Key Takeaways
- • The FCC has expanded its supply chain ban to prohibit authorization of end products containing "logic-bearing hardware components" produced by entities on the Covered List, effective October 13, 2026, adopting a "trust starts in silicon" security framework that extends beyond radiofrequency equipment to include microprocessors, cellular chipsets, and IoT modules.
- • Online marketplaces offering fulfillment, warehousing, billing, or inventory management services are now subject to FCC enforcement for hosting third-party listings of unauthorized equipment, with FCC ID display requirements phased in by March 1, 2027 (Category 1) and June 1, 2027 (Category 2).
- • Entities on the Covered List must obtain full FCC recertification before making any modifications or permissive changes to equipment, with modifications defined broadly to include any change in design, circuitry, or construction of previously authorized devices.
- • The FCC has narrowed its "critical infrastructure" definition following a D.C. Circuit decision, aligning it strictly with the USA PATRIOT Act and Department of Homeland Security's National Critical Functions list, removing the prior expansion to include systems "connected to" critical infrastructure sectors.
- • The rules apply prospectively only; existing equipment authorizations and pending applications before the effective date remain valid, but new products or modified devices from Covered List entities will face significantly heightened authorization barriers.
Summary
On July 22, 2026, the FCC adopted a Third Report and Order advancing its supply chain security mandate under the Secure Networks Act and Secure Equipment Act. The order substantially broadens the regulatory perimeter for controlling equipment and services deemed to pose unacceptable national security risk, moving beyond previous entity-specific prohibitions to encompass component-level restrictions and e-commerce platform oversight.
The most consequential expansion addresses "logic-bearing hardware components" produced by Covered List entities. The FCC defines these components as any device generating and using timing signals at rates exceeding 9,000 cycles per second using digital techniques, or components generating radiofrequency energy for data processing functions. This encompasses microprocessors, cellular and Wi-Fi chipsets, Internet of Things modules, baseband processors, Trusted Platform Modules, optical transceivers, and motor controller boards—but explicitly excludes purely mechanical parts, passive electrical components, basic power cells without digital battery management, and bare motors lacking embedded controllers. The FCC's rationale emphasizes that even non-radiofrequency hardware can compromise system security, establishing a silicon-level security posture. This prohibition becomes effective October 13, 2026, and applies only prospectively; existing authorizations remain valid, and pending applications are grandfathered. Enforcement will initially rely on applicant attestation, though the FCC is soliciting comment on requiring hardware and software bills of materials in authorization applications.
The order significantly expands FCC jurisdiction over e-commerce platforms. Online marketplaces that host third-party device listings while providing consignment, warehousing, inventory management, order processing, billing, or fulfillment services are now subject to FCC enforcement and must verify equipment authorization compliance for all listings, including those from third-party sellers. The FCC declined to limit enforcement to willful violations, making compliance mandatory regardless of marketplace intent. Marketplaces are required to display valid FCC IDs at points of sale, with differentiated liability structures: Category 1 marketplaces with physical access or title assume full responsibility for FCC ID accuracy (effective March 1, 2027), while Category 2 marketplaces without physical possession need only display valid FCC IDs and take reasonable verification steps if third-party sellers certify accuracy (effective June 1, 2027). These requirements apply only to new listings and exclude small sellers and used device sales.
The order also tightens modification rules for Covered List entities. Any change in design, circuitry, or construction of previously authorized equipment now requires seeking new equipment authorization, closing loopholes that allowed iterative product updates under grandfathered approvals. Additionally, the FCC refined its "critical infrastructure" definition following a D.C. Circuit decision that vacated an earlier expansion. The revised definition aligns strictly with the USA PATRIOT Act and the Department of Homeland Security's list of 55 National Critical Functions, removing the prior "connected to" language that broadened scope beyond directly vital systems. This narrowing directly affects surveillance and telecommunications equipment from entities including Hikvision, Dahua, and Hytera, whose products remain on the Covered List primarily for use in critical infrastructure physical security applications.
These changes signal a fundamental shift in FCC regulatory strategy, transforming the equipment authorization process into a primary tool for supply chain security and domestic manufacturing promotion. Manufacturers, e-commerce operators, importers, and distributors across telecom, networking, surveillance, and IoT sectors must now navigate substantially more complex compliance frameworks or face supply chain disruption and enforcement penalties.
The most consequential expansion addresses "logic-bearing hardware components" produced by Covered List entities. The FCC defines these components as any device generating and using timing signals at rates exceeding 9,000 cycles per second using digital techniques, or components generating radiofrequency energy for data processing functions. This encompasses microprocessors, cellular and Wi-Fi chipsets, Internet of Things modules, baseband processors, Trusted Platform Modules, optical transceivers, and motor controller boards—but explicitly excludes purely mechanical parts, passive electrical components, basic power cells without digital battery management, and bare motors lacking embedded controllers. The FCC's rationale emphasizes that even non-radiofrequency hardware can compromise system security, establishing a silicon-level security posture. This prohibition becomes effective October 13, 2026, and applies only prospectively; existing authorizations remain valid, and pending applications are grandfathered. Enforcement will initially rely on applicant attestation, though the FCC is soliciting comment on requiring hardware and software bills of materials in authorization applications.
The order significantly expands FCC jurisdiction over e-commerce platforms. Online marketplaces that host third-party device listings while providing consignment, warehousing, inventory management, order processing, billing, or fulfillment services are now subject to FCC enforcement and must verify equipment authorization compliance for all listings, including those from third-party sellers. The FCC declined to limit enforcement to willful violations, making compliance mandatory regardless of marketplace intent. Marketplaces are required to display valid FCC IDs at points of sale, with differentiated liability structures: Category 1 marketplaces with physical access or title assume full responsibility for FCC ID accuracy (effective March 1, 2027), while Category 2 marketplaces without physical possession need only display valid FCC IDs and take reasonable verification steps if third-party sellers certify accuracy (effective June 1, 2027). These requirements apply only to new listings and exclude small sellers and used device sales.
The order also tightens modification rules for Covered List entities. Any change in design, circuitry, or construction of previously authorized equipment now requires seeking new equipment authorization, closing loopholes that allowed iterative product updates under grandfathered approvals. Additionally, the FCC refined its "critical infrastructure" definition following a D.C. Circuit decision that vacated an earlier expansion. The revised definition aligns strictly with the USA PATRIOT Act and the Department of Homeland Security's list of 55 National Critical Functions, removing the prior "connected to" language that broadened scope beyond directly vital systems. This narrowing directly affects surveillance and telecommunications equipment from entities including Hikvision, Dahua, and Hytera, whose products remain on the Covered List primarily for use in critical infrastructure physical security applications.
These changes signal a fundamental shift in FCC regulatory strategy, transforming the equipment authorization process into a primary tool for supply chain security and domestic manufacturing promotion. Manufacturers, e-commerce operators, importers, and distributors across telecom, networking, surveillance, and IoT sectors must now navigate substantially more complex compliance frameworks or face supply chain disruption and enforcement penalties.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.