FCC Expands Restrictions on Covered List Equipment and Supply Chains

The Federal Communications Commission (FCC) has adopted changes to its equipment authorization rules aimed at strengthening the security of the communications supply chain.

Building on its previous actions, the new Order expands the scope of its equipment authorization rules beyond retail products to include certain internal hardware components produced by entities prohibited from selling their products in the US because they create national security risks. (The list of these entities is known as the Covered List.) The Order also imposes new obligations on online marketplaces selling FCC-regulated devices, including requiring certain online marketplaces to display FCC IDs for certified equipment at the point of sale, subject to limitations and differentiated standards, in addition to other certification requirements for equipment modifications.

Logic-bearing hardware components

The Order closes what the FCC describes as the “component part loophole.” Until now, the FCC restricted the sale of retail products manufactured by named entities specifically named on the Covered List but did not restrict products manufactured with parts made by those entities. Under the new rules, devices incorporating “logic-bearing hardware components” produced by Covered List entities also become ineligible for FCC equipment authorization if the finished device itself would have been prohibited had it been manufactured by the Covered List entity. The FCC concluded that these components present national security risks and could permit unauthorized access, data collection or other malicious activity if they are incorporated into completed products sold in the US.

To implement this new rule, the FCC adopted a definition of “logic-bearing hardware component” that encompasses nearly all hardware capable of performing digital processing functions, including devices, modules, integrated circuits and other physical components that generate and use radio frequency energy to perform data processing functions, but does not include software and firmware at this time. Thus, manufacturers, importers and other companies seeking FCC equipment authorization will need to focus on their supply chains to determine whether logic-bearing hardware components made by entities on the Covered List are used in their products.

New online marketplace requirements

The Order applies the FCC’s marketing rules to online marketplaces that list, distribute or offer regulated equipment for sale. The FCC also concludes that online marketplaces are engaged in “marketing” when they list third-party products, even if they do not take title to those particular products. In that context, the Order requires online marketplaces to display FCC IDs at the online point of sale for devices subject to FCC certification, which generally are products that use radio waves to communicate with other devices. While the FCC’s definition of “online marketplace” is limited to websites that accommodate third-party sellers, the Order seems to apply the rules both to entities that sell products directly to customers and to online marketplaces that provide a platform for third-party sellers.

For listings subject to the rule, the specific requirements depend on the marketplace’s role in the transaction. Notably, if the marketplace sells the device itself, takes title to a third party’s device, or has physical access to the device through warehousing, fulfillment, consignment or shipping, the Order requires display of an FCC ID that is both valid and accurate for the listed product. If, however, a marketplace hosts a third-party listing but does not take title to or have physical access to the device, the marketplace must display a valid FCC ID, take reasonable steps to confirm that the ID is valid in the FCC’s database, and require the seller to certify the accuracy of the information. Marketplace operators are not required to provide FCC IDs for products sold by third-party sellers that are not “high-volume third-party sellers” or for listings for used devices. These new rules take effect six months after Federal Register publication for marketplaces that sell, take title to or physically handle devices, and nine months after publication for qualifying third-party listings where the marketplace does not take title.

Modifications to equipment manufactured by Covered List entities

The FCC adopted new restrictions on modifications to authorized equipment manufactured by Covered List entities. Going forward, any modification or permissive change performed by a Covered List entity must undergo full FCC certification, even if the underlying product was authorized through the Supplier’s Declaration of Conformity (SDoC) process, which covers products that emit radio waves but do not communicate with other devices. In addition, previously authorized equipment cannot later be modified in a manner that causes it to become covered equipment.

FCC considering additional changes

The Further Notice of Proposed Rulemaking signals additional changes that may be on the horizon. Among other proposals, the FCC seeks comment on requiring hardware and software bills of materials to be provided with equipment applications, expanding component restrictions to software and firmware, requiring certification for additional categories of devices, strengthening import restrictions, establishing expiration dates for equipment authorizations, and codifying permanent exceptions allowing software and firmware updates for previously authorized covered equipment in certain circumstances. These developments continue to reflect the FCC’s shift toward regulating the full communications equipment supply chain rather than focusing solely on finished products. The FCC also seeks comment on whether it should expand the rules to require online marketplaces to collect, verify or display information related to approvals through the SDoC.

Companies involved in the design, manufacture or sale of FCC-regulated equipment should evaluate whether their existing compliance programs adequately address the FCC's expanding supply chain requirements. Companies that will be affected should consider filing comments, as many of the FCC’s proposals could expand compliance obligations for both manufacturers and retailers.

If you have any questions about the Order or how it may impact your company, please contact the following Cooley communications attorneys: