FCC Demands Spy-Proof 'Ingredient Lists' for Phone Guts
Published Date: 8/7/2026
Proposed Rule
Summary
The Federal Communications Commission (Commission or FCC) issues a Third Further Notice of Proposed Rulemaking seeking comment on a broad set of additional measures to strengthen the security and integrity of its equipment authorization program. The measures include bifurcating the Covered List into producer/provider-based and production location-based categories; addressing "white labeling" of covered equipment; hardware and software bill of materials (HBOM/SBOM) disclosure requirements; further prohibitions or presumptions against authorizing equipment containing Covered List components or software; certification requirements for devices in Covered List sectors; reforms to equipment importation, marketing, and pre-authorization operation rules; restrictions on use of the FCC logo; streamlined revocation procedures; codification of permissive-change waivers for software, firmware, and hardware updates to covered equipment; codified definitions for UAS, UAS critical components, and routers; term limits on equipment authorizations; registration of Supplier's Declaration of Conformity (SDoC) devices; modernization of the Commission's equipment authorization database; updates to submarine cable Covered List rules; and a proposal to require a U.S.-based liable party for FCC-certified equipment.
Analyzed Economic Effects
9 provisions identified: 2 benefits, 7 costs, 0 mixed.
Hardware & Software BOM Disclosure
If you apply for FCC equipment certification, you would have to submit a written, signed hardware bill of materials (HBOM) and software bill of materials (SBOM) listing each component, its producer, production location(s), and the percentage of component value per location, and update that information within 30 days of any material change. The FCC preliminarily estimates costs of under $5,000 per software program and up to $10,000 per hardware device for these disclosures.
Ban or Presumption Against Covered-Entity Components
The FCC seeks comment on prohibiting authorization of devices that include components or software produced by entities on the Covered List, or on adopting a rebuttable presumption against such authorizations. The FCC tentatively estimates the annual cost of a prohibition on downloading or authorizing software/firmware from Covered List entities at under $50,000,000 per year.
Certification Requirement for Covered Sectors
Devices in Covered List sectors (for example, UAS, UAS critical components, and routers), regardless of producer and even if they would otherwise qualify for Supplier's Declaration of Conformity (SDoC) or exemption, would be required to undergo FCC certification. The FCC is asking whether certain narrow exemptions should apply (for example, Defense Contract Management Agency Blue UAS Cleared List items).
Stricter Import Limits for Covered Equipment
Covered equipment may be imported into the United States only under narrow conditions: with a valid, unrestricted equipment authorization; solely for export; exclusively for U.S. Government use; to develop products for U.S. Government use; or in quantities of 40 or fewer units for testing, evaluation, or product development unless the Chief of OET grants written approval for a larger quantity (replacing the current general 4,000-unit threshold).
Online Marketplace Verification & Warnings
Online marketplaces would have to collect and take reasonable steps to verify Supplier's Declaration of Conformity or equivalent compliance documentation, display equipment authorization/compliance information at point of sale, and prominently show a required notice for devices restricted to licensed users stating that purchase information may be provided to the FCC. Marketings that promote illegal modification or evasion of rules would be prohibited.
Register SDoC Devices With Unique ID
All devices authorized under the Supplier's Declaration of Conformity process must be registered with the FCC before marketing and assigned a unique identification number. That identifier must be displayed on the device or packaging, in the compliance statement, and in online listings; registration records would be publicly available unless protected.
U.S.-Based Liable Party Requirement
For FCC equipment certification grants where the grantee is located outside the United States, the FCC proposes requiring a liable party located in the U.S.: the U.S.-based manufacturer or assembler, or if none, the importer, or another U.S. party that assumes the role by agreement. The FCC cites instances where a U.S. agent alone was insufficient for ensuring compliance.
Term Limits on Equipment Authorizations
The FCC seeks comment on making equipment authorizations expire after a fixed term—tentatively suggesting ten years—instead of remaining valid indefinitely absent revocation, and on associated renewal and expedited re-authorization procedures.
Permissive-Change Waivers Made Permanent
The FCC proposes to codify and make permanent OET waivers (currently effective through January 1, 2029) that permit Class I and Class II software and firmware permissive changes—such as security patches and compatibility updates—to already-authorized covered equipment without a new equipment authorization, provided changes mitigate consumer harm and do not alter device capability or marketed identity. The proposal also seeks comment on limited hardware swaps under conditions.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Department and Agencies
Related Federal Register Documents
2026-18778, Review of the Commission's Assessment and Collection of Regulatory Fees for Fiscal Year 2026
The FCC has set the fees that companies must pay for using communication services in Fiscal Year 2026. If you’re a business in TV, radio, satellite, or other communication fields, these fees affect you, and you need to pay by September 24, 2026, to avoid extra charges. The new fee schedule is official starting September 14, 2026, so get ready to pay up on time!
2026-18774, Information Collection Being Reviewed by the Federal Communications Commission
The FCC is checking in on its paperwork rules for businesses, nonprofits, and governments that use phone systems to make sure emergency calling info is up to date and easy to handle. They want your thoughts on how to keep this info collection useful but less of a hassle, especially for small businesses. Comments are due by November 13, 2026, and this process helps keep emergency phone services running smoothly without wasting time or money.
2026-18581, Notice of Debarment; Federal E-Rate Program
John Comito is officially banned from the E-Rate Program and all related federal support programs for three years starting September 11, 2026, or when he gets the debarment letter—whichever comes first. This means he can’t participate in these programs or receive any federal funds during that time. The FCC is serious about keeping these programs fair and clean!
2026-18591, Notice of Debarment; Federal E-Rate Program
Donna Woods is officially banned from the E-Rate Program and all related federal support programs for three years starting September 11, 2026, or when she gets the letter—whichever comes first. This means she can’t participate in programs that help schools and libraries get funding for internet and technology. The ban aims to keep the program fair and protect taxpayer money.
2026-18535, Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program
The FCC is tightening rules to stop risky communication devices from sneaking into the U.S. supply chain. If a device uses parts from banned companies, it won’t get approved, and online sellers must show official FCC IDs when selling gear. These changes kick in on October 13, 2026, affecting manufacturers, sellers, and anyone buying communication equipment, helping keep our networks safe without extra costs.
2026-18585, Notice of Debarment; Federal E-Rate Program
Donatus Anyanwu is banned from the E-Rate program and all federal support programs for three years starting September 11, 2026, or when he gets the official letter—whichever comes first. This means he can’t participate in any federal funding for schools and libraries during that time. The move protects taxpayer money and keeps the program fair for everyone.
Previous / Next Documents
Previous: 2026-16196, Build America: Eliminating Barriers to Wireline Deployments
In this document, the Federal Communications Commission (Commission) proposes and seeks comment on rules that would eliminate state and local requirements that constrain the deployment of modern high-speed wireline infrastructure in violation of section 253 of the Communications Act (Act), particularly through the imposition of excessive delays and fees that impede infrastructure deployments and disincentivize investments in them. Based on the record resulting from a Notice of Inquiry that identified numerous challenges providers face in offering telecommunications services and deploying wireline infrastructure (2025 Notice of Inquiry), this Notice of Proposed Rulemaking seeks comment on codifying rules that would: establish a rebuttable presumption that state and local governments have effectively prohibited the provision of wireline telecommunications services if they fail to process all authorizations for use of public rights-of-way to provide wireline telecommunications services or to deploy wireline telecommunications infrastructure within 120 days; limit the fees that state and local governments may charge for a wireline telecommunications authorization to a reasonable approximation of the government's actual, direct costs of managing the rights-of-way with respect to that authorization and establish safe harbor fee levels that presumptively comport with that standard; require that the value of in-kind compensation demanded by state and local governments count toward any safe harbor fee levels adopted by the Commission; and prohibit state and local governments from imposing additional requirements on wireline telecommunications infrastructure deployments on the grounds that the infrastructure may be used to provide other services. The Notice of Proposed Rulemaking also seeks comment on the Commission's authority to enact these proposals.
Next: 2026-16209, Radiology Devices; Reclassification of Digital Breast Tomosynthesis System
The FDA wants to change how digital breast tomosynthesis (DBT) systems are classified, moving them from a strict, high-level category (Class III) to a more flexible one (Class II) with special safety rules. This affects companies making these breast imaging devices, making it easier and faster to get them approved. Comments on this change are open until October 9, 2026, so stakeholders should act fast to share their thoughts!