Wireless gadgets and the FCC's Covered List: what the 2025 and 2026 equipment orders changed for buyers

The Federal Communications Commission regulates the import and sale of radio devices in the United States through its equipment authorization program. Two FCC orders have tightened it for products tied to the agency's Covered List. The first, adopted on October 28, 2025, created a way to stop the import and marketing of covered equipment authorized before November 2022. The second, adopted on July 22, 2026, bars new devices with certain components from Covered List companies and requires online marketplaces to display FCC IDs. This guide explains both, from the orders in the Federal Register and the federal code's amendment record, read on November 12, 2026. It does not assess any device.

The Covered List and the 2022 ban

The Secure and Trusted Communications Networks Act of 2019, enacted in March 2020, requires the FCC to list equipment and services that pose “an unacceptable risk to the national security of the United States or the security and safety of United States persons,” based solely on determinations by sources the law names. In November 2022, the FCC stopped authorizing covered equipment, and equipment produced by companies on the list must now go through full certification by a certification body. The FCC did not then revoke existing authorizations.

In 2023, Hikvision USA and Dahua Technology USA challenged parts of that rule in the federal appeals court in Washington, D.C. On April 2, 2024, the court vacated the FCC's definition of “critical infrastructure,” which decides when Hytera, Hikvision and Dahua equipment counts as used to watch over such infrastructure, calling it “unjustifiably broad.”

The 2025 order: older authorizations and modules

The Second Report and Order took effect on December 26, 2025. It bars authorization of any modular transmitter that is covered equipment, and of any device that includes one, even if the module was authorized earlier. It also lets two FCC offices limit earlier authorizations of covered equipment so that it can no longer be imported or marketed, which includes sale; the FCC said consumers' use of devices they already have would not be affected. Each limitation needs a public notice, an analysis of public interest factors such as supply chain effects, in which the security finding carries particular weight, and at least 30 days for comment. The FCC told the offices to start such proceedings for listed equipment “as soon as practicable.”

The order records opposing views. Commenters including CTA, CTIA, TIA, the Competitive Carriers Association and NCTA generally opposed any widespread revocation that would force equipment in use to be removed and replaced. ITI, ZTE, Hikvision and Dahua argued that any revocation of existing authorizations is barred by the Secure Equipment Act or would violate due process. Some commenters supported a broad revocation. The FCC chose to limit future imports and sales, saying years-old covered devices are still widely sold in the U.S.

The 2026 order: components and FCC IDs online

The Third Report and Order took effect on October 13, 2026. It bars authorization of devices containing a logic-bearing hardware component, a digital circuit, module or similar part, made by a company on the Covered List, where the device would be barred had that company made all of it. Housings, wiring, resistors and plain battery cells are excluded, and equipment already authorized is not affected.

For shoppers, the most visible change concerns online marketplaces. Listing a device on a marketplace that also warehouses, packages or ships it now counts as marketing it, even when a third-party seller makes the sale, and marketplaces can face enforcement without proof that they knew. Marketplaces that sell devices themselves, or that handle or take title to a seller's device, must show a valid and accurate FCC ID at the online point of sale from March 1, 2027. Those that only host third-party listings must show a valid FCC ID from June 1, 2027, and are not liable for a wrong one if they checked it against the FCC's database and had the seller certify it. Listings for used devices, listings by sellers below the federal “high-volume” threshold and unchanged listings from before October 13, 2026 are exempt. The FCC declined, for now, to require the ID on packaging.

The FCC estimated one-time costs of no more than $300 million and recurring costs under $40 million a year, against benefits it said could exceed $1 billion a year. Answering the court, it dropped the “connected to” wording from its critical infrastructure definition.

Routers and drones on the list

According to the FCC's 2026 documents, the Covered List recently gained entries based on where equipment is made rather than who makes it: uncrewed aircraft systems, their critical components, and routers “produced in a foreign country.” A proposal published in August 2026 would codify definitions previously set out in public notices and FAQ guidance: routers are consumer-grade networking devices primarily intended for residential use, and “produced in a foreign country” is tied to the “domestic end product” test in federal procurement rules. Waivers allowing certain software and firmware changes, such as security patches, to already-authorized covered drones and routers run through January 1, 2029. The FCC's website, where the list and the agency's public notices appear, did not accept our requests, so we could not read today's list or check whether any earlier authorization has been limited; these entries come only from the Federal Register.

What applies now, and what is pending

The federal code's amendment record, read on November 12, 2026, shows the sections on marketing and on the Covered List ban last amended with effect from October 13, 2026, with no later change. Neither order stops anyone using a device they already own, and compliance with the FCC ID rule is required only from 2027.

Further changes are proposals only. The notice published in August 2026, with reply comments due September 21, 2026, asks whether authorizations should expire after a fixed term, tentatively ten years; whether marketplaces should verify FCC IDs rather than only display them; whether to bar any component or software from Covered List companies; and whether to make the security-patch waivers permanent.