FCC extends the Covered List ban to components

Author Hugues Orgitello Last updated 22 August 2026 ~4 min read

News · Regulatory evolution

Adopted on 22 July 2026 and released on 23 July, Third Report and Order FCC 26-50 closes what the Commission calls the component part loophole. A device will no longer obtain equipment authorization if it contains a logic-bearing hardware component produced by an entity on the Covered List, where the device itself would have been prohibited had that entity built the whole thing. The order takes effect 30 days after it is published in the Federal Register, and that publication had not happened as of 15 August 2026, so no calendar date is fixed yet.

In short:

The prohibition reaches down to the component: integrated circuits, modules, optical transceivers, populated boards.
Software and firmware stay outside the scope for now, though the open consultation proposes bringing them in.
Online marketplaces must display the FCC ID at the point of sale.
Any modification by a Covered List entity requires full certification, with the SDoC route closed to it.

The component becomes an authorization criterion

Until now, the Covered List rules addressed the finished product and its manufacturer. FCC 26-50 targets what the Commission describes as a loophole: a device assembled by an unlisted company but built around components sourced from a listed entity.

The definition of a logic-bearing hardware component is deliberately wide. It covers components that generate or use timing signals at a rate above 9,000 pulses per second using digital techniques, as well as those generating radio frequency energy for data processing functions. In practice that captures almost all digital hardware: semiconductors, IoT modules, optical transceivers, populated printed circuit boards.

Two limits are worth noting:

Software and firmware are excluded from the adopted order. The accompanying consultation asks whether they should be included.
Applications filed before the effective date continue to be processed under the prior rules.

Online marketplaces come into scope

The second strand is a change of perimeter more than a new technical requirement. Marketing, in the sense of the FCC rules, now expressly covers posting a listing, consignment, warehousing, inventory management, order processing, labelling, packaging, billing and fulfilment services. The definition of an online marketplace is taken from the INFORM Consumers Act.

The duty to display the FCC ID at the online point of sale varies with how much control the platform has:

Situation	What the platform must verify
The platform holds title or inventory	FCC ID valid and accurate
The platform hosts a third-party listing without holding the product	FCC ID valid, reasonable due diligence, seller certification

Two carve-outs apply: used devices, and third-party sellers who do not fall within the high-volume seller category.

The timing is set by the order itself, in paragraph 245: the FCC ID display requirement of 47 CFR 2.803(c)(2) takes effect 6 months after Federal Register publication, and 2.803(c)(3) 9 months after it. Both clocks start from a publication that has not yet occurred, so neither has a calendar date yet.

Modifications, recertification and critical infrastructure

Three further provisions round out the order:

Previously authorised equipment cannot be modified into covered equipment.
Any modification or permissive change made by a Covered List entity requires full certification. The supplier's declaration of conformity is no longer open to it for those changes.
The definition of critical infrastructure is amended, answering the remand from the DC Circuit in Hikvision USA v. FCC. It governs when the use-based restrictions apply.

A cross-reference error in 47 CFR 2.903 is corrected at the same time.

What remains at proposal stage

The consultation attached to the order goes considerably further than what was adopted. Comments close on 8 September 2026, replies on 21 September 2026. The avenues opened:

Extending the prohibition to any component, software included, from a listed entity.
Requiring disclosure of a hardware and software bill of materials (HBOM and SBOM) in support of the authorization application.
Governing white labelling by requiring disclosure of every brand and every production entity.
Introducing a limited term of validity for equipment authorizations.
Creating a register of devices declared under SDoC.
Requiring a US-based responsible party for certified equipment.
Restricting importation pathways, revisiting FCC logo rules, streamlining revocation, addressing submarine cables.

What to do

Screen the bill of materials at component level, not tier-one supplier level. The exposure sits in integrated circuits, modules, transceivers and populated boards.
Decide on filing timing. An application filed before the order takes effect falls under the prior rules, and the effective date is 30 days after Federal Register publication. Watch the register rather than a fixed date.
Check that your FCC ID reaches the marketplaces that distribute the product: a missing or inaccurate identifier becomes grounds for delisting.
Decide whether to comment before 8 September, particularly if an SBOM obligation or a limited authorization term would affect your certification programme.