s footprint faster than security practice can follow. That framing is politically useful and technically accurate: AI datacenter buildout is driving the largest surge in new grid interconnection and behind-the-meter generation in decades, and much of the equipment going in is inverter-based, network-connected and sourced globally.

The threat picture supports it independently. Our reporting this year has documented Sandworm’s DYNOWIPER campaign against thirty Polish grid facilities, the NSA and FBI advisory on AI-assisted exploitation of PLCs and SCADA systems, and — on the same day this order was signed — the seizure of the QTFY hacking platforms that counted the Department of Energy among their victims.

The pairing of those two announcements on August 26 is unlikely to be coincidental.

What the order does not do

It is worth being precise about the limits.

EO 14420 addresses supply chain provenance. It does not address the operational security of the grid: unpatched OT, flat control networks, remote access left open for vendor maintenance, or the shortage of ICS security staff at municipal utilities and rural cooperatives. An American-made inverter with a default password on an internet-exposed management interface is not made safer by this order.

It also does not fund anything. Utilities absorb the compliance cost, the procurement disruption and the equipment-conditioning burden. For investor-owned utilities that flows into rate cases. For the small municipals and co-ops that operate a meaningful share of American distribution infrastructure — the same entities profiled in CISA’s red team advisory on critical infrastructure SOCs — it is another unfunded mandate landing on a security program that is frequently one person.

Provenance is a real attack surface, and closing it is worth doing. It is one surface among several.

Sources