New Federal Communications Commission rules addressing national-security risks in the communications supply chain took effect on October 13, 2026. The rules expand equipment-authorization diligence to certain logic-bearing hardware components, tighten modification requirements for Covered List entities, and clarify that online marketplaces may be responsible for marketing unauthorized radiofrequency devices.
Component-Level Screening Is Now Required
The FCC now prohibits authorization of a device containing a logic-bearing hardware component produced by an entity identified on the Covered List when the finished device would itself have been prohibited if produced by that entity. The prohibition applies prospectively to new equipment-authorization applications and generally does not affect equipment previously authorized or applications pending on the effective date, unless a pending application is later amended to add, substitute, or change a covered component.
This change moves Covered List diligence below the finished-device level. Manufacturers and applicants should be able to identify the producers of relevant processors, integrated circuits, modules, subassemblies, storage components, and other logic-bearing hardware and document how they determined that a proposed device is eligible for authorization.
Online Marketplaces Face Direct Marketing Obligations
The FCC also clarified that its marketing rules reach online marketplaces that list regulated equipment while performing functions such as warehousing, inventory management, order processing, packaging, billing, or fulfillment. Marketplaces may therefore face enforcement exposure for unauthorized devices even when a third party is the seller.
Subject to exclusions for certain pre-existing listings, used devices, and lower-volume sellers, covered online listings must display a valid FCC ID at the point of sale. The FCC established phased compliance dates: March 1, 2027, for marketplaces that have physical access to or take title to a device, and June 1, 2027, for marketplaces relying on third-party seller certifications.
Modifications by Covered List Entities Require Full Certification
An entity identified on the Covered List must obtain full certification for a modification or permissive change to equipment, even if the equipment itself is not otherwise covered. The rules also confirm that previously authorized equipment cannot be modified in a way that would make it prohibited equipment.
What Businesses Should Do Now
- Update component and supplier diligence to identify the producer of logic-bearing hardware used in equipment submitted for FCC authorization.
- Review equipment-authorization representations, bills of materials, supplier certifications, and change-control procedures for consistency with the new component rule.
- For online sales, determine which listings require an FCC ID and whether the marketplace has physical access to, or takes title to, the device.
- Build toward the applicable March 1 or June 1, 2027 marketplace compliance date and preserve records supporting FCC ID validation and seller certifications.
- Require legal or compliance review before a Covered List entity supplies components for previously authorized equipment or before manufacturing changes could alter a device’s Covered List status.
The CommLaw Group Can Help
The CommLaw Group advises businesses on FCC equipment authorization, Covered List compliance, supply-chain diligence, importation, and online marketing requirements. For assistance evaluating these developments or strengthening compliance programs, please contact:
Brian Alexander | bal@commlawgroup.com
Diana James | daj@commlawgroup.com
Primary sources: FCC 26-50 | Federal Register notice