When Is the Verifier Independent?

I. INTRODUCTION AND STATEMENT OF INTEREST

Gatewell Group LLC submits these comments in response to the advance notice of proposed rulemaking published at 91 FR 40508 (July 2, 2026).

Gatewell is a Los Angeles consultancy. Its work is documentary: what records establish country of origin, ownership, and component-level provenance, as distinct from records that assert those facts without establishing them.

We state our interest plainly. Gatewell sells advisory services on origin and provenance documentation, and a rule that requires more of such documentation is a rule that could increase demand for advice about it. We are not disinterested and do not claim to be. What we are not is a party this rule would regulate: Gatewell does not manufacture printed circuit boards or any other equipment, is not a Department of Defense contractor, is not a candidate IPC-1791 Trusted Assembler, and sells no product that would be restricted, exempted, or advantaged by any outcome here.

Gatewell is on the record before the Federal Communications Commission in PS Docket Nos. 26-184 and 26-189 (ECFS submission Nos. 26110071980, 26110071982, and 26110071981, disseminated August 18, 2026), on how parties in a distribution chain are to document that equipment is not covered equipment.

We address the Waiver Mitigation and Section 224 Compliance question (91 FR at 40511) primarily, and the Data Rights and Inspection question (id.) secondarily. We take no position on the remaining questions, which turn on manufacturing facts we do not have.

II. THE DEPARTMENT HAS ALREADY ADOPTED THE CORRECT PREMISE

This comment is not a criticism of the Independent Hardware Assurance Framework. The framework declines to rest on the word of the party seeking the waiver, and says so twice.

First: "Recognizing that facilities within covered nations cannot legally or practically guarantee the protection of controlled unclassified information (CUI), this waiver process will not rely on attestations from suppliers." 91 FR at 40509. The Department's stated reason there is CUI protection, and we do not attribute any other reason to it.

Second, and without a stated rationale: "The contractor's attestation or claims of internal corporate equivalency will not satisfy the requirements of the Independent Hardware Assurance Framework." Id.

The framework accordingly requires verification by a facility other than the contractor. Our comment concerns the condition that determines when that verification is in fact independent of the contractor's interest. As drafted, that condition does not reach a class of dependent verifiers, and the report it produces need not disclose the verifier's relationship to the contractor at all.

III. WAIVER MITIGATION AND SECTION 224 COMPLIANCE — SUFFICIENT TO THE EXTENT "INDEPENDENT" IS DEFINED

A. The two Trusted Assembler paragraphs do not partition the field.

The ANPRM addresses verifier independence in two consecutive paragraphs at 91 FR 40510.

The first is mandatory: "If the Trusted Assembler is a subsidiary, an affiliate, or otherwise under the corporate control or influence of the contractor, then the verification report, all verification imagery, digital design files, and/or associated physical hardware must be submitted to a DoD Hardware Assurance Lab for independent validation prior to the DoD component head signing and submitting the waiver request." Id.

The second is discretionary: "If the Trusted Assembler is a wholly independent third party with no financial or corporate affiliation with the contractor, the DoD component head retains the discretion to accept the report or require a DoD Hardware Assurance Lab review." Id.

The two paragraphs use different tests. The mandatory trigger is stated entirely in terms of corporate control — subsidiary, affiliate, corporate control or influence. The discretionary paragraph requires the absence of both financial and corporate affiliation. The word "financial" appears exactly twice in this document: in the discretionary paragraph quoted above, and in the Certification Burden question's reference to the "estimated financial and operational burden" of the four-pillar framework, 91 FR at 40511. It does not appear in the mandatory trigger.

The result is a gap between the two. Consider a Trusted Assembler that is financially dependent on the contractor but not owned or controlled by it. It is not "a subsidiary, an affiliate, or otherwise under the corporate control or influence of the contractor," so the mandatory Hardware Assurance Lab referral does not reach it. Neither is it "a wholly independent third party with no financial or corporate affiliation," so the discretionary paragraph does not describe it either. What governs it is the general sentence immediately preceding both paragraphs, under which the DoD component head "will have the discretion to determine whether this Trusted Assembler verification report is sufficient, or if the report (including IPC-1782 traceability data), verification imagery, digital design files, and/or associated hardware must be submitted to a DoD Hardware Assurance Lab for supplementary validation prior to signing and submitting the waiver to the Secretary of Defense." 91 FR at 40510.

The relationships that fall in that gap are ordinary commercial ones: a verifier drawing a large share of its prior-year revenue from the contractor; contingent or success-based fee arrangements tied to a favorable finding; a non-controlling minority equity stake; overlapping officers or directors short of control; exclusive supply, teaming, or joint-venture arrangements; outstanding loans or supplier financing. Each of these can exist without corporate control, and none of them, standing alone, triggers the mandatory referral.

B. The FAR definition confirms the control-based reading.

"Affiliate" is a defined term in this regulatory system, and the definition points in the same direction as the rest of the sentence: "Affiliates means associated business concerns or individuals if, directly or indirectly either one controls or can control the other; or third party controls or can control both," subject to two exceptions applicable to uses not at issue here. FAR 2.101, 48 CFR 2.101. Read against that definition, every operative term in the mandatory trigger is a control concept. "Influence" is the only word that might be read to reach economic dependence, and it is undefined and modified by "corporate," which points back toward ownership and governance. A component head should not have to rest a mandatory referral on it.

C. Correcting a characterization already on this record.

One comment on this docket tells the Department that the text already handles this. Syncra Technologies, Inc. dba ProvenMetal (DARS-2026-0298-0005) writes that "the ANPR addresses this appropriately: discretionary acceptance for independent verifiers and mandatory Hardware Assurance Laboratory review for affiliated ones."

We agree with that comment's underlying principle, stated in the preceding sentence of the same filing: "Verification by a contractor's corporate-controlled entity amounts to self-inspection, regardless of the certificate displayed." But the two-category division it describes is not the one the text creates, for the reason given in Part III.A: the mandatory trigger and the discretionary paragraph are drawn on different tests, and a verifier can fall outside both. Adopting that characterization as the rule would leave the financially dependent, corporately unaffiliated verifier governed by discretion alone.

We have made a related point in our own comments before the Federal Communications Commission in PS Docket Nos. 26-184 and 26-189: where a rule turns on a documentary determination and does not specify what the document must show, the obligated party is left resting on a counterparty's assertion.

We take no position on what IPC-1791 requires of a certified facility, and this comment does not depend on that question. Whatever a facility-level standard provides, the DFARS rule governs the DoD component head's determination and must carry that determination on its own terms.

D. Recommendation.

The Department should (1) extend the mandatory Hardware Assurance Lab trigger to financial dependence as well as corporate control, and (2) define that trigger by enumeration rather than leaving "corporate control or influence" to case-by-case construction. Objectively determinable criteria are available: common ownership above a stated percentage; revenue concentration above a stated share of the verifier's prior-year revenue; shared officers or directors; contingent or success-based fee arrangements; exclusive supply or teaming arrangements; and outstanding loans or supplier financing.

This is a definitional change to a referral rule, not an additional certification requirement, and it does not bear on the phase-in period the Department selects in response to the Certification Timelines question.

IV. DATA RIGHTS AND INSPECTION — THE CONTENT OF THE INSPECTED REPORT

The Department proposes "limiting its data rights for IPC-1782 traceability logs and IPC-1791 hardware assurance reports strictly to inspection and compliance verification, rather than seeking Government purpose rights," and states that this "is applicable to printed circuit boards manufactured or partially manufactured in a covered nation, without IPC-1791 certification." 91 FR at 40511. So limited and so confined, we agree with the proposal. (We note that the corresponding discussion states the purposes as "inspection, audit, and verifying compliance with 10 U.S.C. 4873 and section 224 of the NDAA for FY 2020." 91 FR at 40510. If the two formulations are meant to be the same, saying so in the proposed rule would avoid the question.)

Our observation concerns what the inspected report must contain. The ANPRM specifies the verification report by required conclusion: it "must demonstrate that the board underwent blind testing and validation prior to population or final assembly to ensure no unauthorized logic, malicious alterations, or counterfeits are present." 91 FR at 40510. Nothing in the ANPRM requires the report to state the basis on which the verifying facility is independent of the contractor. The component head is therefore asked to exercise discretion over independence while holding a document that need not disclose the relationship at all. The document uses the word "independent" throughout, including in the name of the framework, and does not define it; "independence" and "conflict of interest" do not appear in it.

The Department should require the verification report to state its independence basis on its face: a signed statement, by the verifying facility and by an identified signer, disclosing any relationship to the contractor within the categories enumerated in Part III.D above, or affirming their absence. Inspection rights are exercised against the document that exists; this is the disclosure that would make the inspected document responsive to the determination the component head must make.

The following is borrowed from Part III rather than offered as an answer to this question. In an order released August 11, 2026, the Federal Communications Commission's Office of Engineering and Technology and Public Safety and Homeland Security Bureau revoked two equipment authorizations where a declaration filed in support of an application represented that the product was assembled by a named Texas company, and the Commission's Enforcement Bureau, having issued a letter of inquiry to that company concerning its business relationship with the applicant, its device assembly services, and payments between the two, received the response that "[b]ased on eTak's investigation to date, eTak has no affiliation, business relationship, contractual relationship, agency relationship, ownership interest, or other connection with Odyssey Robot LLC." Order of Revocation, Odyssey Robot LLC, DA 26-839, ET Docket No. 26-186, paras. 7, 10-11 (rel. Aug. 11, 2026). That was an equipment-authorization matter under 47 U.S.C. 302a and 47 CFR 2.939(d), not a DFARS waiver, and the defect there was a represented relationship that the counterparty denied rather than a disclosed but dependent one. We do not offer it as precedent. We offer it for the categories: when a declared domestic assembly partner had to answer for its independence, the categories in which it framed its denial were affiliation, business relationship, contractual relationship, agency relationship, and ownership interest. The mandatory trigger drafted here is stated in terms of corporate control alone.

V. CONCLUSION

Our answer to the Waiver Mitigation and Section 224 Compliance question is that the proposed combination of IPC-1791 verification and IPC-1782 traceability is sufficient to the extent that "independent" is defined — which, as drafted, it is not. Whether the combination is operationally feasible turns on manufacturing facts we do not have, and we leave that half of the question to the parties who do. We recommend three changes: extend the mandatory Hardware Assurance Lab referral to financial dependence; enumerate the triggering relationships rather than leaving them to construction; and require the verification report to disclose its own independence basis on its face. Each is a change to a referral or disclosure rule. None adds a facility-certification requirement.