SAFE Supply Chains Act

Summary

Requires the Department of Defense to buy and use only covered information-and-communications-technology (ICT) end-use hardware, components, and their software/firmware that come directly from the original equipment manufacturer (OEM) or an authorized reseller, starting one year after enactment. It defines covered products and reseller/OEM roles, creates a limited waiver process for authorized research or to avoid harming mission-critical operations, and sets reporting and guidance requirements for DoD procurement offices and Congress. No new funding is authorized.

• DoD must procure ICT end-use hardware, components, and related software/firmware only from OEMs or authorized resellers starting one year after enactment.
• Defines key procurement terms for covered products, OEMs, authorized resellers, and ICT.
• Waivers allowed only for scientifically valid research or to avoid jeopardizing mission-critical functions, with specified notification and justification requirements.
• Waiver notices to congressional defense committees must be unclassified (with optional classified annex) and include security mitigations and vendor-control declarations.
• DoD must publish guidance to help entities become authorized resellers.
• DoD must report annually to Armed Services Committees through year six about waivers, legal authority used, and efforts to reduce waivers.
• No new funding is authorized to implement the requirements.
• Research waivers remain valid for the duration of the research project.