Could Rules Designed to Secure America's Power Grid Make It Harder to Patch?

Washington — The grid-security debate is usually framed as a import ban: keep foreign inverters, relays, and control software away from bulk-power assets before adversaries can exploit them. A quieter failure mode runs in the opposite direction—rules so broad that operators cannot install the patches that close known holes.

That is the tension the Electric Power Supply Association put on the record October 8, in comments to the Department of Energy’s Securing the United States Bulk-Power System request for information (Docket DOE-2026-HQ-2026-1123). EPSA represents competitive power producers that, by the trade group’s count, own and operate about 20 percent of U.S. installed capacity—roughly 225,000 megawatts across gas, nuclear, wind, solar, storage, and other fuels. The filing is not a forecast of policy; it is a stakeholder warning about how definitions in a still-unwritten rule could interact with equipment already on the system.

What DOE is actually doing

DOE’s September 9 Federal Register notice implements information-gathering under Executive Order 14421, the August 26 national-emergency order on bulk-power security. The notice asks how to scope covered equipment, foreign entities, and “associated” software, firmware, maintenance services, and remote-access paths—and how restrictions would affect reliability, safety, and existing assets. It is an RFI, not a prohibition on routine updates.

The executive order itself already signals that software and lifecycle maintenance matter: agencies may weigh “associated software and firmware, remote-access capabilities, lifecycle maintenance and update mechanisms” when deciding what falls under bulk-power restrictions. The open question is how DOE will draw lines in implementing regulations—and whether those lines treat a signed vendor patch like a new foreign transaction.

The passage that changes the conversation

On page 11 of EPSA’s comments, the association urges DOE to adopt a targeted definition of “critical software and digital capabilities.” The proposed language, EPSA writes, “is overly broad and could capture firmware, patches and vendor-supplied updates.” The consequence it names is explicit:

If routine patching becomes a restricted transaction, that will likely exacerbate both cyber security and national security concerns while trying to improve bulk power system protections.

EPSA points to NERC’s Critical Infrastructure Protection standards—the mandatory, FERC-approved regime bulk-power owners already use for patch governance—as a tested model rather than reinventing compliance per update.

That chain—foreign-equipment restrictions → uncertainty over software updates → possible compliance delays → longer exposure to known vulnerabilities—is still hypothetical. No final DOE rule has classified patches as restricted transactions. The filing’s value is documenting that a material slice of the generation fleet sees the risk as plausible enough to argue against in October.

Not the same docket as the FCC inverter list

Operators now navigate parallel federal tracks. The Federal Communications Commission’s Covered List regime for foreign-produced power inverters—expanded in July 2026—addresses equipment authorization and import/market access through a different statute and bureau. DOE’s bulk-power order contemplates transaction review, prequalification lists, and mitigation for grid assets under the emergency authority. Conflating the two processes misstates which agency can block which action.

Culled is not treating specific FCC waiver end dates as settled here without primary-order review; the structural point is enough for investors and compliance officers: hardware listing policy and DOE transaction policy can both touch firmware, but they are not one rulebook.

Why the timing bites

EPSA ties the comment to rising load from artificial intelligence, data centers, and reshoring manufacturing—procurement pressure Culled has followed in the Senate permitting fight over who pays for grid upgrades. New generation means more inverters, relays, and digital edge devices entering service while legacy fleets still depend on vendor maintenance channels.

If DOE’s eventual definitions sweep patches into restricted transactions—or simply slow legal review of each update—owners face a perverse choice: run unpatched control software on foreign-origin gear, or stall maintenance while counsel maps a new approval path. Neither outcome matches the executive order’s stated aim of reducing unacceptable risk.

How the story could break

The tension eases if DOE explicitly carves out validated, owner-controlled patching aligned with NERC CIP, or if prequalification lists grandfather maintenance for installed fleets. It sharpens if final rules treat every vendor-signed firmware drop as a new covered transaction without a fast-track path—especially where equipment cannot be swapped before the next disclosed vulnerability.

DOE has not answered EPSA’s page-11 warning yet. The development worth tracking is not another rhetorical pledge to secure the grid, but whether the department’s definitions let operators keep patching it.