Chip policy ran on a decade’s clock; IT backlogs ran on a quarter’s

The week

On July 27, 2022, the Senate passed the CHIPS and Science Act, and the House followed on July 28. President Biden signed it on August 9. The law provided about 52.7 billion dollars for domestic semiconductor manufacturing incentives, research and workforce programs. It also created an investment tax credit for chip manufacturing facilities and authorized a broad expansion of federal science research. It followed two years of chip shortages that had disrupted car production and stretched lead times across electronics. On July 27, the Federal Reserve raised its policy rate by three quarters of a percentage point for the second meeting in a row, making capital purchases more expensive to finance. For IT departments, the shortage showed up as long waits for network switches, firewalls, servers and some laptops.

A large semiconductor law arriving in the middle of a hardware shortage invited an easy assumption: relief was coming. It was, on a timescale of years. New fabrication plants take several years to build and qualify. Many of the chips that were short in 2022 were mature, inexpensive components made in existing plants, not the leading-edge processors the new fabs would target. The law was industrial policy for the next decade. It did nothing for a branch router ordered that summer.

Mixing the two timescales produced bad decisions, such as delaying a needed purchase in the hope that prices would fall. The cleaner approach was to treat supply as three problems with different clocks and different owners. The backlog was a problem of months, owned by infrastructure and procurement. The refresh plan was a problem of years, owned by the CIO and finance. Provenance was a problem of a decade, owned by risk and, in government, by supply chain risk management programs.

The backlog: months, and a risk-ranked order book

In 2022 many organizations held orders for network and server equipment with delivery dates far beyond their plans. Projects stalled. Some teams kept unsupported equipment in service longer than intended, which created security exposure. Others bought whatever was in stock, which created configuration sprawl that cost more to manage later.

The useful responses were mundane. Rank open orders by the risk of not receiving them, so equipment replacing unsupported devices or serving critical sites came first. Hold a small pool of strategic spares for the most important locations. Qualify a second model or vendor for common roles, such as branch switches or access points, so one product line’s shortage did not stop a rollout. Configuration templates and automation that work across models made the second option practical rather than theoretical.

Equipment kept in service past its support date needed its own controls while it waited for a replacement. That meant tighter network segmentation, management interfaces restricted to an administrative network, extra monitoring, and a documented risk acceptance with an expiry date signed by someone senior. An exception without an end date tends to outlive the shortage that justified it, and examiners and auditors notice.

Cloud and managed services were a partial hedge, since large providers buy hardware at scale and absorb some supply risk. They were not a complete one. Branches, clinics and field offices still need equipment on site.

Communication mattered as much as sourcing. Business leaders often learned of delays only when a project missed its date. A monthly view of critical orders, expected delivery and the consequence of further slippage let them plan around the shortage. It also gave the risk committee an honest list of unsupported devices that were waiting on parts.

The refresh plan: years, and the end of fixed cycles

Many regulated organizations ran fixed refresh cycles: laptops every few years, network gear on a longer cycle, servers aligned to support contracts. The shortage exposed how brittle that was. When a large batch falls due at once and supply slips, many systems pass end of support together.

A sturdier plan ties replacement to support dates and risk rather than age alone. It staggers large replacements across years, and it orders long lead-time items well ahead of need. It also asks a sharper question: which workloads still need owned hardware at all? Some organizations used the shortage to move workloads to cloud or to virtual network functions. Others concluded that certain systems, such as those with strict latency or data residency needs, belonged on premises and simply needed earlier ordering.

Interest rates added a financing dimension. As borrowing costs rose, the comparison between buying, leasing and subscribing shifted. Finance and IT needed to compare options on total cost over the asset’s life, including the cost of being caught short, not on the purchase price alone. For public agencies, appropriation timing added a constraint: money that must be obligated within a fiscal year does not sit well with lead times that cross it.

Provenance: a decade, and a question to start asking

The law addressed provenance most directly. Leading-edge chip manufacturing was concentrated in a few places in East Asia, and geopolitical tension made that a strategic risk. For most banks and health systems, where a component was made was not a buying criterion in 2022. For federal agencies and their contractors, supply chain risk management already applied in many programs, and some product restrictions were already in law.

Provenance is a long-horizon question, but it starts with near-term data. Some organizations began asking key vendors where critical components were made, what alternative sources existed and how fast they could switch. They built the information they would need if export controls, tariffs or a regional disruption later forced a change. The answers went into the vendor file next to financial and security assessments.

Public agencies had a procurement step to add. Contract vehicles and approved product lists often lag what vendors can deliver. Agencies that qualified alternative models in advance could switch when a product was delayed instead of restarting a purchase. That work served the backlog and provenance at once, which is the one place the two clocks met.

With hindsight

Lead times for most enterprise hardware eased during 2023 as demand cooled, and some organizations found themselves holding more stock than they needed. CHIPS Act awards went to major fabrication projects. Some began production, and others slipped years behind their original schedules. Export controls on advanced chips, first announced in October 2022 and tightened several times, and tariff measures from 2025 reshaped electronics supply chains. Shortages then moved to new places: AI accelerators from 2023 onward, and memory, whose prices rose sharply from late 2025 as AI demand absorbed supply. By 2026 the three clocks are still distinct. Backlogs come and go with demand cycles. Refresh plans tied to support dates have proved more resilient than fixed cycles. Provenance has become a standing procurement question, especially for public agencies and their contractors.