If an earlier recommendation to stop using high-risk vendors becomes a legal requirement, countries that don’t follow the rules could face penalties.