What a Reliance Safe Harbor Must Have on Paper

I. Introduction, Interest, and Scope

Gatewell Group LLC filed comments in this proceeding dated August 20, 2026 (ECFS 26110072507). Those comments addressed one subject: what the documents proposed in § 2.911(d)(8) through (d)(11) must contain in order to be probative. This reply stays on that subject. Gatewell takes no position on importation thresholds, term limits, marketplace obligations, database modernization, or whether the disclosures should be required at all, filed with each application, or retained and produced on request.

Gatewell's interest is commercial and is stated here in full. Gatewell advises buyers and manufacturers on Covered List exposure and origin evidence. It publishes the Gatewell Protocol for Origin Evidence, an open documentation standard for the evidence file behind a not-covered certification, and it sells services assembling and verifying files under that standard. The text is licensed for reuse under the Creative Commons Attribution 4.0 license. Version 1.0 is a public comment draft, open for comment through October 31, 2026. The current text, Revision 3 of September 17, 2026, is Attachment A and is published at gatewellgroup.com/protocol/v1.0.

Gatewell does not ask the Commission to adopt, reference, or endorse the attached standard, and nothing recommended below would require an applicant to retain Gatewell or any other third party. The confirmation step discussed in Section III is performed by the reviewer the Commission already designates. The attachment is in the record for a narrower purpose. Many opening comments ask for some form of reliance on supplier statements. No commenter specifies the content of the supplier-side instrument: what the request asks, what the answer states, who signs it, how old it may be, and who may confirm it. The attachment shows that each of those elements can be written down.

II. A Reliance Provision Needs Stated Documentary Content

Commenters divide on whether the proposed disclosures should be required. The Foundation for Defense of Democracies supports them as proposed. FDD Comments at 5. Others oppose a filing mandate or would replace it with retention. Gatewell takes no side in that dispute. Its concern is a point on which commenters across that divide describe the same defect. Proposed § 2.911(d)(9)(iii) would require the HBOM and SBOM to be "certified as true and correct by an authorized representative of the applicant," and much of what is to be certified sits with suppliers the applicant cannot compel.

Geoffrey Irving, writing for the Carnegie Endowment for International Peace, proposes a supplier-attestation safe harbor: "The Commission should allow for a responsible party which requests the necessary information from its supplier in writing, documents the request and the response, and discloses the resulting gap has satisfied the rule as to that component. Absent such a provision, the rule would require certification as 'true and correct' of information the responsible party has no lawful means of obtaining." Comments of Geoffrey Irving, Carnegie Endowment for International Peace, at 8 (Aug. 13, 2026) (Carnegie Comments).

USTelecom states that "[a] rule that provides no safe harbor for good-faith reliance on supplier representations will generate duplicative audits and still may not improve the accuracy of the information available to the Commission." USTelecom Comments at 11. The China Chamber of Commerce for Import and Export of Machinery and Electronic Products offers redline text under which an applicant certifies "after conducting a reasonable inquiry," may rely "in good faith on information provided by an independent supplier," and may enter the country of production as "'Unknown,' with a brief explanation of the reasonable investigative measures taken." CCCME Comments at 29-31 (proposed § 2.911(d)(9)(iii) and (d)(10)).

Gatewell agrees that a final rule requiring these certifications needs a reliance provision. An applicant cannot certify on personal knowledge a fact that exists only in a supplier's records. The question for documentary method is what the provision requires the applicant to hold.

"Reasonable inquiry" and "good faith" are standards of conduct. They do not say what a request must ask, what a supplier's answer must state, who must sign it, how old it may be, or whether anyone may check it. Carnegie's formulation names three documents: the written request, the response, and the disclosed gap. PolkaSpots Limited, which discloses that it develops a supplier attestation platform and would participate in that market, asks the Commission to "specify the required attributes and signature requirements" for producer attestations. PolkaSpots Comments at 1-2. Neither states the content of the supplier's declaration itself. A safe harbor defined by a conduct standard alone would reproduce, one tier down, the condition the Commission describes at paragraph 140, a certification whose basis the record does not capture. It would also leave Telecommunication Certification Bodies where the TIC Council says they are, with "few practical ways to determine, from the face of the document, whether a given component traces back to a Covered List entity or prohibition." TIC Council Comments at 2.

Gatewell's opening comments made the related point about the rebuttable presumption at paragraph 149, that an absence showing can be graded only against a defined search. Comments of Gatewell Group LLC § V. A reliance safe harbor is the same problem seen from the applicant's side.

Recommendation. If the Commission adopts a reliance provision, the rule text should condition it on documents with stated minimum content, along the lines Carnegie proposes:

1. A written request to the supplier that identifies the component by manufacturer part number and states the facts requested: the producer's legal name, and the site or sites, by country, where the component is produced.

2. A signed supplier declaration that identifies the declaring entity and its country, the part numbers covered, the production site or sites by name, city, and country, the site operator if it is not the declarant, and a contact for confirmation, and that is signed and dated with the signatory's name and title.

3. A stated maximum age. A declaration older than the stated period at the application date does not support the safe harbor. The attached standard uses twelve months for declarations on the components it requires to be traced to the supplier, measured to the revision date of the evidence file. Measuring to the application date is the adaptation proposed here.

4. A gap record. Where the supplier declines or cannot answer, the applicant retains the request and the response, or a record that none was received, and reports the fact as undetermined with that record. This is Carnegie's "discloses the resulting gap" and CCCME's "Unknown" with an explanation, stated as a document.

5. A limit on what the safe harbor does. It protects the applicant's reliance. It does not convert an undetermined fact into a favorable one.

The fifth condition is where this reply meets the traversal rule in Gatewell's opening comments, which stands as filed. Two commenters address depth. TechNet would stop the HBOM "at the finished-component level, such as a packaged integrated circuit, which a downstream applicant can confirm with its suppliers." TechNet Comments at 4. Gatewell's proposed Tier 2 stops at the same boundary. It traverses to the entity that physically produced the finished component and does not reach inside it. CCIA would go further and limit disclosure to "Tier 1 manufacturers, final assembly entities, or entities with direct, material decision-making control," warning of "an unreasonable standard of strict liability." CCIA Comments at 6. A Tier 1 limit would make a contract manufacturer a terminal node, which Gatewell's opening comments opposed. A reliance provision with stated documents answers the strict-liability concern without that limit, because it defines what an applicant acting in good faith must be able to show. Under the opening comments' rebuttal rule, an undetermined origin does not rebut a presumption adopted under paragraph 149.

The second, third and fourth elements exist in published form. Annex C of the attached standard is a supplier origin declaration with the fields listed in item 2, in which the declarant certifies the production sites, undertakes to give written notice within thirty days of any change of site, and states that the declaration "may be relied upon in the recipient's regulatory and commercial origin documentation." Attachment A, Annex C. Clause 4.7.3 sets evidence-age limits by document class. The bill-of-materials schema permits a design origin of "UNKNOWN" only "with a documented inquiry record." Attachment A, Annex B.1. The Commission can take the elements without taking the standard.

III. Confirming a Declaration Is Authentication, Not Adjudication

Carnegie reads the Odyssey matter as showing that "the gap Odyssey reveals is one of verification, not of intake," and observes that "detection would still have turned on someone testing the assertion against evidence outside the four corners of the filing." Carnegie Comments at 4. Gatewell agrees. What made detection possible in that matter was an assertion a named third party could contradict, and an inquiry that reached that party. PolkaSpots reaches the same conclusion: "the role attributed to each named producer should be confirmed by that producer's own signed statement . . . rather than resting solely on the applicant's assertion." PolkaSpots Comments at 3.

Gatewell's opening comments proposed that where an application names a U.S. entity as a producer, assembler, or manufacturer, the application include that entity's own signed confirmation. Comments of Gatewell Group LLC § VI. That recommendation stands, as does the companion request that the applicant state the location of compliance testing. What follows concerns a different actor, the reviewer.

Two comments appear to pull in opposite directions on who should check. Carnegie states that "Telecommunication Certification Bodies should not adjudicate these determinations," because they lack "the mandate, the classified access, or the interagency relationships that a national security determination requires." Carnegie Comments at 25. The TIC Council, whose members include those bodies, asks the Commission to "specify a standardized, machine-readable format" and to provide tools, because absent them "it would be difficult for a TCB to verify that an HBOM or SBOM actually demonstrates compliance." TIC Council Comments at 2.

Both can be accepted, because they concern different acts. Deciding whether a device poses a national security risk is a determination. Confirming that a named supplier signed the declaration attributed to it, and stands by it, is authentication of a document. The second requires no classified access and no judgment about risk. It requires a contact point, which proposed § 2.911(d)(11) already collects for every named producer, and a rule about how many declarations are confirmed.

Recommendation. If reviewers are to check supplier and producer declarations at all, the Commission should state how in the rule or in OET guidance, so that review is uniform across certification bodies and the forum-shopping the TIC Council warns of does not arise. A workable statement has three elements. The reviewer, not the applicant, selects which declarations are confirmed. The reviewer obtains or corroborates the declarant's contact details independently of the applicant. The reviewer records what was confirmed and with whom. The number confirmed is a calibration question for the Commission. The attached standard states one such method for its own purposes, a reviewer-selected sample with independently corroborated contacts, at Part V, step 4, and is cited only to show that the method can be specified in a sentence. The method serves whether bills of materials are filed with the application or retained under §§ 2.938 and 2.945(c) as Carnegie proposes, because it attaches to the declarations and not to the filing event.

IV. Origin Attributes Can Be Specified Without a New Format

Commenters who address format mostly ask the Commission not to invent one. INCOMPAS, which opposes a filing mandate, asks in the alternative that the Commission "accept established machine-readable formats, including SPDX and CycloneDX, where those formats contain the information the Commission has lawfully required, rather than mandate a new FCC-specific artifact." INCOMPAS Comments at 35. PolkaSpots recommends that the Commission "specify the required attributes and signature requirements and accept any conformant format." PolkaSpots Comments at 2. The TIC Council asks for something different, a single format specified by the Commission together with analytical tools. TIC Council Comments at 2.

INCOMPAS's condition is the difficulty. The Information Technology Industry Council states that "[e]xisting standards-based formats, such as System Package Data Exchange (SPDX) and CycloneDX, are not designed to assign a place of production to software or allocate software value among countries." ITI Comments at 8. TIA notes, quoting CISA's HBOM Framework, that "current HBOM formats need some assistance to be portable between suppliers and purchasers." TIA Comments at 16 n.15. The formats identify components and their suppliers. The Covered List question turns on where a component was produced and by whom.

An attribute list closes that gap without a new format and without choosing between PolkaSpots and the TIC Council, because a specified attribute list is what makes submissions comparable whatever container carries them. The list for origin is short. Annex B.1 of the attached standard is one published example, with thirteen fields per bill-of-materials line: model, line reference, description, manufacturer part number, component manufacturer ("[n]ot the distributor"), the manufacturer's headquarters country, country of origin in ISO 3166 alpha-2 with multi-country entries split into separate lines, country of design, supply channel, a sole-source flag, a flag for components that fix the device's character in its category, the identifier of the supplier declaration on file, and the date origin was last confirmed. Attachment A, Annex B.1. A machine-readable form of the schema is published at the address given in Section I and is dedicated to the public domain. Attachment A, Annex B (note).

The schema has limits the Commission should know. It records a country, not a site, on every line; sites appear on the supplier declarations. It does not separate development from design. It carries no value share by producer.

One drafting point bears on terms. Gatewell's opening comments asked the Commission to define "critical component," for purposes of § 2.911(d)(10), by four functional prongs. Comments of Gatewell Group LLC § II. That recommendation stands, and others propose limits of their own: PolkaSpots asks that the term "be defined functionally and objectively," PolkaSpots Comments at 3, and CCCME would limit it by reference to § 2.903(b)(2). CCCME Comments at 28-29. A further reason to define it has not been raised. Part 25 of the Federal Acquisition Regulation, from which the Commission proposes to borrow the domestic end product test, separately defines "critical component" as "a component that is mined, produced, or manufactured in the United States and deemed critical to the U.S. supply chain." 48 CFR 25.003. Section 25.101(a) does not itself use the term, so the collision is indirect. A reader who follows the Commission's cross-reference into Part 25 will nonetheless find the phrase already defined to mean something else.

V. The Value Element Is Feasible on the Applicant's Own Cost of Components

Most commenters who address proposed § 2.911(d)(10)(iv) call it unworkable. FDD supports it as proposed and does not say how an applicant would obtain the figure. FDD Comments at 5. Carnegie calls the element "not merely burdensome but infeasible as drafted," because "[t]hat is supplier cost data," and adds: "A party can reliably report what it pays its immediate supplier, but it cannot reliably allocate that figure across producers and production locations upstream." Carnegie Comments at 8. Carnegie would replace it with "a country-level concentration assessment like that found in Annex A" of the March 20, 2026 National Security Determination on routers. Id.

Gatewell's opening comments asked for a whole-device value denominator, because the domestic end product test is a ratio, and asked that the applicant report the portion of total component cost attributable to each production location. Comments of Gatewell Group LLC § III. The record shows that a figure allocated by producer and site is not in applicants' hands. A figure by country of origin is, and Gatewell refines its recommendation accordingly. The regulation the Commission proposes to borrow shows why. The test at 48 CFR 25.101(a) compares the cost of domestic components with the cost of all the components, and 48 CFR 25.003 defines the term: "(1) For components purchased by the contractor, the acquisition cost, including transportation costs to the place of incorporation into the end product or construction material (whether or not such costs are paid to a domestic firm), and any applicable duty (whether or not a duty-free entry certificate is issued); or (2) For components manufactured by the contractor, all costs associated with the manufacture of the component, including transportation costs as described in paragraph (1) of this definition, plus allocable overhead costs, but excluding profit." Both limbs draw on figures within the applicant's own books: what it paid for the components it buys, and its own cost of the components it makes. Neither requires a supplier's cost data, and neither allocates a purchased component's price among upstream producers.

Recommendation. Restate § 2.911(d)(10)(iv) to require what the test uses and the applicant has: total cost of components as defined at 48 CFR 25.003, and the share of that total by country of origin of each component, with aggregation permitted below a stated de minimis threshold. That yields the denominator the coverage test requires and has the shape of the country-level assessment Carnegie proposes. Annex B.2 of the attached standard is a record of the same shape, computed there on bill-of-materials value at standard or actual purchase cost: one record per model per country, stating the percentage of value and of unit volume, the valuation basis, the twelve-month period used, and the date computed. Attachment A, Annex B.2. Treating such records as presumptively confidential, as Carnegie and others ask, is compatible with every recommendation in this reply.

VI. Conclusion

Whether or not the Commission requires these disclosures to be filed, applicants will certify facts held by their suppliers. Gatewell asks the Commission to state the documentary content of that certification in rule text or OET guidance:

1. A reliance safe harbor conditioned on a written request, a signed supplier declaration with stated minimum content and maximum age, and a retained gap record, which protects reliance without converting an undetermined fact into a favorable one.

2. A reviewer-side confirmation method for supplier and producer declarations, under which the reviewer selects what is confirmed and corroborates contacts independently, distinguished from any national security determination and additional to the producer confirmation proposed for § 2.911(d)(11) in Gatewell's opening comments.

3. An origin attribute list that any conformant format may carry.

4. A value element restated as total cost of components under 48 CFR 25.003 and its share by country of origin.

5. The functional definition of "critical component" proposed in Gatewell's opening comments, for purposes of § 2.911(d)(10), noting that 48 CFR 25.003 already gives the phrase a different meaning.

Attachment A is offered as evidence that each element can be specified.