Overview
The Federal Communications Commission (FCC) has adopted new restrictions on equipment incorporating certain components from Covered List entities, strengthened online marketplaces' compliance obligations, and tightened its rules for modifying previously authorized equipment. Published in the Federal Register on September 11, 2026, the rules take effect October 13, 2026.
There are four main components of the new rules: (1) prohibiting authorization of devices that contain "logic-bearing hardware components" produced by a covered entity; (2) requiring e-commerce platforms to display a device's FCC ID at the point of sale; (3) clarifying that a manufacturer cannot rely on an existing authorization to modify equipment in a way that makes it covered; and (4) amending the definition of "critical infrastructure" to remove an earlier interpretation that that equipment merely "connected to" critical infrastructure qualify.
Logic-Bearing Hardware Components
The rules (under § § 2.903) now prohibit authorization of a device containing a "logic-bearing hardware component" produced by an entity on the Covered List if, had the covered entity produced the device itself, the device would be prohibited from receiving an equipment authorization. Where that condition is met, using another manufacturer to produce the remainder of the device does not avoid the prohibition.
The FCC's rationale is that "devices incorporating logic-bearing hardware components produced by Covered List entities pose the same or substantially similar ‘unacceptable risks' as devices produced by the Covered List entities themselves" because they "operate at foundational layers of computing."
Codified in 47 C.F.R. § 2.902, the new rule defines "logic-bearing hardware component"
as:
"Any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques; inclusive of telephone equipment that uses digital techniques or any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer."
Notably, the FCC did not adopt broader proposals to ban components produced by any person controlled by or subject to the jurisdiction or direction of a foreign adversary, or to adopt a prohibition on software or firmware components produced by covered list entities, but reserved the right to revisit those possibilities in a further rulemaking.
The FCC did emphasize that the new prohibitions do not apply "to components produced by entities that produce equipment subject to recent production location-based additions to the Covered List – such as components produced by entities that also produce UAS, UAS critical components, or routers in a foreign country – unless that entity is otherwise identified on the Covered List." Further, the new restrictions apply prospectively and do not disturb existing equipment authorizations.
Marketing Unauthorized Equipment
The FCC clarified that entities are engaged in "marketing" under the FCC's equipment marketing rules when they list equipment on an online marketplace, in combination with any of the following activities: consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfilment services—even if that equipment is sold or offered for sale by a third-party seller. Online marketplaces may be held directly liable for marketing unauthorized equipment offered by third-party sellers, even if the marketplace does not take title to the equipment.
Online marketplaces will now be required to display FCC IDs for devices subject to certification. The rules establish two compliance deadlines (see § 2.803):
- March 1, 2027: Marketplaces selling devices themselves, or having physical access to or taking title to third-party devices, must display a "valid and accurate FCC ID" at the online point of sale.
- June 1, 2027: Marketplaces without physical access to or title to third-party devices must display a valid FCC ID. They receive limited protection against liability under this provision for inaccurate seller-supplied information if they take reasonable steps to verify that the ID was validly issued and require the seller to certify accuracy.
Listings on online marketplaces by "small sellers" (low-volume sellers with fewer than 200 discrete sales or less than $5,000 worth of transactions in a 12-month period) are exempt from verifying or displaying an FCC ID.
Though the FCC does not adopt any safe harbor provisions for the marketing rules, the FCC notes that it "is unlikely to pursue enforcement action against an online marketplace that undertakes reasonable due diligence" to comply.
Modifications to Equipment
The FCC clarified that an existing authorization cannot support a modification that would cause equipment to become covered. For example, a manufacturer cannot change a covered drone's components in a way that causes it to lose its domestic-end-product exemption and thus become covered.
For entity-based restrictions, the FCC will assess who "produced" a device under the totality of the circumstances, including substantial responsibility for or control over design, development, manufacture, or assembly. A device assembled by a Covered List entity is "produced by" that entity; the presence of otherwise authorized components does not alter the covered status. Similarly, a device that is covered remains covered regardless of whether it uses components that individually hold valid equipment authorizations.
All Covered List entities that seek permissive change modifications to covered or non-covered equipment already on the market must submit applications for recertification. This requirement applies only when the applicant for the permissive change is itself an entity identified on the Covered List. The FCC confirmed that Covered List entities cannot rely on the
Supplier's Declaration of Conformity (SDoC) process for modifications, even for non-covered equipment regardless of the nature or scope of the change. A non-Covered List manufacturer that modifies equipment originally produced by a Covered List entity is not subject to this recertification requirement if the modification does not result in the modified device being ‘produced by' the Covered List entity under the totality-of-the-circumstances framework.
Critical Infrastructure
Finally, the FCC adopted a revised definition of "critical infrastructure" for purposes of the prohibition on authorization of covered equipment produced by covered list entities and their subsidiaries.
Drawing from the Patriot Act, the Order defines "critical infrastructure" as:
[S]ystems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.
What Businesses Should Do Now
The adopted rules reinforce the need to assess FCC compliance throughout a product's lifecycle. Manufacturers should review their supply chains and procedures for modifying authorized equipment, while online marketplaces should prepare to meet the new FCC ID display and verification requirements.
