Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s

The week

In the last week of July 2022, Washington made a big bet on computer chips. On July 27, the Senate passed the CHIPS and Science Act by 64 votes to 33, and the House followed on July 28 by 243 to 187. President Biden signed it on August 9.

Semiconductors, or chips, are the tiny components that do the thinking and remembering inside nearly every electronic device. They run cars and phones as well as the network equipment that connects a bank branch to its data center. They are made in fabrication plants, usually called fabs, which are among the most expensive and complex factories in the world.

The new law provided about 52.7 billion dollars for domestic semiconductor manufacturing incentives, research and workforce programs. According to the White House fact sheet issued at signing, about 39 billion dollars of that was for manufacturing incentives. That included 2 billion dollars aimed at the older, “legacy” chips used in cars and defense systems. Roughly 13 billion dollars went to research and workforce development.

The law also created a 25 percent investment tax credit for chip manufacturing facilities and equipment, which reduces the tax bill of companies that build fabs. It authorized a broad expansion of federal science research, most of it subject to future appropriations. It attached guardrails. Companies taking the grants could not expand certain advanced chip production in China or other countries of concern for ten years. Nor could they use the funds for stock buybacks or dividends.

The bill had a long path. Its manufacturing incentives had first been authorized, without money, in the defense authorization act passed at the start of 2021. A broader competitiveness package stalled through 2021 and early 2022, as the House and Senate passed different versions. In July 2022 Senate leaders pulled out a narrower bill focused on chips and science, and it moved within weeks. Supporters argued it would reduce dependence on production concentrated overseas. Critics, from several directions, objected to large subsidies for profitable companies.

The timing was no accident. The law followed two years of chip shortages that had disrupted car production and stretched lead times across electronics. A lead time is simply how long you wait between placing an order and receiving the goods. For many products in 2022, that wait had grown from weeks to many months. Earlier that year, in January, the Commerce Department had reported on a survey of chip buyers. It found that median inventories of key chips had fallen from about 40 days in 2019 to fewer than five days in 2021. A buffer that thin meant any disruption at a supplier reached the buyer’s production line almost at once. China’s spring lockdown of Shanghai, a major manufacturing and shipping hub, had added fresh disruption to component supply only a few months earlier.

On July 27, the same day as the Senate vote, the Federal Reserve raised its policy rate by three quarters of a point for the second meeting in a row. The new range was 2.25 to 2.5 percent. Its statement said inflation remained elevated, reflecting supply and demand imbalances related to the pandemic, among other causes. Higher rates made capital purchases, the big-ticket equipment organizations buy and use for years, more expensive to finance. The next day, the government’s first estimate of second-quarter output showed the economy had shrunk for a second straight quarter.

For IT departments, the shortage was a daily operational problem rather than an abstract headline. It showed up as long waits for network switches (the boxes that connect computers within a building), firewalls (the devices that filter traffic coming in and out of a network), servers and some laptops. Large network equipment makers told investors through 2022 that their order backlogs were unusually high, held back by component supply rather than demand. Projects slowed, and some equipment that should have been retired stayed in service while its replacement waited in a queue.

So in one week, an executive could read that the government was spending billions on chips and that their own switch order had slipped again. Around the signing, companies announced new U.S. chip investments, among them a large memory manufacturing plan from Micron. The two stories were related, but they ran on very different clocks.

Suppose the chief operating officer of a regional health system has spent the summer of 2022 waiting for the network switches needed to open a new outpatient clinic. The opening date has slipped twice. Then she reads that Congress has just approved tens of billions of dollars for chip manufacturing. It is natural to wonder whether she should simply wait for the problem to solve itself.

She should not. A large semiconductor law arriving in the middle of a hardware shortage invited an easy assumption: relief was coming. It was, on a timescale of years. New fabrication plants take several years to build and qualify. Many of the chips that were short in 2022 were mature, inexpensive components made in existing plants, rather than the leading-edge processors the new fabs would target. The law was industrial policy for the next decade. It did nothing for a branch router ordered that summer.

Mixing the two timescales produced bad decisions, such as delaying a needed purchase in the hope that prices would fall. The cleaner approach was to treat supply as three problems with different clocks and different owners. The backlog was a problem of months, owned by infrastructure and procurement. The refresh plan was a problem of years, owned by the CIO and finance. Provenance was a problem of a decade, owned by risk and, in government, by supply chain risk management programs.

This piece takes five steps. It starts with why the law could not reach the shortage, because the mechanism explains everything after it. It then takes each clock in turn: the backlog, the refresh plan and provenance. It ends with what it took to keep the three clocks apart, including the costs and the strongest objections.

Why the cheap chips ran short

Not all chips are alike. At one end are leading-edge processors, the most advanced chips that power the newest phones, data center servers and artificial intelligence systems. They are made in the newest, most expensive fabs, using manufacturing processes measured in a few billionths of a meter. At the other end are mature chips: simpler, cheaper components that manage power, control a display or run a small function inside a network switch. They are made in older fabs that have been running for years.

A typical piece of enterprise equipment contains both kinds. A server may have a leading-edge processor at its heart and dozens of mature chips around it. If even one inexpensive mature chip is unavailable, the whole device cannot ship. A part costing very little can therefore hold up a device costing thousands of dollars.

How a shortage compounds

The shortage that began in 2020 had several causes acting at once. Demand for laptops, home networking and cloud capacity jumped as work and school moved online. Car makers cut orders early in the pandemic, then found their place in the queue taken when demand recovered. A series of disruptions, from factory fires to severe weather to lockdowns, took capacity offline at bad moments.

Ordering behavior made it worse. When lead times stretch, buyers order more and earlier, to be sure of getting something. Distributors and manufacturers see those orders as demand and allocate scarce parts accordingly. Some of that demand is duplicate: the same buyer has ordered from several sources and will cancel the extras when one arrives. Supply chain analysts call this the bullwhip effect, because small changes at the customer end become large swings further back.

Enterprise network gear felt this sharply. A switch maker might need hundreds of distinct components from dozens of suppliers. Each was usually qualified for that specific design, meaning tested and approved, so a substitute could not be dropped in without testing. When one power management chip ran short, the manufacturer had to redesign a board or wait. Both took months.

Why new fabs could not help

Building a fab is slow. It involves constructing an extremely clean building, installing highly specialized equipment, and then qualifying the process, meaning running test production until the plant reliably produces chips that meet specification. That takes years. Chip designs also have to be qualified at a specific fab before customers will accept the output. A new plant does not instantly serve existing products.

A new fab is generally built for the chips with the best long-term economics, which usually means advanced ones. Mature parts were scarce precisely because their margins were thin and few companies were adding capacity for them. The law did set aside about 2 billion dollars for legacy chips. Against the cost of a modern fab, that was a modest sum.

Policy could still matter at the margin. The law’s research and workforce money aimed at problems that also slow mature-chip supply, such as shortages of skilled technicians and the time it takes to qualify new processes. Over years, more domestic capacity of any kind adds options when one region is disrupted. Those benefits were real. They simply arrived on the decade’s clock, long after the 2022 orders had been filled or cancelled.

Put together, those facts explain the mismatch. The CHIPS and Science Act was designed to change where advanced chips are made over the long term. The shortage that frustrated IT departments in 2022 was largely about components made in plants that already existed, competing for capacity with car makers, phone makers and everyone else.

The backlog: months, and a risk-ranked order book

In 2022 many organizations held orders for network and server equipment with delivery dates far beyond their plans. Projects stalled. Some teams kept unsupported equipment in service longer than intended, which created security exposure. Others bought whatever was in stock, which created configuration sprawl that cost more to manage later.

Two terms deserve explanation. Unsupported equipment is hardware whose manufacturer no longer provides security fixes or repairs, so newly discovered weaknesses stay open. Configuration sprawl is what happens when an organization ends up with many different models and settings for the same job. Each variation needs its own expertise, its own updates and its own troubleshooting, which raises cost and the chance of error.

Ranking the order book

The useful responses were mundane. Rank open orders by the risk of not receiving them, so equipment replacing unsupported devices or serving critical sites came first. Hold a small pool of strategic spares for the most important locations. Qualify a second model or vendor for common roles, such as branch switches or access points, so one product line’s shortage did not stop a rollout.

A ranking needs criteria that people accept. A workable set has four. The first is the business consequence of delay, such as a site that cannot open. The second is the security consequence, such as an unsupported firewall at an internet edge. The third is regulatory exposure, such as equipment cited in an audit finding. The fourth is the cost of the workaround. Each order gets a score, and the infrastructure lead reviews the top of the list with procurement every two weeks. The scores matter less than the conversation they force.

Vendor and reseller relationships became a lever. Manufacturers allocated scarce stock among customers, and allocation favored buyers who could give clear, stable forecasts. An organization that told its reseller which orders mattered most, and which could wait, sometimes got critical items moved forward. One that placed duplicate orders through several channels and cancelled later gained little goodwill.

Contract terms on open orders

The shortage also exposed weak purchase terms. Several equipment makers raised list prices during 2021 and 2022, and some contracts let them apply increases to orders already placed. Some scarce parts were sold on non-cancellable, non-returnable terms, which removed the buyer’s ability to walk away if a cheaper option appeared. Buyers who had signed standard terms found they carried both the delay and the price risk.

A procurement team can negotiate on several points. Price protection on accepted orders is the first. A right to cancel without penalty after a defined delay is the second. Notice of allocation decisions and revised ship dates is the third. Substitution rights, allowing an equivalent model to be shipped with the buyer’s agreement, are the fourth. No single term guarantees supply. Together they make the risk visible and shared rather than sitting entirely with the customer.

Public agencies often buy through cooperative contracts or schedules whose terms are fixed. They have less room to negotiate individual clauses. Their lever is the choice among contract vehicles and resellers, and the discipline to record ship-date performance so it informs the next award.

A second model that works

Configuration templates and automation that work across models made a second vendor practical rather than theoretical. A configuration template is a standard, pre-written set of settings for a type of device, and automation is software that applies those settings consistently. With both in place, swapping one switch model for another becomes a matter of choosing a different template, without weeks of manual engineering. Without them, a second vendor exists only on paper.

Qualifying a second model has real costs. Engineers need training and lab time. Monitoring and logging tools need to understand both. Security baselines have to be written twice. For a small credit union with a two-person network team, a second vendor may be more than it can support. A better fit there may be a second model from the same vendor, sharing the same operating software, or a managed network service that carries the qualification burden.

Controls for equipment waiting on parts

Equipment kept in service past its support date needed its own controls while it waited for a replacement. That meant tighter network segmentation, management interfaces restricted to an administrative network, extra monitoring, and a documented risk acceptance with an expiry date signed by someone senior. An exception without an end date tends to outlive the shortage that justified it, and examiners and auditors notice.

Segmentation means dividing a network into compartments so that a problem in one cannot easily spread, much as watertight bulkheads protect a ship. A management interface is the back door administrators use to configure a device; restricting it to a separate administrative network keeps attackers from reaching it. A risk acceptance is a formal, written decision by an accountable executive to live with a known risk for a defined period.

Edge devices deserved the most attention. Firewalls, VPN gateways and remote access appliances face the internet directly, and attackers routinely scan for known weaknesses in them. An unsupported internal switch in a closet is a moderate risk. An unsupported VPN appliance at the edge is a serious one. Ranking should reflect that, even when the edge device is cheaper.

Cloud as a partial hedge

Cloud and managed services were a partial hedge, since large providers buy hardware at scale and absorb some supply risk. They were not a complete one. Branches, clinics and field offices still need equipment on site. Large providers were themselves competing for constrained parts, and some regions saw limits on certain instance types. Moving a workload to cloud to escape a hardware delay also takes months of planning, which rarely beats the delay it is meant to avoid.

Telling the business

Communication mattered as much as sourcing. Business leaders often learned of delays only when a project missed its date. A monthly view of critical orders, expected delivery and the consequence of further slippage let them plan around the shortage. It also gave the risk committee an honest list of unsupported devices that were waiting on parts.

Return to the health system and its clinic. A risk-ranked order book would have put the clinic’s switches near the top, alongside replacements for unsupported firewalls at the main hospital. A pre-qualified second switch model, with a ready template, might have let the clinic open on a different model while the original order caught up. And the COO would have seen the slippage, and its consequences, in a monthly report rather than in a missed opening date.

The refresh plan: years, and the end of fixed cycles

Many regulated organizations ran fixed refresh cycles: laptops every few years, network gear on a longer cycle, servers aligned to support contracts. The shortage exposed how brittle that was. When a large batch falls due at once and supply slips, many systems pass end of support together.

Support dates instead of age

A sturdier plan ties replacement to support dates and risk rather than age alone. It staggers large replacements across years, and it orders long lead-time items well ahead of need. Manufacturers publish end-of-sale, end-of-software-maintenance and end-of-support dates, usually years in advance. A plan built from those dates, joined to an accurate asset inventory, shows clusters of risk long before they arrive.

The asset inventory is the weak point in many organizations. Network and server equipment is often tracked in several places: a configuration management database, a monitoring tool, spreadsheets held by regional teams and purchase records in finance. Reconciling them is tedious. Without it, the refresh plan misses devices, and those are often the oldest ones in the most remote sites.

The plan also asks a sharper question: which workloads still need owned hardware at all? Some organizations used the shortage to move workloads to cloud or to virtual network functions. Others concluded that certain systems, such as those with strict latency or data residency needs, belonged on premises and simply needed earlier ordering.

A few more definitions. A workload is any application or service that runs on computing equipment, such as a payroll system or a patient portal. Virtual network functions are network tasks, like routing or firewalling, performed by software running on general-purpose servers rather than by dedicated boxes. Latency is the delay in sending data back and forth; some systems, such as trading platforms or certain medical devices, need it to be very low. Data residency is a requirement that data stay within a particular country or location, often for legal reasons. On premises simply means in the organization’s own buildings rather than in someone else’s data center.

Financing in a rising-rate year

Interest rates added a financing dimension. As borrowing costs rose, the comparison between buying, leasing and subscribing shifted. Finance and IT needed to compare options on total cost over the asset’s life, including the cost of being caught short, rather than on the purchase price alone.

Each option moves risk differently. Buying gives control and, once paid for, no further financing cost, but it puts supply risk and disposal on the buyer. Leasing spreads cost and can include refresh at term, but lease rates rose with interest rates and lessors faced the same supply delays. Subscription models, where a vendor provides equipment as a service, shift more risk to the vendor at a price. They need contract terms on what happens when the vendor itself cannot get parts.

Accounting treatment differs too. Under the lease accounting standards that took effect for most companies in 2019 and 2022, most leases now appear on the balance sheet. That reduced one historical reason for leasing. Finance teams should confirm treatment with their auditors before choosing a model for that reason.

What examiners and auditors expect to see

Lifecycle management is an examination topic as well as an IT practice. The FFIEC’s Architecture, Infrastructure, and Operations booklet was issued in June 2021. It expects financial institutions to maintain inventories of hardware and software and to manage technology through its life cycle, including end of support. Examiners commonly ask for the inventory, the list of unsupported items, and the risk acceptances and compensating controls that cover them.

Health systems face the same question through a different route. The HIPAA Security Rule requires covered entities and business associates to conduct a risk analysis and manage identified risks. Unsupported equipment that touches electronic protected health information belongs in that analysis. Public agencies that follow the NIST Cybersecurity Framework treat asset management as a core function. Whatever the framework, the evidence is similar: an accurate inventory, support dates, owners, and a dated decision for each exception.

A bank’s branch network

Consider a regional bank that bought most of its branch network equipment in a single year, years earlier. On a fixed cycle, all of it falls due together. If supply is tight that year, dozens of branches drift past end of support at once, and the bank faces either a costly scramble or a long list of exceptions.

A support-date plan would have spotted the cluster in advance and started replacing part of the fleet a year or two early, ordering the long lead-time items first. It would also have asked whether some branch functions could run as virtual network functions on a small standard server. That would reduce the number of specialized boxes the bank needs to buy at all. No single answer fits every bank. The value of the plan is that it surfaces the decision while there is still time to make it calmly.

How it differs by type of organization

A broker-dealer has its own pressures. Its trading systems may need low latency, and FINRA’s business continuity rule requires it to maintain a plan for significant business disruptions. Hardware delays that hit a backup site can erode that plan without anyone noticing, so its refresh schedule should treat recovery infrastructure as seriously as production. A credit union, by contrast, often runs most core processing through a service provider, so its exposure lies more in branches, ATMs and end-user devices.

A county government is in another position again. Its network often spans courthouses, public safety sites, libraries and road depots, each with different funding and owners. Equipment for a sheriff’s office may need to meet the FBI’s CJIS Security Policy for criminal justice information, which affects what can be substituted and who must approve it. A delayed firewall at a 911 center is a public safety risk, and the ranking should say so plainly.

A health system faces a different constraint: some equipment connects to medical devices, and changes near clinical systems need testing with biomedical engineering and the device makers. A switch replacement in a hospital wing may need a maintenance window that clinical operations must approve. Lead times for that coordination can rival the hardware lead time itself.

Appropriations and fiscal years

Appropriation timing deserves a closer look from government readers. For public agencies, money that must be obligated within a fiscal year does not fit well with lead times that cross it. Suppose an agency’s budget must be committed by the end of the fiscal year, but the equipment will not arrive until well into the next one. Procurement and finance then need to agree in advance how that order will be handled. Otherwise the money may lapse, or the order may be cancelled and restarted, losing its place in the queue.

Federal appropriations law has a relevant principle. Under the bona fide needs rule, a fiscal year’s money generally pays for needs of that year. The Government Accountability Office’s guidance recognizes an exception for normal production lead time, so an order placed this year for delivery next year can be proper. Agencies should confirm with their own counsel and budget officers how it applies to a given purchase. States and counties have their own rules on encumbrances and carryover, and most state fiscal years start on July 1, not October 1.

Provenance: a decade, and a question to start asking

The law addressed provenance most directly. Provenance means where something comes from: in this case, where the chips inside an organization’s equipment were designed and manufactured. Leading-edge chip manufacturing was concentrated in a few places in East Asia, and geopolitical tension made that a strategic risk. For most banks and health systems, where a component was made was not a buying criterion in 2022.

What already applied to government

For federal agencies and their contractors, supply chain risk management already applied in many programs, and some product restrictions were already in law. Section 889 of the defense authorization act for fiscal 2019 barred federal agencies from buying certain telecommunications and video surveillance equipment from named Chinese companies. It also barred contracts with organizations that used such equipment. The Federal Acquisition Supply Chain Security Act of 2018 created a council that can recommend excluding products or vendors from federal purchasing.

NIST had published a major revision of its guidance on cybersecurity supply chain risk management, Special Publication 800-161, in May 2022. It describes how agencies should assess suppliers, components and their origins as part of risk management. State and local agencies are not bound by it, but many adopt NIST guidance by policy, and federal grants sometimes carry their own restrictions.

Starting with near-term data

Provenance is a long-horizon question, but it starts with near-term data. Some organizations began asking key vendors where critical components were made, what alternative sources existed and how fast they could switch. They built the information they would need if export controls, tariffs or a regional disruption later forced a change. The answers went into the vendor file next to financial and security assessments.

Export controls are government rules restricting which products can be sold to which countries; tariffs are taxes on imported goods. Either can change the price or availability of equipment quickly, and organizations that already know where their critical components come from can respond faster than those starting from scratch.

The quality of vendor answers varies. Large manufacturers can usually say where final assembly happens and where their main processors are made. Fewer can say the same for every minor component, and their answers may change from batch to batch. A reasonable aim is to know the origin of the main processor, memory and final assembly for critical device types, and to know whether the vendor has a second source for each.

What a provenance record holds

A provenance record does not need to be elaborate. For each critical device type it can capture the vendor, the country of final assembly and the origin of the main processor and memory where known. It can add the vendor’s stated second sources and the date of the last answer. A short note on regulatory restrictions completes it, such as whether the product or its maker appears on any federal exclusion list. Updating it at each annual vendor review keeps it current at little cost.

The record also helps with a related question that grew in importance: firmware and software origin. Network devices run software that may be developed in several countries and updated remotely. Provenance of hardware and integrity of software updates are separate risks, but the same vendor conversation can cover both.

Why banks and health systems should care

For banks, provenance connects to third-party risk management. Banking regulators expect institutions to understand concentration risk in critical suppliers, and a vendor whose products depend on a single region is a concentration. For health systems, it connects to clinical continuity. Medical devices contain chips too, and a disruption that affects device supply affects patient care.

Public agencies had a procurement step to add. Contract vehicles and approved product lists often lag what vendors can deliver. Agencies that qualified alternative models in advance could switch when a product was delayed instead of restarting a purchase. That work served the backlog and provenance at once, which is the one place the two clocks met.

Keeping the three clocks apart

Separating the clocks sounds simple. It takes discipline, because the same people, budgets and vendors appear in all three conversations. This final part covers what the delays cost, the objections to the approach, how the better-prepared organizations ran it and the questions that keep the clocks distinct.

Where the delays landed

Customers and services. A delayed switch can mean a delayed branch or clinic opening, and with it delayed revenue and disappointed customers or patients.

Security risk. Unsupported equipment kept in service is one of the more common ways attackers find their way into networks. Every month a replacement is delayed is a month of extra exposure.

Regulators and auditors. Examiners in banking and health care ask about end-of-support equipment. A documented, time-limited risk acceptance with compensating controls is defensible. An open-ended exception is not.

Money. Rising interest rates changed the economics of buying versus leasing or subscribing. Decisions made on purchase price alone could cost more over the life of the equipment.

Strategy. Provenance questions that seem remote can become urgent quickly if trade rules change. Organizations that have the data are in a position to choose; others have to react.

Measuring each clock

Each clock needs its own measures, reported to its own owner. For the backlog, useful measures are the number of critical orders past their original date, the average slippage on them, and the number of unsupported devices waiting on parts. For the refresh plan, they are the share of assets with a known support date and the number reaching end of support in the next eighteen months. A third is the share of those already funded and ordered.

For provenance, the measures are simpler and slower: the share of critical vendors with a current provenance record, and the number of critical device types with only one source. Mixing these into a single dashboard tends to let the loudest clock, usually the backlog, crowd out the others. Separate lines, reviewed at different cadences, keep each visible.

The strongest objections

One objection is that the clocks are not independent. A panic in the backlog can force refresh decisions, and a provenance rule can create a backlog overnight. That is true. Keeping the clocks apart does not mean ignoring the links. It means each decision is made by the owner with the right horizon, who then informs the others.

A second objection is that stockpiling would have been simpler. Buying extra equipment across the board does protect against delay. It also ties up capital at rising interest rates, fills storerooms with hardware whose support clock is already running, and leaves a surplus when the market turns. A small, targeted pool of spares for critical sites captures most of the benefit at a fraction of the cost.

A third objection is that provenance work is wasted effort for organizations outside government. Most banks and health systems cannot change where chips are made, and few will pay more for domestic parts. The response is that the work is mostly data gathering, done during normal vendor reviews. Its value appears only when trade rules change, and then it appears quickly.

How the better-prepared organizations ran it

A well-prepared organization keeps a single, risk-ranked view of critical hardware orders and shares it with business leaders monthly. It has at least two qualified models for its most common network roles, with templates and automation that make switching practical. It plans replacement by support dates and risk, staggers large batches and orders ahead for items with long waits. It treats unsupported equipment as a formal, time-limited risk with compensating controls. And it holds basic provenance information on critical vendors alongside their financial and security assessments.

The errors were predictable:

• Waiting for policy to fix supply. Delaying a needed purchase because a long-term law has passed confuses a decade’s clock with a quarter’s.
• Buying whatever is in stock. It solves today’s gap and creates tomorrow’s management burden.
• Open-ended exceptions. Unsupported devices kept “until the replacement arrives,” with no expiry date and no senior sign-off.
• Fixed refresh cycles. Replacing everything on the same schedule concentrates risk when supply slips.
• Comparing on sticker price. Ignoring financing costs and the cost of being caught short when choosing between buying, leasing and subscribing.
• Surprising the business. Letting leaders discover delays only when a project misses its date.
• Duplicate ordering. Placing the same order through several channels, which inflates demand signals and damages supplier relationships.

Questions for each clock

• Which of our open hardware orders matter most, and what happens to the business if each one slips another three months?
• How many devices in our network are past their support date, and is each covered by a signed, time-limited risk acceptance with extra controls?
• For our most common network roles, do we have a second qualified model, and could we actually switch to it next month?
• Are our refresh plans based on support dates and risk, or simply on age?
• Do we know where the critical components in our key vendors’ products are made, and how quickly those vendors could change sources?

The aim is to keep the three clocks separate in the conversation, so that a long-term policy story never becomes a reason to postpone a short-term decision.

With hindsight

Lead times for most enterprise hardware eased during 2023 as demand cooled, and some organizations found themselves holding more stock than they needed. Network vendors reported later that year that customers were still installing equipment delivered during the shortage, and new orders slowed. Surplus after panic is a familiar pattern in supply shortages: buyers who over-order are left holding stock when the market turns. Risk-ranked ordering, rather than stockpiling across the board, would have softened that swing.

CHIPS Act awards went to major fabrication projects, mostly in 2024. Intel, TSMC, Samsung and Micron each received multibillion-dollar awards. TSMC’s first Arizona fab began producing chips for customers in late 2024. Other projects slipped: TSMC itself pushed back its second Arizona plant, and Intel’s Ohio project moved years beyond its original schedule. That confirms the original point about clocks: industrial policy works, if it works, over years, and even its own timetable can stretch.

The program’s form also changed with the administration. The next administration kept the law but reshaped how it was used. In 2025 Congress raised the investment tax credit from 25 to 35 percent. In August 2025 the federal government took a stake of roughly 10 percent in Intel, paid for with grant money already awarded under the act. Commerce also moved to wind down the nonprofit set up to run the National Semiconductor Technology Center. For IT buyers, none of those changes altered the near-term supply of equipment.

Export controls on advanced chips, first announced in October 2022 and tightened several times, and tariff measures from 2025 reshaped electronics supply chains. Mature chips drew their own attention. Tariffs on Chinese semiconductors rose under existing trade law. In December 2022 Congress included a provision in the defense authorization act on federal purchasing. From late 2027, it bars agencies from buying products that contain chips from certain Chinese manufacturers. Provenance, which most banks and health systems did not consider in 2022, became something that could change the price and availability of equipment.

What did not hold up was the assumption, common in 2022, that mature chips would stay scarce for years. As demand for consumer electronics fell, parts of the chip market swung into surplus in 2023, and lead times for many components returned toward normal. The policy concern about mature chips shifted from scarcity to dependence on foreign supply. In December 2024 the U.S. Trade Representative opened an investigation into China’s practices in legacy chip production.

Shortages then moved to new places: AI accelerators from 2023 onward, and memory, whose prices rose sharply from late 2025 as AI demand absorbed supply. The specific components changed, but the experience for an IT department was the same: long waits and higher prices for parts it needed.

Refresh planning faced a scheduled test as well. Microsoft ended support for Windows 10 in October 2025, a date set years in advance. Organizations that planned by support dates spread their laptop and desktop replacement across 2024 and 2025. Those that waited met the deadline in a crowded market, with some machines that could not run the successor system.

By 2026 the three clocks are still distinct. Backlogs come and go with demand cycles. Refresh plans tied to support dates have proved more resilient than fixed cycles. Provenance has become a standing procurement question, especially for public agencies and their contractors.

The habit that held up was to keep asking which clock a decision belongs to. A shortage in one part of the market is a matter for this quarter’s order book. A refresh plan is a multi-year finance question. Where components come from is a strategic risk measured in a decade. Organizations that managed each on its own terms handled the 2022 shortage, and the ones that followed, with fewer surprises.