Manufacturing and industrial: the numbers, the rules, the AI picture.

• FTC Made in USA Labeling Rule (16 CFR Part 323) and Executive Order 14392

  It is an unfair or deceptive practice to label a product "Made in the United States" unless final assembly or processing happens in the U.S., all significant processing happens in the U.S., and all or virtually all ingredients or components are made and sourced in the U.S. The FTC announced the rule in 2021 and said it can seek civil penalties of up to $43,280 per violation. The rule covers labels, including catalogs and online materials with a seal or mark, and the FTC still pursues other deceptive origin claims under Section 5. Executive Order 14392, signed March 13, 2026, directs the FTC chair to prioritize enforcement against false "Made in America" claims and tells agencies to verify American-origin claims on federal contracts.

  What it means: Audit every origin claim on your site, catalog, quote templates and packaging. If you import castings or raw stock, say what is done in the U.S. instead. In one example on its guidance page, the FTC says "Assembled in U.S.A." would not be deceptive for a product with mostly imported parts. In 2022 the FTC announced its first civil penalty case under the rule against a battery maker whose products used imported cells, with a settlement above $100,000. A false claim to a government buyer carries more risk than a marketing penalty.

  [10] ftc.gov

• California Business and Professions Code section 17533.7: Made in USA safe harbors

  California has its own law on "Made in USA" claims. It allows a product made in the U.S. with some foreign parts to carry the claim if foreign parts are no more than 5% of the final wholesale value. A 10% threshold applies if the manufacturer shows it cannot make the part or source it domestically, and cost cannot be the reason. Federal courts reported in October 2025 held that the FTC rule does not preempt these safe harbors.

  What it means: California tolerates more foreign content than the FTC does, but meeting the state test does not protect you from the federal standard. If you ship to California buyers, write claims to the stricter federal standard or use a qualified claim. Counsel should confirm how both apply to your bill of materials.

  [11] codes.findlaw.com

• ISO 9001 and AS9100 certification claims

  ISO writes the standards and does not certify companies. Independent certification bodies audit and issue certificates, and accreditation bodies assess those certification bodies, according to DNV, a certification body, in its explainer. The IAQG's OASIS database holds supplier and audit data for companies with accredited certification to AS9100, AS9110 and AS9120, and certified suppliers must be listed, according to the PRI Registrar. A certificate covers a management system and a defined scope, not every product you ship.

  What it means: Say "ISO 9001 certified by [certification body], scope: [scope]". Do not say a part is "ISO certified", and do not build your own badge from the ISO logo. Use the certification body's mark only under its rules. Keep the certificate current, because a lapsed or suspended certificate on your site is a false claim that a buyer can check. Confirm that the certification body is accredited.

  [12] dnv.com

• ITAR (22 CFR parts 120 and 122): registration and technical data

  Anyone in the U.S. who manufactures defense articles must register with the State Department, even if they never export, and registration "does not confer any export rights or privileges" (22 CFR 122.1). Releasing technical data to a foreign person in the United States is a deemed export to every country where that person holds citizenship (22 CFR 120.50). The public domain definition in 22 CFR 120.34 lists channels such as newsstands, libraries and trade shows, and includes public release in any form after approval by the cognizant U.S. government agency. It does not mention the Internet.

  What it means: Say "ITAR registered" only if you are, and do not describe it as an approval, certification or proof of compliance. Do not post drawings, specifications or CAD for defense articles on a public page or in an open download without export counsel and the right approvals. A page that is simply public is not safe. Control who can access controlled files, and keep them off your public RFQ upload unless access is controlled.

  [13] law.cornell.edu

• Export Administration Regulations (15 CFR 734.7): published technology

  Under the EAR, unclassified technology is "published" and not subject to the EAR when it is made available to the public without restrictions on further dissemination. The rule names posting on the Internet on sites available to the public as one way. Two exceptions remain: published encryption software under ECCN 5D002, and firearm production software or technology posted online in ready-to-use formats such as AMF or G-code.

  What it means: Commercial and dual-use data you post openly is generally outside the EAR, but check the classification first. Do not assume ITAR data follows the EAR rule: the two regimes differ. If you make firearm components, ask counsel before posting any ready-to-use production files such as G-code.

  [14] law.cornell.edu

• False Claims Act and cybersecurity representations to the Department of Defense

  In March 2025 the Department of Justice announced that MORSECORP agreed to pay $4.6 million to resolve False Claims Act allegations about its Army and Air Force contracts. DOJ said the company reported a NIST SP 800-171 score of 104 to the Department of Defense in January 2021, and a third-party consultant told it in July 2022 its actual score was -142. The settlement is civil.

  What it means: If you sell into defense supply chains, do not publish "NIST 800-171 compliant", a score or a CMMC status unless it is current and supported by a real assessment. A marketing claim and a contract representation are different things, but they need to match. Have your compliance lead approve defense-security wording before it goes live.

  [9] justice.gov

• California Proposition 65: warnings on product pages (27 CCR section 25602)

  Where Proposition 65 requires a warning for a product sold into California, internet purchases must carry a warning on the product display page, a clearly marked "WARNING" hyperlink on that page or another prominently displayed warning before the purchase is completed. A warning the purchaser must search the general website to find is not prominent. Catalogs must associate the warning with the item.

  What it means: If you sell consumer-facing products, parts or kits into California through your site or a catalog, check with counsel whether a warning applies and put it on the product page. Pure B2B suppliers should ask counsel how the rule reaches them and the sellers who buy from them.

  [15] law.cornell.edu

• CAN-SPAM Act: B2B email and outreach

  CAN-SPAM makes no exception for business-to-business email. Messages need accurate header information, a non-misleading subject line, clear identification as an ad, a valid postal address and an opt-out honored within 10 business days. The FTC says each violating email can carry a penalty of up to $53,088, on a page edited in January 2024.

  What it means: Your newsletter, trade-show follow-up and cold outreach to engineers and buyers all count. Include your postal address and an opt-out, keep a suppression list and do not buy lists of unknown origin. Check Canada's CASL and the UK rules before emailing contacts there.

  [16] ftc.gov

General information, not legal advice. Origin, certification, export-control, defense contracting and warning rules change and differ by state and product. Confirm the current rules with counsel, a licensed export compliance adviser and your certification body before you publish.