The extended 1260H compliance list took effect on June 30, banning the defense department from working with companies designated as linked to the Chinese military. Despite all the buzz it generated it didn’t pose much of a problem for most defense contractors.

The list is extensive, covering 188 companies in AI, ecommerce, consumer electronics, energy and semiconductors,  but the process isn’t new:  just run your tier-1 list against the Section 1260H names, adjust your supply chain as necessary, and document. Most US defense contractors weren’t working directly with Chinese companies anyway, and didn’t have to make any changes.

The harder problem arrives in June 2027, when the indirect ban kicks in. By then, you need to know which of your suppliers have commercial relationships with any of the 188 entities on that list, and either eliminate them from your supply chain or receive a waiver. That means mapping your supply chain deep enough to ensure that none of your vendors at any tier have significant commercial relationships with the banned contractors.

Even in the defense industry, where vendor due diligence is a priority, most contractors have never achieved that level of supply chain illumination.

The DoD has made a point of telling contractors to start now. There’s a site for requesting waivers, but as Assistant Secretary of Defense for Industrial Base Policy, Michael Cadenazzi put it, “People need to get ahead of it, because if you’re starting to ask for a waiver starting in 2027, I think that’s going to be a painful process for everyone.”

There’s enough time to meet the requirements — Craft can typically stand up and customize a supply chain illumination and intelligence platform in 4 to 12 weeks, giving you everything you need to root out the listed companies (along with whoever the Pentagon adds next year.) But finding alternate sources and working around compromised suppliers takes time too, and you don’t want to be begging for waivers at the last minute.

If you have no way to root out Foreign influence several tiers upstream, it’s time to make a plan.