How an Origin Evidence File maps to the FCC’s proposed HBOM rule and to other supply-chain regimes
An Origin Evidence File built under the Gatewell Protocol holds records for each element the FCC has proposed to require in a hardware and software bill of materials, with the gaps shown below, and it holds records that UFLPA tracing, a Section 889 reasonable inquiry and DFARS covered-materials work each draw on. Conforming to the Protocol does not answer any of those regimes; the FCC rule described below is a proposal in an open docket rather than an obligation.
The FCC’s proposed HBOM and SBOM disclosure
The Commission proposed § 2.911(d)(9) and (d)(10) in the Third Further Notice of Proposed Rulemaking in ET Docket No. 21-232, FCC 26-50, published at 91 Fed. Reg. 51139 on August 7, 2026. Proposed (d)(9)(ii) would require an HBOM and SBOM identifying all hardware, software and firmware components, and proposed (d)(10) prescribes what the disclosure must say about each “critical component,” a term the item does not define. Neither paragraph has been adopted. Gatewell filed comments on the content of these documents in the proceeding on August 20, 2026.
| Proposed requirement | Record in the Origin Evidence File | Gap |
|---|---|---|
| (d)(9)(ii) an HBOM and SBOM identifying all hardware, software and firmware components | Annex B.1, one record per bill-of-materials line per model; the SBOM per clause 4.6.1 | B.1 lets passive components be aggregated by commodity class where no Annex D match exists. |
| (d)(10)(i) the component name and function | B.1 description and mpn; Annex D lists, by function, the components that fix a device’s character in its category |
Function is not a B.1 field. The Annex D match sits in deep_trace. |
| (d)(10)(ii) the producer of the component | B.1 component_mfr, which the schema states is not the distributor, with supply_channel for direct, distributor or broker sourcing |
None identified. |
| (d)(10)(iii) the location or locations where the component was designed, developed, manufactured, assembled or otherwise produced | B.1 coo and design_origin, ISO 3166 alpha-2, split lines in place of a multi-country entry; Annex C names sites by name, city and country on deep-trace lines |
A country rather than a site on lines that are not deep-trace. Development is not separated from design. |
| (d)(10)(iv) the percentage of component value attributable to each producer and production location | Nearest is Annex B.2 pct_value, the share of total bill-of-materials value by country, with basis_note for valuation basis and period |
B.2 aggregates by country, not producer or site, and reports shares rather than a total component cost. Our comments ask for this element as a whole-device requirement. |
| (d)(9)(iii) the HBOM and SBOM “certified as true and correct by an authorized representative of the applicant” | Annex A, the officer attestation executed once per file revision | Annex A covers the file whole. A certification on the bill of materials alone is drawn from it. |
| (d)(11) per named producer: legal name, trade names, principal place of business, jurisdiction of organization, a representative’s contact details | B.1 component_mfr and mfr_country; Annex C takes a declarant contact for verification confirmations; clause 4.5 holds the rest for the manufacturer |
Trade names and jurisdiction of organization are held for the manufacturer, not for each component producer. |
Source: proposed 47 CFR §§ 2.911(d)(9)–(d)(11), FCC 26-50, 91 Fed. Reg. 51139, 51144 (Aug. 7, 2026), as quoted in Comments of Gatewell Group LLC, ECFS 26110072507, filed August 20, 2026; Protocol Version 1.0, Annex B and clause 4.6. The schema is published as annex-b.schema.json with a CSV template.
Other federal regimes
Four regimes ask a manufacturer or a buyer where something was made and who made it. The file was built for the one in the top row. For the others, the last column is what it leaves to be done.
The regime profiles, published as a comment draft, specify clause by clause what the file holds for defense covered materials, defense batteries, unmanned aircraft systems, Section 889 and Build America, Buy America.
| Regime | What it asks a company to show | Where the file holds it | What the file does not address |
|---|---|---|---|
| FCC Covered List and equipment authorization | A signed certification under 47 CFR § 2.911(d)(5) that the equipment is not prohibited from authorization under § 2.903. The Commission’s guidance states that an applicant needs “sufficient evidence that the device in question was not produced in a foreign country,” and that “there is no specific documentation or evidence required.” | Clause 4.1 model schedule, clause 4.2 coverage determination made against quoted definition text, clause 4.4 component origin, clause 4.5 corporate provenance, Annex A | The file is a record. It does not decide an application, and no agency has adopted a documentation standard to measure it against. |
| UFLPA | On an applicability review, ordinary-course documents on the order, purchase, manufacture and transportation of inputs, tracing from raw material to the finished imported good | Clause 4.3 production provenance with its site attestations, clause 4.4 with Annex C declarations one tier up, the Annex E screening mechanics | Annex E screens Covered List entries and sanctions lists, not the DHS Entity List. Tracing stops one tier up, and there are no shipment-level entry documents. |
| Section 889 and 2 CFR 200.216 | Representations at FAR 52.204-24 and 52.204-26 that the offeror does or does not provide, and “after conducting a reasonable inquiry,” does or does not use covered telecommunications equipment or services. Accepting a federal loan or grant is itself the certification under 2 CFR 200.216(e). | Clause 4.1 vendor equipment schedule, clause 4.5 chains with the dated Annex E screen, clause 4.6 data-flow endpoints | The use limb reaches equipment the signer operates. A vendor-facing file holds the bench, not the buyer’s internal inventory or its award instruments. |
| DFARS covered materials | Under DFARS 252.225-7052, that the contractor will not deliver a covered material “melted or produced” in a covered country, and from January 1, 2027 one “mined, refined, separated, melted, or produced” there | B.1 lines carrying mpn, component_mfr and coo, which is how a covered material is found in a design, with Annex C extending one tier up |
Process-step provenance per material back to the mine, mill and producer certificates, and flow-down evidence from subcontractors. |
Source: 47 CFR §§ 2.903, 2.911(d)(5), current text; FCC Covered List FAQs on advanced robotic devices and power inverters, read September 8, 2026; Pub. L. 117-78 § 3, and CBP’s 2026 UFLPA operational guidance, Appendix E; 48 CFR §§ 52.204-24, 52.204-25, 52.204-26 and 2 CFR § 200.216; DFARS 225.7018 and clause 252.225-7052 (MAY 2024).
Published standards
Buyers ask how this standard sits beside the ones already written into their supplier agreements. Each standard below governs something the Origin Evidence File does not. Two of them are named inside the Protocol as the format its software bill of materials takes.
| Standard | Issuing body and edition | What it covers | How it relates to the file |
|---|---|---|---|
| IPC-1782 | IPC, Revision B, September 2023 | Manufacturing and supply chain traceability of electronic products, on four levels for materials and processes, Level 1 Basic to Level 4 Comprehensive, internal and external | A level grades how completely material and process history is recorded. B.1 coo and design_origin record where a component was produced and designed, the fact a Covered List definition turns on. |
| SAE AS5553 | SAE International, Revision E, issued November 13, 2025 | Counterfeit electrical, electronic and electromechanical parts, through avoidance, detection, mitigation and disposition | A counterfeit program establishes that a part is what it claims to be. B.1 supply_channel marks the lines where that arises, and Annex C requires a declaration for broker-sourced deep-trace components at any tier. |
| SAE AS6171 | SAE International, Test Methods Standard, General Requirements | Inspection and test methods for suspect and counterfeit parts of unknown chain of custody, run by accredited laboratories | The question is authenticity rather than where a part was produced. No record here substitutes for a test result, and a test result does not establish a country of production. |
| NIST SP 800-161 | NIST, Revision 1, May 2022, updated November 1, 2024 | Cybersecurity supply chain risk management practices for systems and organizations | Clause 4.6 supplies facts such a program needs: build and code-signing infrastructure and its operator, update-server jurisdictions, and every endpoint the device talks to in normal operation. |
| SPDX | ISO/IEC 5962:2021, SPDX Specification V2.2.1 | A data format for the components and metadata of a software package | Clause 4.6.1 requires the software bill of materials in SPDX or CycloneDX, matching the shipping build. |
| CycloneDX | Ecma International, ECMA-424, 2nd edition, December 2025 | A bill of materials specification for software and hardware supply chains, serialized in JSON | The alternative clause 4.6.1 accepts. It carries the software side; the hardware side stays on Annex B. |
| Conflict Minerals Reporting Template | Responsible Minerals Initiative, an initiative of the Responsible Business Alliance | A free template that “facilitates the transfer of information through the supply chain regarding mineral country of origin and the smelters and refiners being utilized” | The structural cousin of Annex C. A buyer sends a form and keeps the returned declaration as the record. |
Source: IPC-1782B, September 2023, front matter and table of contents; SAE AS5553E and AS6171, SAE International standards pages, read September 16, 2026; NIST SP 800-161 Rev. 1, csrc.nist.gov, read September 16, 2026; ISO/IEC 5962:2021; ECMA-424, 2nd edition, December 2025; Responsible Minerals Initiative, CMRT page, read September 16, 2026.
Questions readers ask
Does an IPC-1782 traceability record prove a device is not foreign-produced?
No. A traceability level grades how completely material and process history is captured and carried between locations. The advanced-robotics National Security Determination defines a foreign-produced article by reference to 48 CFR 25.101(a), and the power-inverter determination as modified by DA 26-870 uses the same test as one of two alternatives. It is a two-part test: the article must be manufactured in the United States, and the cost of domestic components must exceed a stated share of the cost of all the components, 65 percent for items delivered in calendar years 2024 through 2028 and 75 percent from 2029. A traceability system can hold the inputs to that computation without producing the result, and the computation has to count everything, because the Commission states that the commercially available off-the-shelf exception is “inapplicable” to whether a device is a domestic end product and that COTS components are “still counted.”
Source: IPC-1782B, September 2023; 48 CFR 25.101(a), retrieved from the eCFR September 16, 2026; National Security Determinations of July 27, 2026; DA 26-870 (August 20, 2026); FCC Covered List FAQs on robots and inverters, read September 8, 2026.
If the FCC adopts the HBOM rule, what happens to the Protocol?
Part VII answers that. “The Protocol yields to any mandatory documentation standard on its effective date.” A standard written because no rule prescribes the documents stops being needed at the point a rule does. Until then the two do different work. The proposal is a disclosure filed with an application and certified true and correct by an authorized representative of the applicant under proposed (d)(9)(iii), and the proposed text does not say what that applicant must hold in order to certify. An Origin Evidence File holds records of the shape such a disclosure would be drawn from. The table above shows where the shapes diverge.
Source: Gatewell Protocol for Origin Evidence, Version 1.0, Part VII; proposed 47 CFR § 2.911(d)(9)(iii), FCC 26-50, 91 Fed. Reg. 51139 (Aug. 7, 2026).
Does a UFLPA tracing file cover the FCC certification?
No, and the reverse does not hold either. A UFLPA applicability review asks CBP to accept that a shipment contains no goods or inputs produced in the Xinjiang Uyghur Autonomous Region or by an entity on the DHS Entity List, supported by ordinary-course documents tracing from the raw material stage forward. The FCC question is where the device and its components were produced, measured for advanced robotic devices and power inverters against the domestic end product test of 48 CFR 25.101(a). One file can hold both sets of records. The Protocol requires supplier declarations one tier up, so raw-material tracing is added work in either direction. Our UFLPA screener handles the Entity List side.
Source: Pub. L. 117-78 § 3(a); CBP 2026 UFLPA operational guidance, Appendix E, and the UFLPA Strategy § VI(B); Gatewell Protocol clause 4.4.1.
Does an Origin Evidence File answer a Section 889 representation?
It supports one side of it. FAR 52.204-25(a) defines reasonable inquiry as “an inquiry designed to uncover any information in the entity’s possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity that excludes the need to include an internal or third-party audit.” A current Origin Evidence File holds the vendor bench with its equipment reconciled to public authorization records, the corporate chains behind those vendors, and a dated screen. The representation remains the signer’s own, and its use limb reaches equipment the signer operates, which a vendor-facing file does not enumerate. Our Section 889 page covers the inquiry itself.
Source: 48 CFR §§ 52.204-25(a), 52.204-25(b)(2), 52.204-26(c), current text; 2 CFR § 200.216(a), (c), (e).
Does the FCC recognize the Protocol?
No. The Commission has adopted no documentation standard for origin evidence, and its guidance states that there is no specific documentation or evidence required behind the applicant’s certification. The Protocol is published by a private firm under CC BY 4.0. Part VII allows a conforming party to state the level and date of its file, and it forbids any claim that states or implies government endorsement.
Source: FCC Covered List FAQs on advanced robotic devices and power inverters, read September 8, 2026; Gatewell Protocol for Origin Evidence, Version 1.0, Part VII.
Comment on this crosswalk
This crosswalk is open for comment with the rest of Version 1.0 through October 31, 2026. Tell us which regime belongs here and is missing, or which row reads the record wrong, at the comment docket. The standard is at The Protocol, its full text at Version 1.0, the clauses a buyer can cite in a purchase order in the buyer’s kit, and the file-building sequence at manufacturers.