Blacklists, lawsuits, and supply shocks roil US-China defense ties

By mid-2026, major Chinese firms including WuXi AppTec, Alibaba, and BYD had mounted legal challenges against their inclusion on the Pentagon’s Section 1260H blacklist, contesting their designation as military-linked entities. WuXi AppTec initiated a lawsuit seeking removal from the list, while Alibaba denied any military ties, emphasizing its focus on retail and logistics, and argued that the blacklist violated constitutional protections such as due process and free speech. BYD also threatened legal action following its addition, signaling a coordinated pushback against what these companies view as arbitrary and damaging U.S. government sanctions.

Alibaba’s legal challenge notably secured a temporary court injunction that paused enforcement of the Pentagon’s lobbying ban, which had forced the withdrawal of over two dozen registered lobbyists representing the company. This reprieve underscored the constitutional questions raised by the blacklist, particularly regarding First Amendment rights and due process, and highlighted the broader implications for other blacklisted firms amid escalating U.S.-China tensions and congressional demands for strict enforcement to prevent military-linked influence in defense contracting.

The enforcement landscape evolved sharply as Section 1260H transitioned from a disclosure mandate to imposing concrete prohibitions on DoD contracts with blacklisted Chinese companies starting June 30, 2026. This shift was compounded by a planned June 2027 expansion barring the DoD and its contractors from engaging with any companies sourcing from entities on the blacklist, reflecting a significant escalation in U.S. efforts to decouple defense supply chains from Chinese military-linked firms. The rapid increase in listed entities throughout 2026 has intensified compliance risks for U.S. aerospace and defense businesses, transforming Section 1260H into a critical regulatory hurdle.

By mid-2026, Apple emerged as a prominent example of the intense pressure U.S. tech firms face amid U.S.-China defense tech decoupling, actively lobbying the Trump administration to secure exemptions allowing purchases of critical memory chips from ChangXin Memory Technologies (CXMT), a Chinese supplier blacklisted for alleged military ties. This lobbying, led by CEO Tim Cook, underscores the friction between stringent national security policies and harsh market realities, as soaring global memory shortages threaten to inflate Mac prices and delay deliveries. Despite lawmakers’ vocal opposition—Senator Tom Cotton warned such moves risk shareholder value and national security—Apple’s efforts highlight industry attempts to mitigate supply chain vulnerabilities while navigating legal and reputational risks.

Simultaneously, the enforcement of Section 1260H of the NDAA has reshaped the lobbying landscape, forcing major U.S. firms to choose between representing Chinese tech giants and maintaining Pentagon-related business. This binary choice led lobbying firms to drop Chinese clients like Alibaba to preserve defense contracts, illustrating the broader compliance challenges stemming from the Pentagon’s blacklist and lobbying restrictions. Alibaba’s temporary court reprieve from the lobbying ban in early July 2026, granted on constitutional grounds, highlights industry pushback against these sweeping enforcement measures that bar Pentagon engagement with companies represented by lobbyists also serving blacklisted entities.

The compliance landscape grew even more complex with the June 30, 2026 activation of Section 805 of the NDAA, which prohibits the Department of Defense and its contractors from contracting with entities on the Section 1260H blacklist, marking a significant escalation from prior disclosure mandates. This restriction is set to broaden further in June 2027, barring business with companies sourcing from blacklisted entities, thereby amplifying supply chain scrutiny. The rapid increase in Chinese entities listed under Section 1260H throughout 2026 has intensified these challenges, particularly for U.S. aerospace and defense companies, transforming what were once minor compliance considerations into critical operational risks.

By late 2026, the Cybersecurity Maturity Model Certification (CMMC) program had entered a critical phase requiring Level 2 certification for all new Defense Department contracts involving controlled unclassified information, impacting an estimated 80,000 contractors. However, the rollout faced significant hurdles due to a fragmented industry response lacking coordination, which led to duplicated compliance efforts and inconsistent assessment outcomes across contractors and third-party assessors. Unlike the financial services industry's successful Y2K remediation, the defense sector struggled with insufficient regulatory flexibility and unclear communication about evidence standards, complicating contractors' efforts to meet the 110 documented security requirements effectively.

The shortage of authorized third-party assessment organizations (C3PAOs) emerged as a critical bottleneck, with only about 97 certified assessors available as of March 2026 and projections reaching just 120 by the end of 2027—far below the demand needed to certify tens of thousands of contractors within the enforcement window. This scarcity was exacerbated by widespread contractor unreadiness, as a 2025 Alluvionic survey revealed that roughly half of assessors delayed or declined engagements due to remediation gaps, and 80% of rescheduling stemmed from unvalidated assumptions of readiness. These challenges culminated in the Department of Defense suspending CMMC Phase 2 in July 2026, halting mandatory third-party assessments and shifting compliance risk onto contractors’ self-attestation under heightened False Claims Act liability.

Despite the suspension of mandatory CMMC assessments, cybersecurity risks remain unchanged, prompting security leaders to treat the pause not as a reprieve but as a call to strengthen internal verification processes and embed continuous evidence generation into system architectures. Experts advise verifying every control claim against tangible evidence such as logs and access records rather than relying on point-in-time documentation, emphasizing that firms adopting ongoing cybersecurity practices are better positioned to identify vulnerabilities before they escalate into incidents. This shift underscores the evolving nature of compliance from a checklist exercise to a continuous operational imperative.

Recognizing the systemic challenges in scaling CMMC compliance, the Pentagon has launched initiatives like the War Force program to recruit hundreds of exceptional software engineers for two-year tours focused on AI and digital innovation, aiming to bolster the Department’s cybersecurity capabilities from within. This talent drive complements broader government efforts to address the cybersecurity workforce gap, acknowledging that successful defense contracting compliance will require not only regulatory adjustments but also substantial investments in skilled personnel to manage and sustain complex security requirements.

In a sweeping move to fortify U.S. defense supply chains, President Trump’s July 2026 executive order mandates that major defense contractors like Lockheed Martin and Boeing eliminate reliance on critical minerals sourced from China and other adversaries by January 1, 2027, under threat of losing Pentagon contracts. This directive compels contractors to conduct exhaustive supply chain mapping down to raw material origins, submit formal mitigation plans, and rigorously vet suppliers for foreign ownership and financial vulnerabilities, reflecting a zero-tolerance stance on noncompliance that could trigger contract termination or federal investigations.

The executive order significantly tightens the waiver process under 10 U.S.C. 4872, effectively ending broad exemptions for using restricted materials from non-allied nations unless contractors can provide documented evidence of exhaustive alternative sourcing efforts. Starting in 2027, the Pentagon will only approve waivers accompanied by mitigation plans aimed at replacing noncompliant inputs, shifting the burden onto contractors to prioritize domestic or allied sourcing and thereby reducing vulnerabilities exposed by China’s dominance in rare earth minerals essential for defense manufacturing, such as tungsten and neodymium.

This policy is part of a broader administration initiative to modernize procurement and secure U.S. military supply chains against multifaceted threats—physical, cyber, and economic—amid intensifying global competition. Complementing the supply chain mandates, the administration introduced incentives to boost domestic aluminum production, including tariff reductions for companies investing in new or expanded U.S. primary aluminum facilities, signaling a strategic push to accelerate onshoring and strengthen critical material independence.

To ensure effective implementation, Secretary of Defense Pete Hegseth is tasked with developing comprehensive mapping and vetting policies within 180 days, with regulations to follow 90 days later, covering prime contractors and all subcontractor tiers. This layered approach aims to enhance transparency across complex subcontractor networks, many of which currently include China-based suppliers, thereby enabling the Department of Defense to gain unprecedented visibility into critical material flows and enforce compliance rigorously.

The Pentagon's decision to suspend Phase 2 of the CMMC requirements in July 2026, as announced by CIO Kirsten Davies and Under Secretary Michael Duffey, underscores the delicate balance between enforcing rigorous security mandates and fostering innovation within the defense supply chain. This move reflects growing concerns over the cost and complexity burdens that stringent compliance can impose, potentially stifling the rapid development and deployment of critical military capabilities.

Harish Luthra highlights that security in defense innovation must transcend traditional compliance checklists and be embedded across all business functions to prevent operational bottlenecks that threaten mission readiness. By personally assuming executive sponsorship of cybersecurity, Luthra exemplifies the necessity of top-level accountability to manage risks effectively across research, operations, and procurement, ensuring that security is a strategic enabler rather than a procedural hurdle.

Bridging commercial technology with classified government systems demands a unified approach where internal corporate security controls align seamlessly with the stringent standards required by defense clients. Luthra emphasizes that harmonizing these controls protects both the organization and its customers, facilitating innovation by creating a secure foundation that supports the integration of next-generation technologies, including AI-enabled capabilities.

Adopting a strategic cybersecurity philosophy—'protect what matters, but drive what’s next'—reframes rigorous, localized security measures not as burdensome costs but as essential enablers of innovation. This mindset shift is critical for accelerating the deployment of advanced defense technologies while safeguarding sensitive data, ultimately ensuring that security and innovation advance hand-in-hand to maintain mission readiness in an evolving threat landscape.