Tip of the Spear: Why the FCC Is Policing Strategic Technology

First came a proposal to restrict connected vehicle technologies. Then came actual restrictions on foreign drones,¹ consumer routers, power inverters and robots. The agency enacting these measures was not the U.S. Department of Commerce or Department of War (DOW) but the Federal Communications Commission (FCC) – a surprise to many observers who view the agency as "just" a telecom regulator.

National security policymakers see much broader potential: A "tip of the spear" that already guards entry to the U.S. market for large segments of the technology economy and already manages a Covered List of equipment that it wants to keep out. With the FCC and its Covered List emerging as a preferred tool of industrial policy, companies should assume new restrictions are forthcoming.

Here is what they need to know.

Why the FCC?

Originally developed to protect communications infrastructure supply chains, the Covered List now reaches markets far beyond telecom. So why, with other tools available – such as transaction bans and class-based prohibitions administered by the Bureau of Industry and Security (BIS) Office of Information and Communications Technology and Services (ICTS) – is the administration turning to the FCC?

Four reasons: breadth, speed, flexibility and resilience.

Absent an exemption, most devices capable of emitting RF energy require an FCC equipment authorization before they can be marketed, imported and operated in the United States. That includes not only wireless devices, but products containing digital circuitry, power supplies or other RF-emitting electronics, giving the FCC and its interagency partners reach across much of the technology economy. Talk about breadth.

Speed is another advantage. Congress directed the FCC to publish and update a Covered List of communications equipment and services determined to pose unacceptable national security risks.² Once a qualifying national security body makes that determination, the FCC updates the List without relitigating the threat finding and bars the equipment from receiving new equipment authorizations.³ In practice, updates have followed the underlying interagency determination quickly – usually the next business day. Predicate interagency decisions themselves can move quickly with little formal process. Under National Security Presidential Memorandum/NSPM-1, the National Security Council may convene policy coordination committees and escalate through the Deputies and Principals Committee process as needed to reach national security judgments on compressed timelines.⁴ Congress can also spearhead action by requiring agencies to make a determination, and the FCC to act on it, by a specific deadline – as it did with certain drones.⁵

Then there's flexibility. Covered List entries can be broad enough to move markets while still carving out some trusted products. The administration has used clever entry drafting to effectively stand up a new "whitelist" process – exempting equipment that receives "conditional approval" from the DOW and the U.S. Department of Homeland Security (DHS) to encourage onshoring and partially mitigate marketplace impacts. Combined with the fact that Covered List entries do not, on their own, prohibit the continued sale, importation and marketing of device models with existing equipment authorizations, the framework allows policymakers to calibrate and phase in restrictions over time.

Finally, resilience. The FCC has announced Covered List updates through the Public Safety and Homeland Security Bureau acting on delegated authority. In litigation, the agency has argued that parties must first seek Commission review of the bureau-level action before obtaining judicial review, and FCC rules generally bar parties from presenting arguments to the Commission upon which the bureau itself had no opportunity to pass. The result is potentially a multistep agency process before a court reaches the merits of a Covered List decision, at least in some jurisdictions.

This is not to say the Covered List presents the only method for restricting access to foreign strategic technologies. For example, the BIS Office of ICTS continues to administer a trusted supplier program for connected vehicles, and the administration explicitly carved connected vehicles as defined by ICTS out of the definition of the Covered List entry for advanced robotic devices.

The Emerging Playbook

Early Covered List entries were entity-specific.⁶ That model is expanding. In addition to new entity-based designations, the FCC has shifted to category-based, production location-based designations, as shown by the December 2025 addition of foreign-produced unmanned aircraft systems (UAS) and UAS critical components, March 2026 addition of foreign-produced consumer routers, and July 2026 entries on foreign-produced power inverters and advanced robotics devices.

These category-based, production location entries – and agency action in their aftermath – reveal an emerging playbook for addressing new threats:

1. Threat Identification. The process begins with identifying equipment or services potentially subject to cyber threats or marked by adversarial supply chains in strategic sectors.
2. Interagency Determination. Interagency committees convened by the White House reach a national security determination summarizing evidence and recommending a Covered List entry with specific definitions.
3. Categorical, Prospective Limits. The FCC promptly adds the category to the Covered List, announces the action in a public notice and attaches the underlying interagency determination. The designation immediately prohibits new equipment authorizations⁷ without affecting the continued importation, sale and marketing of already authorized models and with a narrow set of modifications to existing equipment potentially allowable by waiver.⁸
4. Definitional Clarifications. Over the coming weeks and months, the FCC refines definitions through FAQs and other decisions – as illustrated by the agency's clarification on the term "routers"⁹ and the Blue UAS Cleared List and toy-drone exclusions.¹⁰.
5. Whitelisting. Conditional approvals are granted for specific products or product classes.
6. Revisit and Review. Exclusions and conditional approvals expire – leaving manufacturers on a short leash and exposed to uncertainty at the time of renewal, if any.
7. Existing-Authorization Limits. Last October, the FCC adopted a framework for prohibiting the further importation and marketing (but not use) of device models with existing authorizations,¹¹ a tool the FCC used in rapid succession in 2026.¹² For at least some products, the final step may be a phaseout of existing models.
8. Enforcement and Gap-Filling. The FCC has used its enforcement authority to investigate online sales of unauthorized covered equipment, the alleged sales of covered equipment rebrands, and misrepresentation during the equipment authorization process. It also has used its rulemaking authority to address perceived loopholes, such as the incorporation of covered equipment into devices.

Post-Entry Uncertainty

The FCC is not bound to follow the playbook above in any future action – and even when it does, every new category-based entry will force companies to answer threshold questions as they make manufacturing, procurement, inventory, customer-support and disclosure decisions.

• Scope and Impact. Companies must determine what exactly is covered and the practical marketplace impact of the resulting prohibition against new FCC equipment authorizations and modifications. That requires careful evaluation not just of the Covered List entry and underlying national security determination, but ongoing agency clarifications and, perhaps most significant, the puts and takes of a complex and rapidly changing FCC equipment authorization regime that the agency administers in partnership with private testing and assurance laboratories.
• Exemptions. Conditional approvals can keep trusted products on the market, but they raise implementation questions including how long approvals will last and whether an approval survives ownership, manufacturing or component changes.
• Modifications and Support. Companies need to know what types of product changes or updates run afoul of a prohibition against new authorizations. Increasingly, they also need to know what they can and cannot do to support fielded equipment after the FCC acts to limit existing authorizations (as it has done for pre-2025 entries and has proposed to do for some drones).
• Domestic-Content Regimes. Production location-based Covered List entries have embraced Buy America domestic content thresholds for determining whether equipment is "foreign produced" and, thus, covered under the entry. With different standards applicable in different settings, companies must navigate compliance carefully and should not assume that a product satisfying one country of origin or foreign-sourcing regime will pass muster under the Covered List.
• Channel and E-Commerce Compliance. Distributors, retailers, integrators and online marketplaces must manage their own risk. The FCC recently interpreted its marketing rules to reach online marketplaces that list products sold by third-party sellers and required them to display FCC IDs at the online point of sale.¹³ Recent enforcement likewise has focused on sales channels, including the "Operation Clean Carts" removals. Distributors and marketplaces therefore need procedures for diligence and, where necessary, rapid delisting and to manage risk contractually where appropriate.

Ongoing Rulemaking

As Holland & Knight reported, the FCC has a pending further notice of proposed rulemaking seeking comment on substantial reforms to its equipment authorization program as it seeks to adapt that program into a supply chain control framework.

Key proposals under consideration would require FCC certification – rather than authorization through the Supplier's Declaration of Conformity (SDoC) procedure or an exemption – for all devices in "Covered List sectors" (e.g., UAS, UAS critical components, routers, advanced robotics devices, power inverters and so on), even if the device is not foreign-produced.

The FCC also seeks comment on reforms that would mandate software and hardware bill of materials (SBOM and HBOM) disclosures, impose term limits on equipment authorizations, clarify foreign production requirements for UAS and other equipment subject to a production location-based Covered List entry, streamline revocation procedures and require registration of devices authorized through the SDoC procedure.

Comments are due September 8, 2026. Reply comments are due September 21, 2026.

Potential Next Targets

Advance notice is not guaranteed. Still, congressional activity, Cybersecurity and Infrastructure Security Agency (CISA) warnings, and public reporting point to several sectors with elevated risk:

• IoT Modules. Foreign IoT module manufacturers have drawn sustained congressional attention¹⁴ and action from DOW.¹⁵ Given global reliance on foreign manufacturers and the increasing use of IoT modules across economic sectors and in public safety, IoT modules remain a potential target.
• Healthcare/Medical Devices. On June 25, 2026, Sen. Tom Cotton (R-Ark.) introduced the Countering CCP Act, which would direct U.S. Food and Drug Administration (FDA) review and recall of Chinese-made networked medical devices posing cybersecurity risks.¹⁶ The bill follows CISA and FDA reports on the threats posed by a specific model that ultimately resulted in an FDA recall of the device. Notwithstanding shared jurisdiction with FDA, networked medical equipment remains a potential FCC target.
• Foreign GNSS. In March 2024, former Rep. Mike Gallagher (R-Wis.), as chair of the U.S. House of Representatives Select Committee on the Chinese Communist Party, pressed the FCC on U.S. devices receiving unauthorized signals from Chinese and Russian Global Navigation Satellite System (GNSS) constellations, raising concerns about denial and spoofing.¹⁷
• Data Center Equipment. Data-center hardware containing FCC-regulated RF-emitting devices could theoretically receive Covered List treatment. Reuters has reported that a Covered List entry on optical transceivers remains under active consideration.

Practical Guidance

• Monitor for Activity Suggesting Expanded Coverage: Congressional letters and cyber risk reports all precede formal Covered List additions, often by months.
• Map Supply Chain Dependencies on Foreign-Manufactured Communications Equipment and Components: Identify chokepoints, the impact of suddenly being unable to import or modify affected products, and onshoring potential.
• Identify Timing and Waiver Mitigations: The conditional approval process allows manufacturers to demonstrate specific equipment does not pose unacceptable risks. Companies should familiarize themselves with the process.
• Engage Constructively with National Security Officials and the FCC: With the goal of promoting both safety and U.S. industry growth.
• Collaborate Across the Supply Chain: Waivers and scoping decisions often require cooperation between device manufacturers, component manufacturers, installers and distributors closest to the consumer.
• Do Not Assume This Is Partisan: Though a Democratic FCC Commissioner recently called for greater "transparency" and predictability on Covered List implementation, the Covered List regime remains the product of bipartisan FCC rulemaking action and bipartisan legislation: the Secure Networks Act signed by President Donald Trump and Secure Equipment Act signed by President Joe Biden. Congressional letters on some of these issues have been signed by both Republican and Democratic members, including those on the bipartisan Select Committee on the CCP.

Holland & Knight Can Help

For additional information about FCC Covered List designations, equipment authorization, conditional approvals, supply-chain risk or compliance planning for affected products, please contact the authors or another member of Holland & Knight's Telecommunications team.

Notes

¹ "FCC Adds All Foreign-Made Drones and Critical Components to the Covered List" (Dec. 23, 2025); "FCC Exempts Certain Drones from Covered List" (Jan. 13, 2026); "Unleashing Drone Dominance: The FCC Perspective and Request for Comments" (April 3, 2026); "Citing National Security Needs, the FCC and FAA Take Steps on UAS Regulation" (May 12, 2026); "Latest FCC, DOJ, DHS Actions on Drones Indicate an Increased Focus on National Security" (July 21, 2026).

² 47 U.S.C. § 1601.

³ Id. § 1601(c).

⁴ Presidential Memorandum, Organization of the National Security Council and Subcommittees (Jan. 20, 2025).

⁵ Pub. L. 118-159 at § 1709, 138 Stat. 1773, 2209 (Dec. 23, 2024). See also "FCC Adds All Foreign-Made Drones and Critical Components to the Covered List" (Dec. 23, 2025).

⁶ See FCC, List of Equipment and Services Covered By Section 2 of The Secure Networks Act (showing Covered List entries and their date of entry). See also 47 U.S.C. §1601(b) (directing the FCC to place on the list certain equipment that is "produced or provided by any entity, if, based exclusively" on qualifying national security determinations, "such equipment or service produced or provided by such entity poses an unacceptable risk to the national security of the United States or the security and safety of United States persons").

⁷ 47 C.F.R. § 2.903.

⁸ See, e.g., FCC, "Office of Engineering and Technology Announces Waiver of Prohibitions on Certain Class I and Class II Permissive Changes to Covered Foreign-Produced Advanced Robotic Devices and Covered Foreign-Produced Power Inverters," Public Notice, DA 26-789 (rel. July 28, 2026).

⁹ FCC, FAQs on Recent Updates to FCC Covered List Regarding Routers Produced in Foreign Countries ("How are routers defined? … 'Routers' is defined by National Institute of Standards and Technology's Internal Report 8425A to mean consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems.").

¹⁰ FCC, "Public Safety and Homeland Security Bureau Announces Exemption of Certain Aircraft Systems (UAS) and UAS Critical Components from the FCC Covered List," Public Notice, DA 26-22 (rel. Jan. 7, 2026); FCC, "FCC's Public Safety and Homeland Security Bureau Announces that 'Toy Drones' and 'Toy Drones that Contain Foreign-Produced Components' Are Removed from the FCC Covered List," Public Notice, DA 26-588 (June 15, 2026).

¹¹ 47 C.F.R. § 2.939(e).

¹² See FCC, "Public Safety and Homeland Security Bureau and Office of Engineering and Technology Seek Comment on Prohibiting the Importation and Marketing of Previously Authorized Covered Communications Equipment Added to the Covered List in 2024 or Earlier," Public Notice, DA 26-294 (rel. March 27, 2026) (proposing prohibition for pre-2025 equipment); FCC, "Public Safety and Homeland Security Bureau and Office of Engineering and Technology Prohibit the Importation and Marketing of Previously Authorized Covered Communications Equipment Added to the Covered List in 2024 or Earlier," Public Notice, DA 26-635 (rel. June 26, 2026) (adopting same); FCC, "Public Safety and Homeland Security Bureau and Office of Engineering and Technology Seek Comment on Prohibiting the Importation and Marketing of Certain Covered UAS and UAS Critical Components and Equipment Listed in Section 1709 of FY2025 NDAA," Public Notice, DA 26-742 (rel. July 17, 2026) (proposing prohibition for certain UAS). See also FCC, “Public Safety and Homeland Security Bureau and Office of Engineering and Technology Seek Comment on Prohibiting the Importation and Marketing of Certain Covered UAS and UAS Critical Components and Equipment Listed in Section 1709 of FY2025 NDAA,” Public Notice, DA 26-832 (rel. Aug. 10, 2026).

¹³ Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, Third Report and Order and Further Notice of Proposed Rulemaking, ET Docket No. 21-232 (rel. July 23, 2026).

¹⁴ Letter from Chair Mike Gallagher and Rep. Raja Krishnamoorthi (D-Ill.), Ranking Member, House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, to FCC Chairwoman Jessica Rosenworcel (Aug. 7, 2023); Letter from Chairman Gallagher and Rep. Raja Krishnamoorthi to DOW Secretary Lloyd Austin and U.S. Department of the Treasury Secretary Janet Yellen (Jan. 4, 2024).

¹⁵ DOW, List of Chinese Military Companies (adding IoT module manufacturer).

¹⁶ Press Release, Sen. Cotton, Cotton Introduces Bill to Protect Americans from Chinese-Made Medical Devices (June 25, 2026) (introducing the Countering Chinese Cyberthreats for Patients (Countering CCP) Act).

¹⁷ Letter from Chair Gallagher to FCC Chairwoman Jessica Rosenworcel (March 11, 2024).