FCC Expands Covered List Prohibitions To Devices With Certain Logic-Bearing Hardware Components, Imposes Compliance Obligations On Online Marketplaces

On July 23, 2026, the Federal Communications Commission (FCC or Commission) released a Third Report and Order (Order) and Third Further Notice of Proposed Rulemaking (FNPRM) that continues the Commission’s efforts to address national security risks in the communications supply chain. In line with the Commission’s steady expansion of the scope and applicability of the Covered List, the Order expands the universe of prohibited components and imposes broad new compliance obligations on online marketplaces to prevent the sale of unauthorized devices, including covered equipment, and requires these marketplaces to display FCC IDs at the online point of sale, even where products are being sold by third parties.

Below, we summarize the key rule changes and clarifications adopted in the Order and highlight key proposals in the FNPRM before providing a more detailed summary of each item.

Building off the Commission’s October 2025 Second EA Security Report and Order and FNPRM on “untrustworthy gear,” the new Order: 

• Prohibits FCC equipment authorization for devices that contain “logic-bearing hardware components” produced by entities identified on the FCC’s Covered List.
• “Clarifies” that online marketplaces listing third-party devices must comply with the Commission’s marketing rules.
• Requires online marketplaces to prominently display FCC IDs at the online point of sale for regulated devices.
• Requires identified Covered List entities to undertake full recertification by the FCC before making any modification or permissive changes to any equipment, whether such equipment is covered or not.
• Adopts a revised definition of “critical infrastructure” for purposes of identifying use-based Covered List entries in response to a remand from the D.C. Circuit.

Meanwhile, the FNPRM proposes adopting another series of potentially significant changes to the FCC’s equipment authorization process, including:

• Prohibiting the authorization of any device that incorporates any component produced by a Covered List entity.
• Mandating software bill of materials (SBOM) and hardware bill of materials (HBOM) disclosures during the application process.
• Creating term limits for equipment authorization (which currently remain valid indefinitely unless withdrawn, revoked, or terminated).
• Requiring a U.S.-based liable party be designated for certified FCC devices.
• Imposing a new registration requirement and compliance information disclosure obligations for equipment authorized under the Supplier’s Declaration of Conformity (SDoC) process.

Comments on the FNPRM’s proposals are due 30 days after Federal Register publication (which has not yet occurred). Reply comments are due 45 days after publication.

Third Report and Order.

Prohibition on authorization of logic-bearing hardware components. The Order prohibits the authorization of “logic-bearing hardware components produced by Covered List entities,” as well as devices containing such logic-bearing components, if such device would be prohibited from authorization “had the device itself been produced by the Covered List entity [responsible for the production of the logic-bearing hardware component[s]].”

The Order defines “logic-bearing hardware components” as:

“[A]ny device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques; inclusive of telephone equipment that uses digital techniques or any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer.”

The Order further clarifies that although the definition is based on the FCC’s existing definition of “digital device” in 47 C.F.R. § 15.3(k), it captures intentional radiators and unintentional radiators along with components (rather than just systems). Only “dumb” components that, for example, serve a “purely mechanical [or] structural purpose” or perform no “digital logic or RF data processing” functions are exempted. 

The FCC delegates authority to the FCC Office of Engineering and Technology to respond to questions regarding the scope of the definition. The proposed prohibition does not apply to the FCC’s recent sectoral additions to the Covered List, such as the router (previously covered by Wiley here) and uncrewed aircraft systems (UAS) additions (covered here), and also exempts pending applications from the prohibition.

The prohibition on authorization of logic-bearing hardware components will be effective 30 days after publication of the Order in the Federal Register.

Online Marketplace Marketing and Sale Clarification. The Order “clarifies” that the FCC’s rules on the marketing and importation of radiofrequency devices contained in 47 C.F.R. 2.803 apply to “online marketplaces,” adopting the definition of “online marketplace” currently used by the Federal Trade Commission and defined in 15 U.S.C. 45f(f)(4) to encompass:

“[A]ny person or entity that operates a consumer-directed electronically based or accessed platform that (A) includes features that allow for, facilitate, or enable third party sellers to engage in the sale, purchase, payment, storage, shipping, or delivery of a consumer based product in the United States; (B) us used by one or more third party sellers for such purposes; and (C) has a contractual or similar relationship with consumers governing their use of the platform to purchase consumer products.”

Under Section 2.803 of the Commission’s rules, “marketing” includes, among other things, “offering for sale or lease” and “distribution for the purpose of selling.” To extend this rule to online marketplaces, the Order asserts that online marketplaces are “offering for sale” when they list products, including third-party products, on their platforms, and that they engage in “distribution for the purpose of selling” when listing regulated equipment on their platforms in combination with a variety of billing and fulfillment functions.

The Order goes on to adopt a revision to Section 2.803(a) that addresses only the issue of distribution, “to clarify that entities are engaged in ‘marketing’ when they list equipment on an online marketplace, in combination with any of the following activities: consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfilment services – even if that equipment is sold or offered for sale by a third-party seller.”

As a result of this change to Section 2.803(a), the Order establishes that online marketplaces are subject to FCC enforcement if found in violation of the FCC’s marketing and importation rules and may be liable for violations even if the offending conduct was not willful or intentional. The Order also declines to adopt safe harbor proposals in the record, though the Commission states it is “unlikely to pursue enforcement action against an online marketplace that undertakes reasonable due diligence” to comply with the FCC’s rules on marketing and importation.

Additional Online Marketplace Compliance Requirements. In addition to expanding the FCC’s marketing and importation rules to encompass online marketplaces, the Order adopts new rules requiring that FCC IDs (a unique identifier for devices certified through the FCC’s equipment authorization regime) be displayed at the online point of sale, with differing obligations imposed based on whether the online marketplace has “physical access” (or “take[s] title”) to the listed device, and subject to certain exemptions and limitations.

For listings where the online marketplace has physical access to or takes title (defined as “Category 1”), the online marketplace is responsible (and liable for) the display of a “valid and accurate FCC ID for the device at the online point of sale.” In other words, the online marketplace must verify that the provided FCC ID is valid and that it covers the product listed.

For listings where an online marketplace does not have physical access to or take title for the device (defined as “Category 2”), the marketplace is still required to display a valid FCC ID, but is not liable for inaccuracy of an FCC ID or related equipment authorization information supplied by a third-party seller, so long as the online marketplace “has taken reasonable steps to verify that the FCC ID supplied corresponds to [a valid FCC ID] … and [has] required the third-party seller to certify the accuracy of the information supplied.” In practice, this means that a marketplace must still check to make sure the seller-provided FCC ID is valid but need not independently verify that the FCC ID covers the specific product listed.

FCC ID verification requirements for Category 1 listings become effective 180 days following Federal Register publication, and 270 days after publication for Category 2 listings.

Amended “Critical Infrastructure” Definition and Modifications to Permissive Change Regime.

In addition to the logic-bearing component and online marketplace measures described above, the Order also adopts a revised definition of “critical infrastructure” to match the definition provided in Section 1016(e) of the Patriot Act, without expanding its scope and eliminating “connected to” from the definition, in response to a remand from the D.C. Circuit in Hikvision v. FCC, where the D.C. Circuit held that the FCC had adopted an overly broad definition of “critical infrastructure” for purposes of determining the scope of use-based covered list entries, such as those applicable to video surveillance and telecommunications equipment produced by Hytera, Hikvision, and Dahua.

Finally, the Order also adopts several measures addressing the modification of previously authorized equipment and permissive changes, including:

• Clarification that it is unlawful to modify previously authorized equipment that has been added to the Covered List.
• Clarification that it is unlawful to modify equipment in any way that would render the equipment prohibited under existing Covered List determinations.
• Requiring that all covered entities submit applications for recertification to make any permissive change to any type of equipment (covered or not) but exempting production location-based additions to the Covered List (e.g., UAS and routers).

Third Further Notice of Proposed Rulemaking.

The FNPRM includes a number of potential changes to the Equipment Authorization process. Most significantly, the FNPRM proposes to:

• Establish term limits for equipment authorizations.
• Reorganize Covered List rules to clearly separate and distinguish requirements and restrictions placed on named Covered List producers (“producer/provider-based” rules) from requirements and restrictions placed on a general sector and location of production (“production location-based” rules).
• Codify the following definition of “produced by”:

“A device is ‘produced by’ an entity if that entity exercises substantial responsibility for, or control over, any major stage of the process by which the device comes into existence, including the design, manufacturing, assembly, or development of the device. A device may be ‘produced by’ more than one entity.”

• Require applicants for equipment authorization to provide a written and signed list of any and all entities that produced the device for which authorization is sought.
• Require applicants for equipment authorization to submit a written and signed Hardware Bill of Materials (HBOM) and Software Bill of Materials (SBOM) at the time they apply for certification and impose additional disclosure requirements.
• Prohibit authorization of devices that incorporate any components produced by a Covered List entity.
• Prohibit authorization of any device “that has been integrated with [] software or firmware that was produced or provided by a Covered List entity.”
• Require certification for all devices in “Covered List sectors” (i.e., UAS, UAS critical components, routers, and other sectors added to the Covered List in the future).
• Modify the Commission’s importation rules to specifically address covered equipment and restrict the importation of covered equipment.
• Broadly prohibit the marketing of covered equipment under most circumstances.
• Impose additional FCC compliance obligations on retailers.
• Establish a new, streamlined procedure for the revocation of equipment authorizations.
• Require that all devices authorized through the SDoC process be “registered” with the FCC with a unique identification number, which will be publicly displayed on an FCC website.
• Require that all applicants for certified equipment identify a legally liable party located within the United States.