US / FCC / Equipment Authorization
The FCC has closed the component loophole and proposes supply-chain documentation.
The FCC's Third Report and Order bars authorization of any device containing a logic-bearing hardware component produced by a Covered List entity, and pulls online marketplaces into the marketing rules and FCC ID display duties. Its companion Further Notice separately proposes — but has not adopted — HBOM/SBOM disclosure with every application, a bifurcated Covered List, and a required US-based liable party.
Last updated 23rd September 2026 · By Vas Parshin and Anabel Amar
What's actually changing
The FCC adopted its Third Report and Order on 22nd July 2026 and released it on 23rd July 2026. What it actually adopts: a prohibition on authorizing devices that incorporate a logic-bearing hardware component produced by a Covered List entity; a limit confining that component prohibition to producer/provider-based Covered List determinations rather than production-location ones; marketing liability and FCC ID display duties for online marketplaces; re-certification requirements for Covered List entities; and a definition of "critical infrastructure" for Covered List purposes. The Report and Order was published in the Federal Register on 11th September 2026 as a final rule, and those amendments take effect 13th October 2026.
The separate Third Further Notice of Proposed Rulemaking, published in the Federal Register on 7th August 2026, only seeks comment on bifurcating the Covered List into producer/provider-based and production-location-based categories, on HBOM/SBOM disclosure with every application, on a required US-based liable party for certified equipment, and on white labeling, importation, SDoC registration and authorization term limits. Comments were due 8th September 2026, replies 21st September 2026. None of those are requirements today.
The logic-bearing hardware ban closes a real loophole
Previously, a Covered List component could sometimes pass authorization if it wasn't the device's primary chipset. The new rule reaches any logic-bearing hardware component — anything capable of processing instructions — produced by a Covered List entity, wherever it sits in the device. Only genuinely passive parts (screws, connectors, enclosures) fall outside it. For a device with a multi-tier supply chain, that means auditing components several levels down, not just the main board.
HBOM/SBOM: proposed, not yet required
The Third Further Notice asks whether applicants should have to file a hardware bill of materials and software bill of materials with every equipment-authorization application — disclosing the hardware, firmware and software components in the device, including modular transmitters, IoT modules, semiconductors and optical transceivers — so that the FCC can verify nothing traces back to a Covered List entity. It is a proposal at the comment stage, not an obligation. It is worth preparing for anyway: assembling that list depends on visibility into sub-tier suppliers that most manufacturers do not currently track in application-ready form, and the adopted logic-bearing component ban already requires knowing who produced what in the device.
Online marketplaces get pulled in too
Marketplaces that list, distribute, or facilitate sales of FCC-regulated equipment — including on behalf of third-party sellers — must display the device's FCC ID prominently at the point of sale, and fall under the same marketing-rule prohibition on advertising unauthorized equipment. This was adopted, and phases in on its own timeline: the Commission set differentiated compliance dates of 1st March 2027 for a marketplace that sells the device itself or takes title to or has physical access to it, and 1st June 2027 for one that markets on a third party's behalf without physical access and so relies on the seller's certification. Listings published before the rule's effective date are exempt until amended or updated, as are sellers that are not "high-volume third-party sellers" under the INFORM Consumers Act, and used devices. Either way it changes what listing data manufacturers need to hand marketplace partners.
Certification or SDoC: the two routes these rules sit on
A device that needs FCC equipment authorization gets it through one of two procedures, and the changes above land differently on each. Under a Supplier's Declaration of Conformity (SDoC), the responsible party makes the measurements, or completes other procedures the FCC accepts, to ensure the equipment complies with the technical standards; it does not submit a sample or test data to the FCC unless the FCC specifically asks for them. Certification is an authorization issued by the FCC or by a Telecommunication Certification Body (TCB) on the basis of the representations and test data the applicant submits, and it attaches to every later unit that is identical to the sample tested.
The Covered List already cuts across both routes. Equipment that would otherwise qualify for SDoC, or be exempt from authorization altogether, must go through Certification if it is produced by an entity on the Covered List. And the testing behind an SDoC must not be performed at a measurement facility that is owned by, controlled by or under the direction of a prohibited entity. Which route a device takes, and where it is tested, is now a supply-chain question as well as a product-category one. For a Certification filing, lab choice also affects review speed under the FCC's trusted test lab fast track; a device that is also sold in Canada has its own ISED requirements, such as the 2026 5 GHz DFS rule.
Questions
When do the new FCC equipment-authorization rules take effect?
13th October 2026. The Third Report and Order (adopted 22nd July 2026, released 23rd July 2026) was published in the Federal Register on 11th September 2026 as a final rule (2026-18535, ET Docket No. 21-232), effective 13th October 2026. The companion Third Further Notice of Proposed Rulemaking was published separately on 7th August 2026; its 8th September 2026 date was the comment deadline on those proposals, not an effective date. The FCC ID display duties for online marketplaces have their own later compliance dates: 1st March 2027 for marketplaces that take title to or have physical access to the device, 1st June 2027 for those relying on third-party seller certifications.
What is the logic-bearing hardware ban?
The FCC will no longer authorize equipment that incorporates a logic-bearing hardware component — any component capable of processing instructions, not just full modules — produced by an entity on the FCC's Covered List (the Secure Networks Act supply-chain list). The rule closes a loophole that previously let a Covered List component pass if it wasn't the device's primary chipset; only genuinely "dumb" parts like screws and connectors are excluded.
What is HBOM/SBOM disclosure and who has to provide it?
It is a proposal, not yet a rule. In the Third Further Notice of Proposed Rulemaking the FCC seeks comment on requiring every applicant for equipment authorization to submit a hardware bill of materials (HBOM) and software bill of materials (SBOM) — a list of the entities that produced the device's hardware, firmware and software components, so the FCC can verify none trace back to a Covered List entity. Comments were due 8th September 2026 and reply comments 21st September 2026. Nothing in the Third Report and Order obliges applicants to file an HBOM or SBOM today.
What changes for online marketplaces selling FCC-regulated devices?
Marketplaces that list, distribute, or facilitate sale of FCC-regulated equipment — including third-party listings — must display the device's FCC ID prominently at the online point of sale, and are brought within the marketing rules that prohibit advertising unauthorized equipment. This was adopted in the Third Report and Order, which set differentiated compliance dates: 1st March 2027 for a marketplace that takes title to or has physical access to the device, 1st June 2027 for one relying on third-party seller certifications.
What is the difference between FCC Certification and SDoC?
Both are FCC equipment-authorization procedures. Under a Supplier's Declaration of Conformity (47 CFR 2.906) the responsible party ensures the equipment complies through measurements or other procedures the FCC accepts, and submits a sample or test data only if the FCC asks. Certification (47 CFR 2.907) is issued by the FCC or a Telecommunication Certification Body on the basis of test data the applicant submits. Equipment produced by an entity on the Covered List must use Certification even if it would otherwise qualify for SDoC or be exempt.
Where we fit
Most equipment-authorization applicants have never had to assemble a supply-chain bill of materials before — it's a documentation and sourcing-visibility problem as much as an RF-testing one. We map your bill of materials against the Covered List, flag exposure before you submit, and manage the authorization application alongside the rest of your US market-access work.
Contact usSources
- Wiley, "FCC Expands Covered List Prohibitions to Devices with Certain Logic-Bearing Hardware Components"
- Cooley, "FCC Expands Restrictions on Covered List Equipment and Supply Chains"
- Federal Register, 11th September 2026 (2026-18535), the final rule, effective 13th October 2026; FCC, 1st July 2026 Fact Sheet (DOC-422746A1); Federal Register, 7th August 2026 (2026-16197), which publishes the Further Notice as a proposed rule
- FCC, Third Report and Order and Third Further Notice of Proposed Rulemaking (FCC-26-50A1), section IV.C; Federal Register, 7th August 2026 (2026-16197) — filed as a proposed rule
- Federal Register, 11th September 2026 (2026-18535), which states the 1st March 2027 and 1st June 2027 compliance dates; Lerman Senter, "FCC Changes Equipment Authorization Rules — And More Changes are Coming"
- 47 CFR 2.906 (Supplier's Declaration of Conformity), paragraphs (a)(1) and (a)(2); 47 CFR 2.907 (Certification), paragraphs (a) to (c)