Federal Communications Commission	FCC-26-50

Before the
FEDERAL COMMUNICATIONS COMMISSION
WASHINGTON, D.C.  20554


In the Matter of

Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program

)
)
)
)
)


ET Docket No.  21-232


THIRD REPORT AND ORDER AND THIRD FURTHER NOTICE OF PROPOSED RULEMAKING

Adopted:  July 22, 2026	Released:  July 23, 2026

Comment Date: [30 days after date of publication in the Federal Register]
Reply Comment Date: [45 days after date of publication in the Federal Register]

By the Commission: Chairman Carr and Commissioner Trusty issuing separate statements.
TABLE OF CONTENTS
Heading	Paragraph #
I.	INTRODUCTION	1
II.	BACKGROUND	4
A.	The First Report and Order and Further Notice	4
B.	The Second Report and Order and Second Further Notice	7
C.	Covered List additions of equipment “produced in a foreign country”	9
III.	THIRD REPORT AND ORDER	13
A.	Logic-Bearing Hardware Components.	14
B.	Components Prohibitions Limited to Producer/Provider-Based Determinations	37
C.	Marketing	40
D.	Clarifications regarding Modifications Such that Previously-Authorized Equipment Would Become Covered	78
E.	Re-Certifications Required of Covered List Entities for Any Change to Equipment	84
F.	Definition of “Critical Infrastructure” as used in the Covered List	89
G.	Rule Correction and Clarification	96
H.	Regulatory Impact Analysis	98
IV.	THIRD FURTHER NOTICE OF PROPOSED RULEMAKING	128
A.	Bifurcating Covered List rules	129
B.	White Labeling	130
C.	Hardware and Software Bill of Materials	139
D.	Software and other Components produced by Covered List entities	147
E.	Requiring certification for devices in Covered List sectors	153
F.	Importation under 47 CFR § 2.1204	159
G.	Marketing under 47 CFR § 2.803	168
H.	Use of FCC Logo, 47 CFR § 2.1074	177
I.	Streamlined revocation, 47 CFR § 2.939	182
J.	Permitting permissive changes for basic software and hardware updates, even for “covered” equipment	187
K.	Operation of RF devices prior to equipment authorization	196
L.	UAS and Router Covered List definitions – “produced in a foreign country,” “UAS critical components,” “routers”	197
M.	Term limits on equipment authorizations	208
N.	Registration of SDoC devices	211
O.	Data Analytics Capability and need for modern EAS database	216
P.	Submarine Cables	217
Q.	Rule Clarification	223
R.	Universal Service Fund and Supply Chain Annual Report	225
S.	Impact on Other Service Provider Certifications	226
T.	U.S.-based Liable Party for FCC-certified equipment	227
V.	PROCEDURAL MATTERS	235
VI.	ORDERING CLAUSES	244
APPENDIX A – FINAL RULES
APPENDIX B – PROPOSED RULES
APPENDIX C – FINAL REGULATORY FLEXIBILITY ANALYSIS
APPENDIX D – INITIAL REGULAORY FLEXIBILITY ANALYSIS
I. INTRODUCTION
1. In this Third Report and Order, we take further steps to strengthen the Commission’s equipment authorization program against national security risks to the communications supply chain, building on the First Report and Order, Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program; Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232 and EA Docket 21-233, Report and Order, Order, and Further Notice of Proposed Rulemaking, 37 FCC Rcd 13493 (2022) (First Report and Order). 
 the Second Report and Order, Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Second Report and Order and Second Further Notice Of Proposed Rulemaking, 40 FCC Rcd 8430 (2025) (Second Report and Order). 
 and the recent updates to the Covered List addressing uncrewed aircraft systems (UAS), UAS critical components, and routers produced in a foreign country. Press Release, FCC, FCC Updates Covered List to Include Foreign-Made Consumer Routers, Prohibiting Approval of New Models (Mar. 23, 2026), https://docs.fcc.gov/public/attachments/DOC-420034A1.pdf; Press Release, FCC, Public Safety and Homeland Security Bureau Announces Addition of Uncrewed Aircraft Systems (UAS) and UAS Critical Components Produced Abroad, and Equipment and Services Listed in Section 1709 of the FY2025 NDAA, to FCC Covered List (Dec. 22, 2025), https://docs.fcc.gov/public/attachments/DA-25-1086A1.pdf.
 
2. The Third Report and Order closes the component part loophole by prohibiting authorization of devices incorporating logic-bearing hardware components if—had the entity produced the device itself—it would be prohibited from authorization.  It further requires that any modification or permissive changes by entities identified on the Covered List undergo full certification and clarifies that the marketing rules reach any entity—including ecommerce platforms—that market unauthorized equipment.  The Third Report and Order also requires such platforms, subject to limited exceptions, to provide an FCC ID at the online point of sale.  Finally, it amends our definition of “critical infrastructure,” as used on the Covered List.
3. The accompanying Third Further Notice of Proposed Rulemaking invites comment on a series of further measures, to include: bifurcating the Covered List into producer/provider-based and production location-based categories; enhancing supply chain transparency through software bill of materials (SBOM) and hardware bill of material (HBOM) disclosures; restricting certain importation pathways for covered equipment; strengthening post-market enforcement, including streamlined revocation procedures, term-limited equipment authorizations, and a U.S.-based liable party requirement; and requiring registration of equipment authorized through the Supplier’s Declaration of Conformity (SDoC) process.
II. BACKGROUND
A. The First Report and Order and Further Notice
4.  Pursuant to the Secure and Trusted Communications Networks Act (“Secure Networks Act”), the Commission publishes the Covered List, a list of equipment and services that have been specifically determined by enumerated sources to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons. Secure and Trusted Communications Networks Act of 2019, Pub. L. No. 116-124, 133 Stat. 158 (2020) (codified as amended at 47 U.S.C. §§ 1601-1609 (Secure Networks Act); 47 CFR §§ 1.50002, 1.50003.
  In June 2021, the FCC opened this proceeding and issued a Notice of Proposed Rulemaking (“NPRM”) that proposed banning the authorization of equipment on the Covered List.  In November 2021, while this proceeding was pending, Congress enacted the Secure Equipment Act of 2021, which identified this proceeding by docket number and directed the Commission to adopt rules prohibiting authorization of covered equipment. Secure Equipment Act of 2021, Pub. L. No. 117-55, 135 Stat. 423 (codified at 47 U.S.C. § 1601 note), available at https://www.congress.gov/bill/117th-congress/house-bill/3919/text. 

5. In 2022, the Commission issued the First Report and Order.  As mandated by Congress in the Secure Equipment Act, the Commission adopted rules to ban authorizations of covered equipment. Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Report and Order, Order, and Further Notice of Proposed Rulemaking, 37 FCC Rcd 13493, 13514 (2022) (First Report and Order). 
  The rules explicitly prohibited authorization of covered equipment through the FCC’s certification and SDoC procedures. 47 CFR §§ 2.903, 2.906(d). 
  The rules reformed the certification process by requiring any applicant for certification to attest that the equipment at issue was not covered equipment, attest to its status as an entity identified on the Covered List (including subsidiaries and affiliates), and designate a U.S.-based agent for service of process. 47 CFR §§ 2.911(d)(5)-(7).
  The First Report and Order made clear that equipment without an authorization due to its being on the Covered List could not be imported or marketed and could not avail itself of exemptions from equipment authorization requirements. First Report and Order, 37 FCC Rcd at 13529-30, paras. 87-91.
  It also adopted streamlined revocation procedures for authorized equipment for which an applicant submitted false attestations regarding the covered status of equipment. Id. at 13535-37, paras. 108-113.
  The First Report and Order identified as covered equipment subject to prohibition all telecommunications and video surveillance equipment produced by Huawei and ZTE (and subsidiaries and affiliates thereof), and all telecommunications and video surveillance equipment by Hikvision, Dahua, and Hytera to the extent that such equipment is used for “the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, or other national security purposes.” Id. at 13561-64, paras. 176-181.
  The First Report and Order also clarified that equipment on the Covered List included equipment produced by subsidiaries and affiliates of named entities. Id. at 13564-67, paras. 182-186.
  The Commission also adopted the First Further Notice seeking comment on proposals to expand the scope of prohibitions to include component parts, revoke existing equipment authorizations of covered equipment, and to impose greater accountability under U.S.  law on foreign-based grantees of equipment certifications. Id. at 13599-616, paras. 267-326.
 
6. Hikvision USA, Inc.  and Dahua Technology USA, Inc.  thereafter appealed certain aspects of the First Report and Order to the U.S.  Court of Appeals for the District of Columbia Circuit, which issued a partial remand. See generally Hikvision USA, Inc. v. Federal Communications Commission, 97 F.4th 938 (D.C. Cir. 2024) (Hikvision).
  Specifically, the court vacated one portion of the Commission’s decision defining “critical infrastructure” for purposes of understanding when video surveillance and telecommunications equipment produced by Hytera, Hikvision, and Dahua is used “for the purpose of … physical security surveillance of critical infrastructure,” statutory language drawn from Congress’s proscription regarding such equipment as set forth in section 889(f)(3) of the National Defense Authorization Act of 2019 (NDAA). Hikvision, 97 F.4th at 948-50.  See Pub. L. 115-232, § 889, 132 Stat. 1636, 1917-19 (2018) (2019 NDAA § 889).  
  The court found that the Commission’s definition of “critical infrastructure” was “unjustifiably broad,” and remanded those portions of the Equipment Authorization Security R&O to the Commission to “comport its definition and justification for it” with the NDAA statutory provision. Hikvision, 97 F.4th at 950.

B. The Second Report and Order and Second Further Notice
7.  In October 2025, the Commission adopted the Second Report and Order to strengthen the FCC’s equipment authorization program by closing loopholes that previously allowed devices or components that pose national security risk to enter the U.S.  market. Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Second Report and Order, and Second Further Notice of Proposed Rulemaking, 40 FCC Rcd 8430 (2025) (Second Report and Order).
  The Second Report and Order clarified that covered equipment includes modular transmitters, and it prohibited authorization of any device containing a modular transmitter that is itself covered equipment. Id. at 8436-46, paras. 14-31.
  It also established a new process to limit existing equipment authorizations by blocking further importation and marketing of already authorized covered equipment while allowing continued use, and it clarified key statutory terms such as “produced by” to ensure entities cannot evade Covered List restrictions through rebranding or partial manufacturing. Id. at 8447-58, paras. 32-53.
  The Order further barred modifications or permissive changes to covered equipment or previously authorized equipment that would become covered as a result of the modification or permissive change. Id. at 8447, paras. 54-55.

8. The Second Further Notice sought comment on additional measures to fortify the program, including whether to prohibit authorization of equipment containing other components, including any equipment that includes logic-bearing hardware components; Id. at 8459, paras. 58-66
 a refined definition of “critical infrastructure” following the D.C.  Circuit remand; Id. at 8463-68, paras. 68-80.
 and whether any modification made by an entity identified on the Covered List should always require full certification. Id. at 8468-69, paras. 81-83.
  The Second Further Notice also proposed expanded enforcement tools, such as clarifying what constitutes “marketing,” strengthening accountability across importers and distributors, and requiring online display of FCC IDs and periodic verification of authorization status to prevent unauthorized devices from entering or remaining in U.S.  commerce. Id. at 8469-72, paras. 84-93.

C. Covered List additions of equipment “produced in a foreign country” 
9.  Starting in December 2025, the Commission’s Public Safety and Homeland Security Bureau (PSHSB)—following specific determinations pursuant to the Secure Networks Act—updated the Covered List several times to identify categories of equipment produced in a foreign country.  These updates were the first instances of covered equipment and services being defined according to the production location of a class or sector of products and services, rather than in terms of the producer or provider of the equipment or services.  These determinations included all UAS, UAS critical components, and routers produced in a foreign country, subject to certain carveouts.  We refer to these determinations as production location-based determinations, as opposed to the producer/provider-based determinations that comprise the rest of the Covered List.
10. In December 2025, PSHSB made a two-part update to the Covered List in response to a national security determination made by an Executive Branch interagency body.  First, PSHSB added all UAS and UAS critical components produced in a foreign country to the Covered List. Public Safety and Homeland Security Bureau Announces Addition of Uncrewed Aircraft Systems (UAS) and UAS Critical Components Produced Abroad, and Equipment and Services Listed In Section 1709 of the FY2025 NDAA, to FCC Covered List, WC Docket No. 18-89, Public Notice, DA 25-1086 (Dec. 22, 2025) (First UAS Public Notice).
  This was the first production location-based determination added to the Covered List, as opposed to producer/provider-based determinations that comprised the rest of the Covered List.  Second, it added all communications and video surveillance equipment “listed in Section 1709(a)(1) of the FY25 National Defense Authorization Act” based on a more traditional producer/provider-based determination identifying the producers of communications and video surveillance equipment as included in the Executive Branch national security determination. Id. (citing Pub. L. 118-159).
  In January 2026, in response to further determinations by the Department of War (DoW), PSHSB removed certain UAS and UAS critical components from the Covered List temporarily through January 2027; the removals applied to equipment on the Defense Contract Management Agency’s (DCMA) Blue UAS Cleared List and to equipment qualifying as “domestic end products” under the Buy American standard. Public Safety and Homeland Security Bureau Announces Exemption of Certain Uncrewed Aircraft Systems (UAS) and UAS Critical Components from FCC Covered List, WC Docket No. 18-89, Public Notice, DA 26-22 (Jan. 7, 2026) (Second UAS Public Notice).
  PSHSB later removed specific models of covered UAS and UAS critical components from the Covered List pursuant to Conditional Approvals granted by DoW. See, e.g., Public Safety and Homeland Security Bureau Announces Conditional Approval of Certain Uncrewed Aircraft Systems (UAS) and UAS Critical Components and Exemption from FCC Covered List, WC Docket No. 18-89, Public Notice, DA 26-253 (Mar. 18, 2026) (SiFly Aviation, Mobilicom SkyHopper, ScoutDI, Verge Aero); FCC’s Public Safety and Homeland Security Bureau Announces Conditional Approval of Certain Routers and Uncrewed Aircraft Systems (UAS) and Exemption from FCC Covered List (Apr. 14, 2026) (sees.ai v. USA).  For a full list of the conditional approvals, see Federal Communications Commission, https://www.fcc.gov/supplychain/coveredlist#conditional-approvals (last visited June 26, 2026).
  These deadlines were later extended to January 1, 2028.
11. In March 2026, PSHSB added the second production location-based determination to the Covered List for “routers produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS.” FCC’s Public Safety and Homeland Security Bureau Announces Addition of Routers Produced in Foreign Countries to FCC Covered List, WC Docket No. 18-89, Public Notice, DA 26-278 (Mar. 23, 2026).
  It later removed specific models of covered routers from the Covered List pursuant to Conditional Approvals granted by DoW for limited time periods.  See, e.g., FCC’s Public Safety and Homeland Security Bureau Announces Conditional Approval of Certain Routers and Uncrewed Aircraft Systems (UAS) and Exemption from FCC Covered List, WC Docket No. 18-89, Public Notice, DA 26-351 (Apr. 14, 2026) (Netgear and Adtran routers); FCC’s Public Safety and Homeland Security Bureau Announces Conditional Approval of Certain Routers and Exemption from FCC Covered List, WC Docket No. 18-89, Public Notice, DA 26-390 (Apr. 22, 2026) (Amazon and eero routers). Federal Communications Commission, https://www.fcc.gov/supplychain/coveredlist#conditional-approvals (last visited June 26, 2026).

12. In response to the UAS and router class-based determinations, OET waived rules the Commission had adopted in the Second Report and Order that would have prohibited permissive changes to previously-authorized equipment, such as software and firmware security updates. Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered UAS and UAS Critical Components, ET Docket No. 21-232, Public Notice, DA 26-69 (Jan. 21, 2026); Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered Routers, ET Docket No. 21-232, Public Notice, DA 26-286 (Mar. 23, 2026).
  Without these waivers, previously-authorized UAS, UAS critical components, and routers produced in a foreign country would have become prohibited covered equipment after such permissive change under the rules adopted in the Second Report and Order.  These waivers, which now expire in 2029, currently allow such previously-authorized UAS, UAS critical components, and routers to continue to receive software and firmware security updates to mitigate harm to U.S.  consumers. Office of Engineering and Technology Announces Extension and Expansion of Waiver of Prohibitions on Certain Software and Firmware Permissive Changes to Certain Covered UAS, UAS Critical Components, and Routers, ET Docket No. 21-232, Public Notice, DA 26-454 (May 8, 2026). 
  Since May 2026, in response to petitions for waivers, OET has waived rules for one year to allow limited permissive hardware changes to previously-authorized consumer-grade routers to address unavoidable supply-chain shortages and the public interest need to prevent disruptions in the availability of broadband for customers. See, e.g., In the Matter of AT&T Services, Inc., ET Docket No. 21-232, Order, DA 26-491 (May 15, 2026); In the Matter of NCTA - The Internet & Television Association Petition for Expedited Waiver to Permit Targeted Class I and Class II Permissive Hardware Changes to Covered Routers, ET Docket No. 21-232, Order, DA 26-571 (rel. June 9, 2026) (NCTA Waiver Order); In the Matter of Sercomm Corporation; Petition for Expedited Waiver of Sections 2.932(b) and 2.1043(b) of the Commission’s Rules to Permit Targeted Class I and Class II Permissive Hardware Changes to Covered Routers, ET Docket No. 21-232, Order, DA 26-572 (rel. June 9, 2026).

III. THIRD REPORT AND ORDER
13.  In this Third Report and Order, we adopt rules that further strengthen the Commission’s equipment authorization program against national-security threats to the communications supply chain.  First, we close the component part loophole to our Covered List rules.  We find that devices containing logic-bearing hardware components produced by an entity identified on the Covered List pose similar unacceptable risks as covered equipment itself.   Therefore, we prohibit the authorization of logic-bearing hardware components produced by Covered List entities and devices containing such logic-bearing hardware components if—had the device itself been produced by the Covered List entity—the device would be prohibited.  Second, we clarify that the term “marketing” includes the activities engaged in by online marketplaces that list, distribute, or offer for sale equipment produced by third-party sellers, and we require online marketplaces to display the FCC ID of certified devices at the online point of sale. We recognize that Congress defined the term “online marketplace” in the Integrity, Notification, and Fairness in Online Retail Marketplaces for Consumers Act (INFORM Consumers Act), 15 U.S.C. § 45f(f)(4), a statute administered by the Federal Trade Commission. We adopt that definition here, but we do so as an independent exercise of our own authority under sections 4(i), 302(a), and 303 of the Communications Act of 1934, as amended, 47 U.S.C. §§ 154(i), 302a, 303, and the Secure Equipment Act of 2021, Pub. L. No. 117-55, 135 Stat. 423, and not in reliance on 15 U.S.C. § 45f, which confers no authority on this Commission. We find that aligning our terminology with the INFORM Consumers Act’s established definition serves the public interest by promoting regulatory consistency and reducing compliance burdens for the online marketplaces already subject to that definition under the FTC’s regime, while we retain the discretion to depart from that definition where the purposes of our equipment authorization program so require.
  Third, we clarify that previously authorized equipment may not be modified in a manner that would render it covered equipment and that the term “produced by” continues to be evaluated under the totality of the circumstances.  Fourth, we require that any modification or permissive change made by an entity identified on the Covered List undergo full certification, and we clarify that no such entity may rely on the SDoC process for any modification, whether to covered or non-covered equipment.  We also adopt a definition of “critical infrastructure” as used in the Covered List context.  Finally, we correct a cross-reference error in section 2.903 of our rules.
A. Logic-Bearing Hardware Components.
14. In the Second Report and Order, the Commission adopted rules extending its ban on authorizing covered equipment to also ban authorizing any device that contains a modular transmitter that is itself covered equipment. Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Second Report and Order and Second Further Notice of Proposed Rulemaking, FCC 25-71 (Second Report and Order), paras. 14-31.
  The Second Further Notice sought comment on whether this prohibition should extend to other component parts that, if included in another device, would cause the device to pose similar unacceptable risks to the national security of the United States or the safety and security of U.S.  persons as other equipment on the Covered List. Id at 8459, para. 59. 
  We further requested comment on which components produced by entities identified on the Covered List, should trigger authorization bans, how to identify such components with sufficient specificity, and the feasibility and cost of requiring detailed component reporting.  The Commission specifically sought comment on whether the Commission “should … prohibit authorization of equipment that includes component parts that are logic-bearing hardware, firmware, or software produced by entities identified on the Covered List.” Id at 8459, para. 59.
  This terminology was based on a Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector (Team Telecom) filing in another proceeding, which noted that national security concerns arise from “firms using logic-bearing hardware, firmware, or software … from high-risk providers identified by the United States government.” Id at 8459, para. 59, n. 216 (citing Review of International § 214 Authorizations to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Risks, IB 23-119, MB 23-134 at 6 (Aug. 31, 2023), https://www.fcc.gov/ecfs/document/10831697221812/2 (Team Telecom comment)).  Team Telecom often advises the Commission on national security threats from foreign involvement in the U.S. communications sector.  See generally, Executive Order 13913, “Establishing the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector,” (Apr. 4, 2020), https://www.federalregister.gov/documents/2020/04/08/2020-07530/establishing-the-committee-for-the-assessment-of-foreign-participation-in-the-united-states; https://docs.fcc.gov/public/attachments/FCC-20-133A1.pdf. 

15. The Commission also sought comment on broader proposals such as prohibiting equipment containing logic-bearing hardware components that are produced by any entity owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary, regardless of whether they are identified on the Covered List. Id at 8459, para. 64.
  This was an approach suggested by the Hudson Institute, which cited risks if devices contained such components produced by Covered List entities and/or entities owned by, controlled by, or subject to the jurisdiction. See Hudson ex parte in Second Report & Order and Further Notice of Proposed Rulemaking at 1-2.
  The Commission also asked for comments on appropriate transition periods and their impact on supply chains.  Finally, the Commission sought comment on expanding security investigations, or creating partnerships or trusted supplier programs, all while balancing national security protections with minimizing unnecessary market disruption.
16. We find that—from a technical perspective—devices incorporating logic-bearing hardware components produced by Covered List entities pose essentially the same unacceptable risks to the national security of the United States or the safety and security of United States persons as if the device itself were produced by that Covered List entity.  We therefore prohibit authorization of devices incorporating such logic-bearing hardware components if—had the Covered List entity produced the device itself, rather than just a component—the device would be prohibited from receiving authorization.
17. Some examples of the rules we adopt today include:
· Example (1) Under our current rules, if “Device X produced by Entity A” were on the Covered List, the Commission would cease authorizing any Device X produced by Entity A.  We now adopt rules to prohibit the authorization of Device X incorporating an Entity A-produced logic-bearing hardware component, no matter who produced the rest of Device X.
· Example (2) If “Service Y provided by Entity B” were on the Covered List, this would have no effect on the equipment authorization process under our current rules or the rules we adopt today.  
· Example (3) Under our current rules, if “Device Z produced by Entity C to the extent it is used for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes” were on the Covered List, the Commission would cease authorizing any Device Z produced by Entity C until Entity C submits—and gets approved—an FCC compliance plan.  After this, Entity C could get its devices authorized for non-covered use cases. Protecting Against National Security Threats to the Communications Supply Chain through the Equipment 
Authorization Program; Protecting Against National Security Threats to the Communications Supply Chain through 
the Equipment Authorization Program, ET Docket No. 21-232 and EA Docket 21-233, Report and Order and 
Further Notice of Proposed Rulemaking, 37 FCC Rcd 13493 (2022) (EA Security R&O and FNPRM), para. 180 (“Before any … ‘telecommunication equipment’ or ‘video surveillance equipment’” produced by entities whose equipment is subject to a use-based Covered List entry “will be authorized for market or sale, the applicant seeking approval of any ‘covered’ equipment produced by any of these entities (or their subsidiaries or affiliates) must submit a specific plan associated with the equipment, which will be reviewed by the full Commission and only approved if the measures that are and will be taken are sufficient to prevent the marketing and sale of such equipment for purposes prohibited under section 889(f)(3)(B) of the 2019 NDAA.)
  Under the rules we adopt today, the Commission would similarly cease authorizing any Device Z incorporating an Entity C-produced logic-bearing hardware component, no matter who produced the rest of Device Z, similarly contingent on approval of Entity C’s compliance plan.  After such approval, the Commission would authorize a Device Z incorporating an Entity C-produced logic-bearing hardware components for non-covered purposes.
18. Prohibiting the authorization of such devices is generally consistent with the Secure Networks Act and the Secure Equipment Act, It is also consistent with the Commission’s modular transmitter rules adopted last year in the Second EA Security R&O. 
 because it aims to prevent the same harm that Congress addressed in those Acts—the importation of devices the security of which has been compromised by Covered List entities.  Indeed, where a Covered List entity has produced an important component of equipment, that equipment can pose essentially the same risks that Congress was seeking to address when it directed the Commission to prohibit authorizing covered equipment in the Secure Equipment Act.  And logic-bearing hardware components, when produced by Covered List entities whose equipment has been determined to pose unacceptable national security or public safety risks, and included within a device, can, in addition to other threats, enable these entities to “access, store, disrupt, and/or misroute U.S.  communications,” unbeknownst to the user, China Telecom (Americas) Corporation, GN Docket No. 20-109, File Nos. ITC-214-20010613-00346, ITC-214-20020716-00371, ITC-T/C-20070725-00285, Order on Revocation and Termination, 36 FCC Rcd 15966, 15967, para. 2 (2021), aff’d, China Telecom (Ams.) Corp. v. FCC, 57 F.4th 256 (D.C. Cir. 2022).
 representing a national security risk.   
19. We have independent authority for this action under the Communications Act.  Section 302 of the Communications Act authorizes the Commission to regulate radio frequency devices “consistent with the public interest, convenience, and necessity.” 47 U.S.C. § 302a(a).
  It is well established that the public interest standard permits consideration of national security risks. See, e.g., Huawei Techs. USA, Inc. v. FCC, 2 F.4th 421, 439-40, 443-44 (5th Cir. 2021); China Telecom (Ams.) v. FCC, 57 F.4th 256, 261-62 (D.C. Cir. 2022); Pac. Networks Corp. v. FCC, 77 F.4th 1160, 1164-65 (D.C. Cir. 2023); China Unicom (Ams.) Ops. Ltd. v. FCC, 124 F.4th 1128, 1135, 1150, 1151-54 (9th Cir. 2024).
  Moreover, Section 303(g) directs the Commission—again, “as public convenience, interest, or necessity requires”—to “generally encourage the larger and more effective use of radio in the public interest.” 47 U.S.C. § 303(g).
 Section 303(r) confers associated rulemaking authority to “[m]ake such rules and regulations and prescribe such restrictions and conditions .  .  .  as may be necessary to carry out” the Commission’s assigned mission and responsibilities. Id. § 303(r); see also id. § 154(i).
  And Section 303(e) specifies that the Commission may “[r]egulate the kind of apparatus to be used” not only as to “the purity and sharpness of the emissions” but also as to “external effects” more broadly, Id. § 303(e).
 a phrase that readily encompasses national security-related effects.  Taking account of this authority, we find that an “effective” use of radio spectrum includes guarding against radiofrequency devices that have been deemed to pose an unacceptable threat to the national security of the United States (or that, in the case of the logic-bearing hardware components and devices here, would be the subject of a Covered List determination had the device itself been produced by the Covered List entity).  Prohibiting the authorization of such devices likewise serves “the purpose of the national defense” and “the purpose of promoting safety of life and property.” 47 U.S.C. § 151; see Huawei, 2 F.4th at 439; Pac. Networks, 77 F.4th at 1164-65.  The Communications Assistance for Law Enforcement Act (CALEA), Pub. L. No. 103-414, 108 Stat. 4279 (1994), buttresses our authority under the Communications Act. Section 105 of CALEA requires that telecommunications carriers “ensure that any interception of communications access or access to call-identifying information . . . can be activated only in accordance with a court order or other lawful authorization.” 47 U.S.C. § 1004.  And Section 301 directs the Commission to prescribe implementing rules “to require appropriate authorization to activate interception of communications” and “to prevent any such interception or access without such authorization.” 47 U.S.C. § 229(a)-(b).  Our equipment authorization rules, including the rule we adopt today, bear on carriers’ ability to meet their obligations under Section 105 by preventing authorization of equipment that could be connected to the carriers’ networks.
 
20. Given the lack of support in the current record, we do not adopt broader proposals to ban equipment authorizations for equipment incorporating components where there is not a nexus to a specific national security determination resulting in additions to the Covered List.  We do not, at this time, adopt proposals to ban components produced by any person controlled by or subject to the jurisdiction or direction of a foreign adversary, but we reserve the right to act in response to the record on this point in a future Report and Order in this proceeding.  
21. We further find that devices incorporating logic-bearing hardware components produced by Covered List entities pose the same or substantially similar “unacceptable risks” as devices produced by the Covered List entities themselves.  Therefore, if the Commission prohibits the authorization of certain equipment produced by Covered List entities, the Commission should similarly prohibit authorization of any equipment that contains Covered List entity-produced logic-bearing hardware components, whether by SDoC or by certification.
22. Several commenters supported adopting related prohibitions.  David Feith and Michael Sobolik, scholars at the Hudson Institute who filed in last year’s proceeding (Feith & Sobolik), expressly supported expanding restrictions to cover “risks posed by equipment containing logic-bearing components produced by Covered List entities.” Feith & Sobolik Comment at 1. 
  They note that logic-bearing hardware components, such as semiconductors, IoT modules, optical transceivers, and printed circuit boards, among other components can be exploited and argue that without such a restriction, Americans and American critical infrastructure would be “vulnerable to remote access, data collection, and exploitation.” Feith & Sobolik Comment at 2. 
 Chris McGuire similarly urges us to “prohibit authorization of any device that contains logic-bearing hardware—semiconductors, IoT and cellular modules, optical transceivers, baseband processors, and similar programmable components—produced by any entity on the Covered List.” Chris McGuire Comment at 2. 
  He notes that “[a] compromised semiconductor can subvert the entire device in which it is installed,” and that “[t]he national security risk posed by a Huawei chip embedded inside a device is the same risk posed by a Huawei device.” Id.
  Finally, he notes that Covered List entities are active in producing logic-bearing hardware components, making this risk manifest. Chris McGuire Comment at 3-5. 
  He urges us to go further by applying the prohibition not just to logic-bearing hardware, but also to logic-bearing software and firmware. Chris McGuire Comment at 2. 
  The Foundation for Defense of Democracies (FDD) urges us to go further yet and generally supports prohibiting the authorization of any device containing any component produced by Covered List entities and so necessarily supports this prohibition. FDD comments at 1-2. 
   Commenter Somos supports applying a prohibition on wireless chipsets, trust platform modules, cryptographic elements, and other connectivity-enabling components, which are all representative examples of logic-bearing hardware components, because these components directly impact the risk profile of the complete product. Somos Comment at 3. 
  Such components are quintessential examples of logic-bearing hardware (though of course not exhaustive).  
23. We prohibit authorization of devices that incorporate logic-bearing hardware components produced by an entity identified on the Covered List if—had the entity produced the device itself, rather than just a component—the device would be prohibited from receiving authorization under our current rules.   We agree with Team Telecom’s earlier comment that “foreign adversary influence on U.S.  communications networks” can flow from firms using “logic-bearing hardware…from high-risk providers identified by the United States government,” such as entities identified on the Covered List. Review of International § 214 Authorizations to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Risks, IB 23-119, MB 23-134 at 6 (Aug. 31, 2023), https://www.fcc.gov/ecfs/document/10831697221812/2 (Team Telecom comment).
  Although this comment was made in a different proceeding, as we often do, we defer to Team Telecom’s expertise in identifying national security risks. See Review of Submarine Cable Landing License Rules and Procedures to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Policy Risks; Amendment of the Schedule of Application Fees Set Forth in Sections 1.1102 through 1.1109 of the Commission’s Rules. OI Docket No. 24-523 and MD Docket No. 24-524, Report and Order and Further Notice of Proposed Rulemaking, FCC 24-82 (rel. Aug. 26, 2024), para. 145.

24. We also base our rule today on our own independent expert judgment as to how a device with a compromised logic-bearing hardware component can undermine the security of an entire device.  The principal that “trust starts in silicon” reflects the widely recognized role that hardware plays as a foundational element of system security upon which software protections depend. See E. Levine, The Die is Cast, ACM Queue (Jan. 2021), https://cacm.acm.org/practice/the-die-is-cast/; 2 Mohammad Tehranipoor & Farinaz Koushanfar, A Survey of Hardware Trojan Taxonomy and Detection, IEEE Design & Test of Computers (Jan./Feb. 2010), https://dl.acm.org/doi/10.1109/MDT.2010.7; Kaiyuan Yang et al., A2: Analog Malicious Hardware, Proc. 2016 IEEE Symposium on Security and Privacy (May 2016) (Best Paper), https://ieeexplore.ieee.org/document/7546493; Tim Willis, Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems, Google Project Zero (Mar. 16, 2023), https://projectzero.google/2023/03/multiple-internet-to-baseband-remote-rce.html;  ESET Research, LoJax: First UEFI Rootkit Found in the Wild (Sept. 27, 2018), https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/; see also Intel-SA-00086, Intel Management Engine Critical Firmware Update (Nov. 20, 2017), https://www.intel.com/content/www/us/en/support/articles/000025619/software.html; Defense Science Board, Task Force on High Performance Microchip Supply (Feb. 2005), https://dsb.cto.mil/wpcontent/uploads/reports/2000s/ADA435563.pdf; DARPA, Integrity and Reliability of Integrated Circuits (IRIS), https://www.darpa.mil/research/programs/integrity-and-reliability-of-integrated-circuits.
  From a technical perspective, communications equipment containing a logic-bearing hardware component produced by a Covered List entity may present supply-chain and cybersecurity risks comparable to those posed by covered communications equipment that as a whole is produced by a Covered List entity.  A Covered List entity that produces a semiconductor, for example, incorporated into communications equipment could potentially introduce malicious logic, firmware, hidden functionality or other compromised features into such components.  Depending on the component’s function, privileges, and integration into the device, such functionality may enable the interception, recording, modification, rerouting, or exfiltration of sensitive information.  Compromised logic-bearing hardware components may also facilitate sabotage, unauthorized access, or other malicious activity regardless of their visibility to end users or the branding of the final product.  In addition, supply chains controlled by Covered List entities may provide opportunities for persistent access, influence, or exploitation throughout the lifecycle of a device.  
25. These concerns are consistent with guidance from the National Institute of Standards and Technology (NIST), which recommends maintaining visibility into logic-bearing hardware components as part of a cybersecurity supply chain risk management program, including through the use of bills of materials that identify such components. NIST SP 800-161 at p. 224, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf (May 2022). 
  Certain logic-bearing hardware components can serve as, or materially affect, the root of trust because they operate at foundational layers of computing.  Where a security-critical hardware component is compromised, software-based security controls and encryption may be substantially undermined.  Moreover, standard cybersecurity defenses including antivirus software, firewalls, and Endpoint Detection and Response (EDR) tools are generally not designed to detect malicious logic or hardware-level backdoors embedded directly into silicon.  Unlike many software vulnerabilities, which can often be patched or otherwise remediated, malicious modifications at the hardware level in logic-bearing hardware components may persist throughout a device’s lifecycle and can be exceptionally difficult to detect, analyze, or remediate.  
26. Besides Team Telecom’s earlier comment, several other commenters in this proceeding support our decision.  As Chris McGuire notes, logic-bearing hardware components are not passive; each “executes its own firmware beneath the device’s operating system, the most privileged layer of the system.  A compromise at this layer is more powerful, more persistent, and harder to detect than a compromise at the application layer.” Chris McGuire Comment at 2.
  McGuire also identifies numerous security reports demonstrating the possibility of compromise at the logic-bearing hardware component layer—down to the chip level. Chris McGuire Comment at 2-3. 
  Most important for this rule, we agree with McGuire that “the party that compromises a chip need not be the company that assembles the finished device” as “[a] single actor anywhere in the design or fabrication chain can introduce the defect.” Chris McGuire Comment at 3. 
  We also agree with Feith & Sobolik that logic-bearing hardware components, electronic parts that process, store, and transmit data…can be embedded invisibly within larger systems, leaving end users unaware of their provenance even as they enable potential avenues of espionage or disruption.”  David Feith and Michael Sobolik Comment at 1 (paraphrased).  Feith & Sobolik further highlight that “[t]hese risks are particularly pronounced with data centers,” where logic-bearing hardware components pose acute risks.  Id. at 2. 

27. Somos does not specifically address logic-bearing hardware components, but Somos does advocate for component-based prohibitions on a sample of components that are representative of logic-bearing hardware components, namely, “communications modules, wireless chipsets, trust platform modules (“TPMs”), cryptographic elements, and other connectivity-enabling components.” Somos Comment at 3. 
  We believe that “connectivity-enabling components”  is well-captured by our term “logic-bearing hardware components,” because logic is embedded into the function of each these components. Somos also refers at one point to “any device incorporating components manufactured by entities on the Covered List,” which further suggests that Somos has a broad view of which components should be subject to the prohibition, rather than a specific subset of named components.  See Somos Comment at 3. 
  Communications modules require logic to process signals – to packetize, buffer, and arbitrate communications.  Wireless chipsets (Wi-Fi, Bluetooth, cellular) contain embedded processors and protocol stacks; they require logic to make decisions about frequency, power, and retransmission.  TPMs and cryptographic elements require logic because they provide entirely computational functions – such as key generation, signing, verification, entropy management.  Platform modules, such as baseboard management controllers and platform controllers, govern other controllers and require logic to do so.  These connectivity enabling components interpret signals and translate between protocols using logic.  We agree with Somos that such components are “integral to a device’s overall cybersecurity posture.” Somos Comment at 3.
  They contain logic that can carry firmware, keys, or hidden vulnerabilities or hardware-level backdoors.  We further agree that, “[b]ecause these components govern the transmission, security, and trust relationships of data moving into or out of a device, their integrity directly affects the risk profile of the complete product.” Id.
  Furthermore, we agree with FDD that adopting a broad prohibition is important, because in general, the Commission “should enact the broadest possible prohibitions” when it comes to foreign component parts, “to safeguard U.S.  national security.” FDD Comment at 1-2. 

28. We are mindful of several commenters who cautioned that the term “logic-bearing hardware” is vague and ill-defined. CTIA Comment at 14; CTA Comment at 6 (“[U]nclear component restrictions could slow product development cycles, increase manufacturing costs, and limit design options.”); See also ITI Comment at 4 (arguing that “[b]road categories like… ‘logic-bearing hardware,’ …are overbroad and unworkable.”). 
  For example, CTIA states that “logic-bearing hardware” “is simply not specific enough to allow affected parties to identify the equipment that would be prohibited from authorization.” CTIA Comment at 14; National Retail Federation, Retail Industry Leaders Association, ITI, The Coalition to Protect America’s Small Sellers Ex Parte at 13.
  Other commenters urge the Commission to codify “bright line rules clearly identifying components that are covered.” Garmin Comment at 5. 
  We also respond to concerns from commenters regarding the administration of component-level regulation by defining specific components which fall under the proposed rule. INCOMPAS Comment at 4-5; ITI Comment at 2; CTA Comment at 2.
 While we do not adopt a component-by-component approach, we do codify a detailed definition, to guide companies within the communications industry.  We  define logic-bearing hardware components to be any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques; inclusive of telephone equipment that uses digital techniques or any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer.  This definition provides a clear definition using language from our existing definition of “digital device” under section 15.3(k) of our rule.  The only substantial distinction between our definition and the longstanding digital device definition is that the logic-bearing hardware components definition does not exclude intentional radiators. See 47 C.F.R. 15.3(k). 
  Non-logic-bearing components would include, e.g.: (i) purely mechanical/structural parts (such as housings, chassis, brackets, fasteners, and enclosures); (ii) passive electrical/electronic parts that don’t generate or use digital timing signals (such as simple resistors, capacitors, inductors, wiring/cable, and connectors); (iii) basic power-only components that don’t themselves perform digital logic or RF data processing (such as a plain battery cell, as opposed to a battery management system which likely contains control logic and would qualify as a logic-bearing hardware component); and (iv) a bare motor with no embedded digital controller (as opposed to a motor controller/driver board, which would likely qualify as a logic-bearing hardware component).  The defining characteristic of non-logic-bearing components is that they are fixed, do not use digital techniques, and are non-programmable.  By drawing primarily from a well-understood definition, we reduce the risks of industry confusion.  We delegate to OET the authority to respond to questions as to what sort of components meet this definition and provide further clarifications.  

47 CFR 15.3(k) Digital device.  (Previously defined as a computing device)
[NEW] 47 CFR 2.902 Logic-bearing hardware component.
An unintentional radiator (device or system)
Any device, system, module, sub-assembly, integrated circuit, or other physical component
that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques;
that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques;
inclusive of telephone equipment that uses digital techniques
inclusive of telephone equipment that uses digital techniques
or any device or system 
or any device, system, module, sub-assembly, integrated circuit, or other physical component 
that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer.
that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer.


29. We reject several commenters’ arguments that we adopt a broader prohibition on all components produced by entities identified on the Covered List, rather than just those that are logic-bearing hardware components. See, FDD Comments; Somos, Inc. Comments at 2-3; Telit Cinterion at 2.
  For example, FDD urges the “Commission should prohibit the authorization of any equipment that contains any components produced by Covered entities “ FDD Comment at 1 (emphasis added). 
  While we agree, as we noted, with the spirit behind FDD’s comments that we “should enact the broadest possible prohibitions to safeguard U.S.  national security,” FDD Comment at 2.
 we believe that our limit to logic-bearing hardware is more consistent with the Commission’s underlying legal authority and national security goals.  Logic-bearing hardware components pose a higher risk to national security because the computational logic they are capable of performing allows them to execute instructions and decisions that can enable surveillance, disruption and sabotage; the logic components can also accept firmware updates and respond to remote signals and activate dormant code in the future.  We have also limited the prohibition to devices that operate above 9,000 pulses (cycles) per second, or 9kHz, which is the lowest frequency at which the Commission regulates spectrum for interference; this floor is consistent with our authority under Section 302 of the Communications Act to regulate the “interference potential of devices .  .  .  capable of emitting [RF] energy .  .  .  in sufficient degree to cause harmful interference.” 47 U.S.C. § 302a(a). 
  By contrast, some components are “dumb,” such as nails, paint, glue, or plastic structures, and pose no enhanced security concerns.  This prohibition also does not apply to devices that operate above 9kHz but do not use digital techniques or generate and use RF for the purpose of performing data processing functions.  Examples of devices not included in this prohibition would be fluorescent lights with electronic ballasts that run high-frequency oscillators above 9kHz to drive the lamp but do not have logic, or ultrasonic cleaners/ultrasonic transducers that oscillate above 9kHz but do not have logic.  
30. We also decline to adopt a prohibition on software or firmware components produced by entities identified on the Covered List, given the lack of support in the record and the challenges with enforcement and oversight.  For now, we limit our rule to hardware components, though we keep the record open on software and firmware components.  
31. Many commenters opposed applying Covered List prohibitions to individual components other than modular transmitters, which necessarily includes opposing the rules we adopt today. Garmin Comment at 4-8; ITI at 4; Sony at 2; USTelecom at 7; CTIA at 8-9.
  They opposed broad prohibitions because they could sweep in benign components, including those with no RF functionality, and argued that they would be technically impractical and administratively unmanageable. INCOMPAS Comment at 2; ITI Comment at 3; Hikvision Reply at 21.
  We have addressed these concerns by including in our definition of logic-bearing hardware component only those components within our statutory authority to regulate under the Communications Act. 47 U.S.C. 302a(a) (granting the Commission authority to regulate the “interference potential of devices which in their operation are capable of emitting radio frequency energy . . . in sufficient degree to cause harmful interference”). 
  Our definition includes only devices that generate and use RF energy operate above 9 kHz, a threshold that marks the lower boundary of the regulated spectrum, and devices operating above 9kHz implicate the spectrum interference concerns .  
32. Other comments opposed stating that some logic-bearing hardware components can perform various logical computing functions within a device, some of which may have nothing to do with the routing of user traffic. CTIA Comments at 13-14. 
  We reject those arguments.  Compromised logic-bearing hardware components may pose national security risks beyond the narrow situations envisioned by CTIA and other commenters.  A compromised encryption logic chip, for example, may not route or redirect user data or directly permit visibility into user data; that compromised logic may lie dormant and undiscovered for years before hidden logic is triggered and pose a national security risk.  Compromised logic can also cause a device to create power spikes or high-energy pulses that disrupt communications without routing data or eavesdropping user data; this can create national security risks beyond the narrow situations imagined by CTIA and other commenters.  Compromised logic embedded in hardware, such as routers and modems, can enable threat actors to erase all data and disrupt communications, as happened in recent cyberattacks attributed to nation state actors. Juan Andres Guerrero-Saade and Max van Amerongen, Sentinel Labs, AcidRain: A Modern Wiper Rains Down on Europe, https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/ (Mar. 31, 2022). 
  These comments did not address the other statutory prongs, including posing unacceptable national security risk; any one of these prongs would be a reason for inclusion on the Covered List. Id. at § 1601(b)(2)(A)-(C) (“[§ 1601(b)(2)(A)] . . . permitting visibility into any user data or packets that such equipment or service transmits or otherwise handles; or [§ 1601(b)(2)(B)] causing the network of a provider of advanced communications service to be disrupted remotely; or [§ 1601(b)(2)(C)] otherwise posing an unacceptable risk to the national security of the United States or the security and safety of United States persons.”) (emphasis added).
  We also reject arguments that supply chain provenance tracking would be unworkable. See, e.g., Hikvision Reply Comments at 15 (citing ITI, US Telecom, Garmin, CTIA comments). 
  Our prohibition here applies only to those logic-bearing hardware components produced by Covered List entities.  The compliance burden here would be consistent with the practices recommended by NIST in the Cybersecurity Supply Chain Risk Management Practices for Systems, which includes the use of bills of materials that identify logic-bearing hardware components.  The use of hardware bills of materials (HBOM) is common in modern supply-chain risk management practices. Somos, Inc at 6; see also Lucas Tate, et al., Comparing Bills of Material, Pacific Northwest National Laboratory (2024), https://arxiv.org/pdf/2411.10384 (“Recently, BOMs have been gaining traction as a tool to increase our supply chain understanding and help respond to this threat.”); Seth Carmody, et al., Building resilient medical technology supply chains with a software bill of materials, npj Digit. Med. 4, 34 (2021), https://doi.org/10.1038/s41746-021-00403-w (“An example of effective application of the SBOM concept comes from the financial services industry. By 2015, a series of software supply-chain vulnerabilities had forced the industry to re-evaluate the third-party software in its infrastructure. This sector quickly adopted SBOM concepts into their internal development and procurement processes. Now, if a vendor can provide an SBOM, it serves as a litmus test for the maturity of the vendor’s organization. If vendors lack an SBOM, many financial services organizations anticipate that their products will likely cost more to evaluate, operate, and own over their lifecycles. As a result, the financial organizations might negotiate discounts to account for these increased costs.”).  

33. We also reject certain commenters arguments that the Commission should adopt a more limited list of components or not adopt any further component restrictions at all. Commercial Drone Alliance Comments at 2-3, CTIA Comments at 8-12, NCTA Comments at 4-5, Garmin Comments at 4-8.
  We disagree with CTIA’s contention that we should limit ourselves to only those components that can “route or redirect user data traffic or permit visibility into any user data or packets,” as consistent with Section 8 of the National Defense Authorization Act of 2019 and the Secure Networks Act. CTIA Comment at 11-14. 
  For one thing, the Secure Networks Act does not limit additions to the Covered List to devices that pose specific national security risks concerning user data or packets, but also includes devices that “otherwise pos[e] an unacceptable risk to the national security of the United States or the safety and security of United States persons.” 47 U.S.C. 1601(b)(2)(C).
  For another thing, the Commission only applies the restrictions we adopt today to logic bearing hardware incorporated into communications equipment requiring FCC authorization.  This targeted addition responds to record suggestions to focus on components with direct impact on communications functions, which we find includes disruption and interference of communications as well as traditional espionage, surveillance, and interception concerns, while avoiding prohibitions on components further removed from Covered List determinations. CTIA Comment at 10; Motorola Comment at 5; Garmin Comment at 4.
  As we explain above, logic-bearing hardware components are not “components with no RF functionality” divorced from the national security determinations; See, ITI Comment at 3 (warning the Commission against this overbreadth); see also Sony Comment at 1. 
 a Covered List entity can compromise logic-bearing hardware inside communications equipment just as it can compromise a whole device.  including those with no RF functionality.  
34. Furthermore, we recognize that, as some commenters note, these prohibitions may impose compliance costs on device makers. US Telecom Comment at 5-6.
  However, we believe these costs are outweighed by the national security benefits of protecting the nation against devices that might pose “unacceptable risks to the national security of the United States or the safety and security of United States persons.” 47 U.S.C. § 1601(b), (c); EA Security 2d R&O at 45 (“[I]t is obvious and unarguable that no governmental interest is more compelling than the security of the Nation.”) (quoting Haig v. Agee, 433 U.S. 280, 307 (1981)). 
  Device makers that incorporate untrusted logic-bearing hardware components because they fail to maintain a supply chain risk management program with visibility into such components, including by using bills of materials, simply pass those costs onto the end users of the devices.  Those costs are not merely financial.  End users ultimately absorb the costs and risks created by device makers seeking to cut compliance costs.  End users must bear the risks of surveillance, data exfiltration, and disruption that can be created by compromised logic-bearing hardware components that end users have no ability to inspect or audit.  An end user purchasing a connected device has no visibility into whether its logic bearing components originate from untrusted entities named on the Covered List.  We believe the device maker that bears a one-time compliance cost to vet its supply chain is the more appropriate party to bear these costs, rather than placing the costs the downstream end user.  
35. We also believe that many of the commenters’ expressed legal and practical concerns with the breadth of the component part proposals in the FNPRM is alleviated by the fact that we decline at this time to take action on devices containing certain components produced by any entity owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary. David Feith and Michael Sobolik Comments at 2.
  There is minimal record evidence in support of such action, and the commenters made clear the enormous practical challenges with this proposal Commercial Drone Alliance Comments at 2-3, CTIA Comments at 8-12, NCTA Comments at 4-5, Garmin Comments at 4-8.
.  But we keep the record open on these points.   
36. One commenter urges the Commission to add to the Covered List all entities Congress identified in section 5949 of the FY2023 National Defense Authorization Act (NDAA) (all semiconductor producers subject to government procurement restrictions) just as the Covered List currently contain communications equipment and services contained in Section 889 of the FY 2019 NDAA. Chris McGuire Comment at 2, 6-9. 
  The Commission lacks the authority to add to the Covered List on its own initiative. 47 U.S.C. § 1601.
  However, we note that, pursuant to the rules we adopt today, if an enumerated source for making specific determinations for the Covered List 47 U.S.C. § 1601(c).
 makes a determination about communications equipment produced by entities identified in section 5949, the Commission would “prohibit authorization of any device containing their chips.” Chris McGuire Comment at 2. 
 
B. Components Prohibitions Limited to Producer/Provider-Based Determinations
37. We emphasize that the prohibitions recognized and adopted today apply only for logic-bearing hardware components produced by an entity identified on the Covered List.  They do not apply to components produced by entities that produce equipment subject to recent production location-based additions to the Covered List – such as components produced by entities that also produce UAS, UAS critical components, or routers in a foreign country – unless that entity is otherwise identified on the Covered List (for example, because they are identified in Section 1709 of the FY25 NDAA). See, List of Equipment and Services Covered by Section 2 of the Secure Networks Act, FCC.gov,  https://www.fcc.gov/supplychain/coveredlist (last visited May 20, 2026); FY25 NDAA § 1709, Pub. L. No. 118-159, 138 Stat. 1773, 2209–11 (to be codified as Note to 47 U.S.C. § 1601).
 
38. We further determine that this prohibition is effective 30 days after publication in the Federal Register, as the change only impacts new equipment authorizations.  We direct OET to advise Telecommunication Certification Bodies (TCBs) of this change.  This change is prospective, and does not affect previously authorized equipment, which may continue to be marketed, imported, and used pursuant to its existing authorization.  We find good cause to make this restriction effective 30 days after publication in the Federal Register, See, 5 U.S.C. § 553(d)(3).
 because devices containing these components may pose similar “unacceptable risks to the national security of the United States or the safety and security of United States persons” 47 U.S.C. § 1601(b)(1).
 that covered equipment does, which outweighs any temporary disruption.  This is similar to the approach we took in the First EA Security R&O, which adopted an immediate freeze on all authorizations for any device produced by Covered List entities, effective upon release of the Report & Order. EA Security First R&O at paras. 264-66.
  Furthermore, these entities have long been flagged as national security risks; responsible supply chain risk assessments should have identified and mitigated risks from these entities.  Finally, allowing for a lengthy transition period would allow device makers to flood the market with potentially compromised devices.
39. We exempt from the prohibition in § 2.903(b)(2) any application for equipment authorization (whether for certification or under the Supplier’s Declaration of Conformity process) that was filed with the Commission or a TCB before the effective date of this Order and remains pending as of that date.  We find good cause to exempt pending applications.  Unlike future filers, applicants with applications already in process prepared and filed their application under our pre-existing rules and might not be able to substitute a replacement component without effectively restarting the authorization process.  We find that the universe of applications that will be pending at the effective date of this Order is limited and does not present the same “flood the market” concern that justifies immediate, no-exception applicability to new filings.  We therefore conclude that permitting pending applications to proceed to a decision under the rules in effect at the time of filing appropriately balances the national security interests underlying this rule against the reliance interests of applicants who filed in good faith before this rule was adopted.  This exception does not apply to any pending application that is thereafter amended, after the effective date of this Order, to add, substitute, or change a logic-bearing hardware component; any such amendment shall be treated as a new application.  We direct OET to establish procedures for identifying and processing applications eligible for this exception.
C. Marketing
40. The Second Further Notice sought comment on how the Commission could strengthen its efforts to prevent unauthorized marketing of equipment. Second Further Notice, paras. 84-89. 
  After the comment period closed and the Commission publicly released a draft of this Order, several industry participants filed ex parte comments opposing some of the Commission’s marketing actions, particularly with respect to requiring online marketplaces to display the FCC ID at the online point of sale. CCIA Comment (July 14, 2026) (raising implementation concerns, seeking safe harbors, opposing mandates on SDoC display); CTA Comment (July 13, 2026) (raising Paperwork Reduction Act concerns, seeking two-year implementation delay, seeking safe harbors and FCC database modernization); NRF Abbreviated Comment (July 14, 2026) (raising implementation concerns over marketplace liability and FCC ID requirements, seeking good faith safe harbor); NRF, RILA, ITI, the PASS Coalition, and Internet Works Comment (“NRF Comment”) (July 15, 2026) (opposing proposals to extend marketing liability to online marketplaces, clarify scope of activities within marketing, and require display of FCC IDs on grounds that the record lacked support for such requirements, doing so would be arbitrary and capricious, the requirements exceeded the FCC’s statutory authority, or in the alternative, seeking 24 month implementation timeline); PASS Coalition Comment (July 15, 2026) (requesting “marketing” definition distinguish between fulfillment-based platforms that take physical custody of inventory and non-fulfillment platforms that provide third-party listing and do not take possession of goods sold, and requesting requirements be calibrated to exempt resold and refurbished goods from mandatory FCC ID display; providing safe harbors for good faith seller activity; an implementation timeline of at least one year); eBay Comment (July 16, 2026) (noting 40% of eBay sales involve used and refurbished goods, difficulties in displaying SDoC information, requesting 12-18 month implementation timeline, and a safe harbor for reasonable reliance on seller-provided information and prompt action in response to identified violation). 
  Upon consideration of these comments, and as explained below, the Commission made several edits to the public draft of the Order.  
1. Clarifying “distribution for the purpose of selling” as part of marketing
41.  In the Second Further Notice, the Commission sought comment on clarifying the term “distribution for the purpose of selling” as used in the definition of “marketing” under our rules. Second Further Notice, para. 89 (quoting 47 CFR § 2.803(a)) (“Marketing, as used in this section, includes sale or lease, or offering for sale or lease, including advertising for sale or lease, or importation, shipment, or distribution for the purpose of selling or leasing for sale or lease.”)). 
  We sought comment on whether activities typically engaged in by online marketplaces, such as consignment, warehousing, inventory management, order processing, labeling, packaging, billing, and other fulfillment services, individually or collectively, would constitute marketing activities under our rules. Id.
  We specifically sought comment on how the definition of “distribution” might affect various entities that are not themselves engaged in directly selling RF equipment but participate in the distribution of RF equipment. Id.
 
42. Commenter Sirius XM supported clarifying that activities typically engaged in by online marketplaces (e.g., consignment, warehousing, inventory management, order processing, labeling, packaging, billing, and other fulfillment services) are performed in connection with selling devices and constitute “distribution for the purpose of selling.” Sirius XM Comment at 2.
  Sirius XM supports clarifying that the definition of marketing is met when products are shown on online marketplaces, sold through platforms, or delivered to customers with the involvement of these platforms, and such online marketplaces should be held liable. Id.
  Sirius XM argues that the definition of marketing is met by online marketplaces that display devices, allow them to be purchased by clicking on the platform, or play a role in transferring possession of the device to customers, and supported holding those platforms liable for marketing.  In other words, these commenters propose that marketing occurs regardless of whether the online marketplace in question is marketing its own products or a third-party’s products.  
43. Hikvision USA opposes interpreting the scope of distribution in a way that includes intermediary transporters and warehouses, stating that section 302 of the Communications Act expressly exempts “carriers transporting such devices or home electronic equipment and systems without trading in them.” Hikvision Comments at 40 (quoting 47 U.S.C. § 302a(c)). 
  CTIA likewise cautions that “it is not clear that an entity that does not take title to a device could reasonably be held to be distributing a device for the purpose of selling that device as section 2.803 of the Commission’s rules requires, since an entity that does not have title to the device cannot itself sell the device. CTIA Comments at 24.
  Moreover, “a broad interpretation runs the risk of ensnaring logistics companies and shippers like FedEx or UPS, who are clearly not ‘marketing’ devices.” CTIA Comments at 24, n. 63. 
  Other commenters generally cautioned against an expansive interpretation of the definition of marketing, noting that such interpretations “could work a sea change in the way in which products are sold in the United States, and thus deserves careful consideration.” CTIA Comments 24; NTCA Comments at 6-7.
  These comments did not specifically address the indicia of distribution raised in the Second Further Notice (e.g., consignment, warehousing, inventory management, order processing, labeling, packaging, billing, and other fulfillment services); rather, they raised policy arguments against holding online marketplaces liable for marketing.  These comments are discussed in more detail in the section below (Section III.B.3) but are not relevant here as to the threshold definition of distribution under our rules.  Finally, NRF argues that neither the record nor the Commission’s authority would allow the Commission to adopt rules imposing FCC ID disclosure requirements on online marketplaces. NRF Comment. 

44. Discussion.  We have considered comments cautioning against any expansion in our interpretation of our marketing rules.  We agree with Hikvision USA and CTIA that a carrier transporting unauthorized devices without trading in them is outside the scope of section 302 of the Communications Act.  Section 302(c) of the Act provides, in relevant part, that the Commission’s equipment marketing rules “shall not be applicable to carriers transporting such devices or home electronic equipment and systems without trading in them….” 47 U.S.C. § 302a(c).
  We find that our marketing rules do not cover a carrier’s transport of unauthorized devices in isolation.  This conclusion does not, however, preclude enforcement against an online marketplace whose role in a transaction extends beyond mere carriage—including by listing on a website, warehousing, advertising, or processing payment.
45. We have also considered the comment from the National Retail Federation joined by member associations representing online marketplaces (NRF Comment) that the Commission exceeds its statutory authority under Section 302 of the Act because activities of online marketplaces that host third-party device listings -- but do not take title to devices -- are not a “sale” or “offer for sale.” NRF Comment at 9-12 (July 15, 2026). 
  We disagree.  Section 302 gives the Commission broad authority over RF devices.  Section 302(a) provides the Commission with authority to make reasonable regulations “consistent with the public interest, convenience, and necessity,” while the text of section 302(b) provides that:  “No person shall manufacture, import, sell, offer for sale, or ship devices . . . or use devices” unless they comply with FCC regulations. 47 U.S.C. § 302a(b) (emphasis added).
  Congress’s use of each of these terms in the statutory language suggests that it intended to give the Commission authority over each of these differentiated activities. Chickasaw Nation v. U.S., 534 U.S. 84, 93 (2001) (“The Court has often said that ‘every clause and word of a statute,’ should ‘if possible,’ be given ‘effect.’”). 
  This statutory text grants the Commission authority to prohibit unauthorized devices from entering the supply chain at any point—from the manufacturer, to the shipper, all the way to the ultimate end user using an unauthorized device.  The Commission exercised that broad authority to adopt its marketing rules, which mirror section 302 by encompassing the entire post-manufacture supply chain of RF equipment.  The term “offer for sale” cannot be interpreted as narrowly as NRF claims to include a carveout for online marketplaces simply because they do not take title to products. Section 302(b) of the Act cannot reasonably be read to place liability for unauthorized equipment at every point in the supply chain down to the customer using the device, while shielding from liability the online marketplaces that list, price, ship, and process payment for these devices simply because they do not take title to the device.  Under section 302, a customer who borrows an unauthorized device and uses it could be liable even if he does not hold title to it.  Section 302(b) also prohibits any person from shipping an unauthorized device; someone who ships an unauthorized device (as many online marketplaces do today) would still be liable under section 302 without taking title to it.
  
46. The legislative history of section 302 sheds further light on what the statute meant at the time of enactment.  Prior to enactment of section 302 in 1968, the Commission could only stop the use of unauthorized equipment under section 301 of the Act and had no authority to stop such equipment before it was put on the market. Regulation of Devices Capable of Causing Radio Interference, HR 14910, HR 9665, Hearing before the Subcommittee on Communications and Power of the Committee on Interstate and Foreign Commerce, H.Rep. 90-19 (Feb. 6, 1968).
  Congress noted concerns that “the users have purchased the equipment on the assumption that its operation would be legal,” but the Commission did not have enforcement authority upstream; “[t]he enforcement problem in this after-the-fact approach [targeting users] is tremendous.” Radio-Devices Interfering with Reception, S. Rep. No. 1276, 114 Cong. Rec. 2486, 2487-88 (1968).  
  In the legislative history, the Commission urged Congress to grant expanded enforcement authority against supply chain participants beyond the users. Id. at 2497-98, citing Letter from E. William Henry, Chairman, FCC to Jack Wayman, Director, Consumer Products Division, Electronics Industry Association, (June 9, 1965) (noting that “the purpose of the pending bills is to extend [the Commission’s] authority and thereby permit the Commission to apply its regulations directly to the manufacture and sale of the equipment…thus, the fundamental difference between the existing and the requested authority is to permit regulation of equipment…before this equipment is sold to the public”).  
  The Commission’s position today is the same as it was in 1968; liability for unauthorized equipment should not attach solely to the customer who purchases and uses it, but should also be placed with upstream suppliers to prevent unauthorized equipment from reaching the market in the first place.  
47. The plain text of the words “offer for sale” weighs against narrowing the meaning to include a title-transfer requirement as proposed by NRF.  Black’s Law Dictionary defines an “offer” as “[t]he act or an instance of presenting something for acceptance.” OFFER, Black’s Law Dictionary (12th ed. 2024).
  The Merriam-Webster Dictionary similarly defines to offer as “to present for acceptance or rejection,” Offer, Merriam-Webster.com, https://www.merriam-webster.com/dictionary/offer. 
 and “to sell” as “to give up (property) to another for something of value (such as money).” See Merriam-Webster.com, https://www.merriam-webster.com/dictionary/sell. 
  Neither definition limits an offer by requiring the offeror to have ownership or title.  An auctioneer, a consignment shop, a real estate agent, a short-seller on the stock market – each offers for sale goods or property without holding title. See, e.g., U.S. v. Naftalin, 441 U.S. 768, 773 (2011) (in the context of securities, “the term ‘sale’…shall include every contract of sale or disposition of a security or interest in a security, for value…the term…‘offer’ shall include every attempt or offer to dispose of…a security…for value”); 

48. We also consider the NRF’s references to several recent cases in which the Supreme Court declined to hold defendants liable for aiding and abetting a third party’s tort or crime. NRF Comment at 10-11, n.58 (citing Twitter, Inc. v. Taamneh, 598 U.S. 471, 503 (2023) (turning on what it means for a social media company to “aid and abet” terrorists)); id. at 11 n.59 (citing Cox Commc’ns, Inc. v. Sony Music Ent., 146 S. Ct. 959, 964 (2026) (interpreting copyright infringement as applied to Internet service providers)); id. at n. 60 (citing Cisco Sys. Inc. v. Doe I, 609 U.S. ___ , 146 S.Ct. 1882, 1888, 1892 (June 23, 2026) (no liability for aiding and abetting under the Alien Tort Statute); id. at n. 61 (citing Smith & Wesson Brands, Inc. v. Estados Unidos Mexicanos, 605 U.S. 280, 297 (2025) (addressing aiding and abetting liability of sellers of firearms under the Protection of Lawful Commerce in Arms Act) and Hikma Pharms. USA Inc. v. Amarin Pharma, Inc., 146 S. Ct. 1391, 1402 (2026) (rejecting patent infringement claims). 
  These cases are not applicable here.  None of these cases address an agency’s authority to impose direct regulatory obligations on a commercial actor for its own conduct—the listing, billing, and shipping that an online marketplace performs itself.  
49. Having explained our statutory authority under Section 302 of the Act, we now turn to interpreting the definition of “marketing” under section 2.803(a) of our rules, explaining our existing regulatory authority over online marketplaces, including those hosting third-party listings.  As in our interpretation of the statute, the Commission clarifies that online marketplaces that list third-party products on their platforms are engaged in marketing because they are engaged in “offering for sale” under our marketing rules. 47 CFR § 2.803(a). 
  Of course, online marketplaces also frequently also engage in “advertising for sale” of third-party products, and sell keyword search terms funneling customers toward these products, which also expressly brings them within our existing marketing rules. See, 47 CFR § 2.803(a).
  
50. We further find that the term “distribution for the purpose of selling” encompasses the listing of regulated equipment on an online marketplaces, in combination with any of the following activities: consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfilment services – even if that equipment is sold or offered for sale by a third-party seller.  An analogous statute, the Consumer Product Safety Act, has long provided that, “[t]he terms ‘to distribute in commerce’ and ‘distribution in commerce’ mean to sell in commerce, to introduce or deliver for introduction into commerce, or to hold for sale or distribution after introduction into commerce.” 15 U.S.C § 2052(a)(7).
  The Consumer Product Safety Commission (CPSC) unanimously interpreted the plain meaning of “distribution in commerce” to cover many of the same activities on which we sought comment on in the Second Further Notice when performed by online marketplaces. Amazon.com, Inc., CPSC Docket No. 21-2, Decision and Order (July 29, 2024), available at https://www.cpsc.gov/s3fs-public/pdfs/recall/lawsuits/abc/142%20-%20In%20the%20Matter%20of%20Amazon.com%20Inc.%20Decision%20and%20Order.pdf (finding Amazon’s online marketplace activities qualified as “distribution in commerce”) [https://perma.cc/U3QQ-4QAS].  Amazon has challenged the CPSC interpretation. Amazon.com, Inc. v. CPSC, No. 25-cv-853 (D. Md. filed Mar. 14, 2025).  
  For example, the CPSC found that activities such as consignment, CPSC Order at 28 (“Fulfilled by Amazon participants send their products to Amazon, not directly to customers who order through Amazon.com, with the intention and expectation that they will be sold to end customers.”).
 warehousing, Id. (“Amazon stores the Fulfilled by Amazon products in its fulfillment centers until a customer purchases the product on Amazon.com, at which point Amazon fulfills the order and ships the product to the customer . . . Fulfilled by Amazon participants pay Amazon monthly and long-term storage fees for Amazon to store their products in its fulfillment centers.”).
 inventory management, order processing, labelling, packaging, billing, and other fulfilment services Id. (“If Amazon does not hold the product (e.g., it is out of stock), customers cannot complete the transaction, indicating that Amazon must have the product in its warehouse—to hold for sale—before the sales transaction can occur.”).
 constituted “distribution in commerce” when performed by an online marketplaces in connection with sales of defective products on its website.  Like section 302(c) of the Communications Act, the Consumer Product Safety Act exempts carriers who act “solely by reason of receiving or transporting a consumer product in the ordinary course of business as such a [common] carrier or [freight] forwarder.” 15 U.S.C. § 2052(b) (emphasis added).  
  Therefore, we find that the plain meaning of the term “distribution for the purpose of selling” includes the listing of regulated equipment on an online marketplace, in combination with consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfilment services.  We further find that the carveout in Section 302(c) for carriers transporting devices does not exempt online marketplaces involved in the ultimate sale of such devices.  While we find the CPSC’s construction of the analogous term “distribution in commerce” instructive, our holding does not depend on it.  We conclude that the best reading of “distribution for the purpose of selling” in our rules, and of the underlying statutory authority in Section 302(b), independently reaches the fulfillment activities described above. 47 CFR § 2.803(a); 47 U.S.C. § 302a(b).

51. We therefore amend section 2.803(a) of our rules to clarify that entities are engaged in “marketing” when they list equipment on an online marketplace, in combination with any of the following activities: consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfilment services – even if that equipment is sold or offered for sale by a third-party seller.  
2. Online marketplaces that “market” unauthorized devices are subject to enforcement
52. The Second Further Notice sought comment on steps to strengthen the Commission’s ability to enforce its marketing rules, and ensure more accountability among resellers or drop shippers of covered equipment for compliance with the marketing rules. Second Further Notice at para. 85. 
  We also sought comment on additional obligations that should be imposed on retailers, sellers, and re-sellers, e-commerce websites, distributors, or advertisers to ensure that the public is aware of the authorization status of RF equipment. Id. at para. 91.
  We noted that while we have not previously focused past enforcement efforts on commercial consignees, the Commission tentatively concluded that “retailers and commercial consignees are typically better equipped to verify equipment compliance than consumers who might mistakenly assume that a marketed product is compliant.” Id. at para. 88.
 
53. Sirius XM strongly supports clarifying that e-commerce platforms are subject to the marketing rules, and bear responsibility for:
ensuring that all products shown on their platforms, sold through their platforms, or delivered to consumers with the involvement of their platforms .  .  .  are in fact FCC certified.  .  .  If a device subject to FCC requirements is displayed on an e-commerce platform, purchased by clicking on the platform, or if the platform plays a role in transferring possession of the device to customers, then the platform must bear responsibility for verifying the FCC certification and labeling of that device.”  Sirius XM Comment at 2.
 
54. CTA notes that retailers, platforms, and other service providers generally do not have access to regulatory authorization or compliance records held by manufacturers. CTA Comment at 11
  NTCA noted similar concerns about the burdens on retailers. NTCA Comment at 7 (similar concerns);
  The Center for Regulatory Freedom (CRF) likewise opposed holding liable resellers and distributors, who may lack technical awareness or practical control over equipment design or sourcing, and proposed that marketing or distribution liability definitions be tethered to actual knowledge, intent, knowledge and control. Center for Regulatory Freedom (CRF) Comments at 9.

55. Discussion: We find that online marketplaces, to the extent they market unauthorized devices, are subject to enforcement of our marketing rules.  Section 302 of the Communications Act unambiguously prohibits a “person” from selling, offering for sale, or shipping devices that do not comply with our rules governing equipment, without regard to whether the person is a manufacturer of such equipment, an online marketplace, or other such person. 47 U.S.C. § 302a(b).
  
56. We have considered and decline to adopt proposals to limit marketing liability to those bad actors who willfully or intentionally violate the marketing rules.  We note that there is no willfulness or intent element of the prohibited activities in our marketing rules or in Section 302(b) of the Communications Act. See, 47 U.S.C. § 302a(b).  Though even an incidental infraction of the equipment marketing rules may create liability, the Commission will fully consider in determining any forfeiture liability the circumstances attendant to a particular violation, including the extent to which an entity intentionally violates the rules, pleads willful ignorance, or implements robust best practices to strengthen its compliance regime.  See, 47 CFR § 1.80(b)(11) (citing degree of culpability and other factors considered when determining the amount of a forfeiture liability). .  Moreover, the Act’s enforcement provisions provide for enforcement of the Commission’s rules against entities that hold no FCC authorizations so long as the Commission sends a citation of the violation and an opportunity to cease the activity before serving a Notice of Apparent Liability.  See, 47 U.S.C. § 503(b)(5).
  
57. We have also considered downstream supply chain participants (retailers, resellers, distributors, e-commerce platforms), which might not have the same level of access to technical compliance information that a manufacturer or designer may have, and decline to exempt these entities from enforcement.  While commenters noted that online marketplaces might struggle to verify equipment compliance, Consumer Technology Association Comments at 8-9; CTIA Comments at 18. 
 no commenter disputed the tentative conclusion in the Second Further Notice that online marketplaces are typically better able to verify equipment compliance than consumers.  Online marketplaces have greater resources than consumers do to access compliance resources such as the Commission’s equipment authorization websites, as well as commercially available supply chain databases.  Online marketers have front-end access to search the Commission’s public available Equipment Authorization System database; they also have back-end access to Application Programming Interfaces (APIs) to verify FCC IDs. Office of Engineering and Technology, Federal Communications Commission, EAS Web API Services (describing the GetFCCIDList API), 2026, https://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?id=50070&switch=P.
  They can confirm which devices have valid authorizations or FCC IDs because the Commission’s rules require FCC IDs to be displayable via a physical label, e-label, or on the packaging/manual.  They can also require proof of regulatory compliance (including SDoC authorizations) in their commercial agreements with suppliers and otherwise have a greater ability to negotiate with upstream suppliers than consumers.  Expressly exempting online marketplaces from any marketing liability would allow them to receive the benefits, and profits, of marketing unauthorized equipment while passing all the costs on to consumers.  Those costs to consumers are real; consumers must bear the risk of unknowingly purchasing unauthorized equipment that may not be legally used in the U.S., emits harmful or disruptive interference or, by virtue of being on the Covered List, poses “unacceptable risk to the safety and security of United States persons.” 47 U.S.C. § 1601(b)(2)(C); 47 CFR § 1.50002(b)(2)(iii).
  Placing liability on online marketplaces that market unauthorized equipment  ensures that these participants in the supply chain are incentivized to safeguard consumers.
58. We have considered the ex parte comments that have claimed the impossibility of verifying compliance.  The NRF Comment stated that platforms “do not have a meaningful way to confidently assess FCC rule compliance for millions of products.” NRF Comment at 6, 8. 
  Despite claiming that their members cannot verify compliance, the NRF Comment also stated that the Commission has seen success with voluntary initiatives, making mandatory requirements unnecessary.  As evidence, the NRF Comment noted that “Operation Clean Carts has removed millions of illegal-device listings from the Internet” over six months. NRF Comment at 7 (emphasis in the original).
  The NRF Commenters’ claim that their members are unable to achieve compliance is undermined by the fact that their members voluntarily verified and removed three million listings in six months.  Furthermore, the NRF Commenters do not provide any explanation for why online marketplaces, given compliance challenges, should be exempt from liability for marketing unauthorized products if brick-and-mortar stores and friends selling products to other friends are theoretically liable under the FCC’s marketing rules, let alone individual operators of a device under related rules. 47 CFR § 2.805(a). 

59.  We have also considered ex parte concerns about the current state of the Commission’s Equipment Authorization System (EAS), a public database containing FCC IDs of certified equipment and other information, The Equipment Authorization Search database is located at https://apps.fcc.gov/oetcf/eas/reports/GenericSearch.cfm.
 and the feasibility of using it to verify compliance at scale.  As CCIA notes, although a marketplace can confirm that an FCC ID exists, it cannot reliably determine whether that FCC ID corresponds to the product actually being listed in a scalable manner, and notes that the interface lacks bulk-access, reverse-lookup, and change-notification capabilities necessary for automated catalog-wide compliance. CCIA Comment at 3.
  We note that EAS does provide a working FCC ID API that would allow an online marketplace to validate current FCC IDs. The GetFCCIDList API is available today, and can be used to verify the validity of a specific FCC ID or a range of FCC IDs under a grantee code.  See, e.g., https://apps.fcc.gov/OETLabServices/getFCCIDList?fccId=QIS (verifying FCC IDs under grantee code for Huawei).  The NRF Comment claimed that its members frequently encounter website errors and “401” authorization errors.  NRF Comment at 8.  Such errors may be due to common security measures such as rate-limiting and other anti-scraping techniques.  While the API is reachable from home and office networks, it may be blocked from commercial data centers used by AI tools and common scraping services.  Legitimate highvolume API users may request approval for their IP addresses to be added to the FCC’s allowlist.
  We acknowledge the limits of the current available tools to help online marketplaces achieve compliance, including requirements to ensure that FCC IDs are not only valid but are accurate and match the product listings of the marketed equipment.  
60. We have responded to these concerns by making reasonable edits below to the specific FCC ID display requirements below.  We further direct OET to work with the Enforcement Bureau (EB) and the Office of the Chief Information Officer (OCIO) as appropriate to modernize and update EAS as expeditiously as possible.  We also direct OET to engage with online marketplaces to address technical improvements and updates related to the equipment authorization database, available APIs, and machinereadable data resources that support compliance monitoring and help prevent unauthorized marketing.  These discussions should include proposals to resolve challenges on both sides regarding access to and exchange of data, including: (1) antiscraping and ratelimiting measures implemented by the FCC that currently restrict highvolume access to the EAS API by online marketplaces; and (2) antiscraping and ratelimiting measures employed by online marketplaces that impede the FCC’s ability to surveil these platforms for law enforcement purposes to identify unlawful marketing of unauthorized equipment.  
61. We have also considered ex parte comments requesting some sort of safe harbor or knowledge requirement for the imposition of liability for online marketplace marketing. See, e.g., PASS Coalition Comment at 3.
  We do not accept these requests.  The Commission has not expressly exempted any category of persons from compliance with Commission marketing rules, nor has the Commission adopted a safe harbor or knowledge requirement previously.  However, the Commission does clarify that the Commission is unlikely to pursue enforcement action against an online marketplace that undertakes reasonable due diligence to verify the device being offered for sale may be validly marketed under section 2.803(a), even where an isolated or inadvertent listing error occurs.  What constitutes reasonable due diligence will depend on the facts and circumstances, including the marketplace’s size, resources, and role in the transaction.  However, the Commission is likely to look to the best practices identified through the Commission’s “Operation Clean Carts” initiative, such as: implementing automated or systematic controls to screen listings for a valid FCC ID or SDoC compliance information before or shortly after publication; cross-referencing seller-provided authorization information against the Commission’s Equipment Authorization System database; requiring sellers to certify the accuracy of equipment authorization information as a condition of listing; promptly investigating and removing listings identified as lacking required authorization information, whether through the marketplace’s own monitoring or through a complaint, inquiry, or notice from the Commission; and maintaining records sufficient to demonstrate these efforts upon request. “Chairman Carr Announces Six Months of Operation Clean Carts Success,” Press Release (May 4, 2026).
  CTA, in its ex parte, expressly suggested that the Commission rely on Operation Clean Carts best practices. Consumer Technology Association, Ex Parte Comments (July 13, 2026), at 2.
  This statement of enforcement reflects the Commission’s present enforcement priorities and does not create a safe harbor, presumption of compliance, or defense to liability under § 2.803(c) or any other provision of the Communications Act or the Commission’s rules.  Moreover, this statement of enforcement does not bind the Commission’s discretion in any individual case, and a marketplace’s good-faith efforts do not excuse a pattern or practice of noncompliance, willful blindness, or a failure to act after notice of a specific violation.  We direct EB to consider issuing further guidance identifying specific best practices, as appropriate, informed by its experience administering Operation Clean Carts and any successor initiatives, to assist online marketplaces in complying with § 2.803(c).
3. Requiring online marketplaces to display FCC IDs 
62.  In the Second Further Notice, we sought comment on explicitly requiring online marketplaces to display the FCC ID at the online point of sale. Second Further Notice at paras. 91, 93 (referring to e-commerce sites and online retailers). 
  The Commission currently requires that each certified device display its FCC ID on the device or within an integrated display. 47 CFR §§ 2.925, 2.926, 2.935. 
  An FCC ID uniquely identifies the device and is registered to the party responsible for ensuring that each unit marketed continues to comply with the Commission’s rules.  A valid FCC ID is recorded in the Commission’s publicly-accessible EAS database.  
63. Feith and Sobolik are supportive of this requirement, noting that requiring the FCC ID would be broadly beneficial with minimal burdens. David Feith and Michael Sobolik Comments at 2.
  By contrast, CTA opposes new marketing requirements such as mandatory FCC ID display at online points of sale, arguing the measures would impose heavy burdens without meaningful security benefits and could confuse consumers. CTA Comments at 10-12. 
  Other commenters opposed requiring FCC IDs to be included on printed packaging, citing the burden and cost of doing so. Sony Comments at 2-3; ITI at 6.
  
64. We have also considered other ex parte comments raising practical implementation concerns with the FCC ID display requirements.  CCIA and eBay raised concerns about mandates to display Supplier’s Declaration of Conformity (SDoC) compliance information statements, given that no centralized SDoC database exists. CCIA Comments; Ebay Comment.
  CCIA, the Coalition to Protect America’s Small Sellers (PASS Coalition), The PASS Coalition is comprised of third-party marketplace platforms eBay, Etsy, OfferUp, Mercari, Whatnot and Poshmark. PASS Coalition Comment at 1.
 and eBay raised concerns about requiring FCC IDs for refurbished or used devices, as well as devices sold on online marketplaces by sold by small sellers. CCIA Comment at 2; 
  The PASS Coalition asked the Commission to distinguish between different types of online marketplace activities, noting that (1) some platforms provide integrated logistics, warehousing, consignment, order processing, or fulfillment services on top of a third-party listing and take physical custody of inventory, while (2) other platforms provide third-party listing and do not typically take possession of goods prior to being sold. PASS Coalition Comment at 2. 
  CTA raised timing concerns for applying new marketing requirements to previous listings, requested safe harbors for companies that meet best practices derived from voluntary cooperation with the Commission’s Operation Clean Carts initiative, and noted the need to modernize EAS. CTA Comment at 2. PASS Coalition at 5-6; eBay Comment at 1.
  Other commenters sought a knowledge-based standard for sellers. CCIA Comment; CTA Comment; NRF Comment.
  
65. Discussion: We find that requiring the display of FCC IDs at the online point of sale will not only strengthen FCC enforcement of marketing prohibitions, which is needed to counterbalance the national security risks associated with covered equipment, but also allows consumers to make informed purchasing decisions.  The FCC ID exists to promote transparency, reduce confusion regarding the authorization status of devices, and aid the Commission’s duty to ensure safe communications networks. 47 CFR § 2.925(a)(1); 47 C.F.R. § 2.926(e).
  The presence of the FCC ID signals that a device has been certified, i.e., it has been properly tested, demonstrated its compliance with the Commission’s technical standards, and satisfied all other requirements for certification. 47 CFR § 2.926(e) (“No FCC Identifier may be used on equipment to be marketed unless that specific identifier has been validated by a grant of equipment certification.”).
  Through the EAS database, the public may verify whether a particular device is certified by searching the EAS database for the FCC ID.  Consumers, retailers, distributors, and other supply chain entities can verify that that they are purchasing and marketing devices that are authorized for sale within the United States and are safe products.  However, in the past, checking the FCC ID typically required that a device be physically inspected, which meant that consumers often could not determine whether a device is authorized until after an online sale has been consummated.  
66. We find that it is crucial that the FCC ID be displayed at the online point of sale, including in any online advertisement, to advise the public whether RF products are in fact authorized.  We agree with Feith & Sobolik that “[r]equiring FCC ID disclosure in product listings would clarify equipment authorization before a transaction occurs.” David Feith and Michael Sobolik Comments at 2.
  We further find that marketing entities must verify the FCC ID before displaying it.  Online marketplaces must obtain and prominently display the correct FCC ID of a certified device at the online point of sale.  Moreover, online marketplaces may be held liable for the failure to properly display the correct FCC ID. We acknowledge that any website can temporarily experience downtime but decline, at this time, to establish rigid criteria to define the term “readily accessible.”  
  We therefore revise our rules to expressly require in section 2.803(c) that online marketplaces display the correct FCC ID of all certified devices at the online point of sale.
67. Since its adoption in 1979, section 2.925(d) of the Commission’s rules has required that the FCC ID be permanently affixed to the device and be “readily visible to the purchaser at the time of purchase.” 47 CFR § 2.925(d); see also 47 U.S.C. 302a, 303(r).
  Because online purchases now account for over 70 percent Digital Commerce 360, Consumer Electronics Ecommerce Statistics, (“Revenue in consumer electronics . . . Online penetration was very high, at 72.9% in 2023. That’s an increase of about 7% from 2022, when penetration was 68.2%.”). https://www.digitalcommerce360.com/consumer-electronics-ecommerce-statistics/, last visited June 26, 2026.
 of consumer electronics sales today, the amendment we adopt here refreshes the scope of the rule and restores its original intent.  The amended rule also aligns now with similar requirements under our rules that require the provision of certain information at the time of marketing. Devices that display their FCC ID electronically must also display it on the device or its packaging or display other information (such as a model number and identification of a Web page that hosts the relevant regulatory information) that permits the devices to be identified “at the time of importation, marketing, and sales.”  47 CFR § 2.935(f).  Similarly, SDoC compliance information must be provided “at the time of marketing or importation.”  Id. at 2.1077(a).  We acknowledge that marketing is already defined in section 2.803(a) to include the elements of sale and importation.
  We agree with Feith & Sobolik that requiring FCC ID at point of sale is “a minimally invasive standard of compliance that would increase transparency, enforcement, and security.” David Feith and Michael Sobolik Comments at 2.
  We have considered and rejected CTA’s comments opposing this requirement.  CTA contends that requiring the FCC ID in an online product listing could be burdensome; however, it has provided no facts in the record upon which we could begin to assess this claim, and no other entity has supported this claim.  We do not find that requiring compliance information within a product listing would present a burden.  Online marketplaces almost uniformly display product specifications, descriptions, consumer reviews, and hyperlinks within a product listing webpage and generally already display production information of comparable complexity, such as model numbers, UPC codes, and regulatory marks for other agencies.  Online marketplaces also tend to require that third-party sellers provide certain minimal information within a listing regarding the product marketed.  Online marketplaces already display product specification information.  We believe that implementing this requirement should be straightforward and would likely include updating the HTML code of any product page, revising any terms of service agreements, and modifying a platform’s back-end infrastructure to accommodate the new requirement, all of which are routinely performed in the normal course of business.  Moreover, to the extent that online marketplaces have not previously taken steps to ensure that products they market to U.S. consumers are lawful, these measures are both necessary and long overdue.  In our experience, we have found that requiring FCC IDs at the online point of sale for online marketplaces would support compliance efforts by enabling platforms to leverage automated controls to screen for unauthorized equipment. “Chairman Carr Announces Six Months of Operation Clean Carts Success,” Press Release (May 4, 2026).
  
68. We have also considered the NRF Comment argument that requiring display of an FCC ID would hold online marketplaces liable for the content of third-party listings, which is barred by Section 230 of the Communications Act. NRF Comment at 11 at n. 66 (citing Planet Green Cartridges, Inc. v. Amazon.com, Inc., 2025 WL 869209 (9th Cir. Mar. 20, 2025); eBay, 751 F. Supp. 3d at 244-45; Chicago Lawyers’ Comm. For C.R. Under L., Inc. v. Craigslist, Inc., 519 F.3d 666, 671-72 (7th Cir. 2008)). 
  The Section 230 cases cited do not apply here. The rules we adopt in section 2.803(c)(1) and (2) place a requirement on online marketplaces directly to verify FCC IDs by requiring the display of a valid and accurate FCC ID.  If, after verification, an online marketplace fails to display a valid FCC ID—and is not subject to any exemptions—then the online marketplace itself is liable.  To have Section 230 protection, the relevant information must be “provided by another information content provider.” 47 U.S.C. § 230(c)(1).
  Because online marketplaces are required to independently supply accurate FCC IDs or verify FCC IDs, they materially contribute to the provision of the FCC ID. See, e.g., Henderson v. Source for Pub. Data, L.P., 53 F.4th 110, 128-29 (4th Cir. 2022); FTC v. LeadClick Media, LLC, 838 F.3d 158, 176-77 (2d Cir. 2016). 

  Likewise, the NRF Commenters’ reliance on First Amendment concerns is misplaced.   In Zauderer, the Supreme Court held that the government may compel a commercial speaker to include purely factual, uncontroversial information about their goods as long as it is reasonably related to a legitimate state interest and does not chill protected commercial speech. Zauderer v. Office of Disc. Counsel, 471 US 626 (1985). 
  Here, an FCC ID is purely factual, commercial information already required by the Commission’s labeling rules to appear on the device. See, 47 CFR § 2.803(b)(1) 
  The Commission is compelling its disclosure in support of legitimate state interests to prevent sales of unauthorized equipment to consumers, and requiring its disclosure does not chill protected commercial speech. 
69. We do find some of the concerns raised by ex parte comments to be persuasive and have addressed them, adding clarifications and narrowing our rules in six ways, indicated below. Nonetheless, as discussed below, we keep the record open on expanding the scope of this FCC ID requirement for online marketplaces and seek further comment.  See supra para. 164.
  
70. First, we clarify that online marketplaces are not required to list SDoC compliance information for any product listing. Several commenters raised concerns about our initial draft.  See, e.g., EBay Comment at 2; CCIA Comment at 2.
  The FCC ID requirement applies only to FCC IDs and only to RF devices subject to certification. 
71. Second, we clarify that the FCC ID requirement we adopt in § 2.803(c) applies to product listings that are published for the first time or amended or updated on or after the effective date of this rule.  CTA suggests that we “grandfather[] existing listings.” CTA Comment at 2. 
  We do so.  Product listings published before the effective date of this rule (without any amendments or updated thereafter) are exempt from our new rules at § 2.803(c).  We find this approach to be in the public interest.  Unlike the incremental burden of adding FCC ID information to a listing at the time it is created or edited, requiring online marketplaces to affirmatively retrofit their entire existing catalog of product listings within a fixed compliance window would impose a materially greater, one-time burden untethered from the marketplace’s own editorial activity.  We find this approach appropriately balances the transparency and enforcement goals underlying this rule against the compliance burden of applying it retroactively to a marketplace’s existing inventory of listings.  We clarify that any amendment or update to a product listing’s content (such as a change to the product description, product images, product specifications, or seller information) brings that listing within the scope of § 2.803(c) as of the date of the amendment or update.  By contrast, non-substantive or automated changes that do not alter listing content (such as changes to search ranking, page layout, translation, pricing, or currency display) do not constitute an amendment or update to bring the product listing within the scope of § 2.803(c).
72. Third, we exempt from the FCC ID display requirements in § 2.803(c) listings made on an online marketplace by a “small seller,” defined as any third-party seller that is not a “high-volume third-party seller,” as that term is defined in the INFORM Consumers Act. 15 U.S.C. § 45f(f)(6).
  For example, the PASS Coalition urged the Commission to “consider incorporating a small seller exemption that balances the Commission’s objectives with the practical realities that small businesses and casual sellers would face if they were covered by this rule.” Pass Coalition Comment (July 15, 2026) at 4.
  We believe that small sellers account for a small share of overall e-commerce sales. See U.S. Small Business Administration, Office of Advocacy, An Analysis of Internet Sales Taxation and the Small Seller Exemption (November 2013) (finding that 99.9 percent of online sellers are small, and most e-commerce sales are conducted by approximately 1,000 large companies).
  The INFORM Consumers Act requires online marketplaces to verify the identity of high-volume third-party sellers. 15 U.S.C. § 45f.
  We rely on this threshold for our rules, because online marketplaces and third-party sellers are already familiar with it, and because we believe that requiring compliance with FCC ID rules is materially easier for online marketplaces that are already required to verify the identity of third-party sellers.  We agree that low-volume and occasional sellers are less likely to have the resources or sophistication to obtain and verify equipment authorization information, and a marketplace’s practical ability to obtain and enforce compliance commitments from a seller is most developed with respect to sellers already subject to an identity-verification relationship under the INFORM Consumers Act.  We further find that imposing this requirement on the full population of third-party sellers, including individual and occasional sellers with minimal sales volume, would impose compliance costs disproportionate to the incremental public safety and national security benefit, given that high-volume sellers account for a disproportionate share of the equipment marketed on any given online marketplace.  This limitation applies only to listings made by a third-party seller but does not limit the obligations of online marketplaces under § 2.803(c)(1) or (c)(2) with respect to devices the marketplace itself sells or offers for sale or has physical access to or takes title.  
73. Fourth, we further exempt from the FCC ID display requirements in § 2.803(c) listings for a used radiofrequency device.  We adopt this limitation because requiring an online marketplace to separately verify and display that information for every resale listing would impose recurring compliance costs on secondary-market transactions without a corresponding increase in the reliability of the information provided to consumers.  A seller of a used device may struggle to determine the device’s FCC ID, as would the online marketplace hosting such a listing. See, e.g., PASS Coalition Comment (July 15, 2026) at 3; Ebay Comment (July 16, 2026) at 2.
  For purposes of this rule, we define a used radio frequency device to be “any device that was previously sold to a retail customer and is marketed as a ‘used’ or otherwise not ‘new’ device.” 
74. Fifth, several ex partes raised concerns that online marketplaces do not have the ability to verify whether a third-party seller-provided FCC ID accurately matches the product being offered for sale in the listing. See, e.g., PASS Coalition Comment (July 15, 2026) at 3-4.
  Given these practical challenges, we adopt different FCC ID rules for different categories of e-commerce listings.  (1) Listings that offer an online marketplace’s own devices for sale and listings where the online marketplace has physical access or takes title to the device (for example, through fulfillment, warehousing, consignment, shipping, or similar arrangements) are described in 47 CFR § 2.803(c)(1) of our rules.  (2) Third-party seller listings for which the online marketplace never has physical access, or takes title, to the device (for example, through fulfillment, warehousing, consignment, shipping, or similar arrangements) are described in § 2.803(c)(2) of our rules.  We find that, for listings in Category (2), given the practical challenges with verifying that the third-party seller-provided FCC ID actually matches the listed product, online marketplace need only ensure that the FCC ID provided is a valid FCC ID.  They are not responsible for ensuring that the FCC ID provided corresponds to the device being offered for sale, so long as the marketplace has (i) taken reasonable steps to verify that the FCC ID supplied corresponds to a validly issued FCC ID in the Commission’s EAS database, and (ii) required the third-party seller to certify the accuracy of the information supplied.  By contrast, for listings in Category (1), online marketplaces must display a valid and accurate FCC ID corresponding to the listed product.  Online marketplaces that sell their own devices or have physical access or take title to a third-party seller’s device do not face the same verification challenges.  
75. Sixth, while the prohibition on marketing radiofrequency devices without proper authorization, and the requirement that online marketplaces display the FCC ID of certified devices, do not include a willfulness or intent element, the Commission clarifies that it and EB will prioritize enforcement resources under § 2.803(c) toward: (i) instances of knowing, willful, intentional, or negligent noncompliance, including online marketplaces that fail to display a required FCC ID after having been notified of the omission or after a pattern of similar violations; (ii) listings in Category (1); and (iii) the marketing of covered communications equipment or otherwise unauthorized equipment, given the heightened national security and public safety risks such equipment presents relative to authorized equipment that is merely missing point-of-sale FCC ID information.  This statement of enforcement priorities does not narrow the scope of § 2.803.  This statement also does not create a safe harbor or defense to liability for any online marketplace outside these priority categories.  The Commission retains full discretion to pursue enforcement action against any violation of § 2.803(c) as circumstances warrant.
76. Finally, we adopt differentiated transition periods for compliance with the FCC ID display requirements in § 2.803(c)(1) and (c)(2).  For example, the PASS Coalition urged the Commission “to incorporate an appropriate and fair transition period” to “give non-fulfillment marketplaces a meaningful opportunity to implement the rule.” PASS Coalition Comment (July 15, 2026) at 5.
  Similarly, CTA advocates for “an appropriate transition period . . . for implementing the new FCC ID display requirement.” CTA Comment (July 13, 2026) at 2.
  We agree with these comments that both categories of online marketplaces will need time to update their listing infrastructure, revise terms of service with third-party sellers, and, for marketplaces subject to § 2.803(c)(2), build the seller-certification and database cross-referencing processes described above.  We find, however, that these compliance burdens differ in kind between the two categories, and that a single transition period would either impose an unreasonably short timeline on marketplaces with more complex compliance obligations or an unnecessarily long timeline on marketplaces already well-positioned to comply.  Online marketplaces described in § 2.803(c)(1) — those that sell devices themselves, or that have physical access to or take title to third-party sellers’ devices — have direct access to the devices they market and are best positioned to verify FCC ID information without relying on a third party.  We therefore adopt an effective date for compliance with § 2.803(c)(1) of 180 days after the publication of this Order in the Federal Register.  Online marketplaces described in § 2.803(c)(2) must, by contrast, first identify which of their third-party sellers meet the high-volume threshold, establish a process for collecting and verifying seller-certified FCC ID information, and integrate database cross-referencing into their listing workflows, all without the benefit of physical access to the underlying devices.  We find that this additional complexity warrants a longer transition period, and we therefore adopt an effective date for § 2.803(c)(2) to be 270 days after the publication of this Order in the Federal Register.  
77. In the Second Further Notice, we also sought comment on whether certain entities should be required to display a certified device’s FCC ID number so that it is visible on the outside of the device’s packaging. Second Further Notice at para. 91.
  We posited that such a requirement could make it easier for consumers to verify a device’s authorization status. Second Further Notice at para. 91.
  Similarly, the lack of a valid FCC ID on consumer packaging or bulk shipments, for devices that must be authorized by certification, can act as a litmus test that enables swift enforcement.  For instance, U.S.  Customs and Border Protection (CBP) could easily identify and seize equipment that lacks a valid, required FCC ID at the border, before it reaches online marketplaces and consumers.  We have also considered comments opposing including FCC IDs on the external product packaging Sony Comment at 2-3; Sony Comment as 13; ITI Comment at 6. 
 but based on the record we do not adopt such proposals at this time, though we keep the record open on this point should members of the public or industry wish to comment.  
D. Clarifications regarding Modifications Such that Previously-Authorized Equipment Would Become Covered
78. In the First Report and Order, the Commission revised its rules to require that all applicants that request a modification to any previously certified equipment authorizations must include written certifications that authorization of the equipment is not prohibited under section 2.903 and regarding whether or not the applicant is identified on the Covered List. 47 CFR §§ 2.932(b), 2.1043(b)(2)(i)(B), (C). 
  The Commission further modified its rules to reinforce this prohibition and prevent companies on the Covered List from using the SDoC process to authorize any of their equipment.  Instead, Covered List entities must use the more rigorous certification process, which gives the Commission greater oversight and helps prevent authorization of equipment that could pose national security risks. 47 CFR § 2.906(d). 
  In the Second Report and Order, the Commission clarified that the intent of these rule changes was to prohibit any modification to equipment that is already covered or would become covered as a result of a modification, consistent with the Secure Equipment Act’s ban on reviewing or approving applications for covered equipment.  This prohibition also applies to permissive changes that do not require a formal application, such as class I permissive changes that are “approved by rule.” See, 47 CFR § 2.1043(b)(1) (“A Class I permissive change includes those modifications in the equipment which do not degrade the characteristics reported by the manufacturer and accepted by the Commission when certification is granted.”).
  The Commission therefore amended its rules in sections 2.932(b) and (c) and 2.1043(b) to state that permissive changes may be made “[e]xcept for equipment prohibited from authorization pursuant to § 2.903,” 47 CFR § 2.932(b); id. § 2.1043(b) (using identical language); see also § 2.939(c)(2).
 the rules section prohibiting the authorization of covered equipment.  
79. SZ DJI Technology Co.  Ltd.  (DJI) opposes any blanket prohibition of permissive changes or modifications to authorized DJI products already in the U.S.  market. SZ DJI Technology Co. Ltd. Comment at 1 (Jan. 5, 2026)
  DJI cited the need for “firmware updates .  .  .  to strengthen data security and for important safety updates that ensure products can continue to be operated safely and that a blanket prohibition could prevent end users from making the necessary updates, making the equipment and U.S.  airspace less safe.” Id. 
  MEMA, the Vehicle Suppliers Association, similarly recommended that the Commission expressly exclude routine over-the-air (OTA) firmware and software updates used by vehicle suppliers to remediate cybersecurity vulnerabilities, address safety defects, and maintain regulatory compliance, such as in recall scenarios. MEMA Comments at 6-7. 
  We have considered these comments, and find such concerns can be addressed through limited waivers, as we have already done to allow previously-authorized UAS and routers to receive such updates.   
80. The Commission clarifies its rules regarding permissive change modifications.  As we stated in the Second Report and Order, “the intent of the Commission in adopting these provisions was to prohibit modification, including permissive changes, to previously authorized covered equipment or equipment that would become covered as a result of such modification or permissive change.” Second Report and Order at para. 55 (emphasis added). 
  We amended our rules to expressly prohibit modifications to equipment that is prohibited from receiving authorization as covered equipment. 47 CFR §§ 2.932, 2.1043(b).
  In the Second Further Notice, we sought comment on “additional action we might take to further strengthen and streamline our efforts to identify covered equipment and ensure it is not authorized.” Second Further Notice at para. 82. 
  We now revise section 2.932 and 2.1043(b) to make clear the Commission’s intent in its First and Second Report and Order that prohibition applies to both equipment that is already prohibited from receiving equipment authorization pursuant to § 2.903, as well as equipment that would become prohibited pursuant to 2.903 as a result of the change.  
81. This prohibition applies to any “change in the design, circuitry or construction of any equipment or device for which an equipment authorization has been issued.” 47 CFR § 2.932(a).
  A few examples are illustrative.  If a device was originally produced by Entity A, that device may not be subsequently redesigned and produced by Entity B if Entity B is a Covered List entity.  If a UAS was certified at a time at which the UAS was produced in the United States, the device cannot later be modified by transferring production of the device to a foreign country, which would render the UAS “covered.” See Federal Communications Commission, List of Equipment and Services Covered by Section 2 of the Secure Networks Act (“Covered List”), https://www.fcc.gov/supplychain/coveredlist, last visited June 26, 2026. 
  If a UAS device is certified because it meets the “domestic end product” definition, See Federal Communications Commission, List of Equipment and Services Covered by Section 2 of the Secure Networks Act (“Covered List”) (“UAS … produced in a foreign country—except… UAS that qualify as ‘domestic end products’ under the Buy American Standard, 48 CFR 25.101(a), until January 1, 2027”)., https://www.fcc.gov/supplychain/coveredlist, last visited June 26, 2026. 
 the UAS may not subsequently be modified by altering the componentry in such fashion that the modified device would not meet the “domestic end product” definition.  For the avoidance of doubt, routine software and firmware security authorized until January 1, 2029, by the OET waivers referenced in Section II.C above, See supra para. 12.
 do not constitute prohibited modifications under this paragraph.  
82. Several commenters caution that determining whether a modification changes the “production” source or component composition of a device may be technically complex or burdensome, particularly given global supply chains and the evolving meaning of “produced by.” CTA Comment at 4; USTelecom Comments at 4-5.
  We emphasize that modification prohibitions apply only when an applicant makes a change that means that the equipment, as modified, meets the criteria of becoming “covered” equipment.  We are not, at this time, imposing additional obligations on applicants to investigate component lineage beyond what is ordinarily required for compliance with the equipment authorization rules.  The Commission will not deem a device prohibited unless the modification itself renders equipment “covered” equipment.
83. For purposes of Covered List implementation in the equipment authorization program, the Commission clarifies that, for all modifications, the term “produced by” for the purpose of producer/provider-based Covered List additions shall continue to be evaluated under the totality of circumstances, including substantial responsibility or control over design, development, manufacture, or assembly.  For example, a device assembled by a Covered List entity is “produced by” that entity; the presence of otherwise authorized components does not alter covered status.  Similarly, a device that is covered remains covered regardless of whether it uses components that individually hold valid equipment authorizations.  Permitting a Covered List entity to assemble a device using authorized components would enable circumvention of our rules and is incompatible with the “produced by” standard, which looks to substantive involvement in production rather than the authorization status of sub‑components. David Feith and Michael Sobolik Comments at 1-2. 

E. Re-Certifications Required of Covered List Entities for Any Change to Equipment 
84. In the EA Security Second Further Notice, the Commission proposed the submission of recertification for any equipment for which an entity identified on the Covered List seeks modification for a permissive change.  The Commission explained that this proposal was consistent with the Commission’s longstanding “intent to require one procedure for all equipment authorization applications made by” Covered List entities.  The Commission asked for input on how these requirements might enhance supply chain security, whether a streamlined process should be created, and what impacts or burdens this might place on the supply chain and how those could be reduced.  
85. The record in this proceeding reflects broad agreement that modifications to firmware, software, or other functional elements of Covered List equipment can materially alter the device’s security posture.  FDD strongly supports requiring full recertification for any modification made by a Covered List entity, arguing that this is necessary to prevent post‑authorization tampering and maintains that such a requirement directly enhances supply‑chain security by pushing U.S.  companies toward more trustworthy suppliers.  Other commenters stress that any requirement for recertification must be strictly tethered to a “specific determination” by one of the Enumerated Sources identified in the Secure Networks Act.  
86. To ensure the continued protection of U.S.  networks and infrastructure and ensure that there is one procedure for all equipment authorization applications made by Covered List entities, the Commission determines that all Covered List entities that seek permissive change modifications to covered or non-covered equipment must submit applications for recertification.  For the avoidance of doubt, this requirement applies only when the applicant for the permissive change is itself an entity identified on the Covered List.  A non-Covered List manufacturer that modifies equipment originally produced by a Covered List entity, where the modification does not result in the modified device being ‘produced by’ the Covered List entity under the totality-of-the-circumstances framework, is not subject to this recertification requirement.  Under this approach, we affirm that no Covered List entity is permitted to rely on the SDoC process for modifications, even for non-covered equipment regardless of the nature or scope of the change.  This is analogous to the certification requirement adopted in the First Report and Order, prohibiting Covered List entities from using the SDoC process in order to ensure a single equipment authorization procedure for such entities.  
87. We note that this requirement only applies to Covered List entities and therefore does not apply to the production location-based entries on the Covered List, including foreign-produced UAS, UAS critical components, and routers, because this requirement is designed to give the Commission oversight over modifications made by specific entities that pose national security risks.
88. We also note that OET previously granted limited waivers permitting Class I and Class II permissive changes for Covered List UAS equipment and Covered Routers through January 1, 2029 in order to allow continued delivery of software, firmware, and security updates that mitigate risks to consumers and operators.  That waiver remains in effect according to its stated terms.  Furthermore, the Commission proposes to codify these waivers in its rules.  
F. Definition of “Critical Infrastructure” as used in the Covered List
89. In the EA Security Second Further Notice, we addressed the U.S.  Court of Appeals for the District of Columbia Circuit’s partial remand of the Commission’s decision in its EA Security R&O and FNPRM and sought comment on establishing a new definition of “critical infrastructure” for purposes of our prohibition on authorization of covered equipment produced by Hikvision, Dahua, and Hytera, and their subsidiaries and affiliates. EA Security Second Further Notice, paras. 66-80.  We noted that adoption of this definition would be a precondition to the review and approval of any compliance plans, as required under the EA Security R&O and FNPRM.  See id., para. 73.        
  Specifically, the D.C.  Circuit vacated those portions of the Commission’s decision defining “critical infrastructure” for purposes of understanding when video surveillance and telecommunications equipment produced by Hikvision, Dahua, and Hytera (and their respective subsidiaries and affiliates) is used “for the purpose of .  .  .  physical security surveillance of critical infrastructure,” as set forth in section 889(f)(3) of the National Defense Authorization Act (NDAA) of 2019 and incorporated into the Covered List via the Secure Networks Act. See id., para. 66 (citing Hikvision USA, Inc. v. Federal Communications Commission, 97 F.4th 938, 948-50 (D.C. Cir. 2024) (Hikvision)); see also Pub. L. 115-232, § 889, 132 Stat. 1636, 1917-19 (2018) (2019 NDAA § 889);  47 U.S.C. § 1601(c)(3).
  The court concluded that the “Commission’s choice of reference materials—government sources that define ‘critical infrastructure’ and related national security concepts—was reasonable, and that the Commission adequately explained why the cited sources were relevant.” Hikvision, 97 F.4th at 949.  
  However, the court found that the Commission had failed to explain or justify why the definition should include any “systems or assets” that are merely “connected to” critical infrastructure sectors or functions and that the scope of the definition was “therefore arbitrarily broad.” Id.   
  The court vacated those portions of the EA Security R&O and FNPRM defining “critical infrastructure,” and remanded to the Commission to “comport its definition and justification for it” with the NDAA statutory provision. Id. 
 
90. Today, we retain our reliance on the government sources that the D.C.  Circuit upheld, but narrow the definition to no longer interpret “critical infrastructure” to broadly encompass all components “connected to” critical infrastructure.  We define “critical infrastructure” per Section 1016(e) of the USA PATRIOT Act of 2001 (Patriot Act) as: “[S]ystems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.” 50 U.S.C. § 5195c(e).
  We further provide guidance noting that this definition encompasses systems and assets used in the provision of services or functions in the 16 critical infrastructure sectors as identified in Presidential Memoranda and elaborated on by the Department of Homeland Security (DHS) National Security Memorandum on Critical Infrastructure Security and Resilience, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2024/04/30/national-security-memorandum-on-critical-infrastructure-security-and-resilience/ (Apr. 30, 2024) (NSM-22).  NSM-22 identifies the same sixteen “critical infrastructure sectors” identified in Presidential Policy Directive 21 (PPD-21):  chemical; commercial facilities; communications; critical manufacturing; dams; defense industrial base; emergency services; energy; financial services; food and agriculture; government facilities; healthcare and public health; information technology; nuclear reactors, materials, and waste; transportation systems; and water and wastewater systems.  See id.  DHS provides more detail on its website.  See, Cybersecurity & Infrastructure Security Agency, Critical Infrastructure Sectors, https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors (last visited June 22, 2026).   
 to provide any of the 55 National Critical Functions (NCFs) published by DHS through the National Risk Management Center (NRMC). See, Cybersecurity & Infrastructure Security Agency, National Critical Functions Set, https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors (last visited June 22, 2026).   
  In adopting this definition, we apply the same base definition, taken from the Patriot Act, of “critical infrastructure” that the Commission originally adopted in the EA Security R&O and FNPRM that was affirmed by the court, and we provide guidance to facilitate the determination of what is “vital” that follows longstanding presidential and DHS judgments.  But we eliminate the “connected to” provision of the EA Security R&O and FNPRM that the court found overly broad. Second Report and Order, para. 74.
  In doing so, we make clear that we are not expanding the scope of the Patriot Act definition, but rather are providing additional guidance concerning what systems or assets are “vital” under that definition.  
91. Commenters generally agree that the Commission should adopt the Patriot Act definition of “critical infrastructure.” See, e.g., Center for Regulatory Freedom Comments at 7; CTIA Comments at 20-21; Foundation for Defense of Democracies Comments at 2; MEMA Comments at 8; NCTA Comments at 4; USTelecom Comments at 11; CTIA Reply at 16; Motorola Reply at 2-3; NCTA Reply at 8-10.
  In addition to being codified law, the Federal government has consistently used this definition in national policy documents, including Presidential Policy Directive 21 and National Security Memorandum 22. See, Directive on Critical Infrastructure Security and Resilience, 1 Pub. Papers 106, 115 (Feb. 12, 2013) (PPD-21), https://www.govinfo.gov/content/pkg/PPP-2013-book1/pdf/PPP-2013-book1-doc-pg106.pdf; NSM-22. 
  We conclude that this definition is consistent with existing precedent and aligns with current Executive Branch policy directives regarding critical infrastructure.  
92. Likewise, the definition that we adopt today is consistent with the D.C.  Circuit’s opinion.  In the EA Security R&O and FNPRM, the Commission interpreted the prohibition in 2019 NDAA § 889 as having broad scope with respect to Hikvision, Dahua, and Hytera equipment because such equipment poses an unacceptable risk to national security. First Report and Order, para. 209.  
  The court concluded that “[t]he Commission’s choice of reference materials—government sources that define ‘critical infrastructure’ and related national security concepts—was reasonable, and that the Commission adequately explained why the cited sources were relevant.” Hikvision, 97 F.4th at 949.
  The court noted that even Hikvision conceded that the Commission’s application of the Patriot Act definition of critical infrastructure “may be appropriate.” Id. at 949. 
  We have now made clear that the definition we adopt today no longer encompasses systems and assets that are merely “connected to” the 16 critical infrastructure sectors, which was the main focus of the court’s decision. In Hikvision, the court noted that the Commission “does not explain why everything ‘connected to’ any sector or function that implicates national security must be considered ‘critical,’ especially in light of the Patriot Act’s emphasis on particular ‘systems and assets’ that are ‘vital to the United States.’”  Hikvision, 97 F.4th at 949-50.  The court found that the Commission’s definition “threatens to envelop ever-broadening sectors of the economy,” and reads the word “critical” out of the statute and applies the equipment ban to all “infrastructure.”  Id. at 950.  The court found it “entirely implausible that every single system or asset that is ‘connected to,’ for example, the food and agriculture sector, or to the function of supplying water, is ‘critical’ to the national security of the United States,” and it noted that the Commission has not identified any relevant infrastructure that would not be covered, whether critical or not.  Id.   
   We conclude that continuing to use the Patriot Act definition, in conjunction with the 16 critical infrastructure sectors and the 55 NCFs, is the best course and is responsive to the court’s opinion.   
93. In the Second FNPRM, we sought comment on interpreting “critical infrastructure” as  “encompassing equipment when used in the provision of services or functions in the 16 critical infrastructure sectors,” even if the equipment is not “so vital to the United States” to be considered “critical infrastructure.” Second Report and Order, para. 79. 
  Some commenters argue that service providers will face implementation challenges if we include all such equipment within the scope of the definition.  In recognition of those concerns, we here decline to encompass all equipment used in the provision of services or functions in the 16 critical infrastructure sectors. Second Report and Order, para. 79. 
  We instead provide that the definition adopted today encompasses systems or assets used in the provision of services or functions in the 16 critical infrastructure sectors when used to provide any of the 55 NCFs, a distinction that better ensures that the systems and assets in question are reasonably understood as “vital” within the meaning of the Patriot Act definition.  
94. We reject Hikvision USA’s argument that the proposed definition “does not provide the narrowing or comprehensible guidance required by” the D.C.  Circuit and assertions that there is “little or no practical difference between the new proposal and the [original] definition” that the court vacated and remanded to the Commission. Hikvision Comments at 13. 
  Both as proposed in the Second FNPRM  and as adopted today, our definition of critical infrastructure is different from the definition the Commission adopted in the EA Security R&O, which “threaten[en]d to envelop ever-broadening sectors of the economy.” Hikvision, 97 F.4th at 950.
   Specifically, the definition now includes systems and assets used in the provision of services or functions in the 16 critical infrastructure sectors to provide any of the 55 NCFs, but it does not include all systems and assets merely “connected to” the provision of those services and functions.  And we again emphasize that we are explicating, not expanding on, the Patriot Act definition.  That is, we interpret critical infrastructure to encompass only systems and assets “so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”  Systems or assets that are not vital in this way are not encompassed, even if they could conceivably be characterized as being used in the provision of services or functions in the 16 critical infrastructure sectors to provide the 55 NCFs.  Moreover, DHS has helpfully provided extensive online guidance as to the content of the 16 critical infrastructure sectors and the 55 NCFs. See, Cybersecurity & Infrastructure Security Agency, Critical Infrastructure Sectors, https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors (last visited June 23, 2026); Cybersecurity & Infrastructure Security Agency, National Critical Functions Set, https://perma.cc/YGK2-YQU2 (last visited June 24, 2026).   
  We follow this guidance.  We find the definition we adopt today will reduce implementation challenges by providing sufficient guidance and provide industry stakeholders with the information necessary to fully comply with our rules.  
95. We also decline to adopt Hikvision USA’s definition of “critical infrastructure.” See, Hikvision Comments at 19-22 (citing Compliance Plan of Hikvision USA, Inc., ET Docket No. 21-232, at 7 (filed Apr. 29, 2024), https://www.fcc.gov/ecfs/document/10429064727762/2 (April Compliance Plan)).
  Hikvision USA proposes that the Commission use a finite list of 10 systems and assets—across multiple sectors—to define the bounds of critical infrastructure. See id.; Hikvision Comments at 20.  
   It argues that it is enough to include only those specific systems and assets (governmental and private)—which are, in their view, “so vital to the United States that individually incapacitating or destroying those systems and assets would have a debilitating impact on national security, national economic security, and/or national public health or safety.” See, April Compliance Plan, at 7.
 We conclude that Hikvision USA’s proposed definition is not consistent with the Patriot Act definition, excluding several systems and assets that, if incapacitated or destroyed, would result in “a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.” Second Report and Order, para. 80.
  These include systems and assets used in communications, critical manufacturing, emergency services, food and agriculture, and healthcare and public health—sectors recognized in PPD-21 and reaffirmed in NSM-22, and by DHS, as critical infrastructure sectors.  We reject Hikvision USA’s arguments, which are contrary to a presidential determination and years of U.S.  government policy, that not all of the 16 critical infrastructure sectors are “vital” to the security of the United States within the meaning of the Patriot Act. See, Hikvision Comments at 21.
  For example, the Department of Agriculture’s National Farm Security Action Plan notes the food and agriculture sector is “a known target for terrorists and malicious actors” requiring that the U.S.  government “elevate it to the top echelon of national security priorities.” Department of Agriculture, National Farm Security Action Plan,  https://www.usda.gov/sites/default/files/documents/farm-security-nat-sec.pdf (last visited June 22, 2026).
  Hikvision USA’s arguments ignore the interconnected nature of our communications networks that are essential to the successful operation of the 16 critical infrastructure sectors and also are contrary to the broad definition we find necessary in implementing the 2019 NDAA Section 889. See, EA Security Second Further Notice, para. 80 (citing EA Security R&O, 37 FCC Rcd at 13576-77, paras. 208-09).
  And again, the D.C.  Circuit already found that the Commission’s reliance on the 16 critical infrastructure sections was reasonable and reasonably explained. Hikvision USA, Inc v. FCC, 97 F.4th 938 (2024).
  In short, we conclude that the best definition of the statutory term “critical infrastructure” as found in Section 889 is to adopt the Patriot Act definition, explicated by the services or functions in the 16 critical infrastructure sectors and the 55 NCFs.  
G. Rule Correction and Clarification
96. In the Second Report and Order, we redesignated former paragraphs (b) through (d) of Section 2.903 as paragraphs (d) through (f).  Cross-references within paragraphs (d)(1) through (d)(3) inadvertently retained references to former paragraph (b) instead of the newly redesignated paragraph (d).  We correct that scrivener’s error today.  
97. We also adopt corrections to administrative errors in section 2.1204(a) of the Commission’s rules.  In section 2.1204(a)(2), we are adding the word “and” which was missing between “technical” and “administrative[.]”  Finally, we delete section 2.1204(a)(4)(iv), because it is a duplicate of 2.1204(a)(4)(iii), which immediately precedes that section.  
H. Regulatory Impact Analysis
1. Need for regulatory action
98. Regulatory action is necessary because the current equipment authorization framework contains unresolved vulnerabilities that adversarial actors can continue to exploit, particularly through highrisk components, opaque supplychain pathways, and permissive marketing or modification practices.  If we leave these vulnerabilities unaddressed, Covered List entities will remain capable of inserting malicious firmware, intercepting sensitive information, or compromising communications networks through components such as logic-bearing hardware components, even when embedded within otherwise authorized devices.  Without targeted updates to the authorization, marketing, and enforcement rules, these gaps would persist and could expose U.S.  communications infrastructure and consumers to unacceptable nationalsecurity risks.  At the same time, the rule changes under consideration are designed to be narrowly tailored to specific, wellsupported nationalsecurity determinations, ensuring that the Commission strengthens protections while avoiding unnecessary disruption to lawful supply chains.  Taken together, these factors demonstrate that regulatory action is required to safeguard U.S.  telecommunications networks and the public interest in a balanced, riskminimizing manner.
99. This significant regulatory action is submitted to the Office of Information and Regulatory Affairs (OIRA) for interagency review.  This regulatory impact analysis (RIA) presents an assessment of the costs and benefits, including regulatory compliance costs, associated with this action and is consistent with Executive Order 12866.  Comparing the proposed rules with other alternative policy options, we find that the adoption of these proposed rules will result in significant benefits that outweigh the associated costs.  This rule is not an Executive Order 14192 regulatory action because it is being issued with respect to a national security function of the United States.
2. Benefits
100. The rules adopted in the Third Report and Order that take security into consideration in the equipment authorization process would serve the public interest by addressing significant national security risks that have been identified by the Commission, and by Congress and other federal agencies, and would be consistent with the Commission’s broad statutory authority.  The Commission finds that extending the prohibition to include logic-bearing hardware components produced by named and identified entities on the Covered List is necessary to close the existing gap in equipment posing unacceptable risks to national security.  These components, similar to previously banned modular transmitters, are integral to the operation of American communications networks, but they can be leveraged by foreign adversaries for surveillance, monitoring, and malicious interference.  The Commission’s prior analysis has established that adversary access to network infrastructure, whether through transmitters or other critical modules, presents a consistent risk and enables exploitation for unauthorized data collection and disruption of essential services.
101. Logic-bearing hardware components—when sourced from named and identified entities on the Covered List—may facilitate covert surveillance, network disruption, and unauthorized access to confidential information.  The economic impact of such threats is profound.  In 2025, the national GDP exceeded $30 trillion, U.S. Bureau of Economic Analysis, Table 1.1.5. Gross Domestic Product, https://apps.bea.gov/iTable/?reqid=19&step=3&isuri=1&categories=survey&nipa_table_list=5&Series=A&select_all_years=1&_gl=1*16zt8m*_ga*MjY2NzAxMjE1LjE3NzUwNzA3ODk.*_ga_J4698JNNFT*czE3NzUwNzA3ODkkbzEkZzEkdDE3NzUwNzA5ODkkajE3JGwwJGgw (last visited May 11, 2026).
 and even a modest disruption or breach could result in losses amounting to billions of dollars, undermining public confidence and economic stability.  The Commission estimates that preventing even one percent of malicious cyber activity or network disruption would yield direct economic benefits in the hundreds of millions, See, e.g., The Council of Economic Advisers, The Cost of Malicious Cyber Activity to the U.S. Economy at 36 (Feb. 2018), https://trumpwhitehouse.archives.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf (estimating the cost of malicious cyber activity on the U.S. economy in 2016 was between $57 billion and $109 billion).  Alternatively, House Subcommittee on Cybersecurity, Information Technology, and Government Innovation Chairwoman Nancy Mace has stated that malicious cyber activity costs the U.S. economy between $100 billion and $250 billion annually.  Press Release, U.S. House Committee on Oversight and Government Reform, Mace: We Must Have Reliable Safeguards Against Malicious Cyber Activity (Mar. 23, 2023) (stating “[t]he Council of Economic Advisers has estimated that malicious cyber activity costs the U.S. economy more than $100 billion annually. A Rand report estimated the annual cost to be $250 billion dollars – a quarter trillion every year).    
 far outweighing the costs associated with enhanced security requirements adopted by this Order.
102. These rules are intended to eliminate ambiguity in our marketing and enforcement framework and to further close loopholes that have allowed unauthorized or covered equipment to reach U.S.  consumers and networks.  As clarified in this Order, activities undertaken by online marketplaces—such as listing regulated devices online, engaging in consignment or warehousing arrangements, performing order processing, labeling, packaging, billing, and other fulfillment services—constitute “distribution for the purpose of selling” and therefore fall within the scope of our marketing rules.  These clarifications align our interpretation with analogous federal consumer protection practices and ensure that downstream entities with meaningful involvement in the sale and placement of RF equipment into U.S.  commerce cannot evade accountability.  Together with our decision to require online marketplaces to display FCC IDs at the online point of sale, these measures strengthen the Commission’s ability to intercept unauthorized devices before they enter the marketplace, bolster consumer transparency, and support the Commission in identifying and removing unlawful or security risk equipment.
103. We find that requiring online marketplaces to display FCC IDs will strengthen national security by enhancing the Commission’s ability to identify and remove products that are prohibited from being marketed or sold in the United States.  Moreover, we expect that this requirement will generate additional, meaningful public benefits by improving consumer access to information regarding regulated communications equipment, facilitating verification that covered devices have received the appropriate equipment authorization.  By making FCC IDs readily available at the point of sale, consumers, online marketplaces, and the Commission will be better positioned to identify unauthorized or prohibited devices before purchase, thereby reducing the likelihood that communications equipment presenting national security or regulatory concerns reaches consumers.    
104. Additionally, our enforcement and equipment authorization clarifications close gaps that have historically hindered our oversight of foreign manufacturers and Covered List entities.  Our clarification that modifications may not be used to reintroduce covered or potentially covered equipment into the supply chain reinforces the Secure Equipment Act’s prohibition on authorizing insecure devices.  And by requiring Covered List entities to submit full recertification applications for any modification, regardless of scope or authorization pathway, we close a critical loophole that otherwise could allow post authorization tampering or incremental changes to circumvent our national security protections.  Collectively, these rule, revisions and clarifications fortify the equipment authorization system, protect U.S.  networks from unacceptable risk, and ensure that every actor in the supply chain bears appropriate responsibility for safeguarding the integrity of the communications ecosystem.
105. The Commission concludes that the adopted security measures are justified by the substantial public safety and economic benefits.  Safeguarding the integrity of communications networks advances national security and preserves the economic interests of the United States.  The Commission affirms that the action is a critical step in mitigating risks, ensuring the continued trustworthiness of network infrastructure, and protecting the interests of American consumers and businesses.
3. Costs
106. We estimate that the actions adopted today will impose one-time implementation costs of no more than $300 million and recurring annual costs under $40 million.  
107. For logic-bearing hardware components, the Commission finds that the domestic market share associated with Covered List entities is comparatively small, and that many U.S.  manufacturers have already shifted sourcing away from questionable suppliers due to existing federal procurement restrictions, privatesector riskmanagement practices, and multisourcing strategies implemented over the past several years. See e.g., Markets and Markets, Optical Transceiver Companies – Coherent Corp. (US) and INNOLIGHT (China) Are the Key Players, https://www.marketsandmarkets.com/ResearchInsight/optical-transceiver-market.asp (last visited May 15, 2026) (listing the key players in the optical transceiver market, none of which appear on the Covered List); OpporTimes, Top 10 Exporters of Semiconductor Chips to the United States (Aug. 6, 2025), https://www.opportimes.com/en/top-10-exporters-of-semiconductor-chips-to-the-united-states/ (indicating that countries with parent companies on the Covered List comprise a relatively small share of semiconductor chip exports to the United States).
  Most compliance costs under the Report and Order therefore stem from potential product redesigns or component substitution for a narrow subset of firms that still incorporate components from Covered List entities.  Because the adopted requirements apply only to future equipment authorizations, and because the responsibleparty obligation aligns with compliance procedures already familiar to manufacturers and importers, the Commission expects any redesign or retesting burdens to fall on a limited group of market participants, but it is unclear at this point which market participants would need to conduct redesign and retesting.  Accordingly, the operational impacts of these rules are expected to be narrow, and unlikely to generate significant disruptions in ongoing production or supplychain planning.
108. Marketing.  The Commission’s clarification of its marketing rules, expressly confirming that a carrier’s transport of unauthorized devices does not constitute marketing, directly addresses and alleviates the concerns raised by commenters who cautioned against overreach.  At the same time, the Commission reaffirms that the prohibition on marketing covered equipment appropriately extends to the listing of regulated devices on an online marketplace when accompanied by activities such as consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfillment services, even where a third-party seller holds title.  This clarification is essential to prevent entities from exploiting distribution via online marketplaces to evade the Secure Equipment Act, and is fully consistent with the marketing rules adopted in the First and Second Report and Orders.  Because these clarifications primarily codify interpretations already embedded in existing rules and enforcement practices, they are not expected to impose additional costs beyond those in prior Commission decisions.  The Commission finds that requiring online marketplaces to display FCC IDs imposes minimal cost burden with the targeted, narrow measures.  Online marketplaces already post comprehensive product information, and adding a single identifier does not increase marginal effort or expense.
109. Displaying FCC IDs.  We have carefully considered the concerns raised by commenters regarding the costs associated with requiring the display of FCC IDs in online product listings.  Based on the record and the modifications adopted herein—including exemptions for low-volume sellers, used devices, and certain existing listings—we estimate that the costs of compliance will primarily consist of one-time implementation costs for online marketplace platforms and limited recurring costs for covered sellers.  
110. First, we estimate the compliance costs for marketplace platforms.  We estimate that the aggregate one-time implementation costs associated with updating online marketplace systems will remain below $300 million.  Publicly available data indicate that the 15 largest online retail and marketplace platforms account for more than 73 percent of U.S. retail e-commerce sales. Staff calculations show that the combined market share of the top 15 online retail sites combined is 73.4% of the U.S. e-commerce market.  Statistica, Market share of leading retail e-commerce companies in the United States in 2025 (Mar. 2025), https://www.statista.com/statistics/274255/market-share-of-the-leading-retailers-in-us-e-commerce/?srsltid=AfmBOoryjW1vPtT5NhlEAYdERrt77dbvhY0zvAiUQYaRc9wlRwdZE5VZ. 
  To produce a conservative upper-bound estimate, however, we assume that compliance costs are incurred not only by these major online platforms, but by up to 1,500 online marketplace operators—roughly one hundred times the number of the largest platforms—which we expect encompasses virtually all online marketplaces that facilitate sales of covered electronic devices.  This assumption likely substantially overstates the number of marketplace operators likely to incur meaningful implementation costs and therefore provides a conservative estimate of total compliance costs.  We estimate that one-time implementation costs include software development and system integration, database integration and testing, development of seller certification workflows, legal review and policy updates, quality assurance and deployment, and employee training and documentation.  Based on these implementation activities, we estimate aggregate one-time compliance costs to remain below $300 million. We estimate the one-time implementation cost incurred by each online marketplace platform is approximately $191,333—including $98,170 for software development and system integration (1,000 hours x $67.24 hourly wage rate x 1.46 Benefit Markup); $23,184 for database integration and testing (300 hours x $52.93 hourly wage rate x 1.46 Benefit Markup); $18,655 for seller certification workflow development (240 hours x $53.24 hourly wage rate x 1.46 Benefit Markup); $15,654 for legal review and policy updates (120 hours x  $89.35 hourly wage rate x 1.46 Benefit Markup); $29,451 for quality assurance and deployment (300 hours x $67.24 hourly wage rate x 1.46 Benefit Markup); and $6,218 for employee training and documentation (80 hours x $53.24 hourly wage rate x 1.46 Benefit Markup).  Multiplying the estimated one-time implementation cost of $191,333 per platform by 1,500 marketplace platforms yields an estimated aggregate one-time implementation cost of $286,998,900, which is below $300 million.  The Bureau of Labor Statistics reports May 2025 cross-industry hourly mean wages of Software and Web Developers, Programmers, and Testers (15-1250), Database Administrators (15-1242), Project Management Specialists (13-1082), and lawyers (23-1011) as $67.24/hour, $52.93/hour, $53.24/hour, and $89.35/hour, respectively.  Bureau of Labor Statistics (BLS), Occupational Employment and Wage Statistics Query System, https://data.bls.gov/oes/ (accessed July 21, 2026).  According to the Bureau of Labor Statistics, as of December 2025, civilian wages and salaries averaged $33.72/hour and benefits averaged $15.60/hour. Using these figures, benefits constitute a markup of $15.60/$33.72 ~ 46%. See Press Release, Bureau of Labor Statistics, Employer Costs for Employee Compensation—March 2026 (June 12, 2026), https://www.bls.gov/news.release/pdf/ecec.pdf (Benefit Markup).
  We estimate that the recurring compliance costs for online marketplace platforms will be negligible because, once the required system updates have been implemented, the verification of FCC IDs against the Commission’s equipment authorization database and the identification and removal of non-compliant listings can be performed through largely automated processes with minimal ongoing human intervention.  To the extent that some marketplace platforms have already updated their inventory and other systems or otherwise taken steps to mitigate marketing of unauthorized devices by sellers using the platform, the cost of the FCC ID display requirement would be lower.     
111. Second, we estimate that the recurring compliance costs imposed on sellers will remain below $40 million annually. We estimate the upper-bound annual recurring compliance costs as follows.  Amazon reports approximately 1.1 million active U.S. sellers.  We assume that 15.7% of those sellers offer computer and consumer electronic products, corresponding to the share of computer and consumer electronics in U.S. retail e-commerce sales, resulting in an estimated 172,700 Amazon sellers offering products potentially affected by the Order.  We do not further adjust this estimate to account for the fact that only a subset of computer and consumer electronic products contain logic-bearing components or otherwise require an FCC ID, thereby overstating the number of affected sellers.  Because Amazon accounts for approximately 40.5% of U.S. retail e-commerce sales, we estimate that there are up to 426,420 sellers nationwide offering products that may require an FCC ID (172,700 ÷ 40.5%). We further conservatively assume that each seller maintains 10 product listings that require updates and that adding an FCC ID to the product description requires an incremental 10 minutes per listing.  Applying a fully loaded hourly compensation rate of $51.58 ($35.33 hourly wage × 1.46 fringe benefit and overhead multiplier), we estimate the annual recurring compliance cost to be approximately $37,391,064 (426,420 sellers × 10 listings × 10/60 hour × $51.58), which is below $40 million annually. This estimate likely overstates actual compliance costs because it does not account for the exemption adopted herein for low-volume sellers, excludes no existing listings that are grandfathered under the adopted rules, and assumes that every covered listing requires a manual update rather than relying on existing product information or automated listing tools.  See Red Stag Fulfillment, How Many Third-Party Sellers Are on Amazon (2025 figures), https://redstagfulfillment.com/how-many-third-party-sellers-are-on-amazon/ (last visited July 21, 2026) (estimating 1.1 million active Amazon sellers in the United States); see also Emarketer, In the Years Ahead, the Largest Ecommerce Categories Will Lose Share as Emerging Categories Grow (Mar. 14, 2023), https://www.emarketer.com/content/2023-largest-ecommerce-categories-will-lose-share-of-sales-emerging-categories-grow (reporting that of computer and consumer electronics sales account for 15.7% of U.S. retail ecommerce sales); see also Smartscout, Amazon Seller Statistics (2026)-Sales Data, Growth & Trends (July 14, 2026), https://www.smartscout.com/blog/amazon-seller-statistics (reporting that Amazon accounts for approximately 40.5% of the U.S. retail e-commerce market); see also Red Stag Fulfillment, What Is the Average Number of Listings per Amazon Seller? 2025 Statistics, https://redstagfulfillment.com/average-listings-per-amazon-seller/ (last visited July 21, 2026) (reporting an average of 4.2 products listed per seller in the electronic category, a weighted average of 8.3 product listings per seller across product categories, and that 77% of sellers offer fewer than 10 products).  The Bureau of Labor Statistics reports May 2025 cross-industry hourly mean wages of First-Line Supervisors of Office and Administrative Support Workers (43-1011) as $35.33/hour.  Bureau of Labor Statistics (BLS), Occupational Employment and Wage Statistics Query System, https://data.bls.gov/oes/ (accessed July 21, 2026).  
  These recurring costs primarily consist of identifying the applicable FCC ID for covered devices and including that FCC ID in online product listings at the time a listing is created or materially updated.  Our estimate represents a conservative upper bound for two reasons.  First, it assumes compliance by all sellers offering covered devices and does not account for the exemption adopted herein for low-volume sellers.  Second, our estimate is based on the total estimated number of products listed by covered sellers and does not exclude existing listings that are not subject to the adopted FCC ID display requirement.  Consequently, the estimate overstates the number of listings requiring updates because it assumes that all estimated product listings incur compliance costs, even though some listings subsumed by the estimate are expressly excluded from the requirement.  Moreover, once sellers have incorporated FCC IDs into their existing product listing workflows, the incremental effort required to maintain compliance for new or materially updated listings is expected to be minimal.
112. Enforcement.  We find that assigning the liableparty obligation to the U.S.  importers for foreignmanufactured certified equipment will impose minimally incremental burden. Under § 2.909(a), the “responsible party” for certified equipment is the single party to whom the grant of certification is issued and who bears responsibility for the equipment’s compliance with applicable technical and administrative requirements. By contrast, the “liable party” is the U.S.-based party that, by virtue of its designation, is jointly and severally liable with the applicant or grantee for the compliance of FCC-certified equipment. Whereas § 2.909 generally vests compliance responsibility in a single party at any given time (subject to transfer upon modification, contractual assumption, or change of control), the “liable party” designation creates a domestic point of legal accountability that exists alongside, and shares liability with, the applicant or grantee rather than displacing them.
  Specifically, every device imported into the United States necessarily enters through a U.S.-based importer, which already performs core functions parallel to those required of a liable party—such as maintaining import records, coordinating shipment and distribution, and interacting with federal agencies when compliance issues arise.  Because these entities already stand in the supply chain as the domestic point of entry, designating the importer as the liable party does not introduce a new compliance role so much as formalize duties that importers commonly perform today.  We conclude that the resulting additional administrative and documentation obligations on U.S.  importers are minimal.
113. Modification and Re-Certification.  The Commission’s clarification regarding modification and recertification requirements for Covered List entities is necessary to prevent any modification—whether through design changes, production shifts, or permissive software or hardware updates—from transforming previously authorized equipment into covered equipment in violation of the Secure Equipment Act.  Prior orders already prohibited authorization of equipment that is, or would become, covered, but ambiguity remained around how these prohibitions applied to permissive changes and postauthorization modifications.  Codifying these clarifications ensures that no entity on the Covered List can use incremental updates, redesigns, or changes in production origin to reintroduce nationalsecurity risks into the equipment authorization system or circumvent the regulation.  By requiring recertification for any modification made by a Covered List entity and affirming that SDoC pathways are unavailable to such entities, the Commission closes loopholes that could otherwise allow covered equipment to be altered in ways that introduce new vulnerabilities.  These clarifications resolve prior uncertainty, align implementation with the Secure Equipment Act’s directive that the Commission may not review or approve applications for covered equipment.  By aligning the rules with the Secure Equipment Act and clarifying their application, the Commission strengthens supplychain security while reducing costs from ambiguity.
4. Alternate Policies
a. Alternative A – No Action
114. Under this alternative, the Commission would decline to adopt any new measures to address the persistent vulnerabilities identified in the record.  This approach would preserve the status quo and impose zero additional implementation costs on regulated entities.  Because no new compliance obligations, reporting requirements, or equipment authorization reforms would be introduced, industry would not incur incremental expenditures, redesign costs, or administrative burdens.  From a narrow cost accounting perspective, this alternative presents the least immediate regulatory cost impact.
115. However, maintaining the current regulatory framework would leave unaddressed the security gaps and systemic vulnerabilities that have been repeatedly identified across recent national security determinations, including risks associated with logic-bearing hardware components.  These gaps are precisely the channels adversarial nation-states can exploit to facilitate intrusion, unauthorized surveillance, data exfiltration, network disruption, and covert access into U.S. communications infrastructure.
116. While it is difficult to estimate the incremental increase in risk of not adopting these rules, as noted above, even a single compromise of network infrastructure can result in cascading economic losses, including service disruptions, theft of sensitive commercial or governmental information, and degradation of critical infrastructure reliability.  With the national GDP exceeding $30 trillion in 2025, the Commission has already found that preventing only one percent of malicious cyber activity or communications disruption would yield benefits in the hundreds of millions of dollars.  Under this nonaction alternative, those risks would remain unmitigated, exposing U.S.  consumers, businesses, and government systems to continued and potentially escalating threats.
117. Therefore, although this alternative appears cost neutral from an implementation standpoint, it carries substantial hidden costs in the form of heightened exposure to national security threats.  The Commission finds that the economic and national security risks associated with preserving the status quo could easily result in harm costing hundreds of millions of dollars, far exceeding any near-term administrative savings.
b. Alternative B  – Adopt Rules with Broad Ban on All Components Produced by Named and identified entities on the Covered List
118. Under this alternative, the Commission would impose a broad prohibition on all components produced by Covered List entities, including hardware, firmware, and software, regardless of their specific role or relevance to any particular national security determination.  Although such an approach might appear comprehensive, it would create significant and widespread burdens for manufacturers and downstream supply chain participants and could lead to increased prices and possible equipment shortages.
119. A universal component ban would require industry to trace the origin of thousands of inputs that flow through complex global supply chains.  This would far exceed the targeted, risk based prohibitions adopted in the Third Report and Order for specific component classes such as logic-bearing hardware components, which were supported by detailed findings in the record.  A broad ban would likely force extensive redesigns of many products, require retesting to maintain compliance, and disrupt well established sourcing arrangements, particularly for smaller firms with limited supply chain flexibility.
120. These disruptions could translate into substantial consumer harms.  Manufacturers facing higher procurement and redesign costs would pass these costs on to consumers in the form of higher prices, reduced product availability, and slower deployment of new technologies.  Shortages or delays in critical communications equipment could also impair broadband deployment, IoT adoption, and upgrades essential to national competitiveness.
121. Finally, expanding restrictions without clear risk based justification would impose economic costs that are disproportionate to any incremental security benefits.  For these reasons, although the broad ban would reduce theoretical exposure to Covered List components, it would also cause major supply chain disruption, increase costs across the communications sector, and result in substantial consumer harms that outweigh the potential benefits of this alternative.
c. Alternative C  – the Adopted Rules
122. This alternative, which we adopt, is a targeted set of rules designed to close specific nationalsecurity gaps while avoiding unnecessary disruption to manufacturers, supply chains, or consumers.  The adopted approach focuses on components and practices that the record shows present the greatest national security risks, including logic-bearing hardware components produced by named and identified entities on the Covered List, rather than applying a blanket prohibition across all components.  This ensures that Commission action remains tightly aligned with clear nationalsecurity determinations, consistent with statutory requirements.
123. By limiting prohibitions to components directly implicated in national security findings, this alternative minimizes operational and redesign burdens on industry.  The record demonstrates that most suppliers in these categories already rely heavily on trusted manufacturers, and that only a small fraction of the market is affected by these targeted restrictions.  As a result, the expected cost impacts are modest, and the changes apply only to future equipment authorizations, allowing continued use of previously authorized equipment during a transition period.
124. This balanced approach also reduces potential downstream harms to consumers.  By avoiding the broad, sweeping restrictions contemplated under Alternative B, the adopted rules help preserve product availability, maintain price stability, and prevent disruptions to critical communications deployments.  At the same time, they strengthen oversight of high risk components, reinforce marketing and enforcement safeguards, and improve supply chain accountability in a manner proportionate to the threats identified.
125. For these reasons, the Commission finds that this alternative offers an effective framework that meaningfully addresses national security risks while limiting unnecessary economic burdens.  The adopted rules strike an appropriate balance: they close known vulnerabilities, enhance the security of U.S.  communications networks, and protect the public interest, all while minimizing impacts on the supply chain and reducing potential consumer harm.
5. Justification Determination
a. Benefits Exceed Costs
126. We find that the changes being adopted in the Third Report and Order should generate substantial benefits to national security and the resiliency of critical communications infrastructure, and that these benefits far outweigh the moderate compliance costs.  The benefits of enhanced protection of U.S.  communications networks are substantial, but are difficult to quantify.  We find, however, that the adopted rules can result in billions of dollars in annual benefits to the economy.  In contrast, we estimate one-time implementation costs to be below $300 million and annual recurring costs to be no greater than $40 million.  Therefore, we find that the benefits of strengthening oversight and protecting communications networks significantly outweigh the costs.    

Table of Benefits and Costs
 

One-Time
Recurring 
(per year)
Present Value over 5 Years 
(3% discount)
Present Value over 5 Years
(7% discount)
Benefits




Quantitative
N/A
          N/A
N/A
N/A
Qualitative
The Commission estimate the annual benefits can exceed $1 billion.
Costs ($millions)
$300
$40
$489
$475


b. Highest Net-Benefit Alternative  
127. Based on the record and economic analysis, Staff find that Alternative C offers the greatest net benefit among the three alternatives considered.  The adopted rules bolster national security with respect to our nation’s equipment authorization system, coupled with targeted measures to limit burdens on the supply chain and consumer welfare.  Alternative A is inferior because of the unacceptable national security risks that lack of action entails.  Alternative B is inferior to Alternative C because it could result in significantly higher compliance costs without commensurate improvements in national security.  
IV. THIRD FURTHER NOTICE OF PROPOSED RULEMAKING
128. In this Third Further Notice of Proposed Rulemaking we identify several additional loopholes in the current regulatory framework that may create vulnerabilities with potential implications for national security.  We propose targeted rules to close these gaps and prevent entities from exploiting ambiguities that undermine the Commission’s safeguards.  We find that these measures would further strengthen the security and integrity of the nation’s communications networks and yield substantial benefits for national, economic, and public security.  We also seek comment on measures to strengthen enforcement by requiring a U.S.-based liable party for FCC-certified equipment.  We also propose and seek comment on a wide range of additional measures that will modernize our Covered List rules, given recent updates to the Covered List that identify covered equipment based on production location.  These include updates to parts 2 and 15 of our rules concerning the Covered List; white-labelling; hardware and software bills of materials; further prohibitions or presumptions against authorization of equipment containing Covered List components or software; certification requirements for devices in Covered List sectors; equipment importation rules (including the importation for personal use and related definitions in part 15); equipment marketing rules (including prohibitions on marketing and use for illegal or unlawful purposes and related definitions in part 15); use of the FCC logo; streamlined revocation proceedings; codifying previously granted and expanded waivers permitting permissive changes; operating devices prior to authorization; UAS and router Covered List definitions; term limits on equipment authorizations; registration of SDoC devices; data analytics capability and need for modern EAS database; submarine cables; and a U.S.-based liable party requirement for FCC-certified equipment.  
A. Bifurcating Covered List rules
129. In light of recent updates to the Covered List consisting of production location-based Covered List entries applying to specific sectors of devices (i.e. UAS, UAS critical components, and routers), See Federal Communications Commission, List of Equipment and Services Covered by Section 2 of the Secure Networks Act (“Covered List”), https://www.fcc.gov/supplychain/coveredlist, (Last visited June 26, 2026). 
 the Commission seeks comment on a series of rules changes that would, in effect, bifurcate the Covered List into producer/provider-based and production location-based categories to provide clarity for compliance.  Some rules must necessarily apply to both categories—for example, the statutory requirement that the Commission prohibit the authorization of equipment on the Covered List. See, 47 CFR § 2.903(a). 
  But some of the Commission’s existing rules only apply to the first category.  As noted above, See supra para. 66. 
 rules applying to devices “produced by an entity identified on the Covered List” necessarily only apply to the first category, as they are predicated on the existence of a producer.  The Commission now seeks comment on establishing some rules that apply only to the second category of covered equipment, production location-based covered equipment.  Additionally, the Commission seeks comment on some rules changes that would apply to devices within a sector subject to a production location-based Covered List entry (i.e. UAS, UAS critical components, routers, and any sector subject to analogous specific determinations).  We refer to these as devices in a “Covered List sector.”  To that end, we propose to reorganize our part 2 rules and to direct PSHSB (which maintains the Covered List website) to redesign the website into 2 columns to reflect this proposed bifurcation.  
B. White Labeling
130. In the First Report and Order, the Commission expressed concern regarding the authorization of privately labeled, rebranded, or relabeled (“white labeled”) covered equipment and made clear that white labeling of any covered equipment does not change the status of whether the equipment is covered equipment. First Report and Order, paras. 187-88.
  We seek comment on how and whether the phrase “produced by” in specific determinations as reflected on the Covered List should be interpreted, in a manner consistent with the Secure Networks Act and the various specific determinations, Such specific determinations include the determinations by Congress in the 2019 NDAA as to “[t]elecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities)” and “video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities),” see Pub. L. 115-232, § 889, 132 Stat. 1636, 1917-19 (2018) (2019 NDAA § 889), as well as any subsequent determinations that have been or may be made using the phrase “produced by” that we determine to be specific determinations triggering 47 U.S.C. § 1601(c). 
 to address these concerns.
131. In the Second Report and Order, the Commission clarified that, in interpreting whether equipment is “produced by” a specific entity identified on the Covered List, applicants, responsible parties, and entities named in their reporting obligations should take a broad view of the term ‘produced by.’” Second Report and Order, para. 53.
  We declined at that time to adopt a comprehensive definition of “produced by,” but the Commission did offer some general guidance that “produced by” “likely includes substantial responsibility for or control over any major stage of the process by which a device comes into existence,” multiple entities could be said to have produced a single device, and that “produced by” would generally include the design, manufacturing, assembly, or development of the device. Second Report and Order, para. 53.
  However, we also noted, in response to an ex parte comment from Eagle Electronics, a U.S.  module company, that we did not intend to suggest that we “consider originating design IP as a sole factor in determining whether a device is produced by a particular entity.” Second Report and Order, para. 53, n. 205. 

132. Eagle Electronics contends that if an item is “produced by” a foreign entity based on its design, in particular “solely due to originating design IP” then that “would also prevent American companies from reshoring vital technology even if they can redevelop, secure, and improve the product, manufacturing a new and distinct product that is solely under U.S.  control.” Letter from Mark Kvamme, Chairman and Matt Wyckhouse, Board Member, Eagle Electronics, to: Marlene Dortch, Secretary, Federal Communications Commission, Docket No. 21-232, at 3. Filed October, 15, 2025. 
  Eagle Electronics suggests that this could undermine American national security.  For that reason, Eagle Electronics suggested that any definition of “produced by” should exclude cases where “a U.S.  liable party (i) exercises exclusive design control and exclusive authority over compilation, cryptographic signing, and delivery of firmware/updates for the device’s logic-bearing subsystems, (ii) precludes any third-party update pathway through secure-boot/cryptographic binding, and (iii) provides independent security evaluation and supply-chain provenance.” Id.

133. By contrast, Telit Cinterion, another module producer, commented on the Second Further Notice, encouraging the Commission to codify a more expansive definition that would that “include[] any entity that designs, develops, manufactures, supplies, signs firmware, controls over-the-air update infrastructure, manages eSIM/subscription provisioning, or holds cryptographic keys/certificates for an RF module or device, regardless of brand, reseller, or licensee arrangements.” Telit Cinterion Comment at 6. 
  
134. Now, the Commission seeks comment on whether to codify a definition of “produced by” for purposes of the Covered List and related Commission rules. See, e.g., 47 C.F.R. §§ 2.906(d), 2.938(b)(2), 15.103(j).
  We seek comment on whether the Commission should formally codify in our rules that:  “A device is ‘produced by’ an entity if that entity exercises substantial responsibility for, or control over, any major stage of the process by which the device comes into existence, including the design, manufacturing, assembly, or development of the device.  A device may be ‘produced by’ more than one entity.”  If the Commission codifies this definition, should the Commission, as recommended by Eagle, expressly exclude cases in which an entity is solely responsible for the originating design IP but a U.S.  liable party (i) exercises exclusive design control and exclusive authority over compilation, cryptographic signing, and delivery of firmware/updates for the device’s logic-bearing subsystems, (ii) precludes any third-party update pathway through secure-boot/cryptographic binding, and  (iii) provides independent security evaluation and supply-chain provenance?  Alternatively, should the Commission adopt a different definition?  Should we adopt a narrower definition, perhaps excluding design entirely?  Should the Commission instead adopt a broader definition?  For example, should the Commission adopt the definition that Telit Cinterion proposes? 
135. Currently, applicants seeking equipment authorization must certify, among other things, that the equipment for which authorization is sought is not prohibited from receiving equipment authorization as covered equipment and “[a]n affirmative or negative statement as to whether the applicant is identified on the Covered List.” 47 CFR § 2.911(d)(5). 
  Is this sufficient to prevent white labeling of covered equipment?  The Commission seeks comment on whether to adopt a requirement that an applicant for equipment authorization provide a written and signed list of any and all entities that produced the device for which equipment authorization is sought.  Would this better allow the Commission to ensure that white-labelled covered equipment does not inadvertently receive equipment authorization?  Specifically, how might this help the Commission monitor devices for which there is more than one producer, one of which is an entity identified on the Covered List?  What are the costs and benefits of such a requirement? 
136. The Commission further seeks comment on whether white labelers seeking equipment authorizations have abused, or could abuse, our rules streamlining certification requirements for devices claiming “electrically identical” status.  We seek comment on proposals to address the potential for abuse.  The Commission’s rules permit a grantee, or under authorization of the grantee, to market a device that is “electrically identical” to an authorized device without obtaining a new certification or SDoC authorization, and electrically identical devices may share the same FCC ID even though marketed under different model numbers. See, e.g., 47 CFR §§ 2.924, 2.933.
  Electrically  identical devices share the same exact internal electrical circuitry, RF characteristics, and emissions profiles, but can be marketed under different model names or trade names under the same FCC ID.  Our rules also permit a change in identification procedure, where another company can white-label an existing, certified product “without a change in design, circuitry or construction” and legally sell it under their own brand name with their own FCC ID without resubmitting equipment or measurement or test data. 47 CFR § 2.933.
  In our experience, entities have abused this procedure to evade our enforcement authority. In February 2024, security researchers publicly disclosed security vulnerabilities in Eken-branded doorbell cameras that allowed hackers to view private home video streams, and an FCC commissioner publicly investigated the incident.  See, Starks Letters to Amazon, Sears, Shein, Temu, and Walmart (Mar. 8, 2024), https://www.fcc.gov/document/starks-letters-amazon-sears-shein-temu-and-walmart.  Twelve days later, a new grantee, Converge Beauty, obtained different FCC IDs for doorbell cameras “electrically identical” to Eken equipment; Converge Beauty did not need to submit new test reports.  See, https://fcc.report/FCC-ID/2BFEP-M50/7188075.pdf.  Converge Beauty’s filing was signed by Eken employees.  Eken failed to respond to the Commission’s initial attempts to investigate in 2024, leading the Commission to issue a Notice of Apparent Liability later that year.  Eken Group Limited, Notice of Liability for Forfeiture, FCC 24-122, 39 FCC Rcd 12990 (2024) (proposing $730,000 statutory maximum civil penalty against a foreign doorbell camera manufacturer for submitting false certifications under section 2.911(d) regarding its U.S. agent for service of process).

137. Typically, the Commission receives notice of electrically identical equipment either through test measurement reports that are filed as part of the original application for certification or through a subsequent filing in which the grantee identifies specific trade models and avers that they are electrically identical to the unit that was originally tested and found to be compliant.  Entities that wish to rebrand or white label an authorized device may, with permission of the grantee, market an electrically identical version using the grantee’s original FCC ID.   47 CFR § 2.933.
 This type of white labeling arrangement should be, but might not always be, captured within the equipment application files for both entities in our EAS database.  However, white label entities may also apply for their own certification and market the device under their own unique FCC ID; in such cases, the Commission receives no statement that links the original grantee to one or more white label grantees.  To the extent that one of several electrically identical devices, marketed under different brands and trade models, is later found to be noncompliant or pose a potential security risk, there is no current means to swiftly identify the remaining electrically identical trade models, which may present the same risks.
138. We seek comment on the extent to which manufacturers or providers engage in the production of white-labeled RF devices for the U.S.  market, See, e.g., These Video Doorbells Have Terrible Security. Amazon Sells Them Anyway, Consumer Reports (Feb. 29, 2024), https://www.consumerreports.org/home-garden/home-security-cameras/video-doorbells-sold-by-major-retailers-have-security-flaws-a2579288796/ (identifying seemingly identical video cameras, controlled by same app, sold under brand names Eken, Tuck, Fishbot, Rakeblue and others).
 and we seek comment on a range of other measures the Commission could adopt to address potential white labeling.  Does a similar white label market exist for components, such as IoT modules or UAS critical components, that could be produced for the service and repair industry?  Given the lack of transparency concerning white labeling arrangements, should we require equipment authorization applicants to disclose all known “electrically identical” products?  For instance, if a device has been authorized and the liable party then licenses or authorizes an applicant or another entity to produce an electrically identical device, should the liable party be required to disclose that entity, brand name, and device model?  To the extent that the Commission does not adopt a requirement to provide complete HBOM and SBOM, should applicants still be required to provide the origin of the device, i.e., where its components were produced?  Should applicants update the Commission whenever new “electrically identical” products are imported or marketed?  Should the Commission limit the ability to market “electrically identical” products under section 2.924 without a separate authorization?  Should the Commission limit the grantee’s ability to change identification of “electrically identical” products under section 2.933?  Should the Commission adopt any other counter-white labeling measures? 
C. Hardware and Software Bill of Materials 
139. The Commission’s equipment authorization rules have, until recently, focused principally on the finished device — whether the equipment as a whole is produced by an entity identified on the Covered List and whether it complies with applicable technical standards.  In this proceeding, however, the Commission’s inquiry has increasingly turned to the component parts from which equipment is assembled.  In the Second Report and Order, the Commission prohibited the authorization of devices containing covered modular transmitters, and in the Third Report and Order above, the Commission extends that approach to devices containing logic-bearing hardware components produced by Covered List entities. Second Report and Order, 40 FCC Rcd at 8436-46, paras. 14-31; supra, para. 14-35. 
  This shift reflects a recognition that the national security risks a device poses may be determined as much by the provenance of the components embedded within it, as its outward branding or even final assembly.  The recent production location-based additions to the Covered List—covering UAS, UAS critical components, and routers produced in a foreign country—sharpen this concern.  Unlike producer/provider-based determinations, which turn on the identity of a known entity, production location-based determinations turn on where and how a device or its components are made.  The addition of UAS critical components, in particular, demonstrates national security agencies’ concern with device components.
140. Applying such determinations requires information that has not traditionally been seen as relevant to equipment authorization: the geographic origin of components, the location of design and development activity, and the composition of a device’s supply chain.  The Commission’s existing certification record, which centers on technical compliance and a small set of attestations, was not designed to capture this information.  At the same time, the Commission’s experience implementing its Covered List rules—and the broader experience of its federal partners—underscores that supply-chain monitoring is now central, rather than ancillary, to the equipment authorization program’s national-security function. Additionally, the President’s National Security Strategy (NSS) states that “the United States must never be dependent on any outside power for core components.”  National Security Strategy at 13.  The NSS further notes that “the Intelligence Community will monitor key supply chains and technological advances around the world to ensure we understand and mitigate vulnerabilities and threats to American security and prosperity.”  Id.  
  Against this background, the Commission seeks comment on whether SBOM and HBOM disclosures, together with producer and origin reporting, would give the Commission, TCBs, and other stakeholders the visibility into component-level provenance that the current rules do not provide, but are necessary to fulfilling our obligations under the Secure Networks Act, Secure Equipment Act, and our related rules.
141. For example, the Commission recently issued a show-cause order to Odyssey Robot LLC to potentially revoke its equipment authorizations because it allegedly sought to bypass the FCC’s Covered List rules prohibiting the authorization of foreign-made UAS by falsely claiming its devices were manufactured in the United States. In the Matter of Odyssey Robot LLC, Order to Show Cause, ET Docket 26-186 (July 21, 2026). 
  This action shows the need for more detailed supply chain reporting.  The only reason OET learned of Odyssey’s alleged false statement was that Odyssey listed a U.S.-based assembler (who claims not to have assembled Odyssey devices), even though such information was not required by FCC rules.  Id. 
  We therefore tentatively conclude that submission of information regarding the producer and production location of devices is therefore useful for enforcing FCC Covered List rules.
142. As noted by Somos, Inc., the use of SBOM and HBOM to provide transparency is common in modern software supply-chain risk management practices. Somos, Inc at 6; see also Lucas Tate, et al., Comparing Bills of Material, Pacific Northwest National Laboratory (2024), https://arxiv.org/pdf/2411.10384 (“Recently, BOMs have been gaining traction as a tool to increase our supply chain understanding and help respond to this threat.”); Seth Carmody, et al., Building resilient medical technology supply chains with a software bill of materials, npj Digit. Med. 4, 34 (2021), https://doi.org/10.1038/s41746-021-00403-w (“An example of effective application of the SBOM concept comes from the financial services industry. By 2015, a series of software supply-chain vulnerabilities had forced the industry to re-evaluate the third-party software in its infrastructure.  This sector quickly adopted SBOM concepts into their internal development and procurement processes. Now, if a vendor can provide an SBOM, it serves as a litmus test for the maturity of the vendor’s organization. If vendors lack an SBOM, many financial services organizations anticipate that their products will likely cost more to evaluate, operate, and own over their lifecycles. As a result, the financial organizations might negotiate discounts to account for these increased costs.”).  
  For consumers of electronics, SBOM and HBOM play a similar role that ingredients labels play for consumers of food and drug products; they provide transparency about what is found inside a regulated good.  Many manufacturers already develop such materials to satisfy existing standards. For example, the Food and Drug Administration (FDA) now requires that manufacturers of FDA-regulated cyber devices provide an SBOM for the commercial, open-source, and off-the-shelf software components contained within the device.  See Food and Drug Administration (FDA), Cybersecurity in Medical Devices Frequently Asked Questions (FAQs), https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs.  (Last visited June 26, 2026). 
  We seek comment on requiring that applicants for equipment authorization submit a written and signed HBOM and SBOM at the time they apply for certification and requiring that grantees update the Commission of any changes to the HBOM or SBOM of the device.  Under the proposed requirement, all components of a device, including hardware, software, and firmware would be subject to disclosure.  The disclosure would be required to identify: the producer and place of production of the device itself, the producer of each component, the location of each component’s production, and the percentage of component value associated with each production location.  For example, if all components were manufactured in the U.S., the location value would be 100 percent assembled in the U.S.  If production occurs in multiple locations, the disclosure would identify each country involved and the corresponding percentage of component value (e.g., XX percent manufactured in Country A, XX percent manufactured in Country B).  If an equipment authorization is granted, the grantee would be required to update the HBOM and SBOM submissions within 30 days of any changes therein.
143. The Commission seeks comment on this approach broadly.  What are the costs and benefits of such a proposal?  Could such a proposal better ensure that the Commission can better monitor the equipment authorization process to ensure that covered equipment does not get authorized?  Would such a proposal help better inform consumers regarding the devices they purchase?  What are the burdens on industry that would be associated with this proposal?  We observe that a wide range of free and opensource SBOM generation tools are already broadly available and widely used across the software development ecosystem. Widely available open-source tools include Syft, Microsoft SBOM tool, CycloneDX generator, SPDX SBOM generator, Wiz.  See Wiz.com, Guide to SBOM Tools: 5 Picks for Enterprise Security Teams, May 6, 2026, https://www.wiz.io/academy/application-security/top-open-source-sbom-tools.
  We tentatively conclude that the burden associated with producing SBOMs for newly developed software using automated methods is negligible.  We seek comment on this tentative conclusion.  We also seek comment on the costs of implementing SBOM requirements for existing software products.  Specifically, we estimate these costs to be under $5,000 per software program.  We further estimate the HBOM requirements may cost up to $10,000 in engineering input and information gathering per hardware equipment.  We estimate approximately 50% of equipment seeking authorization by the Commission has already met the proposed SBOM and HBOM requirements.  We seek comment with specific quantitative evidence on whether these estimates are reasonable, too high, or too low, and whether alternative cost estimates or methodologies should be considered.  
144. Alternatively, should the Commission limit the HBOM and SBOM requirements to equipment authorizations for devices in a Covered List sector or a narrower subset of applicants?  In other words, should we only require HBOM and SBOM submissions for devices that are UAS, UAS critical components, or routers See, Federal Communications Commission, List of Equipment and Services Covered by Section 2 of the Secure Networks Act (“Covered List”), https://www.fcc.gov/supplychain/coveredlist, (Last visited June 26, 2026).
 (as well as any future Covered List sector)?  Alternatively, should the Commission apply such requirements only to higher-risk equipment, such as equipment from foreign adversary countries or another subset of manufacturers that present heightened national security concerns? Commercial Drone Alliance Ex Parte Letter (July 16, 2026).
  This more targeted approach would focus on the devices for -which component tracking is most critical to enforce the Commission’s restrictions on authorizing covered equipment.  Are there classes of trusted UAS or UAS critical components that should be exempt from such requirements, such as equipment included on the Defense Contract Management Agency’s Blue UAS Cleared List, or for entities who are recipients of Conditional Approvals, manufacturers that satisfy the Buy American standard, Part 135/108 FAA certificated manufacturer-operators, vertically integrated domestic manufacturer-operators who do not sell UAS to third parties, or U.S.-based companies who utilize suppliers based in the United States or in allied countries? Public Safety and Homeland Security Bureau Announces Exemptions of Certain Uncrewed Aircraft Systems (UAS) and UAS Critical Components from FCC Covered List, WC Docket No. 18-89; ET Docket No. 21-232; EA Docket No. 21-233, Public Notice, DA 26-22A1. https://docs.fcc.gov/public/attachments/DA-26-22A1.pdf.

145. We also seek comment on whether we should limit the HBOM/SBOM requirement to certain components?  Should we, for example, limit this to specific components, such as logic bearing hardware component?  Should we instead just list out several critical components, such as modular transmitters and IoT modules, semiconductors, and optical transceivers?  For example, under this proposal applicants would have to provide information on the producer and place of production of any semiconductor in their device, but not mere nails and screws.  Would this more targeted approach better serve national security objectives without imposing undue costs?  We seek comment on this option.  
146. We also seek comment on the appropriate transition periods and implementation timelines if these proposals are adopted.
D. Software and other Components produced by Covered List entities
147. In the Second Report and Order, the Commission took its first step toward addressing component-level national-security risks in the equipment authorization program.  The Commission prohibited the authorization of any device that incorporates a modular transmitter when that modular transmitter is itself covered equipment, even where the host device is not otherwise produced by an entity identified on the Covered List. See supra, at para. 3. 
  In the Third Report and Order above, the Commission has now extended the prohibition to devices containing logic-bearing hardware components produced by Covered List entities, while declining at this time to act on broader categories such as logic-bearing hardware, firmware, or software, and keeping the record open on those questions. See supra, at para. 13.
  We build on that record here.
148. Now the Commission proposes to, and seeks comment on, prohibiting authorization for devices incorporating any components produced by a Covered List entity.  Given that such entities have been found to produce or provide communications equipment or services that “pose unacceptable risks to the national security of the United States or the safety and security of United States persons,” would such a rule advance national security or public safety objectives by prohibiting the authorization of dangerous devices?  What would be the costs and benefits of such a rule?  Would a rule covering all components be simpler and easier to comply with than our existing rules that cover devices containing certain specified components?  Does the Commission have the legal authority to adopt such a rule that would include non-RF components like screws or nails that would otherwise be presumed not to directly cause interference?  We note that the Secure Networks Act allows for the addition of devices to the Covered List for reasons independent of their ability to affect RF transmission or cause interference. For a piece of equipment to be added to the Covered List, the equipment must be “capable of—(A) routing or redirecting user data traffic or permitting visibility into any user data or packets that such equipment or service transmits or otherwise handles; (B) causing the network of a provider of advanced communications service to be disrupted remotely; or (C) otherwise posing an unacceptable risk to the national security of the United States or the security and safety of United States persons.” 47 U.S.C. § 1601(b)(2). 
  Moreover, recent National Security Determinations leading to additions to the FCC’s Covered List have included concerns about supply chain dependencies, rather than direct compromise of communications. See Federal Communications Commission, National Security Determination on the Threat Posted by Routers Produced by Foreign Countries, March 20, 2026, https://www.fcc.gov/sites/default/files/NSD-Routers0326.pdf; Federal Communications Commission, National Security Determination on the Threat Posed by Certain Uncrewed Aircraft Systems and Certain Uncrewed Aircraft Systems Critical Components, January 7, 2026, https://www.fcc.gov/sites/default/files/NSD-FCC-Covered-List-Waiver0126.pdf. 
  Do devices that have a supply chain dependency on Covered List entities for components pose national security risks? The President’s National Security Strategy notes that “the United States must never be dependent on any outside power for core components.” National Security Strategy at 13. 
  Does the Communications Act, the Secure Networks Act, and the Secure Equipment Act, or any other statute, individually or collectively give the Commission this authority? See, e.g., 47 U.S.C. §§ 151, 154(i), 302a, 1601-09.

149. Alternatively, should the Commission adopt a rebuttable presumption against authorizing devices incorporating components produced by a Covered List entity, rather than categorically prohibiting the authorization of such devices?  Under such an approach, the Commission would prohibit the authorization of devices incorporating any component produced by a Covered List entity unless the applicant for equipment authorization could demonstrate that the device incorporating such a component does not pose “unacceptable risks to the national security of the United States or the safety and security of United States persons,” for example because the component cannot affect the RF emissions of the device or other reasons?  If the Commission adopts such a rule, what standard should the Commission use for overcoming this presumption?  Should we use a clear-and-convincing evidence standard, as we have in other proceedings, or should we use a less stringent preponderance of the evidence standard? See, e.g., 47 CFR § 1.80003(e).
  What would be the costs and benefits of this approach compared with a categorical prohibition discussed above? 
150. In addition to hardware components, we also seek comment on how software and/or firmware produced or provided by a Covered List entity, if incorporated into another device, raises unacceptable national security risks.  We note that following a specific determination from the Department of Commerce acting pursuant to Executive Order 13873, we have added to the Covered List, and therefore prohibited from equipment authorization, “equipment with integrated Kaspersky Lab, Inc.  (or any of its successors and assignees) cybersecurity or anti-virus software.” FCC Covered List; Kaspersky Public Notice;  Commerce Final Determination (“The Department finds that Kaspersky’s provision of cybersecurity and anti-virus software to U.S. persons, including through third-party entities that integrate Kaspersky cybersecurity or anti-virus software into commercial hardware or software, poses undue and unacceptable risks to U.S. national security and to the security and safety of U.S. persons”) (emphasis added).  
  We also note that equipment on the Covered List is often controlled by software that is integrated onto the device. DJI Android Go 4 Application Security Analysis, Synacktiv (July 23, 2020) (“We found that . . . two features of the software that call home and wait for a file that orders the user’s phone to install a forced update or install a new software.  This mechanism is very similar to command and control servers encountered with malwares. . . .  [ a component] embedded in recent versions of DJI Android GO 4 application collects personal data such as IMSI, IMEI, the serial number of the SIM card, etc.  This data is not relevant or necessary for drone flights and go beyond DJI privacy policy.”).
  For example, UAS, UAS critical components, and routers are often configured entirely through apps and receive software updates through remote device management platforms. See, e.g., Michael Fagan et al., Profile of the IoT Core Baseline for Consumer IoT Products, NIST IR 8425 (Sept. 2022), https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8425.pdf. 

151. We also note existing rules require software security features for authorized equipment.  For example, all Bluetooth, WiFi, and other wireless devices operating in the unlicensed spectrum bands must “contain security features to protect against modification of software by unauthorized parties.” 47 CFR § 15.407(i).
  Our rules also require manufacturers “to take steps to ensure that only software that has been approved with a software defined radio can be loaded into the radio.” 47 CFR § 2.944(a). 
  
152. Based on these potential risks, should the Commission prohibit the authorization of any device that has been integrated with the software or firmware that was produced or provided by a Covered List entity?  Would such a prohibition address the potential “unacceptable risks” that such software or firmware could pose when integrated into an electronic device?  What are the costs and benefits of such an approach?  What alternative software, firmware and components are available once those produced by the named and identified entities on the Covered List are prohibited from getting authorized by the Commission?  Alternatively, should the Commission adopt a rebuttable presumption against authorizing devices that have been integrated with the software or firmware that was produced or provided by a Covered List entity that can be overcome if an applicant demonstrates that such device does not pose “unacceptable risks to the national security of the United States or the safety and security of United States persons?”  The Commission seeks comment on the potential switching costs associated with transitioning to software, firmware, and components not produced by Covered List entities if such equipment produced by Covered list entities is prohibited, including any increased costs that may fall on U.S.  producers, importers, retailers, or consumers.  The Commission tentatively concludes that the annual costs of this proposal to be under $50 million and seek comment on our tentative assessment.  Should the Commission go further still and prohibit the downloading software produced or provided by a Covered List entity onto communications equipment?  Should it prohibit the downloading of any software that is a communications service identified on the Covered List? 
E. Requiring certification for devices in Covered List sectors 
153. The Commission’s rules require that no communications equipment produced by entities identified on the Covered List can obtain equipment authorization unless the authorization is obtained pursuant to the certification process, which is the most rigorous approval process for radio frequency devices. See, 47 CFR 2.907(c) (“Any equipment . . . produced by any entity identified on the Covered List . . . must obtain equipment authorization through the certification process.”); Federal Communications Commission, Equipment Authorization Procedures, https://www.fcc.gov/general/equipment-authorization-procedures. Last visited (June 30, 2026).
  This certification requirement applies even if the device would be otherwise subject to SDoC or an exemption from equipment authorization. See Federal Communications Commission, Equipment Authorization Procedures, https://www.fcc.gov/general/equipment-authorization-procedures. Last visited (June 30, 2026).
  The Commission adopted these rules for equipment produced by a Covered List entity, because “the certification process provides the Commission with the necessary oversight to” fulfill its statutory mandate to prevent the authorization of covered equipment. EA Security R&O and FNPRM at para. 78; accord. id. at para. 100.
 Under the certification process, applicants are required to make certain attestations (in the form of certifications) about the equipment for which they seek authorization, including attesting that the equipment is not covered and indicating whether the applicant is an entity identified on the Covered List. EA Security R&O and FNPRM, 37 FCC Rcd at 13517-19, paras. 54-56; 47 CFR § 2.911(d)(5); see also, § 2.932(e); § 2.1033(b); § 2.1043(b)(2)(i), (3)(i).
  Applicants are also required to submit supporting documentation and test data, which TCBs use to evaluate the devices, determine whether the devices meet all of the Commission’s applicable technical and non-technical requirements, and ensure that the devices are not covered equipment. See, e.g., EA Security R&O and FNPRM, 37 FCC Rcd at 13514-16, 13518, paras. 48, 50, 52, 55; see also, e.g., 47 CFR § 2.962(e).
  
154. The Commission tentatively concludes that, just as devices produced by Covered List entities require the highest tier of Commission scrutiny and oversight, devices in Covered List sectors, such as UAS, UAS critical components, and routers, do as well.  We seek comment on whether this framework should apply to Covered List sectors pursuant to a determination.  We propose to amend 47 CFR § 2.907(c) to require any device from a Covered List sector to undergo the certification process even if otherwise eligible for authorization pursuant to a SDoC or exempt from equipment authorization.  In other words, we propose to require UAS, UAS critical components, and routers—regardless of the producer or other characteristics of the device—to be subject to certification.  We seek comment on this proposal, including the costs and benefits associated with this proposal.  Should the Commission apply this proposal to any future Covered List sector?  Are there categories of Covered List sector equipment for which the SDoC process would continue to be appropriate (e.g., equipment included on the Defense Contract management Agency’s Blue UAS Cleared List, or for entities who are recipients of Conditional Approvals, manufacturers that satisfy the Buy American standard, Part 135/108 FAA certificated manufacturer-operators who do not sell UAS to third parties, or U.S.-based companies who utilize suppliers based in the United States or in allied countries)?  Should this prohibition only apply to Covered List sector equipment produced in foreign adversary countries?  We seek comment on how the Commission could narrow the scope of this proposal that would still provide the Commission with appropriate oversight over equipment posing national security risk.  The Commission seeks further comment on how this proposal would impact its existing framework for modular component certification and host product integration, and whether changes to the SDoC rules would create burdens or result in longer production timelines. Commercial Drone Alliance Ex Parte Letter (July 16, 2026).

155. We note that certification may also be vital for devices in Covered List sectors as a way to ensure that covered equipment cannot circumvent Covered List restrictions.  The Commission’s rules permit specific types of modules (“modular transmitters”) to be authorized as “standalone” equipment, provided the equipment meets all applicable requirements.  The rules provide that when an authorized modular transmitter is incorporated as a component part into another product, host, or device, no further equipment authorization is required insofar as the final product, host, or device conforms to the terms of the module’s authorization.  Noting that these modular transmitter rules created a potential loophole regarding covered equipment, in the Second Report and Order, the Commission adopted rules to prohibit the authorization of equipment containing modular transmitters if the modular transmitters were themselves covered equipment. Second Report and Order, at para. 3.
  Now that the Covered List contains production location-based covered equipment, the Commission seeks comment on whether there is a new loophole in our Covered List rules that could enable devices to circumvent the Commission’s Covered List restrictions.  As a result of our modular transmitter rules, devices in certain Covered List sectors (e.g., routers) that incorporate previously-authorized non-”covered” modular transmitters may be able to avoid the equipment authorization process altogether by relying on the FCC IDs that have been granted to the modular transmitters.  
156. We seek comment on potential solutions to close this loophole.  Would requiring certification for any device in a Covered List sector adequately reduce concerns that covered equipment in these sectors could skirt Commission restrictions using our modular transmitter rules?  Are there other ways the Commission could close this loophole?  Covered equipment is already prohibited from using the SDoC process under the rules adopted in the First Report and Order. First Report and Order, 37 FCC Rcd 13496, para. 3.
  As national security vulnerabilities evolve, additional equipment may be identified and added to the Covered List, and any such newly added equipment would become subject to the same prohibitions.   We seek comment on the expected volume of products that may be subject to the certification requirements each year.  For example, would the number be on the order of 10,000 products annually, 100,000 products, or some other magnitude?  We invite commenters to provide data, statistics, and other evidence to support their estimates.
157. Under the certification process, applicants must provide, (1), among other submissions, a written and signed certification that the equipment is not covered equipment; and (2) an affirmative or negative statement as to whether the applicant is identified on the Covered List as an entity producing covered communications equipment. See, 47 CFR § 2.911(d)(5).
  Should we amend 47 CFR § 2.911 to require additional disclosures as part of this certification process?  If so, what, if any, additional information should applicants provide?  In addition to HBOM and SBOM requirements that we sought comment on above, See infra, para. 118.
 should we, for example, require applicants to provide additional contact information for the producer(s) of the device and/or components to allow for TCB or Commission verification of the production location information?  The Commission tentatively concludes that the additional contact information required under this proposal would impose, at most, the equivalent of one hour of an office administrator’s time per application.  We seek comment on this preliminary assessment, including whether this estimate accurately reflects the expected burden.
158. We also seek comment on the appropriate transition periods and implementation timelines if these proposals are adopted.
F. Importation under 47 CFR § 2.1204
159. Section 2.1204 of the Commission’s rules sets forth conditions that must be met before radio frequency devices may be imported into the United States.  As presently drafted, however, these conditions do not distinguish between covered equipment and non-covered equipment.  As such, parties could conceivably use the ability to import covered equipment in limited quantities by operation of one of several pre-authorization import conditions.  We tentatively conclude that we should close this loophole by excluding covered equipment from § 2.1204(a) entirely and by creating a new subsection in § 2.1204 to provide a narrow set of conditions for importing Covered List equipment.  We seek comment on this proposal, both generally, and in the following specific areas.  
1. Conditions for Importation of Covered List Equipment 
160. Because covered equipment cannot receive new authorizations from the FCC, we propose to modify § 2.1204(a) of our rules (“Import conditions”) to expressly exclude covered equipment and to add a new paragraph to govern the conditions under which covered equipment may be imported without an equipment authorization.  Specifically, we propose to permit the importation of covered equipment only when such equipment meets one or more of the following conditions: (a) has a valid equipment authorization that has not been limited through the process set forth in § 2.939(e); (b) is being imported in a quantity of 40 or fewer units for testing and evaluation or product development, unless the Chief of OET grants written approval for a greater quantity; (c) is being imported solely for export; (d) is being imported for the exclusive use of the U.S.  Government; or (e) is being imported solely for the purpose of developing products to be marketed exclusively to the U.S.  Government or pursuant to federal contracts.  We seek comment on this proposal.  Are there additional conditions under which we should allow covered equipment to be imported? 
2. Testing and Evaluation Unit Quantity
161. The Commission’s current regulations allow importation of 4,000 or fewer unauthorized radiofrequency devices from a given model if the devices are being imported for testing and evaluation to determine compliance with FCC rules and regulations, product development or suitability for marketing. 47 CFR § 2.1204(a)(3).
  The Commission also permits a greater number of devices to be imported if the OET Chief provides written approval. 47 CFR § 2.1204(a)(3)(i). 
  We tentatively conclude that 4,000 units is an unreasonably large number of unauthorized covered equipment devices to be imported, and that importation to determine suitability for marketing covered equipment is never reasonable, given that the marketing and sale of such equipment is prohibited.  We tentatively conclude, based on our experience dealing with device testing, that 40 devices for a given model seems to be sufficient for testing and evaluation and evaluation and product development.  Are 40 units sufficient for testing and evaluation?  Would a smaller number be sufficient?  Is a greater number needed?  If larger or smaller numbers are needed for these purposes, commenters should explain why.  Additionally, should the Commission continue to allow the Chief of OET to provide written approval for the importation of a greater number of a certain model of covered equipment, as is currently allowed in the Commission’s importation rules? 47 CFR § 2.1204(a)(3)(ii).
  Should there be any limits on the OET Chief’s discretion?
3. Import for Export
162. Section 2.1204(a)(5) of the Commission’s rules, the “import for export” condition, allows unauthorized devices to enter the United States so long as the equipment is being imported solely for export and is not marketed within the United States. 47 CFR § 2.1204(a)(5).
  The Commission proposes to maintain this condition as an option to import unauthorized covered equipment in a new section (b), because importation of the device solely for re-export does not pose the same risks as importing the device of use or sale in the U.S.  market.  We seek comment on this proposal.  
163.  Separately, and independent of the Covered List, subsections 2.1204(a)(5)(i)-(ii) create  exceptions that allow the marketing of unauthorized cellphone handsets and similar devices that are only capable of functioning outside of the United States. The Commission’s rules prohibit the marketing of import for export equipment unless:  1) the device is a foreign standard cellular phone solely capable of functioning outside the U.S., or 2) the device is a multi-mode wireless handset that has been certified under the Commission’s rules and a component (or components) of the handset is a foreign standard cellular phone solely capable of functioning outside the United States.  47 CFR § 2.1204(a)(5)(i)-(ii).
  The rationale given for these exceptions in 1999 was that the phones operate on standards not used in the United States and thus cannot function here.“These types of devices may continue to be imported and marketed for use outside of the U.S.” Federal Communications Commission, Importation of Devices Capable of Causing Harmful Interference, 64 Fed. Reg. No. 248 72571. (Dec. 28, 1999). 
  We tentatively conclude that the exceptions in paragraphs (a)(5)(i)-(ii) should be eliminated, thereby removing the exception permitting the marketing of unauthorized cellphone handsets and similar devices that are only capable of functioning outside of the United States.  There seems to be no need to market devices in the U.S.  that cannot operate in the U.S.  Accordingly, we seek comment on whether this exception should be maintained.  Are there currently domestic entities that benefit from the import for export trade in these cellphones?  If operated within the United States, could these exempted foreign cellphones increase the potential for interference to communications or introduce an unacceptable national security risk through, for example, a Wi-Fi firmware update?  We seek comment regarding methods that would assist in positively identifying cellphone equipment that is only capable of functioning outside of the United States.  
4. Government Use Exclusion
164. Section 2.1204(a)(6) reflects a statutory provision that permits the importation of unauthorized (or not-yet-authorized) equipment exclusively for U.S.  Government use. See, 47 U.S.C. § 302a(c); 47 CFR § 2.1204(a)(6).
  We therefore propose to preserve this condition for the importation of unauthorized covered equipment.  We also propose to expand this condition for unauthorized covered equipment to also include equipment that is imported for the purpose of developing other products that are exclusively for federal use.  Would such exemptions be in the public interest?  For example, might defense contractors want to import the latest models of foreign-produced UAS to develop their products?  If so, what type of documentation would be necessary and sufficient to permit CBP to verify the import condition at the port of entry or prior to its arrival?  What additional safeguards or procedures should we place on the importation of Covered List equipment for this purpose?  
5. Importation for Personal Use
165. The Commission’s import rules also permit a limited exception for an individual’s personal use. Webster’s defines “personal” as, inter alia, “intended for private use or use by one person.”  See, https://www.merriam-webster.com/dictionary/personal.  We note that the term personal use is also used, without definition, in the context of homemade radiofrequency devices.  “Equipment authorization is not required for devices that are not marketed, are not constructed from a kit, and are built in quantities of five or less for personal use.”  47 CFR § 15.23(a) (requiring the use of good engineering practices to prevent interference).
  Section 2.1204(a)(7) permits the importation of up to three devices, in specified categories, that are not intended for sale. Three unauthorized devices for personal use may only be from one the following categories: 
(i) Unintentional radiator as defined in part 15 of this chapter which may include radio receivers, computers or other Class B digital devices in part 15 of this chapter. 
(ii) Consumer ISM equipment as defined in part 18 of this chapter. 
(iii) Intentional radiators subject to part 15 rules only if they can be used in client modes as specified in § 15.202 of this chapter. 
(iv) Transmitters operating under rules which require a station license as subscribers permitted under § 1.903 of this chapter and operated under the authority of an operator license issued by the Commission. 
47 CFR § 2.1204(a)(7).
  Given that compromised Covered List devices could be networked to present a greater threat vector, we seek input on whether any specific types of covered equipment should be excluded from the exemption or whether the personal use exemption should be wholly eliminated for Covered List equipment.  Further, we propose, for purposes of § 2.1204(a)(7), to define “personal use” as applying to a device which will be used: (1) in a manner not intended for sale, lease, marketing, distribution, or other commercial advantage; and (2) solely by an individual or a not-for-profit entity for noncommercial purposes.  We seek comment on the appropriate meaning of the term “personal use” in this context.  Should “personal use” be defined in the same manner for purposes of 
§ 15.23 of the Commission’s rules? 47 CFR § 15.23.
 
6. Other importation exceptions
166. We seek comment on whether any other exclusions to the ban on unauthorized radio frequency device importation should be modified.  For instance, should the § 2.1204(a)(4) exclusion permitting limited numbers of devices for demonstration at trade shows be revised in any way?  Should the § 2.1204(a)(8) exclusion permitting importation for repair of an item be retained or revised in any way?  Should the § 2.1204(a)(9) exclusion allowing importation of medical implant transmitter inserted in a person or a medical body-worn transmitter be retained or amended in any way?  Should the 
§ 2.1204(a)(10) exclusion permitting portable earth-station transceivers be retained or amended?  Should the § 2.1204(a)(11) exclusion allowing imported in quantities of 12,000 or fewer units for pre-sale activity be retained or amended in any way?  Should the Commission adopt any other exclusion? 
167. These proposed exclusions would relax the importation prohibition rules only under narrowly defined and highly targeted conditions.  Given the limited scope of these circumstances, the Commission expects that this proposal would yield net economic benefits by reducing compliance costs without introducing additional national security risks.  We seek comment on this assessment.
G. Marketing under 47 CFR § 2.803
168. “Marketing” is defined to include “sale or lease, or offering for sale or lease, including advertising for sale or lease, or importation, shipment, or distribution for the purpose of selling or leasing or offering for sale or lease.” 47 CFR § 2.803(b).
  In this Third Further Notice, we seek additional comment on any methods that will further restrict the marketing and operation of Covered List equipment within the United States.  We seek further comment on the requirements in § 2.803(c) of the rules we adopt today to display FCC IDs at the online point of sale, as well as SDoC compliance information.  Should we amend § 2.803(c) to require all online marketplaces to verify that the FCC IDs, and SDoC compliance information, is accurate and matches the product being offered for sale?  Should we expand liability for online marketplaces or close exemptions created for small sellers and used goods?  In other words, should we return amend § 2.803(c) to read in full:  “Online marketplaces marketing radiofrequency devices must ensure that any device’s associated FCC ID, as set forth in § 2.925, and/or Supplier’s Declaration of Conformity compliance information, as set forth in § 2.1077, is displayed in online marketing materials at the time of sale”?  We also seek comment on how marketers would verify SDoC compliance information.
1. Limiting Marketing of Radiofrequency Devices Without an Authorization
169. Presently, § 2.803(c) of our rules permits limited marketing of a radiofrequency device before the device has been authorized. Id. § 2.803(c).
  While this flexibility promotes innovation by increasing the speed with which a company can bring a new device to market, the rule, as currently framed, has the potential to create marketplace confusion or subversion of our other rules by suggesting that entities might still engage in marketing of devices on the Covered List under the guise of permitted “pre-authorization” marketing activities, even though such devices cannot receive equipment authorizations under our rules.  We therefore tentatively conclude that the authority to engage in marketing of radio frequency devices without an authorization should expressly exclude radiofrequency devices that are covered equipment and propose to establish a separate general rule under § 2.803 that prohibits the marketing of covered equipment that was authorized prior to inclusion on the Covered List.  To that end, we seek comment on the extent to which unauthorized Covered List equipment is currently being marketed in the United States under § 2.803(c).  Are there circumstances where marketing of unauthorized Covered List equipment should be permitted (for example, to the United States government)?  If so, what conditions should we place on such marketing?  
170. To ensure uniformity in the application of § 2.803, we also tentatively conclude that two additional changes to this section are prudent.  First, we propose to change the title of the rule to “Marketing of radiofrequency devices that lack an equipment authorization.”  § 2.803(b) expressly permits the marketing of equipment that has been authorized pursuant to a valid FCC equipment authorization, and a recent amendment to this rule prohibits the marketing that has been limited through the procedures described in § 2.939(e). Pursuant to § 2.939(e), the Commission will consider both public comment and the public interest to determine whether the importation and marketing of covered devices that have an existing authorization should continue or be prohibited.  47 CFR § 2.939(e).
  Second, we propose an express exclusion of Covered List devices from exceptions set forth in § 2.803(c).  In other words, we propose to amend our rules to exclude unauthorized covered equipment from the exceptions in § 2.803(c).  We seek comment on these additional modifications of § 2.803 as a means of closing pathways for marketing unauthorized Covered List equipment.  
171. These proposed rules may introduce minor delays in stakeholders’ marketing plans; however, such delays could prevent wasted marketing efforts in situations where equipment is later determined to be covered equipment and consequently prohibited.  By reducing the likelihood of unsuccessful or noncompliant marketing activities, the rule offers clarity that can ultimately conserve stakeholder resources.  Moreover, we see substantial national security and public safety benefits from this rule by limiting opportunities for the marketing of new models of covered equipment, which have been determined to pose “unacceptable risks to the national security of the United States or the safety and security of United States persons.” 47 U.S.C. § 1601(c).
  Accordingly, the Commission tentatively concludes that the benefits of eliminating ambiguity through this clarification are likely to outweigh the modest costs associated with potential marketing delays.  We seek comment on this assessment.
2. Disclosure of Device Brand Names and Model Names
172. Entities identified on the Covered List may attempt to enter the U.S.  market through the practice of creating new, seemingly unaffiliated brand names.  A rash of new brand names that are still affiliated with Covered List entities could stymie inspections at ports of entry and could evade detection by online marketplaces.  Similarly, unaffiliated white label online marketplaces could continue, or begin, to market the equipment under their own brand name.  We seek comment on the best means to identify the marketing of authorized, limited, and revoked Covered List equipment that is being marketed within the United States.  Should all applicants for equipment authorization and grantees be required to disclose the brand names under which they operate?  Should grantees be required to disclose, in confidential submissions, the brand names of authorized equipment produced for other entities under white labeling arrangements?  Should the Commission require that grantees keep updated a list of brand names under which devices are sold?  Should applicants and grantees be required to disclose all model names corresponding to each FCC ID?  We tentatively estimate that such disclosures require no more than one hour of an office administrator’s time and seek comment on this estimate.  Alternatively, should disclosure of brands and white-labeled devices be required only of Covered List entities and their subsidiaries and associates?  Is there any analogous process that could be implemented to address SDoC devices, which are not recorded in OET’s EAS database?  
3. Prohibiting Marketing and Using for Illegal or Unlawful Purposes
173. As Americans rely on an increasing number of wireless and connected devices, there is an increased opportunity to use otherwise lawful radio frequency devices for illegal or unlawful purposes.  For example, a certified software defined radio (SDR) platform designed for research can, with the right know-how, be modified, either physically or through software, to operate in an illegal manner (i.e., at variance from its certified parameters) or for an unlawful purpose.  With the increased prevalence of SDRs and the development of similar software-based technologies, we are concerned that otherwise lawful devices might be marketed in a manner that highlights the potential unlawful operation capability or in a way that promotes the ability of an end user to modify a lawful device to operate illegally.  Accordingly, we propose to adopt rules that would restrict individuals and entities from engaging in marketing activities that promote the ability to use a radio frequency device subject to an FCC authorization (either a certification or an SDoC) for illegal purposes or the ability of the end user to modify the device to operate at variance from its authorized parameters.  We seek comment on this proposal.  Do we have authority to impose such a restriction on marketers of radio frequency equipment?  If not, should we prescribe information that must be included in any marketing materials to prevent the promotion of marketing for illegal or unlawful uses of lawful devices or that caution end users against modifying devices to operate outside of their authorized parameters?  What standard should we use to determine whether a marketer is promoting an illegal or unlawful activity?  What standard should we use to assess whether a marketer is promoting how a device can be modified or the ease with which it can be modified?  To the extent that a marketer of radio frequency devices promotes illegal or unlawful uses or illegal or unlawful modifications of an authorized device, should our enforcement mechanisms account for revenues or profits generated from such activity?  Would our proposal, or any alternative proposals, be consistent with any applicable First Amendment requirements?  
174. In addition to authorized devices, there are radio frequency devices (e.g., transmitters capable of operating solely on frequencies allocated to the Amateur Radio Service) that do not require equipment certification because they are intended for use only by licensed operators within their authorized service. See, 47 CFR § 97.301(a) (amateur allocations).
  However, some retailers market equipment that is capable of operating outside these exempt frequency bands—such equipment requires certification, and its marketing and operation violate our rules if the proper certification is not obtained. ABC Fulfillment Services LLC d/b/a HobbyKing USA LLC and HobbyKing.com, Citation and Order, 32 FCC Rcd 7300, para. 4 n.5 (“Although HobbyKing identifies the AV transmitters as operating on amateur frequencies, the equipment is also apparently able to operate outside of the amateur frequencies and, in some cases, at higher power levels than allowed, making the equipment non-compliant under the Act and Commission’s rules.”); New Generation Hobbies, Citation, 26 FCC Rcd 9468, 9471 n.23 (EB SED 2011) (“while amateur radio service equipment is exempt from the FCC’s equipment certification requirement, it is a violation of the Commission’s regulations to market in the United States a transmitter that is designed or intended to operate on frequencies outside of the authorized amateur radio service bands if such equipment has not been issued a grant of equipment certification”).
  We propose that marketers, including online marketplaces, of such devices must prominently display the following warning at the point of sale, including any online advertisement, to advise unwary consumers: “This equipment may only be sold to end users in the United States who hold the appropriate FCC license.  Information regarding the purchase will be provided in response to a request by the FCC.”  Do we have authority to adopt this proposal, consistent with the Communications Act and the First Amendment?  Consumers who operate such equipment without the appropriate license are already subject to enforcement action.  Unlicensed consumers who purchase such equipment, despite the consumer warning, and operate it at variance with our rules would then be subjected to an enhanced penalty.  We seek comment, particularly from manufacturers, distributors, and retailers, regarding how such rules would affect the marketplace for this equipment.  We also seek comment on whether sales to unlicensed end users should be strictly prohibited.  Certain licensee information is publicly available in Commission databases.  Is it feasible to require retailers to obtain proof of licensure and verify that information prior to the sale?
175. We estimate that the verification required under this proposal may take no more than one hour for retailers to confirm each buyer’s license prior to sale.  We seek comment on this estimate, including whether stakeholders anticipate greater or lesser burdens in practice.  We also seek comment on the expected volume of products that may be subject to the verification requirements each year.  For example, would the number be on the order of 10,000 products annually, 100,000 products, or some other magnitude?  We invite commenters to provide data, statistics, and other evidence to support their estimates.  While such verification might be easily accomplished in a brick-and-mortar retail establishment, would such a verification be unduly burdensome for online marketplaces?  If so, what alternatives might we enact to ensure that type-excepted equipment is only sold to authorized end users? 
176. Given the potential for dual use of radio frequency equipment authorized pursuant to a certification or SDoC, we propose to modify parts 2 and 15 of our rules to establish that FCC-authorized radio frequency equipment, including type-accepted equipment, cannot be used to facilitate criminal acts.  Currently, Amateur Radio Service licensees are prohibited from transmitting “communications intended to facilitate a criminal act.” 47 CFR § 97.113(a)(4).
  Likewise, General Mobile Radio Service licensees may not use their stations to communicate “[m]essages in connection with any activity which is against Federal, State, or local law.” 47 CFR § 95.1733(a)(1).
  Should we impose a similar restriction for all FCC-authorized radio frequency devices?  If such a restriction would not be beneficial for all devices, should we instead impose this restriction only on unlicensed devices authorized pursuant to part 15 of our rules?  Should there be any exceptions to such a rule?  We also note Section 705 of the Communications Act already prohibits the unauthorized publication or use of communications, including unauthorized interception of radio communications. 47 U.S.C. § 605.
  How can this prohibition be enforced to mitigate against the risks identified in specific national security determinations? 
H. Use of FCC Logo, 47 CFR § 2.1074 
177. Until 2017, the FCC logo was required on equipment that was authorized by the former Declaration of Conformity equipment authorization procedure.  During a 2017 rulemaking proceeding, the Commission merged the Declaration of Conformity procedures into the new SDoC authorization and reconsidered whether this labeling requirement was still needed. Amendment of Parts 0, 1, 2, 15 and 18 of the Commission’s Rules regarding Authorization of Radiofrequency Equipment, First Report and Order, FCC 17-93 para. 18 (2017).
  Acknowledging that the FCC logo is “a symbol of compliance” and “its presence can assist customs officers, entities in foreign countries, and others who may want to know whether a device complies with our rules,” Id. (citing TCB Council Comments at 2).
 the Commission codified a rule that makes the use of the FCC logo voluntary for SDoC devices. 47 CFR § 2.1074(b) (“Devices subject to authorization under Supplier’s Declaration of Conformity may be labeled with the following logo on a voluntary basis as a visual indication that the product complies with the applicable FCC requirements.).
  Although this rule makes clear that the FCC logo is intended signify that the device complies with the applicable rules, the Commission did not create a parallel rule for certified devices nor did it establish a regulatory structure that prevents use of the logo on an unauthorized device. See Office of Engineering and Technology, Federal Communications Commission, KDB 784748, Product Labelling/Manuals & Packing FCC Disclosures. Nov. 2, 2023, https://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?switch=P&id=27980. 
   
178. We seek comment on whether voluntary use of the FCC logo aids enforcement of our equipment authorization rules and whether its use should be continued.  If so, should we establish a rule that extends the current practice to certified devices?  The Commission has encountered a significant number of inquiries from our federal partners at CBP regarding equipment that appears to be unauthorized while displaying the FCCs logo.  
179. Additionally, in some instances, the Commission has observed that equipment manufacturers have placed the FCC logo on devices that incidentally generate radio frequency energy, known as an “incidental radiator,” 47 CFR § 15.3(n) (defining an incidental radiator as “[a] device that generates radio frequency energy during the course of its operation although the device is not intentionally designed to generate or emit radio frequency energy. Examples of incidental radiators are dc motors, mechanical light switches, etc.”).
 which do not generally require an FCC equipment authorization. Incidental radiators need only be manufactured to minimize the risk of harmful interference.  See, 47 CFR § 15.13.
  We propose that use of the FCC logo should be prohibited from use on incidental radiators because such devices do not require authorization.  Using the FCC logo on incidental radiators may be misleading for consumers, who might incorrectly assume that the device has somehow been given the FCC’s “stamp of approval.”  Restricting stakeholders from using the FCC logo on devices outside the authorization framework, the Commission tentatively concludes that this proposed rule would not impose incremental costs on regulated parties.  We seek comment on this tentative conclusion and general benefits and costs associated with this proposal.  
180. Likewise, the Commission has observed the marketing of unauthorized radio frequency devices with the FCC logo.  Our rules prohibit deceptive use of certification, 47 CFR § 2.927(c) (prohibiting deceptive use of a certification).
 and SDoC procedures, 47 CFR § 2.1072 (prohibiting deceptive use of SDoC).
 but there is no rule that specifically prohibits the misuse of the FCC logo. See Office of Engineering and Technology, Federal Communications Commission, KDB 784748, Product Labelling/Manuals & Packing FCC Disclosures. Nov. 2, 2023, https://apps.fcc.gov/oetcf/kdb/forms/FTSSearchResultPage.cfm?switch=P&id=27980.
  We propose to expressly prohibit the use of the FCC logo on any device that has not been properly tested and authorized under our rules and seek comment on this proposal.  We also seek comment on other proposals to protect consumers and the public from misleading uses of the FCC logo, such as through civil action for a false designation of origin claim under the Lanham Act. 15 U.S.C. § 1125(a).

181. Finally, we seek comment on whether the Commission should adopt other rules regarding the FCC logo.  For example, should the Commission require the use of the FCC logo for all RF devices that have been validly authorized—pursuant to FCC certification or SDoC?  What would the costs and benefits of such a proposal be? 
I. Streamlined revocation, 47 CFR § 2.939
182. We propose to adopt a streamlined procedure for revoking equipment authorizations.  Under our current rules, revocation of an equipment authorization must proceed “in the same manner as revocation of radio station licenses,” except in cases subject to the expedited processes applicable to covered communications equipment in cases in which there has been a false statement or representation in the certification application or associated materials. 47 CFR § 2.939 (d).
  This radio station license framework dates back more than 70 years, when the Commission first unified its equipment authorization rules, which had previously been dispersed across various radio service rule parts. FCC 55-61, Federal Communications Commission, No. 20, Fed. Reg. 337-343; noting that prior rules for withdrawal of type approval did not specify a process for revocation, see, e.g., 47 CFR 18.16 in Federal Communications Commission, No. 15, Fed. Reg. 533. (“A certificate of type approval may be withdrawn if the type of approval equipment for which it was issued proves defective in service and under usual conditions of maintenance and operation such equipment cannot be relied on to meet the conditions set forth. in this part for the operation of the type of equipment involved”).
  At that time, the Commission noted that authorization holders relied on approval but emphasized that it assumed “no responsibility in granting type acceptance [equipment authorization] that the equipment will always comply,” and it relied on the general appeal procedures in the rules to allow parties to seek Commission review of denials or withdrawals. Id. The Commission would later redesignate this rule as one pertaining to equipment authorization, see FCC 74-113, 45 F.C.C.2d 52.
 
183. The equipment authorization landscape, particularly following the creation of the Covered List and the passage of the Secure Equipment Act requiring the Commission to prohibit certain authorizations on national security grounds, has changed substantially since those early rules were adopted.  As a result, the legacy procedures governing revocation of equipment authorizations are no longer aligned with our approach to similar vulnerabilities and create a gap in the Commission’s overall risk‑mitigation framework.
184. We seek comment, for example, on whether we should remove § 2.939(b) entirely, or revise § 2.939(d) of our rules to adopt the streamlined proceeding adopted in the First Report and Order for any revocation involving willfulness, such as false statements or misrepresentations to the Commission, test labs, or TCBs involving an equipment authorization application or existing grant. See, 5 U.S.C. § 558(c) (allowing for streamlined revocation in cases of “willfulness”).  
  We also seek comment on whether this streamlined revocation procedure should also include any false statements or misrepresentations submitted to the Commission and/or DoW and DHS as part of an application for, or maintenance of, a “Conditional Approval” to have a device removed from the Covered List or any similar process to have certain devices removed from the Covered List. UAS, UAS critical components, and routers—even if produced in a foreign country—are not on the Covered List if they “have been granted a Conditional Approval by DoW or DHS.”  See, FCC Covered List.  
  For example, to apply for Conditional Approval, applicants must submit a substantial amount of information, including information concerning corporate structure and an onshoring plan. See Federal Communications Commission, Guidance on Submissions for Conditional Approval for Uncrewed Aircraft Systems (UAS) and UAS Critical Components Produced in Foreign Countries Subject to the FCC’s Covered List, Jan. 7, 2026, https://www.fcc.gov/sites/default/files/UAS-Guidance-Submissions-Conditional-Approvals.pdf; Federal Communications Commission, Annex A: Guidance on Submissions for Conditional Approval for Routers Produced by Foreign Countries Subject to the FCC’s Covered List, Mar. 20, 2026, https://www.fcc.gov/sites/default/files/Guidance-for-Conditional-Approvals-Submissions0326.pdf.  
  Notably, grants of Conditional Approval will be terminated if applicants “knowingly violate the terms of the Conditional Approval or materially misrepresent information provided the U.S.  Government.” See Federal Communications Commission at 1, Guidance on Submissions for Conditional Approval for Uncrewed Aircraft Systems (UAS) and UAS Critical Components Produced in Foreign Countries Subject to the FCC’s Covered List, Jan. 7, 2026, https://www.fcc.gov/sites/default/files/UAS-Guidance-Submissions-Conditional-Approvals.pdf; Federal Communications Commission at 1, Annex A: Guidance on Submissions for Conditional Approval for Routers Produced by Foreign Countries Subject to the FCC’s Covered List, Mar. 20, 2026, https://www.fcc.gov/sites/default/files/Guidance-for-Conditional-Approvals-Submissions0326.pdf.  
  We propose to direct OET to automatically initiate a streamlined revocation process for any equipment authorizations granted pursuant to a Conditional Approval that is terminated on one or more of these grounds.
185. Should we also include willful failure to provide the Commission or a TCB (or DoW and/or DHS if related to a Conditional Approval) with updated information, such as the willful failure to provide updated information on a changed agent for service of process in the United States, as required by the Commission’s rules? 47 CFR § 2.929(c); Eken Group Limited, Notice of Liability for Forfeiture, FCC 24-122, 39 FCC Rcd 12990 (2024) (proposing $730,000 statutory maximum civil penalty against a foreign doorbell camera manufacturer for submitting false certifications under § 2.911(d) regarding its U.S. agent for service of process).
  We also seek comment on applying this procedure to all revocations involving covered equipment.  Given that such equipment has been found to “pose unacceptable risks to the national security of the United States or the safety and security of United States persons,” 47 U.S.C. §§ 1601(b)(1), (c).
 the Commission tentatively concludes that “public health, interest or safety” See, 5 U.S.C. § 558(c) (allowing for streamlined revocation in “those [cases] in which public health, interest, or safety requires”).  
 might require rapidly revoking authorizations to import, market, and operate this equipment.  The Commission further tentatively concludes that the public interest associated with swift revocation is likely to outweigh the costs borne by entities affected by a streamlined revocation decision.  We seek comment on this tentative conclusion, including whether commenters believe the balance of benefits and costs differs under any particular circumstances.  We further seek comment on how the service of process should be effected under these revocation rules, particularly for foreign grantees that may attempt to evade the jurisdiction of U.S.  law.  Is service of process legally required if grantees of actual or constructive notice?
186. Additionally, we seek comment on changing our rules to allow for a streamlined revocation process that nonetheless comports with the three-step process for revocation required by the Administrative Procedure Act (APA), even where willfulness is not present.  The APA only requires “[e]xcept in cases of willfulness or those in which public health, interest, or safety requires otherwise,” that “before the institution of agency proceedings” to revoke, “the licensee has been given (1) notice by the agency in writing of the facts or conduct which may warrant the action; and (2) opportunity to demonstrate or achieve compliance with all lawful requirements.” 5 U.S.C. § 558(c).
  The Commission’s rules requiring the radio station license process therefore requires substantially more process than is statutorily required. See, 47 CFR § 2.939(b) (“Revocation of an equipment authorization shall be made in the same manner as revocation of radio station licenses” except in limited circumstances); 47 U.S.C. § 312(c) (revoking a radio station license requires a hearing or a waiver).
  Should we instead adopt the streamlined revocation procedures that the Commission recently utilized in several international section 214 authorization procedures and recently codified in the submarine cable license context? Review of Submarine Cable Landing License Rules and Procedures to Assess Evolving National  Security, Law Enforcement, Foreign Policy, and Trade Policy Risks, OI Docket No. 24-523, Report and Order and Further Notice of Proposed Rulemaking, FCC 25-49, 40 FCC Rcd 6481, 6508-16 paras. 50-58 (2025) (citing China Telecom Americas Order on Revocation and Termination, 36 FCC Rcd 1618 (2021); China Unicom Americas Order on Revocation, 37 FCC Rcd 1480 (2022); Pacific Networks and ComNet Order on Revocation and Termination, 37 FCC Rcd 4220 (2022)).
  How might such proceedings facilitate the efficient functioning of government and rapid removal of dangerous equipment from the U.S. market?  Would such proceedings undermine the due process rights of grantees?  
J. Permitting permissive changes for basic software and hardware updates, even for “covered” equipment
187. We propose to codify in our rules a limitation on the prohibitions in §§ 2.932(b) and 2.1043(b) for certain Class I and Class II permissive changes to covered equipment.  In particular, we propose to incorporate into our rules a framework permitting software and firmware updates that mitigate harm to U.S.  consumers for already-authorized covered equipment.  We also seek comment on the exact scope of permissive changes to permit and what types of covered equipment should be eligible.  
188. Background.  On December 22, 2025, the FCC added to the Covered List uncrewed aircraft systems (UAS) and UAS critical components produced in foreign countries.  On March 23, 2026, the FCC added to the Covered List “[r]outers produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS” Public Safety and Homeland Security Bureau Announces Addition of Routers Produced in Foreign Countries to FCC Covered List, WC Docket No. 18-89, Public Notice, DA 26-278 (Mar. 23, 2026) (Routers Public Notice).  For the current version of the Covered List and Conditional Approvals, see, Federal Communications Commission, List of Equipment and Services Covered By Section 2 of The Secure Networks Act, https://www.fcc.gov/supplychain/coveredlist.   
 (Covered Routers).
189. On January 21, 2026, OET announced a waiver of certain prohibitions contained in 47 CFR §§ 2.932(b) and 2.1043(b) for UAS and UAS critical components produced in a foreign country, which were added to the Covered List on December 22, 2025.  The waiver permitted all UAS and UAS critical components authorized for use in the United States to continue to receive software and firmware updates that mitigate harm to U.S.  consumers at least until January 1, 2027. Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered UAS and UAS Critical Components, ET Docket No. 21-232, Public Notice, DA 26-69 (Jan. 21, 2026).
  On March 23, 2026, OET announced a similar waiver of these prohibitions for covered routers added to the Covered List earlier that day. Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered Routers, ET Docket No. 21-232, Public Notice, DA 26-286 (Mar. 23, 2026).

190. The waivers of Class I permissive changes were necessary to account for newly adopted revisions of rule §§ 2.932(b) and 2.1043(b), which excluded equipment prohibited from authorization pursuant to § 2.903 from equipment certification procedures that otherwise typically allow for permissive changes to authorized equipment. 47 CFR §§ 2.932(b), 2.1043(b); Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered UAS and UAS Critical Components, ET Docket No. 21-232, Public Notice, DA 26-69 (Jan. 21, 2026); Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I Permissive Changes to Covered Routers, ET Docket No. 21-232, Public Notice, DA 26-286 (Mar. 23, 2026).
  This effectively prevented previously authorized devices from receiving essential updates solely because they had become newly identified as “covered.”   The prohibited changes include Class I permissive changes, which generally do not require a filing with the Commission and may include software, firmware, and security updates to mitigate harm to U.S.  consumers.  The waivers permitted all UAS and UAS critical components and Routers authorized for use in the United States to continue to receive software and firmware updates that mitigate harm to U.S.  consumers.   
191. On May 8, 2026, OET announced an extension of these waivers until January 1, 2029, and an expansion to cover similar software and firmware permissive changes that are classified as Class II permissive changes, because they “degrade the performance characteristics as reported to the Commission at the time of the initial certification.” 47 CFR 2.1043(b)(2); Office of Engineering and Technology Announces Extension and Expansion of Waiver of Prohibitions on Certain Software and Firmware Permissive Changes to Certain Covered UAS, UAS Critical Components, and Routers, ET Docket 21-232, Public Notice, DA 26-454 (May 8, 2026).  
  OET also noted that this extension would give it time to recommend the Commissioner consider a rulemaking on this matter, 47 CFR 2.1043(b)(2); Office of Engineering and Technology Announces Extension and Expansion of Waiver of Prohibitions on Certain Software and Firmware Permissive Changes to Certain Covered UAS, UAS Critical Components, and Routers, ET Docket 21-232, Public Notice, DA 26-454 (May 8, 2026).  
 which OET does here in this Third Further Notice.  
192. We propose to codify, and make permanent, this waiver with respect to all already-authorized covered equipment.  Specifically, we propose to amend §§ 2.932(b) and 2.1043(b) to clarify that that such minor software and firmware updates that mitigate harm to consumers do not constitute applications for equipment authorization—which the Commission is forbidden from granting under the Secure Equipment Act—and are therefore permitted under Commission rules. Second Report and Order, para. 55; Secure Equipment Act Section 2(a)(2).
  We envision that this exception to the general prohibition would include software or firmware updates necessary to maintain existing functionality, security or vulnerability patches, and updates required to maintain compatibility with supported operating systems or protocols.  We seek comment on this approach.  Should the FCC define the category of software and firmware permissive changes differently?  What are the national security benefits from allowing continued software and firmware security updates?  Are there any national security drawbacks to this approach?  Is it consistent with Congress’ statutory directive, as well as broader national security determinations?  Should we only allow for these software and firmware updates for already-authorized covered equipment in a production location-based Covered List entry, rather than covered equipment in a producer/provider-based Covered List entry?  In other words, should we permit an already-authorized router produced abroad to be able to receive these updates, but not an already authorized covered telecommunications device? 
193. Furthermore, the Commission seeks comment on whether we should extend this allowance to any type of Class I and/or Class II permissive changes involving certain minor hardware modifications to certain already-authorized covered equipment?  Should the Commission allow minor component replacements?  What are the costs and benefits of extending this allowance to hardware?  If the Commission permits hardware permissive changes to already-authorized covered equipment in a production location category, the Commission proposes to limit these modifications to the following:
(a) The modification mitigates harm to consumers;
(b) The modification involves the replacement of one component for another component at the same location in the device;
(c) The modification does not enhance the device’s capability or alter its intended use;
(d) The modified device is marketed as an identical product to the pre-modified device;
(e) The modified device is equipment in a producer/provider-based Covered List entry, rather than a production location-based Covered List entry; and
(f) The modification does not involve the replacement of a U.S.-produced component for a foreign-produced component.
194. We seek comment on each of these proposed limits.  We believe this would allow for hardware permissive changes that do not undermine national security.  Is this an appropriate limitation, or should the Commission adopt some sort of variation?  What are the costs and benefits of this approach?  Additionally, should we require that any Covered List entity that engages in the above listed modifications notify the FCC?  Should we require such entity notifies its consumer base?  Would such measures enhance security of said covered equipment?
195. The Commission tentatively concludes that allowing permissive updates and changes to software, firmware, and hardware would reduce consumer harms while not introducing additional national security risks.  In this respect, we preliminarily find that the proposal is likely to produce a net increase in benefits for consumers and other stakeholders.  We seek comment on this tentative conclusion, including whether commenters anticipate any circumstances in which such permissive updates could alter this costbenefit assessment.
K. Operation of RF devices prior to equipment authorization
196. We propose to revise our rules concerning operation of RF devices prior to equipment authorization in § 2.805 47 CFR § 2.805.
 to conform with our proposed changes to our equipment marketing and importation rules.  Are the current safeguards against marketing or importation of devices prior to authorization adequate in the context of pre‑authorization operation, particularly with respect to equipment on the Covered List?  For example, our rules currently allow for the operation of certain unauthorized devices in certain circumstances for purposes of demonstrations at a trade show or an exhibition and “evaluation of performance and determination of customer assembly during developmental, design, or pre-production states.” 47 CFR § 2.805(d)(2). 
  Are either of these exceptions to the general prohibition warranted for covered equipment?  Should the Commission instead adopt different exceptions, such as for testing and product development, as we did for our import and marketing rules? See infra para. 134. 
  What additional categories or clarifications should the Commission consider?  Do the existing provisions adequately balance the need to prevent harmful interference with the need to enable innovation, testing, and early-stage evaluation of new RF technologies?  Commenters are invited to identify specific rule parts that may be overly restrictive or insufficiently protective.
L. UAS and Router Covered List definitions – “produced in a foreign country,” “UAS critical components,” “routers”
197. In the recent UAS, UAS critical components, and routers updates to the Covered List, the Commission has received numerous public inquiries regarding the definitions of “produced in a foreign country,” “UAS critical components,” and “routers.”  The Commission has provided some guidance answering these questions in Frequently Asked Questions (FAQs) posted to its website, Federal Communications Commission, Covered List FAQs: UAS and UAS Critical Components, https://www.fcc.gov/covered-list-faqs-uas-and-uas-critical-components. (Last visited June 30, 2026); Federal Communications Commission, FAQs on Recent Updates to FCC Covered List Regarding Routers Produced in Foreign Countries, Updated May 12, 2026, https://www.fcc.gov/faqs-recent-updates-fcc-covered-list-regarding-routers-produced-foreign-countries.
 but the Commission believes it might be in the public interest to have codified definitions in its rules.  
198. First, we seek comment on how best to interpret “produced in a foreign country” when used in a national security determination.  We tentatively conclude that the Commission interpret “produced in a foreign country” to include any equipment that does not qualify as a “domestic end product” as defined in 48 CFR 25.101(a)(1).  Under 48 CFR 25.101(a)(1), for an end product to be considered a “domestic end product,” the article must be manufactured in the United States and the cost of domestic components must exceed a certain percentage of the total cost of the finished product (currently set at 65%). 48 CFR § 25.101(a). For the manufactured end products, the domestic-component cost must exceed 60 percent of the cost of all the components, increasing to 65 percent for items delivered in 2024-2028, and 75 percent beginning in 2029, subject to exceptions for certain Commercially Available Off-the-Shelf (COTS) items.
  Specifically, we propose to interpret “produced in a foreign country” to mean “does not meet the ‘domestic end product’ standard.”  That is, those devices that are not both manufactured in the United States and that do not satisfy the specified thresholds for the cost of domestic components would be considered “produced in foreign country.”  We also take note of our past statement that production “includes … any major state of the process by which a device comes into existence” and includes the design and development of the device, Second Further Notice at para. 53. 
 as well as the most recent router National Security Determination, which similarly stated that “[p]roduction generally includes any major stage of the process through which the device is made, including manufacturing, assembly, design, and development.” Routers National Security Determination at 2. 
  We seek comment on whether “produced in a foreign country” should broadly include devices where design or development occurs foreign country.  Would including design or development activities provide meaningful additional protection against national security risks?  How would such an approach affect U.S. manufacturers that engage in such cross-border activities? Commercial Drone Alliance Ex Parte Letter (July 16, 2026).
 
199. We seek comment on this interpretation.  We seek comment on whether this interpretation appropriately advances the intended statutory and policy objectives related to domestic sourcing, while providing clear, workable standards for industry.  Should we add further clarity to the terms “design” and “development”?  How should we interpret these terms?  For example, should we draw from existing definitions in the CFR? Should we, for instance, define “development” to mean “the systematic use of the knowledge or understanding gained from research, directed toward the production of useful materials, devices, systems or methods, including design and development of prototypes and processes,” as defined by the Federal Highway Administration?  23 CFR § 420.203.  
  Should we adopt other definitions?  We encourage commenters to provide ideas.  Should the Commission find that if a certain number or percentage of foreign-based employees work on the design or development of the device, that device would be considered to have been “produced in a foreign country”?  What would this number or percentage be?  Would employing any foreign-based employee on design or development of a device render that device “produced in a foreign country?”
200. We note that subsequent to the addition of UAS and UAS critical components produced in a foreign country to the Covered List, DoW provided a time-bound exemption for UAS and UAS critical components that qualify as “domestic end products” as defined in 48 CFR 25.101(a)(1), which requires assembly in the United States and, for now, at least 65% of the components sourced from the U.S. Federal Communications Commission, Fact Sheet: FCC Updates Covered List to Exempt Certain Drones from Restrictions, Releases Additional FAQs, Jan. 7, 2026, https://docs.fcc.gov/public/attachments/DOC-417528A1.pdf. 
  This would seem to suggest that DoW believed that at least some subset of UAS or UAS critical components that are domestic end products are nonetheless “produced in a foreign country” or the exemption would have been redundant.  Therefore, should the Commission adopt a broader interpretation of “produced in a foreign country”?  For example, should the Commission consider any device “produced in a foreign country” if the device would not be considered “Made in the United States” under Federal Trade Commission rules, i.e. “produced in a foreign country” “unless the final assembly or processing of the product occurs in the United States, all significant processing that goes into the product occurs in the United States, and all or virtually all ingredients or components of the product are made and sourced in the United States.” 16 CFR § 323.2.
  Alternatively, should the Commission adopt a narrower interpretation?  For example, should the Commission adopt an interpretation based on trade law’s concept of rule of origin?  
201.   We seek comment on whether whatever interpretation the Commission adopts should be applied to all determinations regarding existing and future production by location-based entries on the Covered List that use the language “produced in a foreign country”.   
202. “”“”“”We propose to codify the Commission’s existing interpretation of the term “UAS critical components.” As stated in the December 22, 2025 Covered List Public Notice and clarified in subsequent Commission guidance Federal Communications Commission, Covered List FAQs: UAS and UAS Critical Components, https://www.fcc.gov/covered-list-faqs-uas-and-uas-critical-components. (Last visited June 30, 2026).
, the term “UAS” critical components includes, but is not limited to the following UAS components and any associated software: (1) Data Transmission Devices; (2) Communications systems; (3) Flight controllers; (4) Ground control stations and UAS controllers; (5) Navigation systems; (6) Sensors and Cameras; (7) Batteries and Battery Management Systems; (8) and Motors. Public Safety and Homeland Security Bureau Announces Addition of Uncrewed Aircraft Systems (UAS) and UAS Critical Components Produced Abroad, and Equipment and Services Listed in Section 1709 of the FY2025 NDAA, to FCC Covered List, WC Docket 18-89, Public Notice, DA 25-1086 (Dec 22, 2025)
  This definition was provided in a National Security Determination from an Executive Branch interagency body, which included participation from several appropriate national security agencies.  We tentatively conclude that codifying the existing interpretation would promote consistent application of the Commission’s rules while maintain a definition that is appropriately tailored to the national security concerns identified in the National Security Determination and related guidance.  We seek comment on this proposal.  
203.  The Commission noted in an FAQ that the Commission “understands ‘UAS critical components’ to mean components designed and intended primarily for use in UAS.  For example, a camera with many potential functions and uses that could theoretically be attached to a drone is not a UAS critical component and so can receive FCC equipment authorization.  But a camera designed and intended primarily to be a drone camera is a UAS critical component.” Federal Communications Commission, Covered List FAQs: UAS and UAS Critical Components, https://www.fcc.gov/covered-list-faqs-uas-and-uas-critical-components. (Last visited June 30, 2026).
  Should the Commission codify this definition?  Should the Commission adopt a different definition that better tracks the National Security Determination’s intention? We propose to codify this concept in the definition of “UAS” critical components” and seek comment on this proposal.  
204. The Commission also seeks comment on codifying a definition of “routers” for purposes of the Covered List.  In the March 20, 2026 National Security Determination, the term “Routers” was defined by the National Institute of Science and Technology’s Internal Report 8425A to include “consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer.  Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems.” National Institute of Standards and Technology, U.S. Department of Commerce. Recommended Cybersecurity Requirements for Consumer-Grade Router Products, NIST IR 8425A, including Appendix C (“Consumer-Grade Acquisition Scenarios Discussion”), Sept. 2024, https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8425A.pdf 
  The Commission adopted that same definition in its Routers Public Notice and FAQs, more explicitly finding that a device is a router if the following elements are present:  (1) it is a consumer-grade networking device that is primarily intended for residential use; (2) it can be, but is not required to be, installed by the customer; and (3) it forwards data packets, most commonly Internet Protocol (IP) packets, between networked systems. See Routers FAQs, https://www.fcc.gov/faqs-recent-updates-fcc-covered-list-regarding-routers-produced-foreign-countries. 

205. The Commission, relying on its technical expertise and experience, clarified in the FAQs that the following devices all constitute a consumer-grade router: consumer or small and medium-sized business routers sold or rented through retail and self-installable by end users; consumer-grade portable or mobile MiFi Wi-Fi or hotspot devices for residential use; LTE/5G CPE devices for residential use; residential routers installed by a professional or ISP; and residential gateways that combine modem and router functions. Id.
  Similarly, we also distinguished that the following devices are not considered a consumer-grade routers:  Analog Telephone Adapters (“ATAs”) that include Ethernet LAN and WAN ports; femtocells; Optical Network Terminals (ONTs); industrial, enterprise, or military equipment; and mobile phones with hotspot features. Id.
 
206. We seek comment on whether to further refine, expand, or limit the scope of how we have defined “Routers.”  Should we add further detail to this definition, such as clarifying whether additional specific devices are or are not “routers”?  Are additional measures necessary to ensure that the definition of “routers” is sufficiently clear, consistently applied, and accurately reflects the National Security Definition? What other clarifications to the inclusions or exclusions are necessary?  We invite comment generally on this point.  
207. We also seek comment on the appropriate transition periods and implementation timelines if these proposals are adopted.
M. Term limits on equipment authorizations
208. In the Second Further Notice, we sought comment on whether equipment authorizations should have an expiration date or be term limited. Second FNPRM at para. 91.
  Currently, equipment certifications remain valid indefinitely unless they are withdrawn, revoked, or terminated or become subject to a subsequent rule change that affects their validity.  We believe that there may be significant value to the automatic expiration of an authorization and seek additional comment from consumers and the industry.  Specifically, we seek comment on the various supply chain effects if the Commission were to uniformly impose an expiration date on all equipment authorizations, with prospective effect.  Should the Commission adopt such a rule?  Should such a rule be limited to the marketing of equipment, or would it also apply to its continued operation?  Is a ten-year period adequate?  
209. Different classes of equipment have different lifecycles, after which equipment producers typically cease issuing software and security updates.  With certain consumer equipment expected to last less than five years, would a ten-year limit permit most consumer or enterprise equipment to age out naturally?  Covered List equipment would be ineligible for a new authorization, but should other term-expired equipment be permitted to renew automatically or by grant of a renewal application submitted to the Commission?  If the Commission adopts rules setting term limits on equipment authorizations, what specific requirements should the Commission adopt for the renewal process in order to balance the burdens on the applicant, the industry, and the agency?  Should the Commission adopt comparable requirements to the initial equipment authorization, or should the Commission adopt more streamlined requirements 
210. The Commission expects to continually advance the development of new communications equipment and so also expects to refine its equipment authorization rules.  Accordingly, should there be an expedited application and approval process instead of automatic renewals?  If so, which equipment authorization procedures should be streamlined, or developed, to speed future authorization renewals and reduce associated costs?  Are there parallels from spectrum licensing that should be integrated into the equipment authorization and renewal processes?  How should the expiration of an equipment authorization apply to SDoC equipment?  We seek any and all comments in this regard.
N. Registration of SDoC devices
211. The SDoC process was “originally established to reduce the burden on manufacturers of Class B personal computers and peripherals by eliminating the delays resulting from the requirement to obtain a Commission approval prior to marketing equipment.” In the Matter of: Amendment of Part 15 and other Parts of the Commission’s Rules, Notice of Proposed Rulemaking and Order. ET Docket 01-278. October 2, 2001. 
  At that time, the Commission concluded that it was not “necessary to mandate the automatic filing of information with the Commission,” because “as long as the measurement procedures are properly followed and testing is performed by a competent laboratory…filing of information with the FCC would not provide any added assurance of compliance and would create an unnecessary administrative burden.” In the Matter of: Amendment of Parts 2 and 15 of the Commission’s Rules to Deregulate the Equipment Authorization Requirements for Digital Devices. Report and Order. ET Docket No. 95-19. May 9, 1996.
  The Commission also noted the limitations of its databases at the time, including that the FCC Public Access Link system, organized around FCC ID numbers, could not support storing SDoC information. Id. at fn. 12.
 
212. As the equipment authorization system has evolved, and threats to our national security have increased with the proliferation of insecure equipment by bad actors, the assumptions underlying the SDoC framework no longer hold.  The Commission can no longer presume that measurement procedures are consistently followed or that testing is conducted by competent laboratories.  In the past year, we have taken action to remove 28 entities from the equipment authorization system due to improper conduct or because they posed unacceptable risks to national security.  The Commission’s information‑management capabilities have also changed markedly.  We no longer rely on physical publications such as the Radio Equipment List, and we now maintain multiple databases capable of handling the information relevant to SDoCs and related authorizations.  Additionally, given the new national security function that the FCC’s equipment authorization has taken on in the wake of the Secure Networks Act, the Secure Equipment Act, and our corresponding rules, it is vital that the Commission have greater oversight over devices that receive authorization through SDoC to protect national security from dangerous devices.  For example, as noted above, See supra at paras. 157-158.
 covered equipment is prohibited from receiving equipment authorization, even through SDoC, and entities identified on the Covered List are similarly prohibited from utilizing the SDoC process.  Given these substantial changes, we are revisiting our 1996 determination not to require registration of SDoC‑authorized devices.
213. We therefore propose to require that all devices authorized through the SDoC process be registered with the Commission with a unique identification number, which the Commission will publicly list on its website, comparable to the oversight and transparency of the certification process and FCC IDs.  We seek comment on the appropriate mechanism for such registration.  What existing databases or systems could support SDoC registrations while minimizing burdens on suppliers?  What specific information should an SDoC registration include?  Should it include sufficient information for the Commission to be able to identify the type of device?  Should it include any of the information that is required through the certification process, including any of the information that the Commission seeks comment on requiring in this Further Notice, such as HBOM and SBOM information? See supra at paras. 121-122. 
  Should a unique SDoC registration identifier be displayed on the device label?  We also seek comment on the appropriate scope of this requirement.  Should it apply to all SDoC devices, only those falling within a Covered List sector, or to some other subset?  Should the Commission require all composite devices (i.e.  those that include both certified and SDoC elements) to be listed in a particular way so it is obvious what certified equipment and what equipment authorized by SDoC is combined?  Should SDoC documentation be available through the database?  Finally, we seek comment on what enforcement mechanisms or procedures the Commission should adopt to ensure effective oversight of SDoC registrations.
214. In the Third Report and Order, we adopted rules that clarify that the term “marketing” applies to online marketplaces  as a means of significantly curtailing the marketing of unauthorized equipment. See supra at para. 28; The Commission also clarifies that e-commerce platforms that list third-party products on their platforms are engaged in marketing, because they are engaged in the “offer for sale” of these products. …]
  We also adopted rules that require that online marketing materials for certified equipment must provide consumers with the device’s FCC ID. See supra at paras. 50-53. 
  We seek comment on whether similar rules should apply to radio frequency devices authorized pursuant to SDoC.  Pursuant to §§ 2.1074 and 2.1077, every device that is authorized by an SDoC must include a compliance information statement at the time of marketing or importation that also identifies the party responsible for compliance and the unique product name and model number. 47 CFR §§ 2.1074, 2.1077.
  This information is, thus, readily available to every supply chain entity that physically manages the equipment.  We acknowledge that many online marketplaces will not physically manage or involve themselves in the distribution of every product that is offered on their platforms; nevertheless, these entities are in a far superior position to be able to obtain this information from the supplier or manufacturer.  It is also critical to the safety of U.S. consumers and communications networks that equipment authorizations are verified prior to being offered for sale.  
215. Thus, we propose that, for radio frequency devices not authorized by certification, online marketplaces collect and take reasonable steps to verify the SDoC compliance information statement or a statement that the radio frequency device to be marketed does not require an FCC authorization and also meets any applicable technical standards. For example, certain devices are excepted from authorization—whether certification or SDoC—as long as they meet certain technical criteria.  See, 47 CFR § 15.103.  
  We believe that displaying equipment authorization information in the online advertisement may be the single most effective means by which the Commission, consumers, supply chain entities, competitors, and other stakeholders may verify whether a particular device may lawfully be marketed within the United States.  We seek comment on viability, benefit, additional expenses that may be incurred, and any other factors relevant to the proposed new requirement.  What issues might online marketplaces encounter while obtaining authorization information, verifying its accuracy, or displaying this information online?  The compliance information statement may take up valuable real estate on the product listing page.  Would providing a URL or QR code that links to the full SDoC compliance statement provide a viable, secure and valid alternative?  What other means might be used to provide the consumer with valuable compliance information at the time of marketing?  What types of information do online marketplaces already collect regarding third party retailers and the products that they market to U.S. consumers?  Would publication of an SDoC or compliance statement create any unfair competitive advantage or disadvantage?  Are additional changes to the SDoC rules needed for online marketplaces to assess the validity of an SDoC?  We further propose that any compliance information obtained and displayed by online marketplaces must match the product that is being advertised.  If we adopt rules requiring registration for SDoC-authorized devices, how might we modify this proposal?  For example, if the FCC adopts a registration requirement for SDoC devices, should we require online marketplaces display SDoC registration numbers for any device sold on their platforms, as we required for FCC IDs above. See supra paras. 53-60. 

O. Data Analytics Capability and need for modern EAS database 
216. Many public commenters have urged the FCC to modernize the Equipment Authorization System (EAS) database. See, e.g., Connor Healy, Director Government Research, IPVM, Modernizing FCC Databases Can Put Valuable Information in Public Hands While Assisting the FCC in Protecting National Security. June 5, 2024. https://s.ipvm.com/uploads/embedded_file/d223c17161ef12ad6103ab23e32801512973c23f792812e9f7f0f68748188f82/51612351-a304-4792-89b0-db1cae328409.pdf.
  We seek comment on such suggestions.  What features would be helpful in the Commission’s effort to modernize the EAS system, both to support the FCC’s national security priorities while also streamlining and alleviating administrative burden on our TCB partners and other participants in the equipment authorization process?  What, if any, changes to the information collection would be helpful, and what portions of the process can be streamlined or done in a more parallel fashion?  How can we better share information and other data with stakeholders?  We welcome all comments and proposals with estimates on associated benefits and costs.  
P. Submarine Cables 
217. In the 2025 Submarine Cable First Report and Order, Review of Submarine Cable Landing License Rules and Procedures to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Policy Risks, OI Docket No. 24-523, MD Docket No. 24-524, Report and Order and Further Notice of Proposed Rulemaking, 40 FCC Rcd 6481 (2025) (2025 Submarine Cable First Report and Order and FNPRM); corrected by Erratum, https://docs.fcc.gov/public/attachments/DOC-414544A1.pdf (OIA and OMD Sept. 16, 2025); corrected by Second Erratum, https://docs.fcc.gov/public/attachments/DOC-415107A1.pdf (OIA and OMD Oct. 24, 2025) (2025 Submarine Cable First Report and Order); Cable Landing License Act of May 27, 1921, Pub. L. No. 8, 67th Cong., ch. 12, § 1, 42 Stat. 8 (1921) (codified as amended at 47 U.S.C. §§ 34-39); Exec. Order No. 10,530, 19 Fed. Reg. 2709, § 5(a) (May 12, 1954), reprinted as amended in 3 U.S.C. § 301.  
 the Commission adopted new certifications and routine conditions that will require applicants and cable landing licensees to comply with Covered List requirements.  Specifically, we adopted rules requiring that, as a condition of a potential grant of an application for a cable landing license, applicants must certify that their submarine cable system will not use equipment or services identified on the Covered List. 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6548-50, 6641-42, 6634, paras. 125-126, Appx. A (§§ 1.70006(d), 1.70007(u)); see Review of Submarine Cable Landing License Rules and Procedures to Assess Evolving National Security, Law Enforcement, Foreign Policy, and Trade Policy Risks; Amendment of the Schedule of Application Fees Set Forth in Sections 1.1102 through 1.1109 of the Commission’s Rules, Second Report and Order and Second Further Notice Of Proposed Rulemaking, FCC 26-42, 2026 WL 1920490 (June 30, 2026) (2026 Submarine Cable Second Cable Report and Order) (amending section 1.70007(u) to incorporate new routine conditions and further restructure section 1.70007(u)(1) to improve regulatory clarity).  
  We also adopted a requirement that, as a condition of a potential grant of an application to modify a cable landing license to add a new segment, applicants must certify that the new submarine cable segment and landing point will not use equipment or services identified on the Covered List. We adopted a rule that a licensee whose modification application to add a new segment is filed and granted after the effective date of the 2025 Submarine Cable First Report and Order shall not use equipment or services identified on the Covered List on the new segment and the new landing point.  See id. at 6550, 6634, para. 128, Appx. A (§ 1.70007(u)(1)).  
  In addition, we adopted a rule requiring existing cable landing licensees, with certain exceptions, to certify that they will not add covered equipment or services to their submarine cable system under the license. 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6548-49, 6634, 6551-53, 6654, paras. 125, 131-134, Appx. A (§ 1.70023) (stating, “this condition shall not apply to a licensee that is identified on the Covered List whose cable landing license was or is granted prior to” the effective date of the rule).  Section 1.70023 requires licensees to submit this certification within sixty (60) days of the effective date of the rule.  Id.
   
218. We propose to narrow and more clearly define the scope of certain submarine cable rules in light of subsequent updates to the Covered List to only prohibit applicants and licensees from using or adding Covered List equipment and services from the producer/provider-based determinations rather than the production location-based determinations, unless a location-based determination specifically refers to the equipment or services at issue posing national security threats when used in submarine cable systems.  We propose that PSHSB, when it updates the Covered List, would determine whether submarine cable licensees would be subject to any future location-based determination, based solely on the content of the determination itself.    
219. Since the adoption of the 2025 Submarine Cable First Report and Order, the Commission updated the Covered List based on specific determinations made by an Executive Branch interagency body with appropriate national security expertise, 47 U.S.C. § 1601(c); 47 CFR § 1.50001(e) (“The term ‘determination’ means any determination from sources identified in § 1.50002(b)(1)(i)-(iv) that communications equipment or service pose an unacceptable risk to the national security of the United States or the security and safety of United States persons.”); 47 CFR § 1.50002(b).
 regarding the unacceptable risks posed by UAS, UAS critical components, and routers produced in foreign countries. See supra para. 10.
  As discussed above, these were the first instances where a specific determination identified equipment and services produced in foreign countries, a production location-based determination, rather than equipment or services produced or provided by specific entities, a producer/provider-based determination. Id.
  Additionally, in the 2026 Submarine Cable Second Report and Order, we adopted a certification and a routine condition that broadly prohibits the use or addition of any principal equipment on the submarine cable system that is produced by any entity owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary, as defined in §1.70001(g). 2026 Submarine Second Cable Report and Order at *31, para. 76; 47 CFR § 1.70001(g).  Licensees whose application for a cable landing license is filed and granted after the effective date of the new rules must ensure that no such principal equipment is used or added, whether by the licensee or any other entity, on their licensed submarine cable system.  Id.  Existing licensees must ensure that no such principal equipment is added, whether by the licensee or any other entity, on their licensed submarine cable system.  Id.
  For purposes of our submarine cable licensing rules, we tentatively conclude that tailoring the Covered List certification requirements and routine conditions by relying on producer/provider-based determinations, rather than prohibiting the use or addition of production location-based determinations would be consistent with our original intent in the 2025 Submarine Cable First Report and Order and provide greater regulatory certainty and minimize burdens. Consistent with this proposed approach, we do not propose to modify those Covered List requirements adopted in the 2025 Submarine Cable First Report and Order that rely on producer/provider determinations.  See, e.g., 47 CFR § 1.70004(a)(ii) (“The disqualifying condition will presumptively preclude the grant of an application, as specified in paragraph (a)(2) of this section, filed by any applicant . . . That is identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C. 1601-1609”); 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6639, 6653, Appx. A (§§ 1.70005(g) (requiring in an initial application for a cable landing license “[a] statement disclosing whether or not the applicant uses and/or will use the following third-party service providers, as defined in § 1.70001(d), in the operation of the submarine cable system . . . [a]ny entity identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C. 1601-1609”), 1.70017(b) (applying the Foreign Adversary Annual Report requirement to a licensee “[t]hat is identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C. 1601-1609”)).
  At the same time, we believe this proposed approach, in combination with other application rules, certification requirements, and routine conditions adopted in the 2025 Submarine Cable First Report and Order See generally 2025 Submarine Cable First Report and Order.  
 and 2026 Submarine Cable Second Report and Order See generally 2026 Submarine Cable Second Report and Order.
 would continue to protect critical submarine cable infrastructure against foreign adversary and other threats.  
220. Producer/Provider-Based Covered List Certifications for Applications and Routine Conditions.  We propose to amend § 1.70006(d) by requiring applicants for initial cable landing licensee applications to certify, as a condition of a potential grant, that their submarine cable system will not use equipment or services that are identified on the Covered List in the producer/provider category. 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6641-42, Appx. A (§ 1.70006(d)) (“An applicant must certify to the following in the initial application for a cable landing license . . . That the submarine cable system will not use equipment or services identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C. 1601 through 1609.”) (emphasis added).
  Accordingly, we propose to amend the routine condition in § 1.70007(u)(1) by prohibiting a licensee, whose application is filed and granted after the effective date of the 2025 Submarine Cable First Report and Order, from using such covered equipment or services on its submarine cable system under the license. Id. at 6634, Appx. A (§ 1.70007(u)); 2026 Submarine Cable Second Report and Order at *112, Appx. A (§ 1.70007(u))(1)) (“A licensee whose application for a cable landing license is filed and granted after November 26, 2025, shall not use equipment or services identified on the Covered List on its submarine cable system under the license.”) (emphasis added).
  We also propose to amend § 1.70007(u)(1)(i) by prohibiting a licensee, whose modification application to add a new segment is filed and granted after the effective date of the 2025 Submarine Cable First Report and Order, from using such covered equipment or services on the new segment and the new landing point. 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6634, Appx. A (§ 1.70007(u)(1)); 2026 Submarine Cable Second Report and Order at *112, Appx. A (§ 1.70007(u)(1)(i)) (“A licensee whose modification application to add a new segment is filed and granted after November 26, 2025, shall not use equipment or services identified on the Covered List on the new segment and the new landing point.”) (emphasis added).  
  Consistent with this proposed change, a licensee seeking a modification of its license under section 1.70011(a) would be required to certify that it accepts and will abide by the routine conditions in § 1.70007, as amended in this proceeding. See 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6647, Appx. A (§ 1.70011(a)(2)) (requiring that an application to add a landing point(s), segment(s), or other like material changes to a submarine cable system must also include certifications set forth under § 1.70006, except for § 1.70006(d)); id. at 6641, Appx. A (§ 1.70006(a)) (requiring a certification that the applicant accepts and will abide by the routine conditions specified in § 1.70007).  Consistent with the overall changes proposed, other applications and reports subject to subpart FF of the rules would similarly require a certification that the applicant or licensee accepts and will abide by the routine conditions in § 1.70007, as amended in this proceeding.  See, id. at 6647, 6651-52, 6653-54, Appx. A (§§ 1.70011(b)(4), 1.70012(b)(7), 1.70013(b)(8), 1.70017(c)(2), 1.70020(b)) (requiring certifications set forth under § 1.70006, as specified therein, or that it accepts and will abide by the routine conditions specified in § 1.70007); 2026 Submarine Cable Second Report and Order at *125-126, Appx. A (§ 1.70018(c) (requiring a certification that the licensee accepts and will abide by the routine conditions in § 1.70007).

221. Producer/Provider-Based Covered List Routine Conditions for All Licensees.  We propose to amend § 1.70007(u) by prohibiting a cable landing licensee from adding to its submarine cable system equipment or services that are identified on the Covered List in the producer/provider category, or other a location-based entry when the determination makes specific reference to national security threats that are specific to submarine cable systems, while retaining the current exception for existing licensees that are entities identified on the Covered List. Id. at 6634, Appx. A (§ 1.70007(u)(1)); 2026 Submarine Cable Second Report and Order at *112, Appx. A (§ 1.70007(u)) (“No licensee shall add to its submarine cable system(s) under its respective license(s) equipment or services identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C. §§ 1601-1609; except, this part of paragraph (u) shall not apply to a licensee that is identified on the Covered List whose cable landing license was or is granted prior to November 26, 2025.”) (emphasis added).
  We note that our proposals in this Further Notice will not alter licensees’ obligation to submit the certification required in § 1.70023 once that rule is effective. 2025 Submarine Cable First Report and Order, 40 FCC Rcd at 6548-49, 6634, 6551-53, 6654, paras. 125, 131-134, Appx. A (§ 1.70023).
 
222. We seek comment on these proposals.  We seek comment on the impact of these proposals on applicants and licensees.  Would narrowing the scope of the Covered List certification requirements and routine conditions to “producer/provider-based determinations” create national security vulnerabilities and other risks for submarine cable infrastructure?  We also seek comment on including the application of these Covered List certification requirements and routine conditions to location-based additions to the Covered List where the specific determination at issue specifically references national security threats in the context of submarine cable systems.  We seek comment on the costs and benefits of these proposals and alternative approaches.  The Commission previously adopted a rule requiring applicants for a cable landing license to certify, as a condition of a potential grant, that their submarine cable systems will not use equipment or services identified on the Covered List.  By clarifying that this requirement—established in the submarine cable proceeding—is limited to producer or provider-based Covered List determinations and does not extend to production location-based criteria except where the determination specifically references threats in the context of submarine cable systems, the Commission aims to eliminate any potential ambiguity in interpreting the certification obligation.  Since the clarification removes regulatory burdens, we tentatively conclude that this clarification will reduce implementation costs and improve regulatory certainty.  We seek comment on this tentative conclusion.
Q. Rule Clarification 
223. We propose to amend § 2.903(c) to clarify that the prohibitions in paragraphs (a) and (b) apply to all equipment, including but not limited to the categories currently enumerated in that paragraph.  Section 2.903(c) currently states that the prohibitions on obtaining an equipment authorization for equipment on the Covered List “apply to” three categories: equipment otherwise subject to certification procedures, equipment otherwise subject to Supplier’s Declaration of Conformity procedures, and equipment otherwise exempt from equipment authorization.  We propose to revise the introductory clause of § 2.903(c) to read: “The prohibitions in paragraphs (a) and (b) of this section apply to all equipment, including.”  We believe this revision would clarify the scope of the rule to prohibit authorization of any equipment on the Covered List—regardless of the equipment authorization procedure that would otherwise apply to it—consistent with the national security objectives of the Secure Equipment Act of 2021.
224. We seek comment on this proposal.  Is the proposed revision necessary or advisable to ensure the prohibitions in § 2.903(a) and (b) are not construed to exclude equipment authorized through mechanisms other than certification, SDoC, or exemption?  Are there existing or anticipated equipment authorization procedures, or categories of equipment, that could fall outside the current enumerated list and that this revision is intended to capture? 
R. Universal Service Fund and Supply Chain Annual Report 
225. We also seek comment on the impact of component-level prohibitions and the bifurcation of the FCC Covered List to the supply chain prohibitions found in part 54 of the Universal Service Fund Program rules and to the Supply Chain Annual Report.  How would adopting our proposals impact other supply chain certifications, including the annual USF supply chain certification? 47 CFR § 54.9.

S. Impact on Other Service Provider Certifications
226. We seek comment on whether and how the determinations made in the Report and Order, and the proposals contained in the FNPRM, may affect other existing or proposed certifications, filings, or attestations that reference the Covered List or otherwise require service providers, applicants, or licensees to certify compliance with our equipment authorization or supply chain security rules.  We are particularly interested in the impact, if any, of (i) the component-level prohibitions we adopt today and (ii) our proposal to bifurcate the Covered List into producer/provider-based and production location-based categories.
T. U.S.-based Liable Party for FCC-certified equipment
227. Currently, the party legally responsible for compliance associated with SDoC-authorized equipment must be located in the United States (i.e., the responsible party). 47 CFR § 2.909(b). 
  Our rules do not, however, require the party legally liable for certified equipment to be located in the United States.  Instead, in general, the grantee or manufacturer is responsible for compliance associated with certified equipment, unless the equipment was modified by another party. First Further Notice, paras. 312-316; compare 47 CFR § 2.909(a) with 47 CFR § 2.909(b). 
  Because of this, many liable parties for certified equipment are located outside of the United States.  As a result, the Commission may not always be able to communicate timely with foreign liable parties for certified equipment, and the Commission’s attempts to enforce compliance by foreign liable parties for certified equipment have sometimes been hindered. See, e.g., In the Matter of Eken Group Limited, Notice of Apparent Liability for Forfeiture, 39 FCC Rcd 12990 (2024) (FCC 24-122, released November 21, 2024) (Eken NAL).
  In the First Report and Order, we revised our rules to require that each applicant for equipment certification designate a U.S.  agent for service of process. First Report and Order at para. 59.
  In the NPRM and the First Further Notice, we proposed going further and requiring a U.S.-based liable party for FCC-certified equipment, analogous to the existing requirement that an SDoC liable party be located in the United States.  Under the SDoC approach, the responsible party must be located in the United States and, depending on the circumstances, could be the manufacturer or assembler, the importer, or the retailer.  Specifically, if the manufacturer or assembler is not located in the United States and the equipment is imported, the importer would become the new responsible party. 47 CFR 2.909(b)(2)
 
228. In response to the NPRM, commenter Hytera US supported identification of a U.S.-based liable party. Hytera US Comments at 13.
  Otherwise, the Commission has received no comment on this issue.
229. We propose to require a U.S.-based liable party for FCC-certified equipment to strengthen enforcement of our rules and promote regulatory harmonization by aligning our equipment certification requirements with SDoC requirements.  Although we imposed a requirement to designate a U.S. agent for service in the First Report and Order, we have found in our experience that requirement to be insufficient to ensure compliance with our rules.  Since implementing the U.S. agent for service of process requirement in our rules, See, 47 CFR § 2.911(d)(7) (effective February 6, 2023).
 we have found that certification applicants have, in multiple instances, provided false names and addresses for the U.S. agent for service of process, allowing bad actors to evade enforcement efforts by placing them beyond the reach of U.S. law. See, e.g., Eken NAL.
  We tentatively conclude that this gives foreign actors an unfair advantage in the marketplace.  U.S.-based equipment manufacturers and grantees are subject to U.S. law, and if their products harm U.S. consumers, they can be held accountable under the Commission’s enforcement authority because their documents, witnesses, and financial assets are within reach of U.S. law.  This is not always the case for foreign actors; we have seen many instances of such actors evade the Commission’s enforcement authority despite the requirement to designate a U.S.  agent for service of process. Id. 

230. We propose to adopt the requirement that every applicant or grantee for FCC-certified equipment have a U.S.-based liable party and revise our equipment certification rules in § 2.909(a) of our rules to align with the SDoC rules in § 2.909(b).  If revised rules were adopted, the liable party would be (1) the manufacturer or assembler, if located in the United States, (2) the importer(s) if the equipment is imported, (3) the retailer or other entity assuming the liable party function pursuant to an agreement with the manufacturer, assembler, or importer, or (4) if the equipment modified without authority of the liable party, the party performing the modification if located in the United States, or the importer if imported subsequent to modification.  
231. Under this proposal, each potential liable party, including the importer, would be jointly and severally liable with the foreign grantee for violations of the Communications Act or of our rules.  A U.S.-based liable party must have organizational authority to ensure compliance and cooperation with enforcement investigations.  This includes the ability to produce documents, relevant witnesses, and financial assets in the United States to support enforcement investigations.  Because importers or other entities would assume the role of the U.S.-based liable party if grantees are not based in the United States and the equipment is imported, this requirement would ensure that financial assets are available for enforcement purposes. We also note that the INFORM Consumers Act, 15 U.S.C. § 45f, requires online marketplaces to collect, verify, and disclose identification and financial information for high-volume third-party sellers and generally make that information available to consumers in a clear and conspicuous manner.  These requirements will make it easier to identify financial assets within reach of our enforcement authority and will strengthen our ability to enforce the Communications and our rules against those actors who benefited from the marketing, sale, or importation of non-complaint equipment. 
  If a U.S.-based liable party was unable to ensure compliance by the foreign grantee, the Commission could seek sanctions or initiate revocation proceedings against the grantee.  This could also include, for example, making adverse inferences to support revocation of equipment authorizations and disqualifying U.S.-based liable parties that do not comply with our rules.  
232. If revised rules are adopted, we would intend to enforce this requirement as needed and expect grantees and their U.S.-based liable parties to respond promptly to Commission inquiries regarding the U.S.-based liable party. Such inquiries are exempted from the information collection requirements of the Paperwork Reduction Act to the extent such information is collected during the conduct of an administrative action or investigation involving an agency against specific grantees.
  Failure to respond could result in initiation of revocation proceedings against the grantee.
233. We seek comment on these proposals.  We seek comment on the impact of these proposals on grantees, manufacturers, importers, and retailers.  We seek comment on the costs and benefits of these proposals and alternative approaches.
234. We seek comment on appropriate transition periods for the various measures proposed in this Further Notice of Proposed Rulemaking.  
V. PROCEDURAL MATTERS
235. Regulatory Flexibility Act.  The Regulatory Flexibility Act of 1980, as amended (RFA), 5 U.S.C. §§ 601 et seq., as amended by the Small Business Regulatory Enforcement and Fairness Act (SBREFA), Pub. L. No. 104-121, 110 Stat. 847 (1996). 
 requires that an agency prepare a regulatory flexibility analysis for notice and comment rulemakings, unless the agency certifies that “the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities.” 5 U.S.C. § 605(b).
  Accordingly, the Commission has prepared a Final Regulatory Flexibility Analysis (FRFA) concerning the possible impact of the rule changes contained in this Report and Order on small entities.  The FRFA is set forth in Appendix C.  
236. The Commission has also prepared an Initial Regulatory Flexibility Analysis (IRFA) concerning the potential impact of the rule and policy change proposals on small entities in the Second Further Notice of Proposed Rulemaking.  The IRFA is set forth in Appendix D.  The Commission invites the general public, in particular small businesses, to comment on the IRFA.  Comments must be filed by the deadlines for comments on the Further Notice indicated on the first page of this document and must have a separate and distinct heading designating them as responses to the IRFA.
237. Paperwork Reduction Act.  This document contains proposed new or modified information collection requirements subject to the Paperwork Reduction Act of 1995 (PRA), Public Law No.  10413.  The Commission, as part of its continuing effort to reduce paperwork burdens, invites the general public and the Office of Management and Budget (OMB) to comment on any information collection requirements contained in this document.  In addition, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107198, see 44 U.S.C.  § 3506(c)(4), we seek specific comment on how we might “further reduce the information collection burden for small business concerns with fewer than 25 employees.” 
238. Ex Parte Presentations—PermitButDisclose.  The proceeding this Further Notice of Proposed Rulemaking initiates shall be treated as a “permitbutdisclose” proceeding in accordance with the Commission’s ex parte rules. 47 CFR § 1.1200 et seq.
  Persons making ex parte presentations must file a copy of any written presentation or a memorandum summarizing any oral presentation within two business days after the presentation (unless a different deadline applicable to the Sunshine period applies).  Persons making oral ex parte presentations are reminded that memoranda summarizing the presentation must (1) list all persons attending or otherwise participating in the meeting at which the ex parte presentation was made, and (2) summarize all data presented and arguments made during the presentation.  If the presentation consisted in whole or in part of the presentation of data or arguments already reflected in the presenter’s written comments, memoranda or other filings in the proceeding, the presenter may provide citations to such data or arguments in his or her prior comments, memoranda, or other filings (specifying the relevant page and/or paragraph numbers where such data or arguments can be found) in lieu of summarizing them in the memorandum.  Documents shown or given to Commission staff during ex parte meetings are deemed to be written ex parte presentations and must be filed consistent with rule 1.1206(b).  In proceedings governed by rule 1.49(f) or for which the Commission has made available a method of electronic filing, written ex parte presentations and memoranda summarizing oral ex parte presentations, and all attachments thereto, must be filed through the electronic comment filing system available for that proceeding, and must be filed in their native format (e.g., .doc, .xml, .ppt, searchable .pdf).  Participants in this proceeding should familiarize themselves with the Commission’s ex parte rules.
239. Providing Accountability Through Transparency Act.  Consistent with the Providing Accountability Through Transparency Act, Public Law 1189, a summary of this document will be available on https://www.fcc.gov/proposedrulemakings.
240. OPEN Government Data Act.  The OPEN Government Data Act Congress enacted the OPEN Government Data Act as Title II of the Foundations for EvidenceBased Policymaking Act of 2018, Pub. L. No. 115435 (2019), §§ 201202.
 requires agencies to make “public data assets” available under an open license and as “open Government data assets,” i.e., in machinereadable, open format, unencumbered by use restrictions other than intellectual property rights, and based on an open standard that is maintained by a standards organization. 44 U.S.C. §§ 3502(20), (22) (definitions of “open Government data asset” and “public data asset”), 3506(b)(6)(B) (public availability).
  This requirement is to be implemented “in accordance with guidance by the Director” of the OMB. OMB has not yet issued final guidance.
  The term “public data asset” means “a data asset, or part thereof, maintained by the Federal Government that has been, or may be, released to the public, including any data asset, or part thereof, subject to disclosure under [the Freedom of Information Act (FOIA)].” 44 U.S.C. § 3502(22).
  A “data asset” is “a collection of data elements or data sets that may be grouped together,” 44 U.S.C. § 3502(17).
 and “data” is “recorded information, regardless of form or the media on which the data is recorded.” 44 U.S.C. § 3502(16).
  
· Filing Requirements—Comments and Replies.  Pursuant to sections 1.415 and 1.419 of the Commission’s rules, 47 C.F.R. §§ 1.415, 1.419, interested parties may file comments and reply comments on or before the dates indicated on the first page of this document.  Comments may be filed using the Commission’s Electronic Comment Filing System (ECFS).  Electronic Filers:  Comments may be filed electronically using the Internet by accessing the ECFS:  https://www.fcc.gov/ecfs/.
· Paper Filers:  Parties who choose to file by paper must file an original and one copy of each filing.
o Filings can be sent by hand or messenger delivery, by commercial courier, or by the U.S.  Postal Service.  All filings must be addressed to the Secretary, Federal Communications Commission.
o Handdelivered or messengerdelivered paper filings for the Commission’s Secretary are accepted between 8:00 a.m.  and 4:00 p.m.  by the FCC’s mailing contractor at 9050 Junction Drive, Annapolis Junction, MD 20701.  All hand deliveries must be held together with rubber bands or fasteners.  Any envelopes and boxes must be disposed of before entering the building.
o Commercial courier deliveries (any deliveries not by the U.S.  Postal Service) must be sent to 9050 Junction Drive, Annapolis Junction, MD 20701.
o Filings sent by U.S.  Postal Service FirstClass Mail, Priority Mail, and Priority Mail Express must be sent to 45 L Street NE, Washington, DC 20554.
241. People with Disabilities.  To request materials in accessible formats for people with disabilities (braille, large print, electronic files, audio format), send an email to fcc504@fcc.gov or call the Consumer & Governmental Affairs Bureau at 2024180530 (voice).
242. Congressional Review Act.  The Commission has determined, and the Administrator of the Office of Information and Regulatory Affairs, Office of Management and Budget, has found, and the Commission concurs, that this rule is “non-major” under the  Congressional Review Act, 5 U.S.C.  § 804(2).  The Commission will send a copy of this Third Report and Order to Congress and the Government Accountability Office pursuant to 5 U.S.C.  § 801(a)(1)(A).
243. Further Information.  For further information, contact the Office of Engineering and Technology, at EASecurity3@fcc.gov.
VI. ORDERING CLAUSES
244. IT IS ORDERED, pursuant to the authority found in sections 4(i), 301, 302, 303, 403, and 503 of the Communications Act of 1934, as amended, 47 U.S.C.  §§ 154(i), 301, 302a, 303, 403, 503; the Cable Landing License Act, 47 U.S.C.  §§ 34-39; the Secure and Trusted Communications Networks Act of 2019, 47 U.S.C.  §§ 1601-1609; and the Secure Equipment Act of 2021, Pub.  L.  117-55, 135 Stat.  423, 47 U.S.C.  § 1601 note, that this Third Report and Order and Third Further Notice of Proposed Rulemaking IS HEREBY ADOPTED. Pursuant to Executive Order 14215, 90 Fed. Reg. 10447 (Feb. 20, 2025), this regulatory action has been determined to be significant under Executive Order 12866, 58 Fed. Reg. 68708 (Dec. 28, 1993).

  
245. IT IS FURTHER ORDERED that the rule amendments set forth in Appendix A of this Third Report and Order SHALL BE EFFECTIVE 30 days after publication in the Federal Register, except that: (1) the FCC ID display requirement in § 2.803(c)(2) SHALL BE EFFECTIVE 6 months after publication in the Federal Register; and (2) the FCC ID display requirement in § 2.803(c)(3) SHALL BE EFFECTIVE 9 months after publication in the Federal Register.
246. IT IS FURTHER ORDERED that the Commission’s Office of the Secretary SHALL SEND a copy of this Third Report and Order and Third Further Notice of Proposed Rulemaking, including the Final and Initial Regulatory Flexibility Analyses, to the Chief Counsel of the Small Business Administration Office of Advocacy.

						FEDERAL COMMUNICATIONS COMMISSION




						Marlene H. Dortch
						Secretary
2
APPENDIX A
Final Rules

For the reasons set forth, the Federal Communications Commission amends 47 CFR parts 1 and 2 as follows: 

Part 1 — PRACTICE AND PROCEDURE

1.	The authority citation for part 1 continues to read as follows:

Authority:  47 U.S.C. chs. 2, 5, 9, 13; 28 U.S.C. 2461 note; 47 U.S.C. 1754, unless otherwise noted.

2.	Amend § 1.50001 by: 
a. Adding new paragraph (f).
b. Redesignating paragraph (f) as paragraph (e).  
c. Redesignating paragraph (e) as paragraph (g).  
d. Redesignating paragraphs (g) through (i) as paragraphs (h) through (j).
The revisions read as follows:

§ 1.50001 Definitions.
* * * * *
(f) Critical Infrastructure.  For purposes of implementing section 889(f)(3) of the John S.  McCain National Defense Authorization Act for Fiscal Year 2019 (Pub.  L.  115-232; 132 Stat.  1918), the term “critical infrastructure” has the meaning given in 42 U.S.C. 5195c(e).  This definition encompasses systems and assets used in the provision of services or functions in the 16 critical infrastructure sectors, as identified in National Security Memorandum 22 and further clarified by the Department of Homeland Security, to provide any of the 55 National Critical Functions published by the Department of Homeland Security through the National Risk Management Center.  

Part 2 — FREQUENCY ALLOCATIONS AND RADIO TREATY MATTERS; GENERAL RULES AND REGULATIONS

3.  	The authority citation for part 2 continues to read as follows:
Authority:  47 U.S.C.  154, 302a, 303, and 336 unless otherwise noted.

4.	Amend § 2.803 by adding paragraph (a)(1), redesignating existing paragraphs (c) and (d) as paragraphs (d) and (e) and adding new paragraph (c) to read as follows:

§ 2.803 Marketing of radio frequency devices prior to equipment authorization.

(a) * * *

· (1) Marketing includes the listing of regulated equipment on an online marketplace, in combination with any of the following activities: consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfilment services – even if that equipment is sold or offered for sale by a third-party seller.  

* * * * *  

(c) FCC IDs must be displayed in online marketplaces as follows:  

(1) An online marketplace that markets a radiofrequency device subject to certification, or that offers for sale a radiofrequency device subject to certification on behalf of a third-party seller and has physical access to or takes title to that device, must display a valid and accurate FCC ID, as set forth in § 2.925, for the device at the online point of sale.
(2) An online marketplace that markets a radiofrequency device subject to certification on behalf of a third-party seller, but does not have physical access to or take title to that device, must display a valid FCC ID, as set forth in § 2.925, at the point of sale. An online marketplace is not liable under this paragraph for the inaccuracy of an FCC ID or related equipment authorization information supplied by a third-party seller, provided the marketplace has (i) taken reasonable steps to verify that the FCC ID supplied corresponds to a validly issued FCC ID in the Commission’s Equipment Authorization System database, and (ii) required the third-party seller to certify the accuracy of the information supplied.
(3) Paragraphs (1) and (2) shall not apply to:

(a)  A listing for a radiofrequency device published before the effective date of this rule, unless and until that listing is amended, updated, or republished on or after the effective date of this rule.  For purposes of this paragraph, an amendment or update includes a change to a listing’s product description, product images, product specifications, or seller information, but does not include a non-substantive or automated change such as a change to search ranking, page layout, translation, pricing, or currency display.
(b) A listing for a radiofrequency device made by a third-party seller that is not a “high-volume third-party seller,” as defined in 15 U.S.C. 45f(f)(6).  
(c) A listing for a used radiofrequency device.  For purposes of this section a “used radio frequency device” refers to “any device that was previously sold to a retail customer and is marketed as a ‘used’ or otherwise not ‘new’ device.”  

* * * * * 

5.	Amend § 2.902 by adding the following definitions, in alphabetical order, to read as follows:

§ 2.902 Terms and definitions.

Logic-bearing hardware component.  Any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses (cycles) per second and uses digital techniques; inclusive of telephone equipment that uses digital techniques or any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses radio frequency energy for the purpose of performing data processing functions, such as electronic computations, operations, transformations, recording, filing, sorting, storage, retrieval, or transfer.

Online marketplace.  An “online marketplace” as that term is defined in 15 U.S.C. § 45f(f)(4).

6.	Amend § 2.903 by revising the title and revising paragraph (b) and (d) to read as follows:

§ 2.903 Prohibition on authorization of equipment on the Covered List and related equipment.

* * * 
(b) All devices that incorporate one or more of the following components are prohibited from obtaining an equipment authorization under this subpart:
	(1) Equipment meeting the descriptions in paragraph (a)(1) or (2) of this section; and 

	(2) A logic-bearing hardware component produced by an entity identified on the Covered List pursuant to § 1.50002 of this chapter if—had such entity produced the device itself, rather than just a component—the device would be prohibited from receiving authorization under paragraph (a) of this section.
  
* * * * *  

(d) Each entity named on the Covered List as producing covered communications equipment, as established pursuant to § 1.50002 of this chapter, must provide to the Commission the following information: the full name, mailing address or physical address (if different from mailing address), email address, and telephone number of each of that named entity’s associated entities (e.g., subsidiaries or affiliates) identified on the Covered List as producing covered communications equipment.

(1) Each entity named on the Covered List as producing covered communications equipment must provide the information described in this section no later than March 8, 2023;

(2) Each entity named on the Covered List as producing covered communications equipment must provide the information described this section no later than 30 days after the effective date of each updated Covered List; and

(3) Each entity named on the Covered List as producing covered communications equipment must notify the Commission of any changes to the information described in this section no later than 30 days after such change occurs.

7.	Amend § 2.932 by adding a sentence to paragraph (a) and adding paragraph (f).  to read as follows:

§ 2.932 Modification of equipment.

(a) * * * The exceptions set forth in this section do not apply to changes made by Covered List entities or changes that would result in the modified device being considered covered communications equipment.

* * * * *
(f) Notwithstanding other provisions of this section, use of the permissive change procedures to modify equipment that is produced by any entity identified on the Covered List, established pursuant to § 1.50002 of this chapter, is prohibited.  Any modification to such equipment must be authorized under the equipment certification provisions under subpart J of this part.

8.	Amend § 2.1043 by revising paragraph (a) to read as follows:

§ 2.1043 Changes in certificated equipment.

(a) Any changes made by Covered List entities or changes that would result in the modified device being considered Covered Equipment shall not be performed without application for and authorization of a new grant of certification.  In all other instances, except as provided in paragraph (b)(3) of this section, changes to the basic frequency determining and stabilizing circuitry (including clock or data rates), frequency multiplication stages, basic modulator circuit or maximum power or field strength ratings shall not be performed without application for and authorization of a new grant of certification.  Variations in electrical or mechanical construction, other than these indicated items, are permitted provided the variations either do not affect the characteristics required to be reported to the Commission or the variations are made in compliance with the other provisions of this section.  Changes to the software installed in a transmitter that do not affect the radio frequency emissions do not require any additional filings and may be made by parties other than the holder of the grant of certification.  

9.	Amend § 2.1204 by revising paragraph (a)(2) and removing and reserving (a)(4)(iv) to read as follows:
§ 2.1204 Import conditions.

* * * * * 

(a) * * *

(2) The radio frequency device is not required to have an equipment authorization and the device complies with FCC technical and administrative regulations.  

* * * * *

(4)(iv) [Removed and Reserved]

* * * * *
APPENDIX B
Proposed Rules

For the reasons set forth, the Federal Communications Commission proposes to amend 47 CFR parts 1, 2, and 15 as follows:

PART 1 – PRACTICE AND PROCEDURE
1. The authority citation for part 1 continues to read as follows:
Authority: 47 U.S.C. chs. 2, 5, 9, 13; 28 U.S.C. 2461 note; 47 U.S.C. 1754, unless otherwise noted.
2.	Delayed indefinitely, amend § 1.70006 by revising paragraph (d) to read as follows:

§ 1.70006 Certifications.

* * * * *

(d) That the submarine cable system will not use equipment or services that are produced or provided by an entity identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C.  1601-1609, or other covered communications equipment or services wherein the specific determination concerning such equipment or services specifically references national security threats involving submarine cable systems.

3.	Delayed indefinitely, amend § 1.70007 by revising paragraph (u) to read as follows:

§ 1.70007 Routine conditions.

* * * * *

(u) No licensee shall add to its submarine cable system(s) under its respective license(s) equipment or services that are produced or provided by an entity identified on the Covered List that the Commission maintains on its website pursuant to the Secure Networks Act, 47 U.S.C.  1601-1609; except, this paragraph (u) shall not apply to a licensee that is identified on the Covered List whose cable landing license was or is granted prior to November 26, 2025.  

(1) A licensee whose application for a cable landing license is filed and granted after November 26, 2025, shall not use equipment or services that are produced or provided by an entity identified on the Covered List on its submarine cable system under the license.
(i) A licensee whose modification application to add a new segment is filed and granted after November 26, 2025, shall not use equipment or services that are produced or provided by an entity identified on the Covered List on the new segment and the new landing point.  
(ii) * * * [Reserved]

* * * * *

Part 2 — FREQUENCY ALLOCATIONS AND RADIO TREATY MATTERS; GENERAL RULES AND REGULATIONS

4.	The authority citation for part 2 continues to read as follows:

Authority:  47 U.S.C. 154, 302a, 303, and 336 unless otherwise noted.

5.	Amend § 2.803 by changing the title, redesignating paragraphs (c) and (d) as paragraphs (d) and (e), and adding section (d)(3) to read as follows:

§ 2.803 Marketing of radiofrequency devices that lack an equipment authorization.

* * * * *

(d) * * *
 
(3) Notwithstanding paragraph (b) of this section, for devices that lack an equipment authorization and are listed on the Covered List, as established pursuant to § 1.50002 of this chapter, marketing is prohibited.  

* * * * *

6.	Add § 2.804 to read as follows:
§ 2.804  Online Marketing of radiofrequency devices subject to an equipment authorization
(a) Prohibited marketing representations.  Online marketplaces shall not market a radiofrequency device subject to equipment authorization in a manner that:
(1) Promotes or encourages operation of the device in violation of the Communications Act or the Commission’s rules;
(2) Promotes or encourages modification of the device to operate outside the parameters authorized by the Commission; or
(3) Represents that the device may be used to evade, interfere with, disable, or circumvent lawful communications, regulatory requirements, or technical safeguards.
(b) Required warning for licensed-use devices.  Online marketplaces marketing a device subject to authorization shall prominently display the following notice at the online point of sale:
“This equipment may only be sold to end users in the United States who hold the appropriate FCC license.  Information regarding the purchase may be provided to the FCC upon request.”
(c) Online marketplace obligations.  Online marketplaces shall:
(1) Collect the Supplier’s Declaration of Conformity compliance information statement or equivalent compliance documentation;
(2) Take reasonable steps to verify that the device is authorized or exempt from authorization under Commission rules;
(3) Maintain such records for a period specified by the Commission; and
(4) Display equipment authorization or compliance information at the online point of sale.

7.	Amend § 2.902 by adding the following definitions, in alphabetical order, to read as follows:

§ 2.902 Terms and definitions.

Covered List sector.  
A category of equipment, the entirety of which or a subset of which is listed on the Covered List in § 1.50002 of this chapter.  
Hardware bill of materials (HBOM).  
A formal record identifying the hardware components contained in a device and information regarding the origin and production of those components.
* * * * * 
Personal use.
Use of a device:
(1) In a manner not intended for sale, lease, marketing, distribution, or other commercial advantage; and
(2) Solely by an individual or a not-for-profit entity for noncommercial purposes.
Produced in a foreign country.  
A device is produced in a foreign country if it either:
(1) Does not qualify as a domestic end product as that term is defined in 48 C.F.R. § 25.101(a); and
(2) Is designed or developed in a foreign country.
* * * * * 
Software bill of materials (SBOM).  
A formal record containing details and supply chain relationships of software and firmware components used in a device.

8.  	Amend § 2.903 by revising paragraph (c) to read as follows:

§ 2.903 Prohibition on authorization of equipment on the Covered List.
* * * * *
(c) The prohibitions in paragraphs (a) and (b) of this section apply to all equipment, including:
(1) Equipment that would otherwise be subject to certification procedures;
(2) Equipment that would otherwise be subject to Supplier’s Declaration of Conformity procedures; and
(3) Equipment that would otherwise be exempt from equipment authorization.

* * * * *

9.  	Amend § 2.906 by revising paragraph (d) and adding paragraphs (e) and (f) to read as follows:

§ 2.906 Supplier’s Declaration of Conformity.

* * * * *

(d) Notwithstanding other parts of this section, equipment otherwise subject to the Supplier’s Declaration of Conformity process that is produced by any entity identified on the Covered List, established pursuant to § 1.50002 of this chapter, or a device within a Covered List sector are prohibited from obtaining equipment authorization through that process.  The rules in this chapter governing certification apply to authorization of such equipment.

(e) Registration requirement.  Devices authorized pursuant to the Supplier’s Declaration of Conformity process shall be registered with the Commission prior to marketing.
(1) The Commission shall assign a unique identification number for each registered device.
(2) The responsible party shall provide information specified by the Commission, including compliance information, responsible party identification, and device identification information.
(3) Registration information shall be publicly available unless entitled to confidential treatment under § 0.459 of this chapter.
(f) Public Display Requirement.  The unique registration identifier shall be displayed:
(1) On the device or its packaging;
(2) In the compliance information statement; and
(3) In online marketing and product listings.

10.	Amend § 2.907 by revising paragraph (c) to read as follows:

§ 2.907 Certification.
* * * * *
(c) Any equipment otherwise eligible for authorization pursuant to the Supplier’s Declaration of Conformity, or exempt from equipment authorization, produced by any entity identified on the Covered List, established pursuant to § 1.50002 of this chapter, or devices within a Covered List sector must obtain equipment authorization through the certification process.  Devices subject to this paragraph shall comply with all certification application requirements set forth in this subpart, including disclosure and reporting obligations applicable to certification applicants.

* * * * *

11.	Revise § 2.909 to read as follows:
§ 2.909 Responsible Party and Liable Party.
(a) Responsible Party.
(1) In the case of equipment that requires the issuance of a grant of certification, the party to whom that grant of certification is issued is responsible for the compliance of the equipment with the applicable technical and other requirements.  If any party other than the grantee modifies the radio frequency equipment and that party is not working under the authorization of the grantee pursuant to § 2.929(b) of this chapter, the party performing the modification is responsible for compliance of the product with the appliable administrative and technical provisions in this chapter.
(2) For equipment subject to Supplier’s Declaration of Conformity the party responsible for the compliance of the equipment with the applicable standards, who must be located in the United States (see § 2.1077 of this chapter), is set forth as follows:
(i) The manufacturer or, if the equipment is assembled from individual component parts and the resulting system is subject to authorization under Supplier’s Declaration of Conformity, the assembler.
(ii) If the equipment by itself, or, a system is assembled from individual parts and the resulting system is subject to Supplier’s Declaration of Conformity and that equipment or system is imported, the importer.
(iii) Retailers or original equipment manufacturers may enter into an agreement with the responsible party designated in paragraph (b)(1) or (b)(2) of this section to assume the responsibilities to ensure compliance of equipment and become the new responsible party.
(iv) If the radio frequency equipment is modified by any party not working under the authority of the responsible party, the party performing the modifications, if located within the United States, or the importer, if the equipment is imported subsequent to the modifications, becomes the new responsible party.
(3) If the end product or equipment is subject to both certification and Supplier’s Declaration of Conformity (i.e., composite system), all the requirements of paragraphs (a) and (b) of this section apply.
(4) If, because of modifications performed subsequent to authorization, a new party becomes responsible for ensuring that a product complies with the technical standards and the new party does not obtain a new equipment authorization, the equipment shall be labeled, following the specifications in § 2.925(d) of this chapter, with the following: “This product has been modified by [insert name, address and telephone number or internet contact information of the party performing the modifications].
(5) In the case of transfer of control of equipment, as in the case of sale or merger of the responsible party, the new entity shall bear the responsibility of continued compliance of the equipment.(b) Liable Party.  In the case that the grantee of equipment authorization through certification is located in a foreign country, there must be a liable party located in the United States.  The party liable for compliance of the equipment with the applicable standard and Commission rules is set forth as follows:
(1) The manufacturer or, if the equipment is assembled from individual component parts and the resulting system is subject to authorization under certification, the assembler.
(2) If the equipment by itself, or, a system is assembled from individual parts and the resulting system is subject to certification and that equipment or system is imported, the importer.
(3) Retailers or original equipment manufacturers may enter into an agreement with the liable party designated in paragraph (b)(1) or (b)(2) of this section become the new liable party.
(4) If the radio frequency equipment is modified by any party not working under the authority of the responsible party, the party performing the modifications, if located within the United States, or the importer, if the equipment is imported subsequent to the modifications, becomes the new liable party.
12.	Amend § 2.911(d) by adding paragraphs (d)(8) to (d)(11) to read as follows:

§ 2.911 Application requirements.

* * * * * 
(d) * * * 
(8) The applicant shall provide a written and signed certification identifying any and all entities that produced the device for which equipment authorization is sought.
(i) The certification shall identify each entity that produced the device, including any entity involved in the design, development, manufacturing, or assembly of the device.
(ii) The certification shall be signed by an authorized representative of the applicant.
(iii) The applicant shall update the certification if material changes occur prior to grant of the equipment authorization.
(iv) The Commission or Telecommunication Certification Body may request additional information reasonably necessary to determine whether an identified entity produced the device.
(9) Supply chain disclosure materials.
(i) An applicant for certification shall submit, as part of its application, a written and signed hardware bill of materials (HBOM) and software bill of materials (SBOM) for the device for which equipment authorization is sought.
(ii) The HBOM and SBOM shall identify all components of the device, including hardware, software, and firmware components of the device.
(iii) The HBOM and SBOM shall be certified as true and correct by an authorized representative of the applicant.
(iv) The Commission or Telecommunication Certification Body may require the applicant to provide supplemental documentation sufficient to verify the accuracy or completeness of the HBOM or SBOM.
(10) Required contents of HBOM and SBOM disclosures.  The HBOM and SBOM required by paragraph (d)(9) of this section shall identify, for each critical component:  
(i) The component  name and function;
(ii) The producer of the component;
(iii)  The location or locations where the component was designed, developed, manufactured, assembled, or otherwise produced; and
(iv) The percentage of component value attributable to each producer and production location.
(11) Producer contact information.  For each producer identified pursuant to this section or within any required HBOM or SBOM submission, the applicant shall provide:
(i)  The producer’s legal name;
(ii)  Any trade names or doing-business-as names used by the producer;
(iii)  The producer’s principal place of business;
(iv)  The jurisdiction of incorporation or organization;
(v)  Contact information for an authorized representative of the producer, including mailing address, telephone number, and electronic mail address; and
(vi)  Any additional identifying or contact information required by the Commission or Telecommunication Certification Body for purposes of verifying production location or supply chain information.
* * * * *
13.	Amend § 2.931 by adding paragraph (f) to read as follows:

§ 2.931 Responsibilities
* * * * *
(f) The responsible party shall update any HBOM or SBOM information submitted pursuant to § 2.911 within 30 days of any material change to the hardware, software, firmware, producer, or production location information contained therein.

14.	Revise § 2.932 by adding a final sentence to paragraph (b) and paragraphs (b)(1) through (b)(4) to read as follows:

§ 2.932 Modification of equipment.
* * * * *
(b) * * * Notwithstanding this section, software or firmware updates to already-authorized covered equipment shall not constitute a request for a new equipment authorization where:
(1)  The modification mitigates harm to consumers; 
(2)  The modification does not enhance the device’s capability or alter its intended use; 
(3)  The modified device is marketed as an identical;
(4)  The modified device is marketed as an identical product to the pre-modified device;
(5)  The modified device is equipment in a producer/provider-based Covered List entry, rather than a production location-based Covered List entry; and
(6)  The modification does not involve the replacement of a U.S.-produced component for a foreign-produced component.
* * * * *
15.	Amend § 2.939 by removing paragraph (b) to redesignate paragraph (c) as paragraph (b)  and amending paragraphs (c) and (d) to read as follows:

§ 2.939 Revocation, withdrawal, or limitation of equipment authorization.
* * * * *
(b) [Remove and Redesignate (c)]
(c) Notwithstanding other provisions of this section, the Commission directs the Office of Engineering and Technology and the Public Safety and Homeland Security Bureau to revoke equipment authorizations using the streamlined process in paragraph (d) of this section for any of the following equipment authorizations:
(1) Any case of willfulness, such as false statements or misrepresentations to the Commission, by a test lab, a TCB, or another federal agency, involving an equipment authorization application or existing grant;
(2) Any willful failure to provide required information associated with the equipment authorization to the Commission, a test lab, a TCB, or another authorized federal agency;
(3) Any equipment authorization for equipment that has been granted a Conditional Approval, but which Conditional Approval has been subsequently terminated.  
(d) The streamlined revocation process shall be: 
(1) If the Office of Engineering and Technology and the Public Safety and Homeland Security Bureau determine that one of the conditions in paragraph (c) of this section is met, they will provide written notice to the grantee that a revocation proceeding is being initiated and the grounds under consideration for such revocation.
(2) The grantee will have 10 days in which to respond in writing to the reasons cited for initiating the revocation proceeding.  The Office of Engineering and Technology and the Public Safety and Homeland Security Bureau will then review the submissions, request additional information as may be appropriate, and make their determination as to whether to revoke the authorization, providing the reasons for such decision.
* * * * *

16.	Amend § 2.1043 by adding paragraph (m) to read as follows:

§ 2.1043 Changes in certificated equipment.
* * * * *
(m) Software, firmware, or hardware updates to already-authorized covered equipment shall constitute Class I or Class II permissive changes respectively, shall not constitute applications for equipment authorizations, and are not be prohibited, so long as:
(1)  The modification mitigates harm to consumers;
(2)  The modification does not enhance the device’s capability or alter its intended use;
(3)  The modified device is marketed as an identical product to the pre-modified device; and
(4)  Involve swapping a U.S.-made component for a non-U.S.  made component.

17.	Amend § 2.1074 by adding paragraphs (c) and (d) to read as follows:

§ 2.1074 Identification.
* * * * *
(c) The FCC logo shall not be affixed to, displayed on, or associated with incidental radiators or any other devices not subject to equipment authorization requirements under this chapter.
(d) The FCC logo shall not be used on, displayed in connection with, or associated with any device that:
(1) Has not been properly tested and authorized in accordance with the Commission’s rules;
(2) Is marketed in violation of the Commission’s equipment authorization requirements;
(3) Has had its equipment authorization revoked, withdrawn, suspended, or limited; or
(4) Is otherwise not eligible to bear the FCC logo under this chapter.

18.	Amend § 2.1204 by revising paragraph (a)(5)and adding paragraph (c) to read as follows:
§ 2.1204 Import conditions.

(a) * * *

(1) * * *
(5) The radio frequency device is being imported solely for export.  The device will not be marketed or offered for sale in the United States.
* * * * *
(c) Covered equipment.  Notwithstanding paragraph (a) of this section, covered equipment may be imported only if one or more of the following conditions are satisfied:
(1) The equipment has a valid equipment authorization that has not been limited, revoked, or otherwise restricted pursuant to § 2.939(e) of this chapter;
(2) The equipment is imported in a quantity of 40 or fewer units for testing and evaluation or product development, unless the Chief of the Office of Engineering and Technology grants written approval for a greater quantity;
(3) The equipment is imported solely for export;
(4) The equipment is imported exclusively for use by the United States Government; or
(5) The equipment is imported solely for the purpose of developing products for use exclusively by the United States Government.

PART 15 – RADIO FREQUENCY DEVICES
19.	The authority citation for part 15 continues to read as follows:
Authority: 47 U.S.C. 154, 302a, 303, 304, 307, 336, 544a and 549.
20.	Amend § 15.101 by adding paragraph (f) to read as follows:
§ 15.101 Equipment authorization of unintentional radiators.

* * * * *
(f) Notwithstanding any other provision of this section, devices within a Covered List sector shall be subject to certification.
APPENDIX C

Final Regulatory Flexibility Analysis

1. As required by the Regulatory Flexibility Act of 1980, as amended (RFA), 5 U.S.C. §§ 601 et seq., as amended by the Small Business Regulatory Enforcement and Fairness Act (SBREFA), Pub. L. No. 104-121, 110 Stat. 847 (1996).
 the Federal Communications Commission (Commission) incorporated an Initial Regulatory Flexibility Analysis (IRFA) in the Second Equipment Authorization Security Report and Order, Order, and Further Notice of Proposed Rulemaking (Second Report and Order and Second Further Notice). Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Second Report and Order, and Second Further Notice of Proposed Rulemaking, 40 FCC Rcd 8430 (2025) (Second Report and Order and Second Further Notice).
  The Commission sought written public comment on the proposals in the Second Report and Order and Second Further Notice, including comment on the IRFA.  No comments were filed addressing the IRFA.  This Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA and it (or summaries thereof) will be published in the Federal Register. 5 U.S.C. § 604.

A. Need for, and Objectives of, the Rules
2. In the Second Report and Order and Second Further Notice, the Commission expanded upon previously adopted rules to further proscribe the authorization of communications equipment determined to “pose an unacceptable risk to the national security of the United States or the security and safety of United States persons” under our equipment authorization program (EA program). See Second Report and Order and Second Further Notice.
  Such equipment, also known as “covered equipment,” is identified on the Commission’s Covered List. Pursuant to sections 2(a) and (d) of the Secure and Trusted Communications Networks Act of 2019, and sections 1.50002 and 1.50003 of the Commission’s rules, the Federal Communications Commission’s Public Safety and Homeland Security Bureau (PSHSB) publishes a list of communications equipment and services that have been determined by one of the sources specified in that statute to pose an unacceptable risk to the national security of the United States or the security and safety of United States persons (covered equipment).  Secure and Trusted Communications Networks Act of 2019, Pub. L. No. 116-124, 133 Stat. 158 (2020) (codified as amended at 47 U.S.C. §§ 1601-1609 (Secure Networks Act); 47 CFR §§ 1.50002, 1.50003.  
  In the Third Report and Order, the Commission takes additional action to strengthen the Commission’s equipment authorization (EA) program against national security risks to the communications supply chain by adopting clarifications and revisions to our part 2 rules. See supra at para. 13.
  Specifically, we close previous loopholes by prohibiting the authorization of devices that include logic-bearing hardware components that are covered equipment.  We further require that any modification or permissive changes by entities identified on the Covered List undergo full certification and clarify that the marketing rules reach any entity—including e‑commerce platforms—that market unauthorized equipment.  Finally, we require online marketplaces to provide an FCC ID at the online point of sale.  The adoption of these rule clarifications and revisions will further our goals of strengthening the security of the Commission’s EA program and, by extension, our national security.  
B. Summary of Significant Issues Raised by Public Comments in Response to the IRFA
3. No comments were filed addressing the impact of the proposed rules on small entities.  
C. Response to Comments by the Chief Counsel for the Small Business Administration Office of Advocacy
4. Pursuant to the Small Business Jobs Act of 2010, which amended the RFA, Small Business Jobs Act of 2010, Pub. L. No. 111-240, 124 Stat. 2504 (2010).
 the Commission is required to respond to any comments filed by the Chief Counsel for the Small Business Administration (SBA) Office of Advocacy, and also provide a detailed statement of any change made to the proposed rules as a result of those comments. 5 U.S.C. § 604 (a)(3). 
  The Chief Counsel did not file any comments in response to the proposed rules in this proceeding.
D. Description and Estimate of the Number of Small Entities to Which the Rules Will Apply
5. The RFA directs agencies to provide a description of, and where feasible, an estimate of the number of small entities that may be affected by the adopted rules. Id. § 604.  
  The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” Id. § 601(6).  
  In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. Id. § 601(3) (incorporating by reference the definition of “small-business concern” in the Small Business Act, 15 U.S.C. § 632).  Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition(s) in the Federal Register.”
  A “small business concern” is one which: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA. 15 U.S.C. § 632.
  The SBA establishes small business size standards that agencies are required to use when promulgating regulations relating to small businesses; agencies may establish alternative size standards for use in such programs, but must consult and obtain approval from SBA before doing so. 13 CFR 121.903.
  
Our actions, over time, may affect small entities that are not easily categorized at present.  We therefore describe three broad groups of small entities that could be directly affected by our actions. 5 U.S.C. § 601(3)-(6).
  
6. In general, a small business is an independent business having fewer than 500 employees. See SBA, Office of Advocacy, Frequently Asked Questions About Small Business  (July 23, 2024), https://advocacy.sba.gov/wp-content/uploads/2024/12/Frequently-Asked-Questions-About-Small-Business_2024-508.pdf.
  These types of small businesses represent 99.9% of all businesses in the United States, which translates to 34.75 million businesses. Id.
  Next, “small organizations” are not-for-profit enterprises that are independently owned and operated and are not dominant in their field. 5 U.S.C. § 601(4).
  While we do not have data regarding the number of non-profits that meet that criteria, over 99 percent of nonprofits have fewer than 500 employees. See SBA, Office of Advocacy, Small Business Facts, Spotlight on Nonprofits (July 2019), https://advocacy.sba.gov/2019/07/25/small-business-facts-spotlight-on-nonprofits/.  
  Finally, “small governmental jurisdictions” are defined as cities, counties, towns, townships, villages, school districts, or special districts with populations of less than fifty thousand. 5 U.S.C. § 601(5).
  Based on the 2022 U.S.  Census of Governments data, we estimate that at least 48,724 out of 90,835 local government jurisdictions have a population of less than 50,000. See U.S. Census Bureau, 2022 Census of Governments –Organization, https://www.census.gov/data/tables/2022/econ/gus/2022-governments.html, tables 1-11.  
  
7. The rules adopted in the Third Report and Order will apply to small entities in the industries identified in the chart below by their six-digit North American Industry Classification System (NAICS) The North American Industry Classification System (NAICS) is the standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy.  See, www.census.gov/NAICS for further details regarding the NAICS codes identified in this chart.
 codes and corresponding SBA size standard. The size standards in this chart are set forth in 13 CFR 121.201, by six digit NAICS code.
  Where available, we also provide additional information regarding the number of potentially affected entities in the identified industries below.

Regulated Industry (Footnotes specify potentially affected entities within a regulated industry where applicable)
NAICS Code

SBA Size Standard

Total Firms U.S. Census Bureau, “Selected Sectors: Employment Size of Firms for the U.S.: 2022.” Economic Census, ECN Core Statistics Economic Census: Establishment and Firm Size Statistics for the U.S., Table EC2200SIZEEMPFIRM, 2025, “Selected Sectors: Sales, Value of Shipments, or Revenue Size of Firms for the U.S.: 2022.” Economic Census, ECN Core Statistics Economic Census: Establishment and Firm Size Statistics for the U.S., Table EC2200SIZEREVFIRM, 2025.

Total Small Firms Id. 

% Small Firms
Electronic Computer Manufacturing
334111
1,250 employees
148
128
86.49%
Computer Terminal Manufacturing
334118
1,000 employees
201
194
96.52%
Telephone Apparatus Manufacturing Affected Entities in this industry include Multi-Line Telephone System Manufacturers Importers Sellers or Lessors.

334210
1,250 employees
155
136
87.74%
Radio and Television Broadcasting and Wireless Communications Equip Manufacturing Affected Entities in this industry include Aviation Radio Equipment Manufacturers, Broadcast Auxiliary Services (BAS) Remote Pickup (RPU) Manufacturing, part 15 Handset Manufacturers, Radio Frequency Equipment Manufacturers, Uncrewed Aircraft Radio Equipment Manufacturers, Vendors of Infrastructure Development_Network Buildout.

334220
1,250 employees
155
136
87.74%
Other Communications Equipment Manufacturing Affected Entities in this industry include Radio Frequency Equipment Manufacturers (Non-standard specialized equipment) and Vendors of Infrastructure Development_Network Buildout.

334290
800 employees
310
294
94.84%
Audio and Video Equipment Manufacturing
334310
750 employees
506
492
97.23%
Semiconductor and Related Device Manufacturing
334413
1,250 employees
675
610
90.37%
Search Detection Navigation Guidance...Nautical Sys and Instrument Manufacturing
334511
1,350 employees
404
369
91.34%
Aircraft Manufacturing Affected Entities in this industry include Uncrewed Aircraft Radio Equipment Manufacturers.
 
336411
1,500 employees
234
209
89.32%
Medical Laboratories
621511
$41.5 million
4,527
3,525
77.87%
Uncrewed Aircraft System (UAS) Operators
None
100 employees or less See Federal Aviation Administration, Department of Transportation, Remote Identification of Unmanned Aircraft, 86 Fed. Reg. 4390, 4494 (Jan. 15, 2021) (Remote ID Rule).
 
Data Not Disclosed
Data Not Disclosed
92.20% Id.


E. Description of Economic Impact and Projected Reporting, Recordkeeping and Other Compliance Requirements for Small Entities
8. The RFA directs agencies to describe the economic impact of proposed rules on small entities, as well as projected reporting, recordkeeping and other compliance requirements, including an estimate of the classes of small entities which will be subject to the requirement and the type of professional skills necessary for preparation of the report or record. 5 U.S.C. § 604(a)(5). 
 
9. In the Third Report and Order, we build upon the steps taken in the Second Report and Order and Second Further Notice, by amending the Commission’s part 2 rules concerning the equipment authorization program’s requirements, processes, and guidance to include additional provisions and further clarification of our current reporting and certification requirements.  Specifically, the adopted rules affect small entity grantees that seek authorization of any equipment identified on the Covered List that fails to comply with our rules regarding covered equipment.  Further, the adopted rules address the prohibited authorization of devices that contain logic-bearing hardware components produced by entities identified on the Covered List, prohibition on importation and marketing, and those posing unacceptable risks to national security.  The adopted rules also affect online marketplaces that must display FCC IDs for certified equipment at the online point of sale.  The Commission expects that all filing, recordkeeping, and reporting requirements associated with the adopted rules will be the same for small and other entities.  Moreover, the existing record does not reflect that the rules adopted today would disproportionately affect small entities.    
10. The Commission expects that the actions taken in the Third Report and Order will efficiently advance our nation’s security objectives without incurring substantial costs to small and other entities.  For example, some measures, such as the prohibition of logic-bearing hardware components and the broad scope of the prohibition on authorization of equipment identified on the covered list, are simply minimal changes reflecting clarifications of measures previously taken and, as such, should present minimal compliance costs to small entities.  Broad alternatives—such as banning all components produced by any foreign adversary controlled actor—were rejected because they would impose sweeping and disproportionate burdens on small entities.  Other measures, such as the requirement to display FCC IDs for certified equipment at the online point of sale, are also minimal changes; online marketplaces already post comprehensive product information, and adding a single identifier does not increase marginal effort or expense.  In addition, while we cannot conclusively determine whether the rules adopted in the Third Report and Order will necessitate the need for small entities to hire professionals to assist them with complying with the adopted rules, we note that the comments in the existing record do not indicate such a need.  
11. With the adoption of the Third Report and Order, the further revisions to the rules will help advance the Commission’s goals of protecting national security and public safety from threats to the communications supply chain and help to ensure we have the necessary information to prohibit authorization of equipment deemed to be a threat to our nation’s communications systems.
F. Discussion of Steps Taken to Minimize the Significant Economic Impact on Small Entities, and Significant Alternatives Considered
12. The RFA requires an agency to provide “a description of the steps the agency has taken to minimize the significant economic impact on small entities…including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.” Id. § 604(a)(6).

13. The Third Report and Order adopts revisions to the Commission’s part 2 rules regarding covered equipment identified on the Covered List in order to protect our nation’s communications systems from equipment that poses a national security risk or a threat to the safety of U.S.  persons.  Future prohibitions of covered equipment are mandated by the Secure Equipment Act, requiring that the Commission prohibit existing covered equipment, authorization or approval of any application for covered equipment, such as logic-bearing hardware components in devices.  Pursuant to Executive Order 12866, the Commission considered alternatives to this rule that would impose less of a societal burden.  We did not find any reasonable alternative that would have decreased the impact on small entities but still achieve the objective of the rule.
14. Through its review of the record in this proceeding and in its ultimate adoption of the rules set forth in the Third Report and Order, the Commission has sought, where practicable, to minimize significant economic impact to small entities and, in doing so, has considered significant alternatives to those adopted today.  For example, the adopted rules have been narrowly tailored to account for commenter concerns that an overly broad approach to limiting previously granted authorizations of covered equipment would create significant financial and technological burdens to small and other entities that may lack the financial or human resources to effectively comply with the new rules.  In addition, we also considered preserving the status quo by not adopting any new measures to address the persistent vulnerabilities identified in the record.  While this alternative would, on the surface, provide the least amount of immediate regulatory cost impact, it would carry substantial hidden costs in the form of heightened exposure to national security threats.  In making our determinations in this proceeding, we believe that the costs we are imposing are reasonable in light of our national security goals.
G. Report to Congress
15. The Commission will send a copy of the Third Report and Order, including this Final Regulatory Flexibility Analysis, in a report to Congress pursuant to the Congressional Review Act. 5 U.S.C. § 801(a)(1)(A).
  In addition, the Commission will send a copy of the Third Report and Order, including this Final Regulatory Flexibility Analysis, to the Chief Counsel for the SBA Office of Advocacy and will publish a copy of the Third Report and Order, and this Final Regulatory Flexibility Analysis (or summaries thereof) in the Federal Register. Id. § 604(b).
 
	Federal Communications Commission	FCC 26-50


APPENDIX D

Initial Regulatory Flexibility Analysis

1. As required by the Regulatory Flexibility Act of 1980, as amended (RFA), 5 U.S.C. §§ 601 et seq., as amended by the Small Business Regulatory Enforcement and Fairness Act (SBREFA), Pub. L. No. 104-121, 110 Stat. 847 (1996).
 the Federal Communications Commission (Commission) has prepared this Initial Regulatory Flexibility Analysis (IRFA) of the policies and rules proposed in the Third Further Notice of Proposed Rulemaking (Third Further Notice) assessing the possible significant economic impact on a substantial number of small entities.  The Commission requests written public comments on this IRFA.  Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments specified on the first page of the Third Further Notice.  The Commission will send a copy of the Third Further Notice, including this IRFA, to the Chief Counsel for the Small Business Administration (SBA) Office of Advocacy. Id. § 603(a).
  In addition, the Third Further Notice and IRFA (or summaries thereof) will be published in the Federal Register. Id.

A. Need for, and Objectives of, the Proposed Rules
2. In the Second Report and Order and Second Further Notice, the Commission sought comment on how best to strengthen our prohibitions regarding the authorization of covered equipment and to clarify and enforce its related rules.  In the Third Further Notice, the Commission proposes and seeks comment on additional measures to close loopholes, strengthen supply‑chain visibility, and modernize enforcement mechanisms.  These measures include: Bifurcating Covered List rules into producer/provider‑based and production‑location‑based categories; further prohibition on authorization of devices containing any component or associated element, including software, by a foreign adversary or Covered List entity; requiring hardware bills of material (HBOM) and software bills of material SBOM) submission for new authorizations; requiring registration for all SDoC devices; updating definitions relating to the Covered List (“produced by,” “critical infrastructure,” “produced in a foreign country”); strengthening rules governing white labeling, electrically identical devices, and modular‑transmitter loopholes; modernizing importation, marketing, and pre‑authorization operation rules; considering term limits for equipment authorizations; and expanding enforcement tools, including streamlined revocation procedures.  Through these proposals, the Commission aims to prevent exploitation of gaps in the equipment authorization (EA) process while enabling future technological innovation.
B. Legal Basis
3. The proposed action is authorized pursuant to sections 4(i), 301, 302, 303, 403, and 503 of the Communications Act of 1934, as amended, 47 U.S.C.  §§ 154(i), 301, 302a, 303, 403, 503, and the Secure Equipment Act of 2021, Pub.  L.  117-55, 135 Stat.  423.
C. Description and Estimate of the Number of Small Entities to Which the Proposed Rules Will Apply
4. The RFA directs agencies to provide a description of and, where feasible, an estimate of the number of small entities that may be affected by the proposed rules, if adopted. 5 U.S.C. § 603(b)(3).  
  The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” Id. § 601(6).  
  In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. Id. § 601(3) (incorporating by reference the definition of “small-business concern” in the Small Business Act, 15 U.S.C. § 632).  Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition(s) in the Federal Register.”
  A “small business concern” is one which: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the SBA. 15 U.S.C. § 632.
  The SBA establishes small business size standards that agencies are required to use when promulgating regulations relating to small businesses; agencies may establish alternative size standards for use in such programs, but must consult and obtain approval from SBA before doing so. 13 CFR 121.903.
  
5. Our actions, over time, may affect small entities that are not easily categorized at present.  We therefore describe three broad groups of small entities that could be directly affected by our actions. 5 U.S.C. § 601(3)-(6).
  In general, a small business is an independent business having fewer than 500 employees. See SBA, Office of Advocacy, Frequently Asked Questions About Small Business (July 23, 2024), https://advocacy.sba.gov/wp-content/uploads/2024/12/Frequently-Asked-Questions-About-Small-Business_2024-508.pdf.
  These types of small businesses represent 99.9% of all businesses in the United States, which translates to 34.75 million businesses. Id.
  Next, “small organizations” are not-for-profit enterprises that are independently owned and operated and not dominant in their field. 5 U.S.C. § 601(4).
  While we do not have data regarding the number of non-profits that meet that criteria, over 99 percent of nonprofits have fewer than 500 employees. See, SBA, Office of Advocacy, Small Business Facts, Spotlight on Nonprofits (July 2019), https://advocacy.sba.gov/2019/07/25/small-business-facts-spotlight-on-nonprofits/.  
  Finally, “small governmental jurisdictions” are defined as cities, counties, towns, townships, villages, school districts, or special districts with populations of less than fifty thousand. 5 U.S.C. § 601(5).
  Based on the 2022 U.S.  Census of Governments data, we estimate that at least 48,724 out of 90,835 local government jurisdictions have a population of less than 50,000. See, U.S. Census Bureau, 2022 Census of Governments –Organization, https://www.census.gov/data/tables/2022/econ/gus/2022-governments.html, tables 1-11.  
  
6. The rules proposed in the Third Further Notice will apply to small entities in the industries identified in the chart below by their six-digit North American Industry Classification System (NAICS) The North American Industry Classification System (NAICS) is the standard used by Federal statistical agencies in classifying business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy.  See, www.census.gov/NAICS for further details regarding the NAICS codes identified in this chart.
 codes and corresponding SBA size standard. The size standards in this chart are set forth in 13 CFR 121.201, by six digit North American Industrial Classification System (NAICS) code.
  Where available, we also provide additional information regarding the number of potentially affected entities in the industries identified below.
Regulated Industry (Footnotes specify potentially affected entities within a regulated industry where applicable)
NAICS Code

SBA Size Standard

Total Firms U.S. Census Bureau, “Selected Sectors: Employment Size of Firms for the U.S.: 2022.” Economic Census, ECN Core Statistics Economic Census: Establishment and Firm Size Statistics for the U.S., Table EC2200SIZEEMPFIRM, 2025, “Selected Sectors: Sales, Value of Shipments, or Revenue Size of Firms for the U.S.: 2022.” Economic Census, ECN Core Statistics Economic Census: Establishment and Firm Size Statistics for the U.S., Table EC2200SIZEREVFIRM, 2025.

Total Small Firms Id. 

% Small Firms
Electronic Computer Manufacturing
334111
1,250 employees
148
128
86.49%
Computer Terminal Manufacturing
334118
1,000 employees
201
194
96.52%
Telephone Apparatus Manufacturing Affected Entities in this industry include Multi-Line Telephone System Manufacturers Importers Sellers or Lessors.

334210
1,250 employees
155
136
87.74%
Radio and Television Broadcasting and Wireless Communications Equip Manufacturing Affected Entities in this industry include Aviation Radio Equipment Manufacturers, Broadcast Auxiliary Services (BAS) Remote Pickup (RPU) Manufacturing, part 15 Handset Manufacturers, Radio Frequency Equipment Manufacturers, Uncrewed Aircraft Radio Equipment Manufacturers, Vendors of Infrastructure Development_Network Buildout. 

334220
1,250 employees
155
136
87.74%
Other Communications Equipment Manufacturing Affected Entities in this industry include Radio Frequency Equipment Manufacturers (Non-standard specialized equipment) and Vendors of Infrastructure Development_Network Buildout.

334290
800 employees
310
294
94.84%
Audio and Video Equipment Manufacturing
334310
750 employees
506
492
97.23%
Semiconductor and Related Device Manufacturing
334413
1,250 employees
675
610
90.37%
Search Detection Navigation Guidance...Nautical Sys and Instrument Manufacturing
334511
1,350 employees
404
369
91.34%
Aircraft Manufacturing Affected Entities in this industry include Uncrewed Aircraft Radio Equipment Manufacturers.
 
336411
1,500 employees
234
209
89.32%
Medical Laboratories
621511
$41.5 million
4,527
3,525
77.87%
Uncrewed Aircraft System (UAS) Operators
None
100 employees or less See Federal Aviation Administration, Department of Transportation, Remote Identification of Unmanned Aircraft, 86 Fed. Reg. 4390, 4494 (Jan. 15, 2021) (Remote ID Rule).
 
Data Not Disclosed
Data Not Disclosed
92.20% Id.


D. Description of Economic Impact and Projected Reporting, Recordkeeping, and Other Compliance Requirements for Small Entities 
7. The RFA directs agencies to describe the economic impact of proposed rules on small entities, as well as projected reporting, recordkeeping and other compliance requirements, including an estimate of the classes of small entities which will be subject to the requirements and the type of professional skills necessary for preparation of the report or record.   5 U.S.C. § 603(b)(4). 

8. In the Third Further Notice, the Commission seeks comment on ways in which we could strengthen our prohibitions on the authorization of covered equipment and how best to clarify the rules and enforcement of such proposals.  If adopted, additional or revised rules resulting from the inquiries made in the Third Further Notice may create additional reporting, recordkeeping, and other compliance requirements for small entities.  For example, the proposals in the Third Further Notice could introduce new compliance responsibilities, such as software bill of materials (SBOM) and hardware bill of material (HBOM) filings with updates after material changes, Suppliers’ Declaration of Conformity (SDoC) device registration with unique identifiers, expanded certification disclosures, including identification of all producers, possible termlimited authorization renewal filings, and enhanced importation documentation for Covered List equipment.
9. The Commission also seeks comment from small entities and other interested parties to assist us with the clarification of specific terms and in determining how covered equipment is identified.  We will developing our assessment of the economic impact of reporting, recordkeeping, or other compliance requirements on small entities as additional information is added to the record.  In addition, while we do not anticipate that small entities would need to hire professionals to comply with any rules that are ultimately adopted as a result of the responses to our inquiries herein, we seek comments from small entities specific to any potential economic or regulatory burdens or costs that would assist the Commission with promulgating future regulations that may establish new requirements for small entities.
E. Discussion of Significant Alternatives Considered That Minimize the Significant Economic Impact on Small Entities 
10. The RFA directs agencies to provide a description of any significant alternatives to the proposed rules that would accomplish the stated objectives of applicable statutes, and minimize any significant economic impact on small entities. Id. § 603(c).
  The discussion is required to include alternatives such as: “(1) the establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance and reporting requirements under the rule for such small entities; (3) the use of performance rather than design standards; and (4) an exemption from coverage of the rule, or any part thereof, for such small entities.” Id. § 603(c)(1)-(4).

11. As discussed above, the Second Report and Order and Second Further Notice sought comment on how best to strengthen our prohibitions regarding the authorization of covered equipment and the clarification and enforcement of its related rules.  However, those rules do not fully address the Commission’s statutory responsibilities, thus necessitating the Third Further Notice’s request for additional comment.  In formulating its request for comments in the Third Further Notice, the Commission considered alternatives addressing the economic impact of its proposals on small entities, should they be adopted.  We considered maintaining the status quo, however doing so would be rejecting increased security controls.  We also considered adopting a blanket ban on all foreignproduced components, however we rejected such an approach as overly burdensome.  By seeking additional comment and considering other approaches, the Commission could clarify the scope of activities that constitute the authorization prohibitions, the marketing of equipment and measures to strengthen the enforcement of marketing prohibitions.  We also note that in developing our proposed rules, we have designed them to be narrowly tailored to specific, well-supported national security determinations, thereby ensuring that the Commission strengthens protections while avoiding unnecessary disruption to lawful supply chains.  
12. The Commission will fully consider the economic impact on small entities as it evaluates the comments filed in response to the Third Further Notice, including comments related to costs and benefits.  Alternative proposals and approaches from commenters would further develop the record and could help the Commission further minimize the economic impact on small entities.  The Commission’s evaluation of the comments filed in this proceeding would shape the final conclusions it reaches, the final alternatives it considers, and the actions it ultimately takes to minimize any significant economic impact that may occur on small entities from the final rules.
F. Federal Rules that May Duplicate, Overlap, or Conflict with the Proposed Rules
13. None.
2

Statement of
CHAIRMAN BRENDAN CARR


Re: 	Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Third Report and Order and Third Further Notice of Proposed Rulemaking (July 22, 2026).

The FCC’s Covered List has evolved a lot over the years.  Congress created the Covered List in 2019 in the Secure Networks Act, and it did so to bar FCC subsidies to carriers using dangerous equipment.  Congress provided it with additional teeth in 2021 through the Secure Equipment Act, which prohibited the FCC from authorizing covered equipment for import or sale in the U.S.  In 2022, we adopted rules implementing these prohibitions. 

Over the last year and a half, the FCC has continued to lean on the Covered List.  Indeed, the FCC has added new products, new services, and new entities to the Covered List.  This includes the addition of foreign-produced drones and routers that Executive Branch national security agencies determined pose unacceptable national security risks.  As a result, new models of drones and routers are generally prohibited unless they are made in the U.S. or approved by the Department of War or DHS following the submission of an onshoring plan.

Since these national security actions, we have seen many economic benefits as well: over $4 billion has flowed to U.S.-based drone and related production companies, opening up hundreds of thousands of square feet of manufacturing space and creating thousands of jobs.  We are seeing similar results on the router side, too, with dozens of companies committing to produce routers in America. 

Additionally, following the FCC’s first Covered List rulemaking since the agency adopted our initial rules, we have taken steps to prohibit the import or sale of even already-authorized covered equipment.  Last month, we finalized a ban on already-authorized devices added to the Covered List in 2024 or earlier; and just yesterday we proposed to ban the import or sale of already-authorized foreign-produced military grade drones, like swarming drones. 

Given all this action, today, we are taking a range of actions to bolster and modernize the Commission’s Covered List rules.  Among other final and proposed rules, three are worth highlighting here.
First, we take action to finally and fully close the component part loophole.  Since 2022, devices made by Covered List entities, like Huawei, were banned from getting new authorizations, but devices containing Huawei component parts could continue to get approval to enter the U.S. market, even though the compromised component part can make up the whole device.  Last year, we took an initial step to stop this, by prohibiting devices containing Huawei modular transmitters.  But now we go further to prohibit devices containing any Huawei-made logic-bearing hardware component (basically any “smart” component).

Second, we expand our oversight of e-commerce platforms.  This follows the success of the FCC’s “Operation Clean Carts,” an agency effort working with e-commerce platforms to rid the internet of millions of illegal listings of covered equipment.  We clarify that platforms that host third-party sellers generally still “market” equipment under FCC rules.  We also require platforms to list FCC IDs when selling their devices, facilitating greater consumer awareness and FCC oversight and enforcement of our national security rules.  But we also tailor these rules to minimize the regulatory burden—providing reasonable timelines, exemptions for small sellers and sellers of used goods, and similar actions to smooth the transition to these new requirements.

Finally, the Commission also seeks comment today on a range of ideas to further modernize the Covered List, proposing to expand FCC oversight over our existing equipment authorization process, given the crucial role it plays in national security.  We specifically seek comment on a range of ways we can update our rules in light of the recent foreign-produced drone and router Covered List updates. 

For their work on the item, I want to thank Andy Hendrickson, Alice Jou, Mateo Dunne, Katherine Patsas Nevitt, Brandon Moss, Erika Heeren-Moon, Thomas Rigolage, Chris Smeenk, Rebecca Clinton, Shannon Lipp, Kevin Pittman, and Deb Broderson.
STATEMENT OF COMMISSIONER OLIVIA TRUSTY

Re:	Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, Third Report and Order and Third Further Notice of Proposed Rulemaking, ET Docket No. 21-232 (July 22, 2026).

Last month, my staff and I visited the Office of Engineering and Technology’s Laboratory Division in Columbia, Maryland.  There, the Commission’s expert engineers evaluate radio frequency devices and related technologies to assess interference risks and verify compliance with our technical rules. Laboratory Division | Federal Communications Commission.
  The work performed at the lab is rigorous, highly technical, and essential to the interworking's of the communications ecosystem.  It also helps ensure that the devices American’s rely on every day are safe, reliable, and worthy of the public’s trust.  That mission requires constant vigilance and close collaboration among government, industry, and independent testing bodies.  Today’s item reflects that important responsibility.
 Manufacturers that bring products such as drones, networking equipment, and security devices to the U.S. market rely on complex global supply chains to source hundreds of components that go into a single device.  While these supply chains have fueled innovation and lowered costs, they can also create opportunities for hardware manufactured by foreign adversaries to enter products sold in the United States.  In some cases, a single compromised component can introduce vulnerabilities that undermine the security of an otherwise compliant device.  
Today’s rulemaking closes that security gap by ensuring that hardware produced by entities on the Covered List cannot be incorporated into devices authorized for sale in the U.S. through our equipment authorization process.  By closing these loopholes, we strengthen the integrity of our supply chains, better protect our communications networks, and enhance our national security.
I appreciate that this item also improves transparency throughout the equipment authorization process and clarifies our rules to make them more predictable for manufacturers, testing laboratories, and certification bodies.  
Finally, I welcome the Further Notice of Proposed Rulemaking, which seeks comment on additional ways to improve supply chain transparency, strengthen enforcement of the equipment authorization program, and ensure that our rules maintain flexibility to address both emerging technologies and evolving national security risks.  As communications technologies advance, our policies must keep pace to ensure the continued trustworthiness and resilience of our networks.
I thank the staff of the Office of Engineering and Technology for their hard work on this item.