Key Takeaways
- • The FCC adopted a Third Report and Order on July 22, 2026, proposing sweeping expansions to Covered List equipment prohibitions, including requirements for Hardware Bills of Materials (HBOM) and Software Bills of Materials (SBOM) disclosures detailing component origins, suppliers, and country-of-origin valuations for all devices seeking equipment authorization.
- • The Commission seeks to prohibit authorization of any device incorporating any component produced by Covered List entities, expanding beyond current restrictions on modular transmitters and logic-bearing hardware to encompass software, firmware, and all component categories regardless of whether the host device manufacturer is itself on the Covered List.
- • New compliance obligations include mandatory designation of U.S.-based liable parties for all FCC certifications (jointly and severally liable for enforcement actions), registration requirements for SDoC-authorized equipment with unique FCC identification numbers, and term limits on equipment authorizations that currently remain valid indefinitely.
- • Importation and marketing restrictions would significantly narrow pathways for covered equipment entry into U.S. commerce, limiting imports to 40 units or fewer for testing (absent written approval), while requiring online marketplaces to verify FCC IDs and SDoC compliance prior to sale and restricting marketing of covered equipment authorized before Covered List inclusion.
- • Comment deadline is September 8, 2026, with reply comments due September 21, 2026—creating a compressed 14-day window for stakeholder feedback on proposals that substantially broaden FCC visibility into supply chains and enforcement authority over RF device markets.
Summary
The Federal Communications Commission's July 22, 2026 adoption of a Third Report and Order signals an aggressive regulatory posture designed to systematically close what the agency characterizes as "loopholes" in Covered List enforcement. The Third Further Notice of Proposed Rulemaking represents an escalation in the FCC's supply chain security strategy that began in December 2025 and extends far beyond traditional equipment authorization procedures. At its core, the proposal would require comprehensive transparency into device component sourcing through mandatory submission of Hardware and Software Bills of Materials, demanding disclosure of all hardware, firmware, and software components—including modular transmitters, IoT modules, semiconductors, and optical transceivers—along with the entities producing each component, locations of design and manufacturing, and valuation by country of origin.
The most consequential proposal targets component-level prohibitions. Rather than restricting only finished devices or specific component categories produced by Covered List entities, the FCC seeks comment on prohibiting authorization of any device incorporating any component produced by a Covered List entity, regardless of the host device manufacturer's status. This represents a categorical expansion with potentially severe consequences for equipment manufacturers reliant on global supply chains. The proposal would encompass not only hardware but also software and firmware, creating incentive structures for equipment designers to substitute suppliers entirely or restructure sourcing architecture to avoid any Covered List component integration.
Compliance infrastructure changes impose additional operational burdens. Entities must designate U.S.-based liable parties who become jointly and severally liable for FCC certification violations—effectively transferring enforcement risk to domestic representatives or subsidiaries. The FCC proposes establishing term limits for equipment authorizations (currently indefinite unless withdrawn or revoked) and requiring registration of all SDoC-authorized devices with publicly displayed unique FCC identification numbers, substantially increasing regulatory visibility into the device marketplace. Additionally, the Commission proposes establishing a "streamlined" equipment authorization revocation process for certain violations requiring as little as 10 days to execute.
Importation and marketing restrictions would effectively narrow legal pathways for covered equipment entry. Under the proposal, covered equipment imports would be permitted only under five conditions: valid authorization without limitations, testing in quantities of 40 units or fewer (absent written approval), export-only shipments, exclusive U.S. government use, or development for exclusive U.S. market sale. Online marketplaces face expanded verification obligations and potential expanded liability for selling unauthorized devices. The FCC also seeks comment on prohibiting marketing of covered equipment authorized prior to Covered List inclusion—a retroactive measure targeting previously compliant devices.
The FCC also proposes codifying its interpretation that equipment is "produced by" an entity if that entity exercises substantial responsibility or control over any major stage of device development, design, manufacturing, or assembly—directly addressing white-label and rebranding strategies. Equipment produced in locations designated on the Covered List (foreign-produced unmanned aircraft systems, routers, power inverters, advanced robotic devices) would require full FCC Certification rather than Supplier's Declaration of Conformity authorization, eliminating streamlined pathways previously available to such equipment.
The most consequential proposal targets component-level prohibitions. Rather than restricting only finished devices or specific component categories produced by Covered List entities, the FCC seeks comment on prohibiting authorization of any device incorporating any component produced by a Covered List entity, regardless of the host device manufacturer's status. This represents a categorical expansion with potentially severe consequences for equipment manufacturers reliant on global supply chains. The proposal would encompass not only hardware but also software and firmware, creating incentive structures for equipment designers to substitute suppliers entirely or restructure sourcing architecture to avoid any Covered List component integration.
Compliance infrastructure changes impose additional operational burdens. Entities must designate U.S.-based liable parties who become jointly and severally liable for FCC certification violations—effectively transferring enforcement risk to domestic representatives or subsidiaries. The FCC proposes establishing term limits for equipment authorizations (currently indefinite unless withdrawn or revoked) and requiring registration of all SDoC-authorized devices with publicly displayed unique FCC identification numbers, substantially increasing regulatory visibility into the device marketplace. Additionally, the Commission proposes establishing a "streamlined" equipment authorization revocation process for certain violations requiring as little as 10 days to execute.
Importation and marketing restrictions would effectively narrow legal pathways for covered equipment entry. Under the proposal, covered equipment imports would be permitted only under five conditions: valid authorization without limitations, testing in quantities of 40 units or fewer (absent written approval), export-only shipments, exclusive U.S. government use, or development for exclusive U.S. market sale. Online marketplaces face expanded verification obligations and potential expanded liability for selling unauthorized devices. The FCC also seeks comment on prohibiting marketing of covered equipment authorized prior to Covered List inclusion—a retroactive measure targeting previously compliant devices.
The FCC also proposes codifying its interpretation that equipment is "produced by" an entity if that entity exercises substantial responsibility or control over any major stage of device development, design, manufacturing, or assembly—directly addressing white-label and rebranding strategies. Equipment produced in locations designated on the Covered List (foreign-produced unmanned aircraft systems, routers, power inverters, advanced robotic devices) would require full FCC Certification rather than Supplier's Declaration of Conformity authorization, eliminating streamlined pathways previously available to such equipment.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.