Key Takeaways:

• The FCC seeks comment on proposals designed to expand the reach of the Covered List prohibitions, including requiring entities to designate a U.S.-based liable party for Certified devices and imposing a new registration requirement and compliance information disclosure obligations for equipment authorized under the SDoC process.
• In addition, the FCC seeks comment on requiring disclosure of a HBOM and SBOM detailing the origin of each component, including modular transmitters and IoT modules, semiconductors and optical transceivers, within the device for which authorization is sought.
• The FCC also seeks comment on prohibiting the authorization of any device that incorporates any component produced by a Covered List entity regardless of whether the host device is produced by an entity on the Covered List.
• Comments are due September 8, 2026, and reply comments are due on September 21, 2026.

On July 22, the Federal Communications Commission (FCC or Commission) adopted a Third Report and Order and Third Further Notice of Proposed Rulemaking (Third Further Notice) that demonstrates that the FCC is continuing to prioritize its obligation to protect the U.S. communications supply chain from national security risks. Discussed in greater detail in a separate post, the Third Report and Order not only expands the type of components that are subject to the Covered List prohibitions but also imposes broad new obligations on online marketplaces to restrict the sale of unauthorized devices, such as those on the Covered List. This Third Further Notice represents the latest in a series of actions that began in December 2025 that have expanded the scope and applicability of the Covered List.

The FCC now seeks comment on significant changes to its equipment authorization procedures that the agency contends would close additional “loopholes” and address certain vulnerabilities in the current regulatory framework that have implications for national security. Specifically, the Third Further Notice proposes, among other things, the following rule changes.

Codify the Interpretation of “Produced By” to Circumvent White Labeling. The FCC has long expressed concern regarding the authorization of privately labeled, rebranded, or relabeled (“white labeled”) covered equipment and made clear that white labeling of any covered equipment does not change the status of whether the equipment is covered equipment. To address those concerns the FCC previously clarified that applicants should take a broad view when interpreting whether equipment is “produced by” a specific entity identified on the Covered List. The FCC seeks comment on whether it should codify its interpretation that “a device is ‘produced by’ an entity if that entity exercises substantial responsibility for, or control over, any major stage of the process by which the device comes into existence, including the design, manufacturing, assembly, or development of the device. A device may be ‘produced by’ more than one entity.”

Deep Component Transparency: Submitting Hardware and Software Bill of Materials. While the FCC’s equipment authorization rules currently focus primarily on finished devices, the Third Further Notice seeks comment on whether it should expand its normal equipment authorization inquiry and dive deeper into the components of all devices for which equipment authorization is sought. Specifically, the FCC seeks comment on whether it should require all applicants for equipment authorization to submit a Hardware Bills of Materials (HBOM) and Software Bills of Materials (SBOM) at the time that they apply for certification. This would require entities to disclose all hardware, firmware and software components, including logic bearing hardware components such as modular transmitters and internet of things (IoT) modules, semiconductors and optical transceivers. It would also require the applicants to provide a list of all entities that produce the components within the device as well as locations of design, development, manufacture and assembly and the values attributable to each country of origin. Companies holding these authorizations would be required to keep them updated with any material changes.

Prohibiting the Authorization of All Software and Other Components Produced by Covered List Entities. The Commission previously has prohibited the authorization of any device that incorporates a modular transmitter when that modular transmitter is itself covered equipment, even where the host device is not otherwise produced by an entity identified on the Covered List. The Commission has also extended the prohibition to devices containing logic-bearing hardware components produced by Covered List entities. In the Third Further Notice, the FCC seeks comment on further expanding its prohibitions to prohibit the authorization of devices incorporating any components produced by a Covered List entity. This prohibition could include not only hardware components but also software and firmware produced or provided by a Covered List entity regardless of whether the entity that produces the host device is itself on the Covered List.

Requiring Equipment Authorization for Devices Subject to Production Location-Based Covered List Determinations. FCC equipment authorizations are required for the importation, marketing and sale of most radiofrequency (RF) devices. In general, intentional radiators (devices that deliberately transmit RF) must undergo Certification, whereas unintentional and incidental radiators (devices that only emit RF as a byproduct of their circuitry) can use the Supplier’s Declaration of Conformity (SDoC) process. The FCC also exempts certain equipment from its more formal authorization procedures and instead authorizes that equipment by rule.

In an effort to align its rules with those that are applicable to equipment produced by entities identified on the Covered List (e.g., Huawei), the FCC now proposes to require any device that is included on the Covered List pursuant to a production location-based determination (e.g., foreign-produced uncrewed aircraft systems (UAS), routers, power inverters, advanced robotic devices) to undergo full certification even if that device would normally be eligible for authorization pursuant to a SDoC or exempt from equipment authorization. The FCC also seeks comment on whether there are certain categories of equipment that should be exempt from this authorization process, such as where entities have met the Buy American standard or received a conditional approval that has essentially removed that equipment from the Covered List. The FCC broadly seeks comment on whether additional rule revisions are necessary to ensure that covered equipment cannot circumvent Covered List restrictions. For example, the FCC seeks comment on how devices in certain Covered List sectors (e.g., routers) that incorporate previously authorized non-“covered” modular transmitters may be able to avoid the equipment authorization process altogether by relying on the FCC IDs that have been granted to the modular transmitters.

Tightening the Importation Rules. The Commission’s rules currently set forth conditions that must be met before a RF device can be imported into the United States. However, noting that these rules do not distinguish between covered and non-covered equipment, the Third Further Notice seeks comment on revising its importation requirements such that the FCC will only permit the importation of covered equipment when such equipment meets one or more of the following conditions: (a) has a valid equipment authorization that has not been limited through the process set forth in § 2.939(e); (b) is being imported in a quantity of 40 or fewer units for testing and evaluation or product development, unless the Chief of OET grants written approval for a greater quantity; (c) is being imported solely for export; (d) is being imported for the exclusive use of the U.S. government; or (e) is being imported solely for the purpose of developing products to be marketed exclusively to the U.S. This proposal, as written, would greatly restrict the ability of an entity to import unauthorized equipment that is subject to the Covered List (e.g., advanced robotic devices).

Tightening Marketing Prohibitions. In the Third Further Notice, the FCC seeks comment on additional ways that it can restrict the marketing of devices that are on the Covered List. In particular, the FCC seeks comment on whether it should require online marketplaces to verify FCC IDs and SDoC compliance prior to offering the device for sale. The FCC also seeks comment on whether it should expand liability on online marketplaces where it is found that the marketplace has continued to sell unauthorized devices. In addition, the FCC seeks comment on whether authority to engage in marketing of RF devices without an authorization should expressly exclude RF devices that are covered equipment and on whether it should establish a rule that prohibits the marketing of covered equipment that was authorized prior to inclusion on the Covered List. Further, the FCC seeks comment on whether it should restrict individuals and entities from engaging in marketing activities that promote the ability to use a RF device subject to an FCC authorization for unlawful purposes or the ability of the end user to modify the device to operate at variance from its authorized parameters.

Tightening the Screws. The FCC seeks comment on several other changes to its equipment authorization rules aimed at increasing its visibility into the equipment marketplace, limiting the importation of unauthorized devices, and strengthening its enforcement authority, including seeking comment on:

• Bifurcating the rules to separate producer/provider determinations (e.g., Huawei) and production location-based determinations (e.g., foreign-produced UAS) on the Covered List to reflect that slightly different rules apply to each category and avoid confusion about the significance of each determination.
• Establishing term limits for equipment authorizations, which currently remain valid indefinitely unless withdrawn, revoked or terminated.
• Requiring that all devices authorized through the SDoC process be “registered” with the FCC with a unique identification number, which will be publicly displayed on an FCC website.
• Requiring entities to designate a U.S.-based liable party for all FCC certifications, which would be jointly and severally liable for any enforcement action against the certification holder. This could be the domestic importer of the device or a U.S. subsidiary.
• Codifying into the FCC’s rules a limited waiver it previously issued, which allows certain changes to equipment on the Covered List—namely, Class I and Class II permissive changes relating to software and firmware updates that mitigate harms to U.S. consumers.
• Replacing the legacy system for revoking equipment authorizations with a “streamlined” process for certain violations that would take as little as 10 days.

Conclusion. As the FCC continues to lean into the Covered List as its primary tool to secure U.S. networks and electronic devices, it is continuing to look for ways to eliminate loopholes and expand the scope and applicability of Covered List prohibitions. This Third Further Notice potentially foreshadows the agency’s future actions in this area, expanding the universe of companies impacted by the Covered List, and requiring those already subject to the rules to be even more vigilant in their compliance practices. Interested stakeholders may provide comments by September 8, 2026, and reply comments by September 21, 2026.