Regulatory Watch | Vantikon

Regulatory Watch

Ongoing coverage of the regulatory developments that shape defense supply chain compliance — so you can track obligations and timelines as they change.

Regulatory WatchSeptember 25, 2026

Adopted in July, Effective in October: The Component-Sourcing Rule Gets Its Federal Register Date

The FCC's Third Report and Order barring new equipment authorizations for devices with Covered List logic-bearing components — reported here in July as adopted but 'not yet effective' — published in the Federal Register on September 11, 2026, fixing October 13, 2026 as its effective date. The same document sets separate 2027 compliance dates for online-marketplace FCC ID display and extends a Class I/II permissive-change waiver for Covered List UAS and routers to January 1, 2029. No other new CMMC, SPRS, 800-171, Covered List, or UAS development was found in the trailing window.

Read article

Regulatory WatchSeptember 21, 2026

When "Validated" Stops Meaning "Usable for New Systems": FIPS 140-2 Certificates Move to the Historical List on September 21

NIST's Cryptographic Module Validation Program transition schedule moves all FIPS 140-2 certificates to the Historical List on September 21, 2026. Existing systems may continue to procure and use those modules; new systems should move to FIPS 140-3. NIST separately issued SP 1352, a non-binding small business primer on CUI assessment, and Draft NIST IR 8623, an initial public draft O-RAN profile for federal agencies open for comment until November 2, 2026, which imposes no certification or market-access requirement today. Three developments, three distinct legal statuses.

Read article

Regulatory WatchSeptember 9, 2026

The Covered List Has a Working Door — Two Taiwan-Linked Router Makers Just Walked Through It

On September 9, 2026 the FCC's Public Safety and Homeland Security Bureau released DA 26-957, announcing that the Department of War granted Conditional Approvals to named router products from ASUS Computer International and Comtrend Corporation, effective September 9, 2026 through March 6, 2028. The identified equipment is now excluded from the Covered List's foreign-produced-router restriction. The approvals are entity- and product-specific, and they do not replace ordinary FCC equipment authorization.

Read article

Regulatory WatchSeptember 2, 2026

Two Comment Clocks, One Denied Extension, and the First Proposed Penalties

A second tranche of named entities landed in the FCC's UAS import-and-marketing docket — reaching a US-domiciled producer through a licensing relationship — while the agency denied one extension request, granted another, and proposed forfeitures against two Covered List entities for incomplete affiliate disclosure. Also confirmed: the Blue UAS and domestic-end-product exemptions now run to January 1, 2028.

Read article

Regulatory WatchAugust 24, 2026

Revocation, Inverters, and a CMMC Signal That Is Not Yet a Rule

The FCC revoked equipment authorizations for cause for the first time in this program, granted two more rounds of router conditional approvals, and rewrote the Covered List definition for foreign-made power inverters. Separately, DoD's Unified Agenda listed a CMMC move from NIST SP 800-171 Rev. 2 to Rev. 3 — planning only, with no Federal Register document and no enforceable date.

Read article

Regulatory WatchAugust 10, 2026

A Live FCC ID Is Not a Safe Harbor — and the FCC Now Wants Your Bill of Materials

The FCC opened a formal comment proceeding on prohibiting the import and marketing of foreign covered UAS, critical components and named surveillance equipment that already hold valid authorizations, and published its Third Further Notice of Proposed Rulemaking proposing HBOM/SBOM filings, a place-of-production Covered List category and a US-responsible-party requirement.

Read article

Regulatory WatchJuly 27, 2026

The FCC Closed the Component Loophole — Screening the Brand on the Box Is No Longer Enough

The FCC adopted a Third Report and Order barring new equipment authorizations for devices containing logic-bearing hardware components from Covered List entities, and issued two waves of conditional approvals for foreign-made routers — including, for the first time, approvals granted at product-class level.

Read article

Regulatory WatchJuly 13, 2026

CMMC Phase II Is Suspended. Here's What Still Binds You.

On July 13, 2026, the U.S. Department of War announced the suspension of CMMC Phase II and ordered a 60-day reform review. For Taiwanese manufacturers in the U.S. defense supply chain, the obligations that matter most — Phase I self-assessments, NIST SP 800-171 Rev 2, and DFARS 252.204-7012 — remain fully enforceable. And with self-assessment as the interim standard, the False Claims Act risk of getting your attestation wrong just went up.

Read article