Federal Communications Commission	DA 26-286

DA 26-286
Released:  March 23, 2026

OFFICE OF ENGINEERING AND TECHNOLOGY ANNOUNCES WAIVER OF PROHIBITIONS ON CERTAIN CLASS I PERMISSIVE CHANGES TO COVERED ROUTERS

ET Docket No. 21-232
The Federal Communications Commission’s Office of Engineering and Technology (OET) announces that certain prohibitions contained in 47 CFR §§ 2.932(b) and 2.1043(b) will not apply for now to certain routers.  All routers authorized for use in the United States may continue to receive software and firmware updates that mitigate harm to U.S. consumers at least until March 1, 2027.  These include all software and firmware updates to ensure the continued functionality of the devices, such as those that patch vulnerabilities and facilitate compatibility with different operating systems.
Background: On March 23, 2026, the FCC added to the Covered List “Routers produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS” For the current version of the Covered List and Conditional Approvals, see Federal Communications Commission, List of Equipment and Services Covered By Section 2 of The Secure Networks Act, https://www.fcc.gov/supplychain/coveredlist (last updated Mar. 17, 2026).  The term “Routers” is defined by National Institute of Standards and Technology Internal Report 8425A to include consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer.  Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems. 
 (Covered Routers).
On October 28, 2025, the Commission adopted revisions to its rules at 47 CFR §§ 2.932(b) and 2.1043(b), which went into effect in December 2025. Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program, 90 Fed. Reg. 53227 (Nov. 25, 2025).
  These revisions exclude “equipment prohibited from authorization pursuant to § 2.903”—equipment on the Covered List—from equipment certification procedures allowing for permissive changes to authorized equipment. 47 CFR §§ 2.932(b), 2.1043(b). 
  Such changes include Class I permissive changes, which generally do not require a filing with the Commission and may include software, firmware, and security updates to mitigate harm to U.S. consumers. See 47 CFR § 2.1043(b)(1) (“A Class I permissive change includes those modifications in the equipment which do not degrade the characteristics reported by the manufacturer and accepted by the Commission when certification is granted.”).
   
On January 21, 2026, OET announced a similar waiver of certain prohibitions contained in 47 CFR §§ 2.932(b) and 2.1043(b) for uncrewed aircraft systems (UAS) and UAS critical components produced in a foreign country, which were added to the Covered List on December 22, 2025.  The waiver permitted all UAS and UAS critical components authorized for use in the United States to continue to receive software and firmware updates that mitigate harm to U.S. consumers at least until January 1, 2027. Office of Engineering and Technology and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered UAS and UAS Critical Components, Public Notice, DA 26-69 (Jan. 21, 2026). 
  
Applying the revised 47 CFR §§ 2.932(b) and 2.1043(b) to the newly added Covered Routers would have the effect of prohibiting permissive changes to Covered Routers even if they were authorized prior to the March 23, 2026, Covered List addition.  This prohibition would be in effect even for Class I permissive changes—such as software and firmware security updates that mitigate harm to U.S. consumers—because previously-authorized Routers are now covered equipment.  
Legal Analysis: OET, under delegated authority, 47 CFR § 0.241(b).
 waives the applicability of the prohibitions against Class I permissive changes under 47 CFR §§ 2.932(b) and 2.1043(b) to software and firmware updates that mitigate harm to U.S. consumers for Routers authorized prior to the March 23, 2026, Covered List addition.  These include all software and firmware updates to ensure the continued functionality of the devices, such as those that patch vulnerabilities and facilitate compatibility with different operating systems.  OET finds that special circumstances warrant a deviation from the general rules and the public interest would be better served by waiving prohibitions on these Class I permissive changes in these circumstances. See 47 CFR § 1.3; see also Northeast Cellular Tel. Co. v. FCC, 897 F.2d 1164, 1166 (D.C. Cir. 1990); WAIT Radio v. FCC, 418 F.2d 1153, 1157 (D.C. Cir. 1969) (finding that the Commission may decide in some instances that waiver serves the public interest if it will not undermine the policy served by the rule). 
  
As OET concluded in January with respect to the December 22, 2025 Covered List update, this Covered List addition warrants a limited waiver of our rules.  For example, particular safety and security features regarding the continued operation of routers support a limited waiver to ensure that relevant updates can be made.  This delay will give the Commission an opportunity to consider the application of the Commission’s October 2025 Class I permissive change rule revisions to the new Covered List update.  The limited duration of this waiver also reduces potential harm to the public interest.  
Therefore, OET concludes that a limited waiver until March 1, 2027, is warranted and in the public interest.  March 1, 2027, is convenient because it is the date until which the recent DoW determination excepts certain otherwise Covered Routers.  Prior to March 1, 2027, the OET will re-evaluate whether to further extend applicability.
For further information, please contact Katherine Nevitt at 301-362-3017 and katherine.nevitt@fcc.gov. 
– FCC –

2