The FCC Looks Inside the Box: New Rules for Components and Online Marketplaces

On July 22, 2026, the Federal Communications Commission (“FCC” or “Commission”) adopted a Third Report and Order (“Order”) and Third Further Notice of Proposed Rulemaking (“FNPRM”) in its long-running communications supply chain security proceeding, ET Docket No. 21-232 (FCC 26-50, released July 23, 2026). The item marks the most significant expansion of the FCC’s equipment authorization program since the Commission first implemented the Secure Equipment Act in 2022, and its message to the device industry is direct: it is no longer enough for the finished device to be “clean.” The components inside the box, and the online shopping cart from which the box is sold, are now squarely within the FCC’s reach.

Device manufacturers, component suppliers, importers, retailers, and online marketplaces should evaluate their compliance posture now. Several new obligations take effect within months, and the accompanying FNPRM proposes changes that would reshape the certification process itself.

1. Key Decisions in the Report and Order

• Component-level prohibition. The centerpiece of the Order closes what Chairman Carr called the “component part loophole.” Going forward, the FCC will not authorize any device that incorporates a “logic-bearing hardware component” produced by an entity on the Covered List (e.g., Huawei, ZTE, Hikvision, Dahua) if the device would have been prohibited had that entity produced the device itself. The new definition in Section 2.902 is drawn from the existing “digital device” definition in Section 15.3(k) and sweeps in essentially any “smart” component, in particular, integrated circuits, modules, and sub-assemblies using digital timing signals above 9,000 pulses per second or RF energy for data processing. The only substantive departure from the digital-device definition is that the new definition does not exclude intentional radiators. Purely mechanical or passive parts (housings, chassis, resistors, capacitors), simple battery cells, and bare motors are excluded, and the Commission delegated authority to the Office of Engineering and Technology (OET) to resolve classification questions.

  Notably, the Commission declined (for now) to ban all components from Covered List entities, components from foreign-adversary jurisdictions generally, or software/firmware components, citing an insufficient record — but those options are addressed in the Further Notice. The prohibition applies only to producer/provider-based Covered List entries, not to the newer production location-based entries for foreign-produced drones and routers (unless the producer is separately named on the List). The Order takes effect 30 days after Federal Register publication; pending applications are grandfathered unless amended to change a logic-bearing component.

• Online marketplaces “market” third-party listings. The Order clarifies that listing a regulated RF device on an online marketplace, when combined with fulfillment-type activities such as warehousing, consignment, order processing, labeling, packaging, or billing, constitutes “marketing” under Section 2.803, even when a third-party seller offers the product and holds title.

  Relying on Section 302 of the Communications Act and drawing an analogy to the Consumer Product Safety Commission’s 2024 Amazon decision, the FCC rejected retail-industry arguments that platforms not taking title fall outside “offer for sale.” Other objections based on Section 230 of the Communications Act and the First Amendment were also rejected. Carriers that merely transport devices without trading in them remain exempt under Section 302(c). The Commission declined to adopt a formal safe harbor but issued an enforcement-priorities statement: platforms exercising reasonable due diligence (consistent with the FCC’s “Operation Clean Carts” best practices) are unlikely to be enforcement targets, with priority given to knowing and willful violations, own-inventory listings, and covered equipment.

• FCC ID display at online point of sale. New Section 2.803(c) requires online marketplaces to display the FCC ID of certified devices at the point of sale. Responding to a wave of eleventh-hour industry advocacy (discussed below), the Commission substantially narrowed the rule from the draft. In particular, the Commission adopted a two-tier framework: (i) marketplaces selling their own devices or taking physical custody or title must display a valid and accurate FCC ID, and (ii) pure third-party platforms need only verify validity against the FCC’s Equipment Authorization System database and obtain a seller certification of accuracy. Existing listings are grandfathered until amended, updated, or republished (non-substantive changes such as pricing, translation, or page layout do not count); used devices are exempt; and no SDoC information need be displayed. A small-seller exemption covers listings by third-party sellers below the INFORM Consumers Act “high-volume” threshold (more than 200 sales/$5,000 gross revenue/24 months), but that exemption does not relieve a marketplace of its obligations for devices it sells itself or takes custody or title. The rule impacting third-party platforms takes effect six months after Federal Register publication.
• Modifications, recertification, and “critical infrastructure.” The Order prohibits modifying previously authorized equipment in ways that would render it covered equipment, confirms that “produced by” continues to be evaluated under a totality-of-the-circumstances test, and requires Covered List entities to obtain full certification for any modification, even to non-covered equipment. Existing OET waivers permitting security-related software and firmware updates to covered drones and routers (through January 1, 2029) remain in place.

  Finally, responding to the D.C. Circuit’s partial remand in Hikvision USA, Inc. v. FCC, the Commission adopted the Patriot Act’s definition of “critical infrastructure” (42 U.S.C. § 5195c(e)), guided by the 16 critical infrastructure sectors and 55 National Critical Functions, eliminating the “connected to” language the court found problematic and rejecting Hikvision’s proposed narrow asset list. The Commission estimates one-time implementation costs of no more than $300 million and recurring annual costs under $40 million, against security and economic benefits it values in the hundreds of millions annually.

2. The Further Notice: A Sweeping Modernization Agenda

The FNPRM spans roughly twenty topics that collectively signal where the equipment authorization program may be heading — and several proposals would fundamentally change what it takes to bring an RF device to the U.S. market.

• Supply chain transparency and white labeling. The Commission proposes to require every certification applicant to submit a hardware bill of materials (HBOM) and software bill of materials (SBOM) identifying each critical component’s producer, production locations, and the percentage of component value attributable to each, along with an ongoing obligation to update filings within 30 days of any material change. The FCC estimates compliance costs below $5,000 per device for SBOMs and $10,000 for HBOMs, and asks whether disclosure should be limited to Covered List sectors or critical components. Relatedly, the FNPRM targets white-labeling abuse: it proposes codifying the meaning of “produced by,” requiring disclosure of every entity involved in a device’s design, development, manufacture, or assembly, and dealing with “electrically identical” devices certified under multiple brand names.
• Broader component and software prohibitions. Having limited the new rules to logic-bearing hardware, the Commission asks whether to go further and prohibit (or adopt a rebuttable presumption against) authorization of devices containing any Covered List component, and whether to extend the prohibition to software and firmware produced by Covered List entities, invoking the Commerce Department’s Kaspersky precedent. The FCC preliminarily estimates industry-wide costs of roughly $50 million per year for the more extensive component ban.
• Mandatory certification and SDoC registration. The FNPRM proposes to require full certification, rather than the lighter-touch Supplier’s Declaration of Conformity (SDoC), for all devices within a “Covered List sector” (currently drones, UAS critical components, and consumer routers), closing what the Commission views as a modular-transmitter loophole. More broadly, it proposes a first-ever public registration system for SDoC devices, assigning each a unique identifier displayed on the device, in compliance statements, and in online listings.
• Codified definitions for drones and routers. Responding to numerous inquiries after the December 2025 (UAS) and March 2026 (routers) Covered List additions, the FCC proposes to codify “produced in a foreign country” (tentatively, any device that fails the “domestic end product” test in 48 C.F.R. § 25.101 and asks whether foreign design or development alone should suffice), the eight-category definition of “UAS critical components” (flight controllers, navigation systems, sensors and cameras, batteries, motors, and more), and the NIST-based definition of consumer-grade “routers,” including which devices (MiFi hotspots, residential gateways) are in and which (femtocells, ONTs, enterprise gear) are out.
• Enforcement and lifecycle reforms. The Commission proposes a streamlined revocation process, consisting of a written notice providing a 10-day response window, for authorizations involving willful misrepresentations, terminated Conditional Approvals, or covered equipment, replacing the lengthier radio-station-license revocation framework. It also seeks comment on term limits for equipment authorizations (asking whether a ten-year expiration is adequate), prohibiting misuse of the FCC logo on unauthorized devices and incidental radiators, and requiring a U.S.-based liable party for all FCC-certified equipment, citing repeated enforcement failures against foreign actors who supplied false U.S. agent information.
• Import, marketing, and operation. Proposed import reforms would substantially reduce the test-and-evaluation import allowance for covered equipment from 4,000 to 40 units, permit import solely for export or U.S. government use, and define “personal use.” On the marketing side, the FCC asks whether to close the small-seller and used-device gaps it just created in the Report and Order, prohibit marketing that promotes illegal device operation (targeting software-defined radios and amateur-band transmitters), and require a point-of-sale warning that licensed-use equipment may only be sold to FCC licensees.
• Codifying the update waivers and other items. The FNPRM proposes to make permanent the existing OET waivers allowing security-related software and firmware updates to already-authorized covered drones and routers, with defined limits for minor hardware component swaps. It also seeks comment on bifurcating the public Covered List into producer/provider-based and production location-based categories, modernizing the Equipment Authorization System database, narrowing submarine cable Covered List certifications to producer/provider-based entries, and clarifying that the Section 2.903 authorization prohibitions reach all equipment regardless of authorization pathway.

3. Late-Filed Comments Moved the Needle

An important feature of this Order is the impact of industry advocacy after the draft was publicly released. The Order expressly acknowledges that the Commission “made several edits to the public draft” in reply to these submissions, citing the ex parte filings from the Consumer Technology Association, CCIA, the National Retail Federation, and a joint retail-tech coalition including RILA, ITI, the PASS Coalition, Internet Works, and eBay (which noted that 40% of its sales involve used and refurbished goods).

Those filings produced six substantive changes to the FCC ID display rule: the grandfathering of existing listings, the small-seller and used-device exemptions, the two-tier liability structure, the elimination of mandatory SDoC display, the staggered compliance deadlines, and the enforcement-priorities framework keyed to the “Operation Clean Carts” best practices that CTA had urged. In short, the filings demonstrate an important lesson for parties in any FCC proceeding: focused, solution-oriented advocacy is demonstrably effective, even late in the process.

4. Three Practical Takeaways and Deadlines

Comments on the FNPRM are due 30 days after Federal Register publication, with replies due 15 days later. The component prohibition takes effect 30 days after publication; the FCC ID display requirements follow on the staggered timeline described above.

1. Map Your Supply Chain: Device makers should identify any Covered List-sourced logic-bearing components in their products now and begin preserving HBOM/SBOM-level visibility ahead of likely future disclosure requirements.
2. Build FCC ID Compliance Workflows: Online marketplaces should establish FCC ID verification and display processes against the compliance clocks, confirm the treatment of grandfathered and used-goods listings, and remember that the small-seller exemption does not reach a marketplace’s own-inventory obligations.
3. Weigh In Now: All stakeholders, especially importers and foreign grantees, should file comments in response to the FNPRM, which may impose significant new compliance costs across the device ecosystem.

The FCC has made clear that supply chain security now extends from the factory floor to the checkout page. Companies should review their product lines and online sales channels before the next round of proposals lands in their cart.