FCC Demands Spy-Proof 'Ingredient Lists' for Phone Guts
Published Date: 8/7/2026
Proposed Rule
Summary
The Federal Communications Commission (Commission or FCC) issues a Third Further Notice of Proposed Rulemaking seeking comment on a broad set of additional measures to strengthen the security and integrity of its equipment authorization program. The measures include bifurcating the Covered List into producer/provider-based and production location-based categories; addressing "white labeling" of covered equipment; hardware and software bill of materials (HBOM/SBOM) disclosure requirements; further prohibitions or presumptions against authorizing equipment containing Covered List components or software; certification requirements for devices in Covered List sectors; reforms to equipment importation, marketing, and pre-authorization operation rules; restrictions on use of the FCC logo; streamlined revocation procedures; codification of permissive-change waivers for software, firmware, and hardware updates to covered equipment; codified definitions for UAS, UAS critical components, and routers; term limits on equipment authorizations; registration of Supplier's Declaration of Conformity (SDoC) devices; modernization of the Commission's equipment authorization database; updates to submarine cable Covered List rules; and a proposal to require a U.S.-based liable party for FCC-certified equipment.
Analyzed Economic Effects
9 provisions identified: 2 benefits, 7 costs, 0 mixed.
Hardware & Software BOM Disclosure
If you apply for FCC equipment certification, you would have to submit a written, signed hardware bill of materials (HBOM) and software bill of materials (SBOM) listing each component, its producer, production location(s), and the percentage of component value per location, and update that information within 30 days of any material change. The FCC preliminarily estimates costs of under $5,000 per software program and up to $10,000 per hardware device for these disclosures.
Ban or Presumption Against Covered-Entity Components
The FCC seeks comment on prohibiting authorization of devices that include components or software produced by entities on the Covered List, or on adopting a rebuttable presumption against such authorizations. The FCC tentatively estimates the annual cost of a prohibition on downloading or authorizing software/firmware from Covered List entities at under $50,000,000 per year.
Certification Requirement for Covered Sectors
Devices in Covered List sectors (for example, UAS, UAS critical components, and routers), regardless of producer and even if they would otherwise qualify for Supplier's Declaration of Conformity (SDoC) or exemption, would be required to undergo FCC certification. The FCC is asking whether certain narrow exemptions should apply (for example, Defense Contract Management Agency Blue UAS Cleared List items).
Stricter Import Limits for Covered Equipment
Covered equipment may be imported into the United States only under narrow conditions: with a valid, unrestricted equipment authorization; solely for export; exclusively for U.S. Government use; to develop products for U.S. Government use; or in quantities of 40 or fewer units for testing, evaluation, or product development unless the Chief of OET grants written approval for a larger quantity (replacing the current general 4,000-unit threshold).
Online Marketplace Verification & Warnings
Online marketplaces would have to collect and take reasonable steps to verify Supplier's Declaration of Conformity or equivalent compliance documentation, display equipment authorization/compliance information at point of sale, and prominently show a required notice for devices restricted to licensed users stating that purchase information may be provided to the FCC. Marketings that promote illegal modification or evasion of rules would be prohibited.
Register SDoC Devices With Unique ID
All devices authorized under the Supplier's Declaration of Conformity process must be registered with the FCC before marketing and assigned a unique identification number. That identifier must be displayed on the device or packaging, in the compliance statement, and in online listings; registration records would be publicly available unless protected.
U.S.-Based Liable Party Requirement
For FCC equipment certification grants where the grantee is located outside the United States, the FCC proposes requiring a liable party located in the U.S.: the U.S.-based manufacturer or assembler, or if none, the importer, or another U.S. party that assumes the role by agreement. The FCC cites instances where a U.S. agent alone was insufficient for ensuring compliance.
Term Limits on Equipment Authorizations
The FCC seeks comment on making equipment authorizations expire after a fixed term—tentatively suggesting ten years—instead of remaining valid indefinitely absent revocation, and on associated renewal and expedited re-authorization procedures.
Permissive-Change Waivers Made Permanent
The FCC proposes to codify and make permanent OET waivers (currently effective through January 1, 2029) that permit Class I and Class II software and firmware permissive changes—such as security patches and compatibility updates—to already-authorized covered equipment without a new equipment authorization, provided changes mitigate consumer harm and do not alter device capability or marketed identity. The proposal also seeks comment on limited hardware swaps under conditions.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Department and Agencies
Related Federal Register Documents
2026-20591, Information Collection Being Reviewed by the Federal Communications Commission Under Delegated Authority
The FCC is checking in on its paperwork rules for TV stations using Next Gen TV technology to make sure they're not too tricky or time-consuming. Businesses, governments, and nonprofits involved with local TV broadcasts might need to share info, but the FCC wants to keep it simple and clear. If you have thoughts, speak up by December 7, 2026, so the FCC can keep things smooth and fair without extra costs or hassle.
2026-20590, Information Collection Being Reviewed by the Federal Communications Commission
The FCC is asking for your thoughts on how it collects info about radiofrequency safety rules. This affects individuals, businesses, and governments who must report or share info sometimes. They want to make the process easier and clearer, especially for small businesses, and need your comments by December 7, 2026.
2026-20676, Information Collection Being Reviewed by the Federal Communications Commission Under Delegated Authority
The FCC is checking in on its paperwork rules for cable companies and local governments to make sure the info they collect is useful and not too much work. They want your thoughts on how to make the process easier, especially for small businesses with fewer than 25 employees. If you want to share your ideas, send them in by December 7, 2026—this helps keep things fair and smooth for everyone involved.
2026-20607, Information Collections Being Submitted for Review and Approval to Office of Management and Budget
The Federal Communications Commission (FCC) is asking the public and other agencies to review and comment on their paperwork plans to make things easier, especially for small businesses with fewer than 25 employees. They want feedback by November 9, 2026, to help reduce the time and hassle of filling out forms. This is part of a government effort to cut down on unnecessary paperwork and save everyone time and money.
2026-20681, Information Collection Being Submitted for Review and Approval to Office of Management and Budget
The Federal Communications Commission (FCC) is asking the public and other agencies to comment on a paperwork update aimed at making things easier, especially for small businesses with fewer than 25 employees. They want your thoughts by November 9, 2026, to help reduce the hassle and keep everything running smoothly. This is part of a government effort to cut down on unnecessary forms and save time and money.
2026-20486, Information Collections Being Reviewed by the Federal Communications Commission
The FCC is asking the public and businesses to review and comment on some paperwork they collect to make sure it’s useful and not too much of a hassle. This review affects companies, nonprofits, and government groups, especially small businesses with fewer than 25 employees. Comments are due by December 7, 2026, and the FCC aims to keep things clear, quick, and fair without costing too much time or money.
Previous / Next Documents
Previous: 2026-16196, Build America: Eliminating Barriers to Wireline Deployments
In this document, the Federal Communications Commission (Commission) proposes and seeks comment on rules that would eliminate state and local requirements that constrain the deployment of modern high-speed wireline infrastructure in violation of section 253 of the Communications Act (Act), particularly through the imposition of excessive delays and fees that impede infrastructure deployments and disincentivize investments in them. Based on the record resulting from a Notice of Inquiry that identified numerous challenges providers face in offering telecommunications services and deploying wireline infrastructure (2025 Notice of Inquiry), this Notice of Proposed Rulemaking seeks comment on codifying rules that would: establish a rebuttable presumption that state and local governments have effectively prohibited the provision of wireline telecommunications services if they fail to process all authorizations for use of public rights-of-way to provide wireline telecommunications services or to deploy wireline telecommunications infrastructure within 120 days; limit the fees that state and local governments may charge for a wireline telecommunications authorization to a reasonable approximation of the government's actual, direct costs of managing the rights-of-way with respect to that authorization and establish safe harbor fee levels that presumptively comport with that standard; require that the value of in-kind compensation demanded by state and local governments count toward any safe harbor fee levels adopted by the Commission; and prohibit state and local governments from imposing additional requirements on wireline telecommunications infrastructure deployments on the grounds that the infrastructure may be used to provide other services. The Notice of Proposed Rulemaking also seeks comment on the Commission's authority to enact these proposals.
Next: 2026-16209, Radiology Devices; Reclassification of Digital Breast Tomosynthesis System
The FDA wants to change how digital breast tomosynthesis (DBT) systems are classified, moving them from a strict, high-level category (Class III) to a more flexible one (Class II) with special safety rules. This affects companies making these breast imaging devices, making it easier and faster to get them approved. Comments on this change are open until October 9, 2026, so stakeholders should act fast to share their thoughts!