Key Takeaways:
- The FCC has expanded its ban to prohibit the authorization of end products where such products contain “logic-bearing hardware components” produced by an entity on the Covered List.
- The FCC has clarified that online marketplaces that offer fulfillment, warehousing or billing services alongside third-party device listings are now subject (under certain circumstances) to and could be subject to enforcement for failing to comply with the FCC’s marketing rules.
- The FCC adopts rules that require Covered List entities to undertake full recertification by the FCC before making any modifications or permissive changes to any equipment, whether such equipment is covered or not.
- In response to a D.C. Circuit decision vacating an earlier definition, the FCC now strictly aligns the meaning of “critical infrastructure” in its rules with existing statutory and DHS definitions.
On July 22, 2026, the Federal Communications Commission (FCC or Commission) adopted a Third Report and Order and Third Further Notice of Proposed Rulemaking (covered separately here) in which the Commission advances its ongoing efforts to secure the U.S. communications supply chain pursuant to the Secure Networks Act and the Secure Equipment Act. In particular, the Commission continues to extend the reach of its Covered List of equipment and services that pose a national security risk to the United States by significantly expanding authorization prohibitions to include logic-bearing hardware components produced by an entity on the Covered List and broadening the FCC’s direct regulatory reach to e-commerce platforms that allow for the marketing and sale of radiofrequency equipment in the United States.
Covered List Overview
Enacted in March of 2020, the Secure Networks Act requires the Commission to publish a list of equipment and services that pose “an unacceptable risk to the national security of the United States or the security and safety of United States persons” based solely on specific determinations made by certain enumerated sources (Covered List). Under the Secure Networks Act, the statute directs the FCC to place on the Covered List any equipment or service posing an unacceptable risk to national security as determined by certain enumerated sources. Once the FCC adds an entity, equipment or service to the Covered List, the entity is prohibited from receiving equipment authorizations, which are required for the importation, marketing and sale in the United States, for the devices on the Covered List.
Although previously authorized equipment may still be sold, placement on the Covered List largely prevents the introduction of new (or updated) products, which require new equipment authorizations. The FCC also has expanded the reach of the Covered List by prohibiting the authorization of any modular transmitter that is covered equipment, and any product, host or device that incorporates a modular transmitter that is covered equipment, regardless of any previous authorization of the modular transmitter. The FCC’s aim in doing so was to ensure that entities cannot find loopholes that would allow them to avoid the Covered List prohibitions by taking advantage of a modular transmitter that was approved before the Covered List addition(s) were issued.
The FCC has also moved beyond entity-specific prohibitions and is now including on the Covered List large categories of “foreign-produced” equipment and components of equipment. For example, the FCC has updated its Covered List to include unmanned aircraft systems (UAS), UAS critical components, routers, power inverters and advanced robotic devices that are “foreign-produced.”
Zooming In: The New “Logic-Bearing Hardware Component” Prohibition
The Third Report and Order prohibits the authorization of “logic-bearing hardware components” produced by Covered List entities and end devices containing such components regardless of whether the end device is itself produced by a Covered List entity. The FCC determined that such products pose the same risks as those currently banned, adopting a “trust starts in silicon” point of view. The FCC is recognizing the important role that even small components can play in a system’s security. Notably, while radiofrequency (RF) capabilities are part of the analysis of what is covered by this rule, the lack of RF functionality is not dispositive. The FCC argues that even non-RF hardware can compromise the whole device, and therefore its analysis goes beyond the question of whether the device transmits, receives or processes RF.
Largely paralleling the FCC’s current definition of “digital device,” the FCC defines “logic-bearing hardware components” as “any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques; inclusive of telephone equipment that uses digital techniques or any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer.”
Components now subject to the rule could include microprocessors, cellular/Wi-Fi chipsets, Internet of Things modules, baseband processors, Trusted Platform Modules, optical transceivers or motor controller boards, but it excludes purely mechanical/structural parts (housings, chassis, brackets, fasteners), passive electrical components not using digital timing signals (resistors, capacitors, inductors, wiring/cable, connectors), basic power-only cells (without a digital battery management system) and bare motors lacking embedded digital controllers.
Under the current rules, the Commission’s primary enforcement mechanism will be the applicant attestation as required by Section 2.911(d). However, the Third Further Notice of Proposed Rulemaking is currently seeking comment on mechanisms that would enable it to enforce this prohibition by requiring, for example, an entity to submit a hardware and software bill of materials for the device in its equipment authorization application. This prohibition is limited to the entities specifically identified on the Covered List. It does not apply to entities whose products are on the Covered List because they are already subject to “foreign-produced” prohibitions (e.g., foreign-produced UAS, routers, power inverters and advanced robotic devices) and must provide a detailed bill of materials with country of origin for each component in their device as part of the Condition Approval process. This also only applies prospectively, meaning existing equipment authorizations remain valid and any authorization applications that are pending before the FCC or a telecommunication certification body (TCB) prior to the effective date are unaffected. This prohibition will be effective on October 13, 2026.
Expanding the FCC’s Jurisdiction over E-Commerce Platforms
The FCC’s rules already govern the importation, marketing and sale or lease of equipment subject to its authority as well as “distribution for the purpose of selling” such equipment. In the Third Report and Order, the FCC clarifies that this applies to online marketplaces that host third-party listings for these products, provided they also engage in consignment, warehousing, inventory management, order processing, labeling, packaging, billing or fulfillment. The FCC defined “online marketplace” as “any person or entity that operates a consumer-directed electronically based or accessed platform that”
(A) includes features that allow for, facilitate or enable third-party sellers to engage in the sale, purchase, payment, storage, shipping or delivery of a consumer product in the United States.
(B) is used by one or more third party sellers for such purposes.
(C) has a contractual or similar relationship with consumers governing their use of the platform to purchase consumer products.
That means that online marketplaces that list unauthorized devices, such as equipment on the Covered List, for sale in the United States are subject to enforcement action from the FCC, and the FCC declined to limit this to only those who do so willfully and intentionally. Online marketplaces will therefore now be required to verify equipment authorization compliance for all listings, even those from third parties.
Online marketplaces will also now be required to display the FCC ID of these products at the point of sale, enabling consumers and retailers to verify that they are purchasing authorized products before the sale is complete. The FCC breaks this requirement into two categories:
- Category 1: For listings where the online marketplace has physical access to or takes title, the online marketplace is responsible for the display of a “valid and accurate FCC ID for the device at the online point of sale.” This will require the online marketplace to verify that the provided FCC ID is valid and that it covers the product listed.
- Category 2: For listings where an online marketplace does not have physical access to or take title for the device, the marketplace is required to display a valid FCC ID, but is not liable for inaccuracy of an FCC ID or related equipment authorization information supplied by a third-party seller, so long as the online marketplace “has taken reasonable steps” to verify the FCC ID and has required the third-party seller to certify to its accuracy.
Crucially, these requirements will only apply to new listings (i.e., not those published before these rules become effective) and will not apply to “small sellers” or sales of used devices. While most of the new rules adopted in this Third Report and Order will become effective 30 days after Federal Register publication, the new FCC ID display requirements for online marketplaces follow a longer timeline—Category 1 FCC ID verification requirements become effective on March 1, 2027, and Category 2 FCC ID verification requirements become effective on June 1, 2027.
Modifications of Existing Devices
Because the Covered List rules are prospective and existing devices are generally “grandfathered”—existing authorizations remain valid even if they would be subject to the Covered List unless the FCC takes further action—the question of what kinds of modifications are permitted is critically important. In the Third Report and Order, the FCC clarified that it is unlawful to modify a device, which includes any change in design, circuitry or construction of previously authorized equipment, where that device has been added to the Covered List. Such a modification requires seeking a new equipment authorization.
Critical Infrastructure Definition
In the FCC’s First Report and Order in this proceeding, it defined “critical infrastructure” for purposes of its prohibition on the use of certain equipment from Covered entities in the “physical security surveillance of critical infrastructure.” The D.C. Circuit largely upheld the FCC’s decision, but it vacated the specific finding that “critical infrastructure” includes “systems or assets” that are “connected to” critical infrastructure sectors and functions. In response, the FCC retained the core of its definition—which is based on the USA PATRIOT Act of 2001 and on the Department of Homeland Security’s (DHS) list of 55 National Critical Functions—but removed the additional “connected to” expansion. The FCC defined “critical infrastructure” as having the meaning in 42 U.S.C. 5195c(e), which states that critical infrastructure includes “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.” This definition ties directly to the video surveillance and telecommunications equipment produced by Hytera, Hikvision and Dahua since the equipment produced by those entities is only on the Covered List to the extent that it is used for, among other things, physical security of surveillance of critical infrastructure.
Closing Thoughts
The FCC’s equipment authorization process is quickly evolving from a highly technical part of its work into one of the Trump administration’s preferred tools for not only securing communications networks but also promoting domestic manufacturing. With this Third Report and Order, the FCC has significantly expanded the list of companies, ecommerce platforms and industries that need to know the ins-and-outs of this new area of FCC law in order to avoid disrupted supply chains, angry customers or even enforcement penalties. This is a major move by the FCC, but it will certainly not be the last, so stay tuned!
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
