# 2026-16197: FCC Demands Spy-Proof 'Ingredient Lists' for Phone Guts 2026-16197, Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program, is a Federal Register proposed rule from Federal Communications Commission published 2026-08-07, effective 2026-09-08; PRIA reads it as touching household money (as of 2026-08-14). - Canonical: https://policyrisk.com/federal-register/2026-16197 - As of: 2026-08-14 - Plain-text twin of the page above; the HTML and this file carry the same facts. ## Facts - Document number: 2026-16197 - Title: Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program - Type: Proposed Rule - Agencies: Federal Communications Commission - Citation: 91 FR 51139 - Published: 2026-08-07 - Effective: 2026-09-08 - Comments close: 2026-09-08 - Significant: no - Touches household money: yes - Regulation identifier numbers: none - Last updated: 2026-08-14 ## In one line FCC Demands Spy-Proof 'Ingredient Lists' for Phone Guts ## Summary The Federal Communications Commission (Commission or FCC) issues a Third Further Notice of Proposed Rulemaking seeking comment on a broad set of additional measures to strengthen the security and integrity of its equipment authorization program. The measures include bifurcating the Covered List into producer/provider-based and production location-based categories; addressing "white labeling" of covered equipment; hardware and software bill of materials (HBOM/SBOM) disclosure requirements; further prohibitions or presumptions against authorizing equipment containing Covered List components or software; certification requirements for devices in Covered List sectors; reforms to equipment importation, marketing, and pre-authorization operation rules; restrictions on use of the FCC logo; streamlined revocation procedures; codification of permissive-change waivers for software, firmware, and hardware updates to covered equipment; codified definitions for UAS, UAS critical components, and routers; term limits on equipment authorizations; registration of Supplier's Declaration of Conformity (SDoC) devices; modernization of the Commission's equipment authorization database; updates to submarine cable Covered List rules; and a proposal to require a U.S.-based liable party for FCC-certified equipment. ## Effects PRIA read - Hardware & Software BOM Disclosure: cost, high. If you apply for FCC equipment certification, you would have to submit a written, signed hardware bill of materials (HBOM) and software bill of materials (SBOM) listing each component, its producer, production location(s), and the percentage of component value per location, and update that informat… - Ban or Presumption Against Covered-Entity Components: cost, high. The FCC seeks comment on prohibiting authorization of devices that include components or software produced by entities on the Covered List, or on adopting a rebuttable presumption against such authorizations. The FCC tentatively estimates the annual cost of a prohibition on downloading or authorizi… - Certification Requirement for Covered Sectors: cost, medium. Devices in Covered List sectors (for example, UAS, UAS critical components, and routers), regardless of producer and even if they would otherwise qualify for Supplier's Declaration of Conformity (SDoC) or exemption, would be required to undergo FCC certification. The FCC is asking whether certain n… - Stricter Import Limits for Covered Equipment: cost, medium. Covered equipment may be imported into the United States only under narrow conditions: with a valid, unrestricted equipment authorization; solely for export; exclusively for U.S. Government use; to develop products for U.S. Government use; or in quantities of 40 or fewer units for testing, evaluati… - Online Marketplace Verification & Warnings: benefit, medium. Online marketplaces would have to collect and take reasonable steps to verify Supplier's Declaration of Conformity or equivalent compliance documentation, display equipment authorization/compliance information at point of sale, and prominently show a required notice for devices restricted to licens… - Register SDoC Devices With Unique ID: cost, medium. All devices authorized under the Supplier's Declaration of Conformity process must be registered with the FCC before marketing and assigned a unique identification number. That identifier must be displayed on the device or packaging, in the compliance statement, and in online listings; registration… - U.S.-Based Liable Party Requirement: cost, medium. For FCC equipment certification grants where the grantee is located outside the United States, the FCC proposes requiring a liable party located in the U.S.: the U.S.-based manufacturer or assembler, or if none, the importer, or another U.S. party that assumes the role by agreement. The FCC cites i… - Term Limits on Equipment Authorizations: cost, medium. The FCC seeks comment on making equipment authorizations expire after a fixed term—tentatively suggesting ten years—instead of remaining valid indefinitely absent revocation, and on associated renewal and expedited re-authorization procedures. - Permissive-Change Waivers Made Permanent: benefit, low. The FCC proposes to codify and make permanent OET waivers (currently effective through January 1, 2029) that permit Class I and Class II software and firmware permissive changes—such as security patches and compatibility updates—to already-authorized covered equipment without a new equipment author… ## Related documents - [2026-20591](https://policyrisk.com/federal-register/2026-20591): Information Collection Being Reviewed by the Federal Communications Commission Under Delegated Authority, 2026-10-08 - [2026-20590](https://policyrisk.com/federal-register/2026-20590): Information Collection Being Reviewed by the Federal Communications Commission, 2026-10-08 - [2026-20676](https://policyrisk.com/federal-register/2026-20676): Information Collection Being Reviewed by the Federal Communications Commission Under Delegated Authority, 2026-10-08 - [2026-20607](https://policyrisk.com/federal-register/2026-20607): Information Collections Being Submitted for Review and Approval to Office of Management and Budget, 2026-10-08 - [2026-20681](https://policyrisk.com/federal-register/2026-20681): Information Collection Being Submitted for Review and Approval to Office of Management and Budget, 2026-10-08 - [2026-20486](https://policyrisk.com/federal-register/2026-20486): Information Collections Being Reviewed by the Federal Communications Commission, 2026-10-06 ## Sources - [2026-16197 on federalregister.gov](https://www.federalregister.gov/documents/2026/08/07/2026-16197/protecting-against-national-security-threats-to-the-communications-supply-chain-through-the) - [2026-16197 as published (PDF)](https://www.govinfo.gov/content/pkg/FR-2026-08-07/pdf/2026-16197.pdf) ## Related - [Previous: 2026-16196, Build America: Eliminating Barriers to Wireline Deployments](https://policyrisk.com/federal-register/2026-16196) - [Next: 2026-16209, Radiology Devices; Reclassification of Digital Breast Tomosynthesis System](https://policyrisk.com/federal-register/2026-16209) - [All Federal Register documents](https://policyrisk.com/federal-register) Source: PRIA, https://policyrisk.com/federal-register/2026-16197 (as of 2026-08-14).