Beginning October 13, the Federal Communications Commission will add a new question to the approval process for communications equipment: not only who made the device, but who made the important hardware inside it.
The rule closes what the FCC describes as a component loophole. A device seeking new authorization generally cannot contain a qualifying logic-bearing hardware component produced by an entity on the agency’s Covered List if the device itself would have been prohibited had that entity produced the finished product. The change applies to new equipment-authorization applications. It does not recall every previously approved router, camera, drone or radio already in use.
The technical issue is more significant than the legal wording suggests. Modern devices are assembled through supply chains that can include a brand owner, design house, contract manufacturer, board assembler, module supplier, firmware provider and distributor. The logo on the case identifies only the last visible layer. It does not necessarily identify the company that designed the processor, radio module or controller responsible for handling data.
The FCC is therefore making component provenance part of market access. That is a reasonable direction for a communications regulator. It is also a test of whether manufacturers possess the records needed to comply with the rule they are being asked to follow.
What the FCC changed
The FCC’s final rule published in the Federal Register defines a “logic-bearing hardware component” broadly. It can include a device, module, subassembly, integrated circuit or other physical component that uses digital techniques for computation, storage, retrieval, transformation or transfer of data. Components that use radio-frequency energy for data-processing functions are also included.
The definition does not cover every physical object in a product. Housings, fasteners, wiring, resistors and plain battery cells are specifically outside the definition. The FCC also declined, for now, to extend this particular prohibition to all software or firmware components.
The agency’s concern is that a compromised logic-bearing component could permit interception, disruption, sabotage or unauthorized access regardless of who assembled or branded the finished product. That is technically plausible. It is not the same as finding that every component made by a listed entity contains a backdoor, or that every device containing one has been compromised.
The rule is a market-access restriction based on the producer, the component and the equipment category. It is not a forensic conclusion about a particular chip.
Authorization is not the same as security
This distinction matters because the FCC’s equipment-authorization system is often treated as if it were a security certification. It is not.
The new rule can prevent certain devices from receiving approval. It can force manufacturers to treat component substitutions as a regulatory issue. It can require a company to examine whether a replacement processor, cellular modem or wireless module changes the status of an already designed product.
What it cannot do is prove that an approved device is secure. It cannot guarantee that the manufacturer’s records are complete. It cannot detect every unauthorized substitution. It cannot eliminate vulnerabilities in non-covered components or determine whether a previously approved product has already been compromised.
Component origin, hardware design, firmware security, configuration and evidence of exploitation are related questions, but they are not interchangeable. A component made by a trusted company can still contain vulnerabilities. A component made by a listed company is not, solely for that reason, proven malicious.
The FCC is addressing eligibility and traceability. It is not creating end-to-end security for every connected device that enters the American market.
The difficult failure may be ordinary supply-chain confusion
Compliance discussions often focus on deliberate evasion. The more common problem may be less dramatic: a supply chain changing faster than the organization’s records.
A component becomes unavailable. A contract manufacturer substitutes a functionally similar part. An engineering-change notice stays inside a supplier’s system. An acquired subsidiary continues using its own vendor list. A regional product variant receives a different radio module. A marketplace listing is updated without a corresponding change to the product’s certification record.
The finished product may look identical to the buyer. Its internal electronics may not be.
That is why the practical burden of this rule will fall heavily on bills of materials, supplier attestations, engineering-change controls and audit rights. A company does not need to publish every resistor in a router to comply. It does need to know enough about the components that process information or control communications to determine whether a new product can be authorized.
This is the same general systems problem that appears elsewhere in technology: the visible interface is smaller than the system underneath it. In earlier reporting on third-party industrial-control vendors, the relevant question was who could reach a water plant’s machinery through an outside technical relationship. Here, the question is who made the hardware before the device reached the certification process. The subject is different, but the weakness is familiar: an organization cannot control a dependency it cannot identify.
Modifications may become the next pressure point
The rule also clarifies how modifications are handled. Changes made by Covered List entities, or changes that would cause a device to become covered equipment, cannot simply rely on ordinary permissive-change procedures. In some cases, a new certification will be required.
That raises practical questions for equipment that evolves after its first approval. What happens when a manufacturer replaces a Wi-Fi module during a shortage? Does a memory or processor change affect the certification? How are regional versions treated? What happens when a hardware change arrives together with a firmware update?
The FCC says its “produced by” standard continues to consider the totality of the circumstances, including substantial responsibility for or control over design, development, manufacture or assembly. That gives the agency room to evaluate complicated corporate and manufacturing relationships. It also means companies may need more than a simple country-of-origin field in a procurement database.
The rule does not create a perfect map of every corporate relationship. It creates a reason for companies to maintain one.
Online marketplaces will add visibility, not certainty
The FCC is also extending its marketing rules to online marketplaces and requiring, subject to exceptions and phased deadlines, the display of a valid FCC ID at the online point of sale.
Marketplaces with physical access to or title over a device face a March 1, 2027, compliance date. Marketplaces that rely on certifications from third-party sellers face a June 1, 2027, deadline. The rule excludes used-device listings, certain low-volume sellers and some listings published before the rule takes effect unless they are later amended or updated.
An FCC ID can help a buyer identify the authorized product. It does not provide a complete bill of materials. Nor does the existence of an ID prove that a marketplace listing accurately describes the device being sold, especially in a fragmented market of refurbished products, regional variants and third-party sellers.
The rule may therefore improve the quality of information at the point of sale without making that information complete. A marketplace can verify that an FCC ID exists. It may have less ability to determine whether the listed device contains the exact hardware configuration associated with that authorization.
Who benefits, and who pays?
Manufacturers with well-documented supply chains may benefit from a rule that raises the cost of opaque competitors. Government and enterprise buyers may gain a clearer regulatory requirement for procurement. The FCC gains a pre-market intervention point instead of waiting for evidence of compromise after equipment has been deployed.
The costs will be distributed less evenly. Smaller device companies may lack dedicated compliance staff. Contract manufacturers may have to manage several bills of materials for similar products. Marketplaces will need new listing and verification systems. Broadband providers could face delays or higher costs if approved replacement equipment becomes harder to source.
There is also a second-order risk. A rule designed to reduce dependence on certain foreign suppliers may increase dependence on a smaller group of approved vendors. That could reduce one category of geopolitical exposure while increasing concentration, shortage and pricing risk elsewhere.
Supply-chain security is not the same as domestic self-sufficiency. It is possible to make a supply chain more traceable without making it independent of foreign manufacturing. Those are separate objectives, and policymakers should not treat progress on one as proof of progress on the other.
The first test will be administrative
The first visible effects of the rule are unlikely to be a dramatic consumer recall. They are more likely to appear in certification delays, supplier audits, redesigned bills of materials, engineering changes and disputes over whether a particular component qualifies.
The useful measures will be concrete. How many applications are rejected or withdrawn because of covered components? How many manufacturers discover that their internal records are incomplete? How many products require redesign? Does the FCC identify unauthorized modifications? Do prices, delivery times or equipment availability change?
Those measures will not prove that the rule prevented espionage or disruption. National-security benefits are difficult to observe because the prevented event does not occur. But the agency should still publish enough information to show whether manufacturers can comply and whether enforcement is finding meaningful violations rather than merely generating paperwork.
The FCC is right to look past the label on the box. A communications device is not made secure by the nationality of the brand printed on its housing, and a component restriction is not a complete security program. The rule’s value will depend on whether it produces something more useful than a new declaration for a certification file: reliable knowledge about what companies buy, what suppliers change and what hardware actually enters the American communications system.
That is the real test beginning October 13. The government is asking manufacturers to prove what is inside the product. Before it can work, many companies will have to determine whether they know themselves.
