What changes when the FCC bans logic-bearing parts from covered-list companies?

The component loophole that stayed open

The FCC first blocked authorizations for complete devices produced by covered-list entities in 2022. That rule stopped a router or a base station from getting a grant if the named manufacturer was on the list. It did not stop a different company from assembling a device around a processor, a radio module, or a memory chip that came from a covered-list supplier.

From a technical perspective, such components pose essentially the same unacceptable risks as covered equipment itself, the Commission now says. A compromised logic-bearing part can enable interception, disruption, sabotage, or unauthorized access regardless of who assembles or brands the finished product.

The new prohibition applies only to logic-bearing hardware components. The Commission defines that term as any physical component that generates and uses timing signals or pulses at a rate in excess of 9,000 pulses per second and uses digital techniques, or that generates and uses radio frequency energy to perform data processing functions such as computation, storage, or transfer of data. The definition draws on the existing digital device definition in Section 15.3(k) to provide a bright-line standard.

Purely mechanical or passive parts — housings, fasteners, resistors, wiring, plain battery cells — are excluded.

Software or firmware components are not reached by the rule at this time. It also does not apply to production-location-based covered-list entries such as uncrewed aircraft systems, UAS critical components, or routers produced in a foreign country unless the producing entity is independently identified on the Covered List.

Prospective application only: previously authorized equipment is unaffected. Applications pending on the effective date are exempt unless later amended to add, substitute, or change a logic-bearing hardware component.

What online marketplaces must now show

Section 2.803 now clarifies that distribution for the purpose of selling includes listing regulated equipment on an online marketplace combined with activities such as consignment, warehousing, inventory management, order processing, labeling, packaging, billing, or fulfillment services — even where the equipment is sold by a third-party seller. Carriers that merely transport devices without trading in them remain outside the marketing rules under Section 302(c) of the Communications Act.

Marketplaces that market unauthorized devices are subject to enforcement on the same basis as any other person, without a willfulness or knowledge element.

Online marketplaces must also display a certified device's FCC ID at the online point of sale, the rule requires. Marketplaces that sell their own devices, or that have physical access to or take title to a third-party seller's device, must display a valid and accurate FCC ID. Marketplaces that market third-party listings without physical access to or title over the device need only verify that the FCC ID supplied is validly issued and require the seller to certify its accuracy.

Three categories are excluded from the display requirement: listings published before the rule's effective date that are not later amended or updated; listings by sellers that are not high-volume third-party sellers as defined in the INFORM Consumers Act; and listings for used devices.

Differentiated compliance dates were adopted. Marketplaces with physical access to or title over the device must comply by March 1, 2027. Marketplaces relying on third-party seller certifications have until June 1, 2027. The Commission declined to require display of FCC IDs on external product packaging but kept the record open on that question.

Modifications and the recertification trigger

Permissive changes and modifications in Sections 2.932 and 2.1043 are now prohibited for equipment already barred under Section 2.903 and for equipment that would become prohibited through the proposed modification. A shift in production to a covered-list entity or a change that would cause a device to lose domestic end product status triggers the bar.

No new component-lineage investigation obligations are imposed beyond those already required for compliance. The produced-by standard continues to be evaluated under a totality-of-the-circumstances test that looks to substantial responsibility for or control over a device's design, development, manufacture, or assembly.

Any entity identified on the Covered List seeking a permissive change to equipment — whether or not the equipment is itself covered — must submit an application for recertification rather than relying on the more limited permissive-change process. No covered-list entity may use the Supplier's Declaration of Conformity process for any modification.

This requirement applies only where the applicant for the modification is itself a covered-list entity. It does not apply to a non-covered-list manufacturer's modification of equipment originally produced by a covered-list entity where the modification does not itself render the device produced by that entity. The requirement does not apply to production-location-based covered-list entries.

Limited waivers previously granted by the Office of Engineering and Technology permitting Class I and Class II permissive changes for covered-list UAS equipment and covered routers, through January 1, 2029, remain in effect according to their terms.

The court-ordered definition rewrite

The U.S. Court of Appeals for the District of Columbia Circuit partially remanded the Commission's prior definition of critical infrastructure. The Commission responded by retaining the definition set forth in Section 1016(e) of the USA PATRIOT Act of 2001: systems and assets so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. It continues to rely on the 16 critical infrastructure sectors identified by the Department of Homeland Security and the 55 National Critical Functions published by DHS's National Risk Management Center.

The prior connected-to language that the D.C. Circuit found unjustifiably broad has been eliminated. The revised definition instead encompasses systems and assets used in the provision of services or functions in the 16 critical infrastructure sectors when used to provide any of the 55 National Critical Functions. The Commission finds this revision responsive to the court's remand while remaining consistent with existing Executive Branch critical-infrastructure policy.

Two administrative fixes

A scrivener's error in Section 2.903 has been corrected, restoring cross-references within redesignated paragraphs (d)(1) through (d)(3) that had inadvertently continued to refer to former paragraph (b). Section 2.1204(a) also received fixes: adding the omitted word and between technical and administrative in paragraph (a)(2), and removing paragraph (a)(4)(iv) as duplicative of paragraph (a)(4)(iii).

What the Commission says it costs and saves

One-time implementation costs are estimated at no more than $300 million, largely attributable to online marketplace platforms updating listing systems to support FCC ID display. Recurring annual costs are projected under $40 million, largely attributable to sellers identifying and including FCC IDs in covered listings. These estimates account for the exemptions adopted for low-volume sellers, used devices, and certain pre-existing listings.

Because the logic-bearing hardware component prohibition applies only prospectively and affects a comparatively narrow subset of manufacturers, and because the marketing and modification clarifications largely codify existing interpretations, the Commission does not expect these measures to impose significant additional compliance burdens.

Against these costs, the Commission finds that closing the identified component, marketing, and modification loopholes will generate substantial, if difficult to quantify, benefits by reducing the risk of espionage, network disruption, and unauthorized access to U.S. communications infrastructure. The Commission estimates those benefits could exceed $1 billion annually given the scale of the U.S. communications economy. The Commission considered and rejected two alternatives: taking no action, which would leave existing vulnerabilities unaddressed, and adopting a categorical ban on all components produced by covered-list entities, which the record shows would impose disproportionate costs.