EO 14117 is in enforcement — a gate every US-bound company must clear

The direct obligations fall on US persons, but the impact travels through contracts: US companies upstream or downstream will ask you to contract through a US entity, amend clauses, cooperate with diligence, and assume compliance responsibility. Map your data transactions in advance — that is where your leverage at the negotiating table comes from.

EO 14117 defines a Covered Person as: 1. A restricted entity: an entity that is 50% or more owned, directly or indirectly, by a country of concern, organized under the laws of a country of concern, or whose principal place of business is in a country of concern; 2. A foreign entity: an entity that is 50% or more owned, directly or indirectly, by a restricted entity; 3. A foreign employee or contractor: an employee or contractor of an entity that is a country of concern or a restricted entity, and who is a foreign person; 4. A foreign person: a foreign person whose principal residence is in a country of concern (excluding US persons, unless they are otherwise on the list); 5. Any person or entity the Attorney General designates as restricted. Notice there is no employee-nationality requirement: a foreign person only meets the definition if their principal residence is in a country of concern — a Chinese national living long-term in Singapore on a work visa, for instance, does not. Nor does your corporate entity meet definitions 1, 2, or 3. So there is exactly one scenario in which the company would be subject to EO 14117: the US Attorney General designating the company or its employees as Covered Persons.

EO 14117 is concerned with whether countries of concern and Covered Persons can access Covered Data — it is not a simple data-localization requirement.

Product R&D is not the only path that moves data across borders. In real cases, operations teams have run database synchronization across regions or even across clouds, and that sync service can move US personal data into a country of concern. Data analytics and even routine business-operations needs can likewise be configured with data or file sync services that produce cross-border transfers.

Yes. Bulk status does not depend on the form of the data: anonymized, pseudonymized, de-identified, and encrypted data all count toward the 12-month cumulative volume. Only methods that meet CISA-recognized standards and effectively prevent re-identification and access are accepted — which has to be assessed item by item.

The CISA security requirements include, at the organizational and system level (item B), logical and physical access controls that prevent covered persons or countries of concern from accessing covered data that does not meet the data-level requirements, and at the data level, a combination of mitigation measures that, taken together, are sufficient to fully and effectively prevent covered persons or countries of concern from accessing covered data that is linkable, identifiable, unencrypted, or decryptable using commonly available technology. Cross-border access to Covered Data from a country of concern is therefore not itself consistent with the CISA security requirements.

Under Example 8 of the EO 14117 Final Rule, where the vendor did not hire Covered Persons to process US personal data at the subsidiary's direction or as a deliberate attempt to evade the compliance requirements, the vendor agreement between the subsidiary and the vendor is not a restricted transaction and the subsidiary is not judged in violation.

Civil penalties reach a maximum of $368,136 or twice the transaction value, whichever is higher; willful violations additionally carry a criminal fine of up to $1 million and up to 20 years in prison. Enforcement sits with the DOJ's National Security Division, which holds investigation, hearing, and subpoena powers.