TAA, NDAA Section 889 and AI Server Supply-Chain Screening

Use this checklist to organize evidence. The contracting officer and authorized agency officials make final applicability and acceptability determinations.

Begin with an applicability sheet prepared with contracting/compliance owners. List contract vehicle/order, solicitation number, clause set, thresholds, product/service classification, funding/agency-specific restrictions and required representations.

Do not ask “Is this NDAA compliant?” Ask specific questions: Does the Trade Agreements clause apply to this end product? What country-of-origin evidence supports the proposed configuration? Has the offeror completed the required Section 889 representations? Does the offeror use covered equipment or services as described by the clause? Does this BOM include covered telecommunications or video-surveillance equipment?

Other requirements may apply: Buy American, agency-specific prohibited sources, FIPS-validated cryptography, DoDIN APL, FedRAMP for cloud services, CMMC/NIST requirements for contractors or supply-chain risk controls. Keep them separate in the matrix so one representation is not mistaken for all.

The existing TAA explainer, Section 889 screening guide and TAA checklist provide deeper background.

FAR 52.225-5 defines terms and requirements for Trade Agreements when included in a solicitation/contract. FAR Part 25 governs foreign acquisition and explains applicable policies and procedures. Contracting staff should identify whether and how the clause applies.

For a proposed server or rack, collect manufacturer, exact part number/configuration, country of origin stated by the responsible source, basis/supporting evidence required, and any substantial-transformation analysis provided by an authorized party. A reseller location or final shipping point does not by itself establish origin.

Configurable servers are challenging. The chassis, system board, GPUs, NICs, drives and memory may come from multiple countries, while final assembly/integration occurs elsewhere. Do not independently declare the origin based on component count. Obtain the representation/evidence the acquisition requires from the responsible manufacturer/offeror and route unresolved questions to the contracting officer.

Services and software may have separate treatment. Identify whether integration, installation, cloud/software subscriptions and support are part of the end product or separate lines and how the solicitation handles them.

FAR 52.204-25 addresses prohibition on contracting for certain telecommunications and video-surveillance services or equipment, with defined covered equipment/services and exceptions. Related provisions and representations may apply during offer and performance.

Screen the complete environment. AI racks can include top-of-rack switches, out-of-band management, console/KVM, environmental sensors and security cameras in the facility or delivery scope. Section 889 is not primarily a GPU-origin rule, but covered telecom/video components or an offeror's prohibited use can affect the acquisition.

Request the offeror's current representations through the approved government process and any product-level information the solicitation requires. Do not substitute a self-created “NDAA certificate” for the required representation.

Address services. Managed network, remote monitoring, installation or support can involve equipment and providers outside the physical BOM. Ask how subcontractors and remote service paths are screened and flowed down.

Escalate ambiguous components and exceptions. Contracting officials should interpret the clause; technical teams should provide enough BOM and use detail for that decision.

Create one record per proposed system/rack:

Add evidence source, date, owner, expiration/refresh trigger and reviewer. Link documents rather than pasting unsupported conclusions. A spreadsheet cell that says “TAA yes” without issuer and basis is not audit-ready.

Apply NIST SP 800-161 Rev. 1 for broader cybersecurity supply-chain risk: supplier criticality, provenance, counterfeit risk, vulnerability handling, logistics, integration and lifecycle. Regulatory screening is a floor, not the entire risk program.

Require offerors to disclose assumptions and proposed alternates. State that substitutions need written approval before shipment and must include updated technical, price, lead-time, support and compliance evidence.

Seemingly minor substitutions matter. A drive may change origin and firmware. A NIC may require another driver and transceiver. A management switch may introduce a covered supplier or unsupported cryptography. A different rack integrator may change substantial-transformation/origin analysis asserted by the offeror.

Freeze the approved BOM at factory acceptance. Compare the serialized as-built record with the approved configuration. Record unavoidable changes and the authority that accepted them.

Monitor supplier representations and exclusions through performance. A representation valid at award may need refresh under the contract or after corporate/supply-chain change. Assign responsibility rather than assuming the reseller will notify every stakeholder automatically.

A U.S. reseller address does not establish the country of origin of an end product. Final rack integration in the United States does not automatically prove substantial transformation. A manufacturer's name does not establish that every configurable SKU has the same origin. A TAA representation does not answer Section 889, and a Section 889 representation does not establish TAA status.

Likewise, “NDAA compliant” without a section, clause, representation, configuration and date is too vague for an acquisition record. A downloadable certificate may be useful evidence only if it comes from the responsible party, applies to the exact proposed item and answers the actual solicitation requirement.

Use a stoplight workflow: green when current required evidence is present, amber when a responsible owner and resolution date exist, and red when an offer or delivery conflicts with a mandatory term. Do not convert an amber evidence gap to green because schedule pressure increases.

At receiving, verify tamper/shock indicators where used, packing list, manufacturer/model, quantities, serial/asset tags and country markings/evidence against the approved package. Do not make country-of-origin determinations from a carton marking alone, but record discrepancies for review.

During integration, capture firmware/software versions and component serials at the level required. Maintain chain of custody for high-risk or controlled deliveries. Segregate suspect, counterfeit, damaged or unapproved-substitution items.

At acceptance, deliver the evidence file with the as-built BOM. Store it in configuration management. Trigger review after component replacement, major firmware/platform upgrade, new supplier, service-provider change or expansion order.

At disposal/RMA, preserve data-handling and chain-of-custody requirements. A failed drive or system board sent through an unapproved return path can create risk even though the original acquisition was screened.

Treat vague or absolute answers as a prompt for evidence. “Everything we sell is compliant” is not credible across every clause, threshold, configuration and order.

Uniqcli can align an integrated AI BOM, supplier records, staging and as-built package with the evidence fields the solicitation requires. Review federal/DoD solutions, OEM integration and the counterfeit/gray-market checklist, or request a configuration-specific evidence checklist.

Uniqcli cannot replace the contracting officer's determination or guarantee blanket compliance. The goal is to make the exact configuration and evidence reviewable before award and traceable after delivery.

Compliance note: Laws, regulations, clauses and interpretations change. Use current Acquisition.gov text, solicitation terms and authorized agency counsel/contracting guidance.