Overview of the Third Report and Order
On July 22, 2026, the Federal Communications Commission adopted a Third Report and Order and Third Further Notice of Proposed Rulemaking (FCC 26-50) in ET Docket No. 21-232, which was released on July 23, 2026. The action builds on previous orders under the Secure and Trusted Communications Networks Act of 2019 and the Secure Equipment Act of 2021 to fortify the FCC's equipment authorization program against national security risks.
The newly adopted rules close component-part gaps by prohibiting the authorization of equipment containing logic-bearing hardware components produced by entities on the FCC Covered List. The Commission also clarified its equipment marketing regulations under Part 2, established point-of-sale FCC ID display mandates for online marketplaces, required full recertification for equipment modifications made by Covered List entities, and refined the regulatory definition of critical infrastructure.
- Adopted: July 22, 2026; Released: July 23, 2026; Erratum released: August 13, 2026.
- Federal Register citation: Volume 91, page 51139 (published August 7, 2026).
- Rule amendments take effect 30 days after Federal Register publication, with phased compliance dates for point-of-sale FCC ID display rules.
Prohibition on Logic-Bearing Hardware Components
Expanding upon prior prohibitions that covered finished devices and modular transmitters, the Commission amended Section 2.903 to prohibit the authorization of any device incorporating logic-bearing hardware components produced by an entity identified on the Covered List if the device itself would have been prohibited had the Covered List entity produced it. The Commission established that compromised hardware components operating below operating system layers can facilitate surveillance, data exfiltration, or remote disruption regardless of outer product branding.
Under new Section 2.902, a logic-bearing hardware component is defined as any device, system, module, sub-assembly, integrated circuit, or other physical component that generates and uses timing signals or pulses at a rate exceeding 9,000 pulses (cycles) per second (9 kHz) and uses digital techniques. This includes digital telephone equipment or components generating and using radio frequency energy for data processing functions such as computation, recording, sorting, storage, retrieval, or transfer.
- Excluded non-logic-bearing items: Purely mechanical/structural parts, passive electrical parts (simple resistors, capacitors, inductors), basic power-only cells without control logic, and bare motors lacking digital controllers.
- Pending applications: Applications filed with the FCC or a Telecommunication Certification Body (TCB) before the effective date are exempt, provided they are not subsequently amended to change logic-bearing components.
- Scope limitation: The component ban applies strictly to producer/provider-based Covered List entities and does not extend to production location-based entries unless specifically named.
Online Marketplace Marketing and FCC ID Display Requirements
The Commission amended Section 2.803(a)(1) to clarify that marketing includes listing regulated equipment on an online marketplace in combination with fulfillment activities such as consignment, warehousing, inventory management, order processing, labelling, packaging, billing, or fulfillment services, even for third-party seller items.
Under Section 2.803(c), online marketplaces must ensure the display of FCC IDs at the online point of sale for devices subject to certification. As clarified in the August 13, 2026 Erratum (DOC-424161A1), compliance dates are tiered based on platform operational models.
- Section 2.803(c)(1) compliance date: March 1, 2027, for marketplaces selling their own devices or third-party items to which they take title or have physical access (valid and accurate FCC ID required).
- Section 2.803(c)(2) compliance date: June 1, 2027, for marketplaces hosting third-party sellers without physical access or title (marketplace must display a valid FCC ID, perform an Equipment Authorization System database check, and obtain seller certification of accuracy).
- Grandfathering: Existing listings published before the effective date are exempt unless amended, updated, or republished.
- Exemptions: Listings by third-party sellers who are not 'high-volume third-party sellers' under the INFORM Consumers Act (15 U.S.C. § 45f(f)(6)) and listings for used radiofrequency devices are exempt from Section 2.803(c).
- SDoC exclusion: Marketplaces are not required to display Supplier's Declaration of Conformity compliance information statements under Section 2.803(c).
Equipment Modifications and Covered List Recertification
The Commission revised Section 2.932 and Section 2.1043 to make clear that permissive change procedures cannot be used to modify equipment in ways that render previously authorized equipment 'covered' under Section 2.903. The term 'produced by' continues to be evaluated under the totality of circumstances, focusing on substantive control over design, development, manufacturing, or assembly.
Entities identified on the Covered List are barred from using permissive change pathways or the Supplier's Declaration of Conformity (SDoC) process. Any modification or change made by a Covered List entity must be submitted as a full application for a new grant of certification under Part 2, Subpart J.
- Applies to all modifications by Covered List entities, regardless of whether the equipment is covered or non-covered.
- Non-Covered List manufacturers modifying equipment originally made by a Covered List entity are not subject to recertification if the modified device is not 'produced by' the Covered List entity under the totality of circumstances.
- Existing OET waivers permitting software and firmware security patches for certain foreign-produced UAS and routers remain in effect through January 1, 2029.
Revised Definition of Critical Infrastructure
In response to the partial remand by the U.S. Court of Appeals for the District of Columbia Circuit in Hikvision USA, Inc. v. FCC, the Commission amended Section 1.50001(f) to narrow the definition of 'critical infrastructure' used under Section 889(f)(3) of the 2019 National Defense Authorization Act.
The updated rule adopts the base definition from Section 1016(e) of the USA PATRIOT Act (42 U.S.C. § 5195c(e)) and encompasses systems and assets in the 16 critical infrastructure sectors identified in National Security Memorandum 22 used to provide any of the 55 National Critical Functions published by the Cybersecurity and Infrastructure Security Agency's National Risk Management Center. The Commission eliminated the previous provision that broadly encompassed any equipment merely 'connected to' critical infrastructure.
- Base statutory standard: Systems and assets so vital that their incapacity or destruction would have a debilitating impact on national security, economic security, or public health and safety.
- Scope: Excludes equipment that is merely connected to a critical sector without supporting one of the 55 National Critical Functions.
Proposals in the Third Further Notice of Proposed Rulemaking
The accompanying Third Further Notice of Proposed Rulemaking (Third FNPRM) solicits public feedback on additional measures to modernize equipment authorization safeguards and post-market enforcement. Comments are due 30 days after Federal Register publication (September 8, 2026), and reply comments are due 45 days after publication (September 21, 2026).
Key proposals under consideration include bifurcating the Covered List into producer/provider-based and production location-based categories, requiring Hardware Bill of Materials (HBOM) and Software Bill of Materials (SBOM) submissions, mandating central registration and unique identifiers for SDoC-authorized devices, and establishing a U.S.-based liable party requirement for all foreign-grantee certified equipment under Section 2.909.
- HBOM and SBOM disclosures: Reporting component origin, producer identity, and value percentages, with mandatory updates within 30 days of changes.
- SDoC reforms: Proposed registration of SDoC devices in an FCC database with assigned identifiers displayed on devices, packaging, and online listings.
- Importation restrictions (§ 2.1204): Proposed 40-unit cap for unauthorized covered equipment testing/evaluation imports, elimination of the import-for-export cellular handset exception, and definition of 'personal use'.
- Revocation procedures (§ 2.939): Streamlined 10-day response revocation process for willfulness, false certifications, or terminated Conditional Approvals.
- Submarine cable landing licenses: Tailoring Covered List routine conditions and certifications under Part 1 Subpart FF to producer/provider entries unless location-based determinations explicitly cite submarine cable threats.