FCC extends the Covered List ban to components

Hugues Orgitello updated 6 Oct 2026 4 min read

Adopted on 22 July 2026 and released on 23 July, Third Report and Order FCC 26-50 closes what the Commission calls the component part loophole. A device will no longer obtain equipment authorization if it contains a logic-bearing hardware component produced by an entity on the Covered List, where the device itself would have been prohibited had that entity built the whole thing. The order was published in the Federal Register on 11 September 2026, at 91 FR 57798, and takes effect on 13 October 2026. The online marketplace duties follow later, on 1 March and 1 June 2027: see FCC 26-50 in force, but marketplaces wait until 2027.

In short:

The prohibition reaches down to the component: integrated circuits, modules, optical transceivers, populated boards.
Software and firmware stay outside the scope, though the accompanying consultation, now closed, proposed bringing them in.
Online marketplaces must display the FCC ID at the point of sale.
Any modification by a Covered List entity requires full certification, with the SDoC route closed to it.

The component becomes an authorization criterion

Until now, the Covered List rules addressed the finished product and its manufacturer. FCC 26-50 targets what the Commission describes as a loophole: a device assembled by an unlisted company but built around components sourced from a listed entity.

The definition of a logic-bearing hardware component is deliberately wide. It covers components that generate or use timing signals at a rate above 9,000 pulses per second using digital techniques, as well as those generating radio frequency energy for data processing functions. In practice that captures almost all digital hardware: semiconductors, IoT modules, optical transceivers, populated printed circuit boards.

Two limits are worth noting:

Software and firmware are excluded from the adopted order. The accompanying consultation asks whether they should be included.
Applications filed before the effective date continue to be processed under the prior rules.

Online marketplaces come into scope

The second strand is a change of perimeter more than a new technical requirement. Marketing, in the sense of the FCC rules, now expressly covers posting a listing, consignment, warehousing, inventory management, order processing, labelling, packaging, billing and fulfilment services. The definition of an online marketplace is taken from the INFORM Consumers Act.

The duty to display the FCC ID at the online point of sale varies with how much control the platform has:

Situation	What the platform must verify
The platform holds title or inventory	FCC ID valid and accurate
The platform hosts a third-party listing without holding the product	FCC ID valid, reasonable due diligence, seller certification

Two carve-outs apply: used devices, and third-party sellers who do not fall within the high-volume seller category.

Corrected 19 September 2026. This paragraph previously read the timing from paragraph 245 of the order, as six and nine months after Federal Register publication, in 47 CFR 2.803(c)(2) and (c)(3). The codified rule published at 91 FR 57798 does it differently: the duties sit in § 2.803(c)(1) and § 2.803(c)(2), with (c)(3) carrying the exemptions, and the compliance dates are fixed at 1 March 2027 and 1 June 2027 rather than running from publication. See FCC 26-50 in force, but marketplaces wait until 2027.

Modifications, recertification and critical infrastructure

Three further provisions round out the order:

Previously authorised equipment cannot be modified into covered equipment.
Any modification or permissive change made by a Covered List entity requires full certification. The supplier's declaration of conformity is no longer open to it for those changes.
The definition of critical infrastructure is amended, answering the remand from the DC Circuit in Hikvision USA v. FCC. It governs when the use-based restrictions apply.

A cross-reference error in 47 CFR 2.903 is corrected at the same time.

What remains at proposal stage

The consultation attached to the order goes considerably further than what was adopted. Comments closed on 8 September 2026 and replies on 21 September 2026. The avenues opened:

Extending the prohibition to any component, software included, from a listed entity.
Requiring disclosure of a hardware and software bill of materials (HBOM and SBOM) in support of the authorization application.
Governing white labelling by requiring disclosure of every brand and every production entity.
Introducing a limited term of validity for equipment authorizations.
Creating a register of devices declared under SDoC.
Requiring a US-based responsible party for certified equipment.
Restricting importation pathways, revisiting FCC logo rules, streamlining revocation, addressing submarine cables.

What to do

Screen the bill of materials at component level, not tier-one supplier level. The exposure sits in integrated circuits, modules, transceivers and populated boards.
Decide on filing timing. An application filed before the order takes effect falls under the prior rules, and that date is now fixed at 13 October 2026.
Check that your FCC ID reaches the marketplaces that distribute the product: a missing or inaccurate identifier becomes grounds for delisting.
Track what the consultation produces. It closed on 21 September 2026, and an SBOM obligation or a limited authorization term would reach your certification programme directly.