When Infrastructure Needs a Passport: Inside the New US Power Grid Rules
The new US power-grid order moves technology security deeper into the hardware itself. For years, infrastructure protection was framed largely around software, network access and cyber controls. The latest rules widen that perimeter.
Under the executive order signed on August 26, the US government can block or condition the acquisition, installation or continued use of foreign-produced bulk-power equipment when its ownership, origin or associated digital capabilities create an unacceptable national-security risk [1]. The directive also opens the door to pre-qualified equipment and vendor lists.
That changes the logic of trust. Security is no longer judged only by what a system does or how well it is protected once installed. Increasingly, it also depends on who designed it, who supplied it and which jurisdiction ultimately sits behind the hardware.
Hardware Now Carries Political Risk
The next change is in how infrastructure equipment is evaluated. A transformer, inverter or industrial control system is no longer judged only by cost, performance and expected service life. Its ownership, jurisdiction and exposure to external control now sit inside the same risk assessment.
The White House order makes that explicit. It allows scrutiny not only of where equipment was manufactured, but also of who designed, supplied or controls it, and whether associated firmware, digital services or remote-access capabilities could create an unacceptable security risk [1]. That broadens the definition of hardware risk well beyond the physical device itself.
For procurement teams, this creates a geopolitical layer that technical specifications cannot resolve. Two components may perform identically on paper, yet carry very different regulatory exposure depending on their corporate ownership or country of origin. In critical infrastructure, provenance is becoming part of the engineering decision.
Technology Sovereignty Changes Procurement
Once origin becomes part of the risk model, procurement stops being an open comparison of equivalent products. The White House order explicitly allows the Department of Energy to establish criteria for pre-qualified equipment and vendors, creating a path toward a market where eligibility can matter before price is even considered [1].
That changes the commercial position of suppliers. Winning a contract may increasingly depend on proving who controls the company, where critical components come from, how firmware is maintained and whether the equipment can remain inside an approved operational environment. For utilities and other operators of critical systems, vendor selection starts to look less like ordinary sourcing and more like regulated access.
A similar shift is already visible in AI infrastructure, where long-term capacity commitments are replacing some forms of open-market purchasing. The mechanism is different, but the direction is the same: strategic technology is becoming harder to buy anonymously, opportunistically or at the last minute. Access is being shaped earlier — by qualification, contractual commitment and control over the production chain.
Trust Becomes Part of the Product
The larger change is that technical merit no longer guarantees commercial access. Price, performance and reliability still matter, but in critical infrastructure they are being joined by another test: whether the buyer and the state can trust the chain of control behind the equipment.
That shifts value in a way hardware markets are not used to pricing. Two products can deliver the same output and meet the same engineering standard, yet only one may remain eligible for a sensitive grid, telecom network or industrial system because its ownership, firmware path and jurisdiction are considered acceptable. In that sense, provenance starts to function like a core compliance barrier.
Europe is already moving in a similar direction, where security of supply is becoming part of the commercial specification in defense procurement [2]. The US power-grid rules push the same logic into civilian infrastructure: origin is no longer a background detail once the equipment sits inside a system the state cannot afford to lose control of.
That may prove to be the defining shift. The next generation of infrastructure suppliers will compete not only on what their equipment can do, but on whether governments are willing to let it remain inside the system at all.
Sources:
Why Smart Devices Still Feel Less Smart Than Promised
Why Smart Homes Still Have a Trust Problem
Edge Computing: When the Cloud Is Too Far Away
Advertisement