FCC Closes Component Loophole And Clarifies Its Authority Over Online Marketplaces: New Rules Reach Beyond Finished Product, Proposals Suggest Even Stricter Controls

On July 22, the Federal Communications Commission (FCC) released a Third Report and Order (Order) and a companion Third Further Notice of Proposed Rulemaking (Further Notice) — its most aggressive step yet to purge untrusted foreign technology from America’s communications supply chain. The component ban takes effect 30 days after Federal Register publication. Comments and replies on the Further Notice are due 30 and 45 days, respectively, after Federal Register publication.

Background

Over the past several years, communications supply chain security has become a top priority of U.S. national security policy. The Executive Branch, Congress, and federal regulators have mounted a full-court press to limit the presence of technology perceived to pose national security, cybersecurity, and supply chain risks. And the FCC has played a central role in these efforts.

Since 2022, the FCC has adopted a series of orders designed to prevent equipment identified on its Covered List from receiving FCC equipment authorizations and entering the U.S. market. Earlier FCC actions prohibited authorization of covered equipment outright, expanded those restrictions to devices incorporating covered modular transmitters, and imposed new equipment certification and reporting obligations to give FCC greater insight into applicant ownership. Taken together, these actions transformed the FCC’s equipment authorization process from a largely technical compliance regime into a critical lever for securing America’s communications supply chain.

Order

The FCC’s previous supply chain efforts focused on covered equipment and covered modular transmitters. Its latest Order extends the agency’s national security scrutiny to the components embedded inside communications devices, and targets pathways like online marketplaces that the Commission believes have let covered equipment enter or remain in the U.S. market. The Order:

• Extends Covered List restrictions to certain hardware components. Prohibits authorization of any device that incorporates a “logic-bearing hardware component”¹ produced by a Covered List entity — even where the finished product is manufactured, branded, and sold by an unrelated company — if the finished product would itself have been prohibited had the Covered Entity produced it directly. Components with embedded control logic are covered, including communications modules, wireless chipsets (Wi-Fi, Bluetooth, cellular), Trusted Platform Modules, and cryptographic elements.

By contrast, non-logic bearing components, characterized as those that are “fixed, do not use digital techniques, and are non-programmable,” fall outside the restriction. Examples include housings, brackets, simple resistors, plain battery cells, and motor controllers. The prohibition applies to new applications and pending applications only when they are later amended.

• Clarifies that online marketplaces are subject to FCC marketing requirements. The Order confirms that online marketplaces are engaged in FCC-regulated “marketing” when they list FCC-regulated equipment and provide services like consignment, warehousing, inventory, and billing, even when a third-party seller, not the online marketplace, holds title to the product. The Order specifically creates two compliance paths, based on whether the online marketplace has physical access or title to the devices it lists:

The Order does not require online marketplaces to list Supplier’s Declaration of Conformity (SDoC) compliance information, and both small sellers and listings for used RF devices are exempt.

To support these efforts, the FCC’s Office of Engineering and Technology (OET) will work with the Enforcement Bureau and Office of the Chief Information Officer to modernize the FCC’s Equipment Authorization System, and will engage online marketplaces on technical improvements that support compliance monitoring.

• Signals enforcement priorities, but stops short of a safe harbor. The FCC declined to adopt a formal safe harbor or knowledge-based liability standard for online marketplace marketing. It indicated it is unlikely to pursue enforcement actions against online marketplaces that exercise “reasonable due diligence” and follow the FCC’s “Operation Clean Carts” best practices. But the FCC made clear this is neither a safe harbor nor a legal defense; good faith efforts will not excuse a pattern of noncompliance or willful blindness. OET will publish guidance identifying specific best practices based on that initiative.
• Tightens restrictions on post-authorization changes. Clarifies that previously authorized equipment may not be modified in ways that cause it to become covered equipment and reaffirms that determinations about who “produced” a device will continue to be based on the totality of the circumstances.
• Eliminates streamlined approval for modifications and permissive changes by Covered List entities. Requires full FCC certification for any modification or permissive change to previously authorized equipment made by a Covered List entity and prohibits use of the more streamlined SDoC process.
• Narrows the definition of “critical infrastructure.” Removes language the D.C. Circuit found overly broad and aligns the FCC’s definition with the USA Patriot Act definition, guided by the 16 critical infrastructure sectors and 55 National Critical Functions.

Effective Dates and Scope: Most of the rules, including the component prohibition, take effect 30 days after Federal Register publication. Applications pending as of that date are exempt from the component prohibition, unless later amended to add, substitute, or change a logic-bearing hardware component, in which case the amended application is treated as new and subject to the new rules. Previously authorized equipment is unaffected and may continue to be marketed, imported, and used under its existing equipment authorization. The FCC ID display requirement for marketplaces with physical access or title to listed devices takes effect 6 months after Federal Register publication, and the FCC ID display requirement for marketplaces without physical access or title are effective 3 months after that.

Further notice

The Further Notice suggests the FCC is far from finished. Specifically, it proposes to:

• Reorganize the Covered List framework: Bifurcate Covered List restrictions into producer/provider-based and production location-based categories, reflecting the FCC’s focus on where equipment is produced, not just who produced it.
• Require greater supply chain transparency: Require hardware and software bills of materials (HBOMs and SBOMs), component origin disclosures, and other reporting to give the FCC greater visibility into who designed, developed, manufactured, and supplied communications equipment, including white-labeled and “electrically identical” devices.
• Expand restrictions to cover hardware components, software, or firmware: Prohibit — or create a presumption against authorizing — devices that incorporate any hardware component, software, or firmware produced by an entity identified on the Covered List.
• Require certification for all devices in Covered List sectors, including UAS, UAS critical components, and routers — even if those devices would otherwise qualify for a more streamlined authorization pathway.
• Tighten controls on how covered equipment enters and stays in the U.S. market by narrowing importation exceptions, limiting pre-authorization marketing and operation of covered equipment, and imposing additional labeling and disclosure requirements.
• Strengthen enforcement and accountability by adopting streamlined equipment authorization revocation procedures, imposing term limits on equipment authorizations, requiring registration of SDoC devices, and requiring FCC-certified equipment to identify a U.S.-based liable party.
• Preserve limited update pathways for already-authorized covered equipment by making permanent existing waivers that allow software, firmware, and certain limited hardware updates intended to mitigate consumer harm or address security vulnerabilities in already-authorized covered equipment.
• Codify key Covered List definitions by defining terms such as “produced in a foreign country,” “UAS critical components,” and “routers,” which will be central to determining if equipment falls within production location-based Covered List restrictions.
• Refine submarine cable compliance obligations by tailoring certain submarine cable Covered List certifications to producer/provider-based determinations, rather than automatically applying production location-based restrictions unless the relevant determination specifically identifies submarine cable-related risks.

Next steps

The Order has near-term compliance implications for companies that make, source, import, sell, or support devices for sale in the U.S. market. Companies should not assume this is only an issue for traditional telecommunications manufacturers. The new rules also impact retailers, online marketplaces, and manufacturers that may not have viewed themselves as directly subject to the FCC’s equipment authorization requirements. Companies should:

• Assess whether products contain newly restricted components: Companies should assess whether any of their products — including those currently under FCC review — (1) contain logic-bearing hardware components and (2) are produced by Covered List entities, to determine whether they are subject to the new restriction and whether additional compliance actions are required.
• Determine whether sales or distribution activities could be considered “marketing” under FCC rules: Online marketplaces, distributors, and other intermediaries should assess whether their activities may fall within the FCC’s interpretation of equipment marketing and, if so, ensure compliance with the new FCC ID display requirements and related obligations. Online marketplaces and similar entities should review the FCC IDs of products they sell to ensure FCC authorization information is valid before products are offered to consumers.
• Expect greater scrutiny of Covered List product changes: Any modification or permissive change by a Covered List entity now requires full FCC certification. Companies on the Covered List should consider the impact of this potentially longer process for product updates, component substitutes, and other post-authorization changes moving forward.
• Understand who is actually producing your products: The FCC clarified that previously authorized equipment may not be modified so as to become covered equipment, and reaffirmed that it will evaluate who “produced” a device based on the totality of the circumstances. Companies should evaluate their existing and planned supply chain vendors and processes to ensure that post-authorization changes do not inadvertently create Covered List exposure.
• Evaluate whether your products are used in critical infrastructure environments: The FCC adopted a revised definition of “critical infrastructure” that will continue to play a key role in certain Covered List determinations. Companies should assess whether their systems and products are used to support the 16 critical infrastructure sectors identified by the Executive Branch or provide any of the 55 National Critical Functions identified by the Department of Homeland Security.

The Further Notice also signals additional FCC supply chain regulations on the horizon. Several proposals would push the FCC well beyond traditional equipment authorization review into broader scrutiny of how products are developed, built, and supported — including, for example, proposals that would make the locations products are “designed” and “developed” relevant to certain FCC determinations. Companies should evaluate the proposals in relation to their products, services, operations, and supply chains, and consider submitting comments before the FCC determines the content and scope of any final rules.

Comments and reply comments on the Further Notice will be due 30 and 45 days, respectively, after Federal Register publication.