Executive Branch Determination and Covered List Update
On March 23, 2026, the Federal Communications Commission announced an update to its Covered List to include all consumer-grade routers produced in foreign countries. The action follows a formal determination made by a White House-convened Executive Branch interagency body with national security expertise.
The interagency determination concluded that foreign-produced consumer routers pose unacceptable risks to the national security of the United States and the safety and security of U.S. persons. Specifically, the determination cited two key findings: foreign-made routers introduce a supply chain vulnerability capable of disrupting the U.S. economy, critical infrastructure, and national defense, and they pose severe cybersecurity risks that could be leveraged to disrupt infrastructure and harm individuals.
The announcement highlighted that malicious actors have previously exploited security vulnerabilities in foreign-made routers to carry out network attacks, espionage, and intellectual property theft, specifically noting involvement in the Volt, Flax, and Salt Typhoon cyberattacks targeting U.S. critical infrastructure.
Impact on Equipment Authorizations, Existing Devices, and Sales
Under the FCC's Covered List rules, equipment placed on the list is prohibited from receiving FCC equipment authorizations. Because consumer-grade routers require equipment authorization prior to importation, marketing, or sale in the United States, placing foreign-produced routers on the list bars new foreign-made models from entering the U.S. market.
The Commission clarified that the update does not affect routers that have already been purchased or router models previously approved through the equipment authorization process.
- Consumers may continue using any consumer-grade router they have already lawfully acquired.
- Retailers and distributors may continue to sell, import, and market router models that were authorized by the FCC prior to this update.
- Restrictions apply strictly to applications for authorization of new device models.
Conditional Approval Exemption Process
The interagency determination established an exemption process for equipment that receives 'Conditional Approval' from either the Department of War (DoW) or the Department of Homeland Security (DHS) after finding the device does not pose unacceptable risks.
Producers of consumer-grade routers seeking eligibility for FCC equipment authorization are instructed to apply for Conditional Approval pursuant to guidance attached to the determination by submitting applications to conditional-approvals@fcc.gov.
Statutory Authority and Prior Actions
Under the Secure and Trusted Communications Networks Act, the FCC does not independently generate entries for the Covered List; it is required to update the list based on determinations issued by national security authorities.
The router determination follows prior additions to the Covered List made in December and January, which covered uncrewed aircraft systems (UAS) and UAS critical components produced in foreign countries, subject to specific exemptions such as the Defense Contract Management Agency Blue UAS Cleared List, domestic end-product standards under 48 CFR 25.101(a), and Section 1709(a)(1) of the FY25 National Defense Authorization Act (Pub. L. 118-159).