The FCC Closed the Component Loophole — Screening the Brand on the Box Is No Longer Enough
July 27, 2026
The FCC adopted a Third Report and Order barring new equipment authorizations for devices containing logic-bearing hardware components from Covered List entities, and issued two waves of conditional approvals for foreign-made routers — including, for the first time, approvals granted at product-class level.
1. New equipment authorizations now turn on what is inside the device, not whose name is on it
On July 23, 2026 the FCC adopted a Third Report and Order, FCC 26-50, in ET Docket No. 21-232. It bars new FCC equipment authorizations for any device containing a logic-bearing hardware component produced by an entity named on the Covered List — where that entity would itself be barred from producing the finished device. The test now reaches chips, modules, PCBs and controllers inside the product, not only the brand on the enclosure. Equipment that was already authorized is not retroactively caught by this new prohibition.
Legal status: formal agency order — adopted, not yet effective. The rules take effect 30 days after publication in the Federal Register. As of early September 2026 the Third Report and Order had still not appeared there, so no effective date can yet be computed. Related online-marketplace FCC ID display obligations phase in over 6 and 9 months from that same publication date.
One boundary worth stating clearly, because the two halves of FCC 26-50 are easy to conflate: the HBOM/SBOM filing, SDoC registry, US-responsible-party and authorization-term items released alongside this order sit in the companion Third Further Notice of Proposed Rulemaking. Those are proposals, not adopted rules, and none of them is in force.
What it could mean for a Taiwanese manufacturer. If you build routers, gateways, wireless modules or any RF-bearing product for the US market, the binding half of this changes your bill-of-materials diligence now rather than after the effective date lands. Covered-entity screening has to run down to the programmable parts — every chip, module, PCB and controller — and your evidence of having done that screening has to survive an application review. Practically that means a component screening sheet that captures manufacturer, part number, country of origin, function and qualified alternates for each logic-bearing part, plus a supplier questionnaire that actually obliges your vendors to produce those fields rather than asserting compliance in the abstract. Because the prohibition bites at the new-authorization gate, the products most exposed are the ones in your 2026–2027 launch pipeline, not the SKUs already carrying an FCC ID.
Primary sources:
2. Two waves of router conditional approvals — and the first grants issued at class level
The FCC issued conditional approvals under the foreign-produced router prohibition in two public notices this window: DA 26-756 on July 20, 2026 and DA 26-768 on July 24, 2026. Legal status: formal agency orders — in effect on grant. Grantees across the two notices included Wi-Fi 7 and Wi-Fi 8 router and gateway manufacturers, several of them Taiwan-based, alongside broadband-equipment vendors.
Two structural facts matter more than any individual grant.
First, most grants are per-model and time-limited. The approval terms in these two notices run to dates between November 22, 2027 and January 17, 2028 — roughly 18 months from grant. A conditional approval is not a general FCC technical certification. It covers the named model for the named term only; a derivative or rebadged SKU built on the same platform is not automatically inside it.
Second — and this is the development of the window — two of the grants in the July 24 notice were issued at class level, covering an entire product family rather than one model at a time. That establishes that the FCC will process a class-based submission at all, which changes the filing economics for any manufacturer carrying a broad SKU range.
What it could mean for a Taiwanese manufacturer. For router, gateway and CPE makers exposed to the foreign-produced prohibition, this pathway is demonstrably live, and these grants are the closest available comparables for how a filing is structured and what term to expect. The class-level precedent is the actionable part: if your current plan is one filing per SKU, a product-family submission is now a documented option worth modelling before you commit engineering and legal time to a model-by-model campaign. Two cautions carry from the grant language itself — do not reason from a shared platform or a rebadge to coverage, and do not treat a conditional approval as a substitute for ordinary FCC equipment authorization. With terms in this window clustering in late 2027 and early 2028, renewal planning belongs in a 2027 roadmap, not a 2028 one.
Primary sources:
3. On the defense-compliance side, a quiet window
No new formal changes to CMMC, NIST SP 800-171, SPRS or DFARS were confirmed in this window. Following the July suspension of CMMC Phase II, the obligations that remain enforceable are unchanged: Phase I self-assessments and attestations, NIST SP 800-171 Rev. 2 as the control baseline, current SPRS scores, and the safeguarding requirements in DFARS 252.204-7012 wherever that clause reaches you through a prime's flow-down. A quiet fortnight is worth reporting as quiet.
About this briefing
Vantikon tracks US regulatory developments that reach Taiwanese manufacturers and their supply chains. If something here touches your product line and you want to talk it through, get in touch — we are glad to have the conversation.
This briefing is informational and does not constitute legal advice; consult qualified counsel for your specific situation.
