US / FCC / Equipment Authorization
The FCC's Third Report and Order bars authorization of any device containing a logic-bearing hardware component produced by a Covered List entity, and pulls online marketplaces into the marketing rules and FCC ID display duties. Its companion Further Notice separately proposes — but has not adopted — HBOM/SBOM disclosure with every application, a bifurcated Covered List, and a required US-based liable party.
Last updated 6 September 2026
The FCC adopted its Third Report and Order on 22 July 2026 and released it on 23 July 2026. What it actually adopts: a prohibition on authorizing devices that incorporate a logic-bearing hardware component produced by a Covered List entity; a limit confining that component prohibition to producer/provider-based Covered List determinations rather than production-location ones; marketing liability and FCC ID display duties for online marketplaces; re-certification requirements for Covered List entities; and a definition of "critical infrastructure" for Covered List purposes. Those rules take effect 30 days after the Report and Order is published in the Federal Register, which had not happened as of 6 September 2026.
The separate Third Further Notice of Proposed Rulemaking, published in the Federal Register on 7 August 2026, only seeks comment on bifurcating the Covered List into producer/provider-based and production-location-based categories, on HBOM/SBOM disclosure with every application, on a required US-based liable party for certified equipment, and on white labeling, importation, SDoC registration and authorization term limits. Comments were due 8 September 2026, replies 21 September 2026. None of those are requirements today.
Source: FCC, July 1, 2026 Fact Sheet (DOC-422746A1); Federal Register, 7 August 2026 (2026-16197), which publishes the Further Notice as a proposed rule.
Previously, a Covered List component could sometimes pass authorization if it wasn't the device's primary chipset. The new rule reaches any logic-bearing hardware component — anything capable of processing instructions — produced by a Covered List entity, wherever it sits in the device. Only genuinely passive parts (screws, connectors, enclosures) fall outside it. For a device with a multi-tier supply chain, that means auditing components several levels down, not just the main board.
Source: Wiley, "FCC Expands Covered List Prohibitions to Devices with Certain Logic-Bearing Hardware Components"; Cooley, "FCC Expands Restrictions on Covered List Equipment and Supply Chains".
The Third Further Notice asks whether applicants should have to file a hardware bill of materials and software bill of materials with every equipment-authorization application — disclosing the hardware, firmware and software components in the device, including modular transmitters, IoT modules, semiconductors and optical transceivers — so that the FCC can verify nothing traces back to a Covered List entity. It is a proposal at the comment stage, not an obligation. It is worth preparing for anyway: assembling that list depends on visibility into sub-tier suppliers that most manufacturers do not currently track in application-ready form, and the adopted logic-bearing component ban already requires knowing who produced what in the device.
Source: FCC, Third Report and Order and Third Further Notice of Proposed Rulemaking (FCC-26-50A1), section IV.C; Federal Register, 7 August 2026 (2026-16197) — filed as a proposed rule.
Marketplaces that list, distribute, or facilitate sales of FCC-regulated equipment — including on behalf of third-party sellers — must display the device's FCC ID prominently at the point of sale, and fall under the same marketing-rule prohibition on advertising unauthorized equipment. This was adopted, and phases in on its own timeline: 180 days after Federal Register publication for a marketplace that sells the device itself or takes title to or has physical access to it, 270 days for one that markets on a third party's behalf without physical access. Listings published before the effective date are exempt until amended or republished, as are non-high-volume third-party sellers and used devices. Either way it changes what listing data manufacturers need to hand marketplace partners.
Source: Lerman Senter, "FCC Changes Equipment Authorization Rules — And More Changes are Coming".
No date is fixed yet. The Third Report and Order (adopted 22 July 2026, released 23 July 2026) states that its rule amendments take effect 30 days after publication in the Federal Register — and as of 6 September 2026 the Report and Order itself has not yet been published there. Only the companion Third Further Notice of Proposed Rulemaking was published, on 7 August 2026, and its 8 September 2026 date is the comment deadline on the proposals, not an effective date. The FCC ID display duties for online marketplaces phase in later still: 180 days after publication for marketplaces that take title to or have physical access to the device, 270 days for those that do not.
The FCC will no longer authorize equipment that incorporates a logic-bearing hardware component — any component capable of processing instructions, not just full modules — produced by an entity on the FCC's Covered List (the Secure Networks Act supply-chain list). The rule closes a loophole that previously let a Covered List component pass if it wasn't the device's primary chipset; only genuinely "dumb" parts like screws and connectors are excluded.
It is a proposal, not yet a rule. In the Third Further Notice of Proposed Rulemaking the FCC seeks comment on requiring every applicant for equipment authorization to submit a hardware bill of materials (HBOM) and software bill of materials (SBOM) — a list of the entities that produced the device's hardware, firmware and software components, so the FCC can verify none trace back to a Covered List entity. Comments were due 8 September 2026 and reply comments 21 September 2026. Nothing in the Third Report and Order obliges applicants to file an HBOM or SBOM today.
Marketplaces that list, distribute, or facilitate sale of FCC-regulated equipment — including third-party listings — must display the device's FCC ID prominently at the online point of sale, and are brought within the marketing rules that prohibit advertising unauthorized equipment. This was adopted in the Third Report and Order and phases in after Federal Register publication: 180 days for a marketplace that takes title to or has physical access to the device, 270 days for one that does not.
Most equipment-authorization applicants have never had to assemble a supply-chain bill of materials before — it's a documentation and sourcing-visibility problem as much as an RF-testing one. We map your bill of materials against the Covered List, flag exposure before you submit, and manage the authorization application alongside the rest of your US market-access work.
Book a scoping call