Inteldefense
Section 889 Is an Evidence Problem, Not a Tool Problem
The prohibition covers five vendors and two dates. No visibility platform can prove a bill of materials its suppliers will not disclose.
Section 889 is usually described as a supply chain visibility problem. It is an evidence problem.
The law prohibits federal agencies from procuring or using certain telecommunications and video surveillance equipment from five named Chinese companies. It also prohibits agencies from contracting with an entity that uses that equipment, whether or not the use is in performance of the contract. A visibility platform can tell you where the risk might be. It cannot prove the negative a contracting officer needs.
What the rule prohibits
Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, Public Law 115-232, has two prohibitions with two dates.
The first, at 889(a)(1)(A), took effect on 13 August 2019. It bars agencies from procuring or obtaining any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component, or as critical technology.
The second, at 889(a)(1)(B), took effect on 13 August 2020. It bars agencies from entering into, extending, or renewing a contract with an entity that uses covered equipment or services as a substantial or essential component, or as critical technology, regardless of whether that use is in performance of the contract.
The covered vendors are Huawei, ZTE, Hytera, Hikvision, and Dahua, including subsidiaries and affiliates. The definition also reaches equipment or services from an entity the Secretary of Defense reasonably believes is owned or controlled by, or connected to, the government of China.
FAR 52.204-25 (opens in a new tab) puts the prohibition into contracts. It requires the contractor to report a finding to the contracting officer, or to DIBNET for DoD, within one business day, and to flow the clause down to subcontracts.
That is a representation and a reporting duty. It is not a certificate you can buy.
Why tools cannot close the gap
Supply chain platforms aggregate supplier questionnaires, corporate filings, customs records, sanctions lists, and news. They resolve entities, map ownership, and flag changes. That is useful work, and it is not the same as a component-level answer.
The gap is physical. A router or a camera can contain a component from a covered vendor inside an assembly the original equipment manufacturer does not fully document. A customs record shows where a shipment entered. It does not show what is on the board. A corporate filing shows who owns a supplier. It does not show whether the supplier changed a sub-tier source last month.
The weakest link is the attestation. A supplier signs a form saying it does not use covered equipment. The form is a point-in-time claim, and it goes stale when the supplier changes a source, is acquired, or rebrands a product. A platform that ingests the form has digitized the claim. It has not validated it.
A risk score is a reason to look. It is not evidence of compliance.
What evidence looks like
Evidence for Section 889 is specific to a system. For a critical assembly, it is a bill of materials that goes to the component level, with a source for each component and a record of when the source was checked.
It is a contract that gives you the right to ask for that record and to audit the answer. Without the clause, the supplier has no obligation to disclose, and the tool has nothing to analyze.
It is a technical validation for the highest-risk items: a teardown, a firmware inspection, a lab test, or a vendor audit. A document review cannot substitute for opening the box.
It is a reporting procedure that meets the one-business-day clock. The procedure needs a named owner, a template, and a path to DIBNET. A finding discovered in a quarterly review is already late.
And it is a remediation record. When a covered component is found, the file should show what was removed, what replaced it, and how the replacement was verified.
Where AI helps
AI is good at the top of the funnel. It can resolve entities across databases, trace ownership through corporate structures, parse questionnaires, flag a supplier whose ownership changed, and monitor news for a facility closure or a new subsidiary.
It can also help draft the evidence package and keep a timeline of what was checked. That is real work, and it reduces the number of suppliers a human has to review.
It cannot infer a component that was never disclosed. It cannot turn a customs record into a bill of materials. It cannot make a supplier tell the truth.
The useful deployment is a triage system that points a compliance team at the ten suppliers that need a call, not a dashboard that claims 4,000 suppliers are clean.
How to build the record
Start with the contract. If the clause does not require disclosure and audit rights, fix that before buying a platform.
Then tier the supply chain by consequence. A router in a secure enclave and a camera in a lobby are not the same risk. Spend the technical validation where the consequence is highest.
Keep the inventory current. The reporting duty is one business day, and the inventory is what makes that possible.
Finally, test your own claim. Pick a critical assembly and try to trace one component to its source. If you cannot, you have found a gap before an assessor did.
Section 889 does not ask whether you have a dashboard. It asks whether you can show, for a specific system, that no covered component is inside it. That is a record, and records are built one supplier at a time.