FCC 26-50 takes effect 13 Oct: Covered List chips block equipment authorisation

The Analysis

The thirteenth of October is one of those dates that never makes the evening news but quietly decides whether a container of wireless gear gets to move. FCC report and order 26-50 went live that day, and if the product you ship into the United States carries chips or sensors from anyone sitting on the Covered List, the authorisation you were counting on just stopped existing. I spent most of this week on the phone walking clients through it, and I want to walk you through it the same way, plainly, with the numbers on the table.

Here is the plain version of what happened. From 13 October, the supply-chain rules inside report and order 26-50 are in force, and they say that any equipment going through authorisation on or after that date cannot rely on Covered List entities for its critical components. If the part that runs the radio, or the part that does the sensing, traces back to a company the FCC has listed, the authorisation does not happen. Full stop. And the FCC widened the net at the same time, because biometric sensors working at 9000 pulses per second or more now count as covered, which pulls a whole shelf of fingerprint readers, iris modules and palm-vein scanners into scope. The law firm note I read on Tuesday put it without decoration, and I will do the same: this is a hard gate on the finished device, not a fine on a part.

Let me start with the list itself, because the way it works is the part people get wrong. The Covered List is the FCC's roll of entities it has decided are a risk to American communications security, and if you have been importing anything with a radio into the States over the past few years, you already know the famous names on it. What changed this month is less about who is on the list and more about how the list bites. The status attaches to the entity itself, not to the country it happens to sit in.

I keep having to explain this one, because the first instinct of almost every buyer I talk to is geographic. They hear the rule and they think, fine, I will buy the same part from a trading house in Singapore, or a distributor in Germany, or a subsidiary registered somewhere neutral, and the problem goes away. It does not go away. The question the FCC asks is who designed the component and who actually makes it, not who invoices you for it. A fab owned by a listed group in a third country is still a listed group.

An intermediary that exists mainly to re-paper invoices is still the same supply chain underneath, just with a nicer letterhead. Anyone who has lived through tariff engineering or forced-labour customs enforcement in the last few years knows exactly how this film ends: the agency reads your paperwork, then it looks straight through the paperwork at the real manufacturer, and when the two do not match, it is the importer of record who sits in the chair and answers for it. You do not get to be surprised by that. You get to be prepared for it.

The second thing that matters, and I would argue it matters even more for the mid-market, is the paperwork route. For years a lot of commodity devices got onto the US market through the SDoC, the supplier's declaration of conformity, which is the self-declaration channel where you hold the test evidence yourself and skip the formal certification filing. This order keeps that door shut for covered hardware. Certification via an SDoC remains blocked for anything built on Covered List components, so the quiet, cheap, low-visibility path that plenty of access-control panels, attendance terminals and consumer gadgets used is simply not available for this category anymore. If your device is in scope, you are in the full certification world, with a lab, a filing, a fee and a clock. That is not a disaster on its own, but it changes your planning, because the SDoC route could be turned around in days while a full certification cycle is measured in weeks, and weeks in the fourth quarter are money.

Now let me talk about what this actually does to a shipment, because I promised you numbers, not theory. Picture a brand importing a smart access-control reader with a fingerprint module, the kind of thing sold in boxes of fifty to system integrators. Assume, and I am making these numbers up as an honest example, so take them as assumptions rather than facts: annual volume of 120,000 units, FOB cost 19 dollars a unit, and the fingerprint sensor inside is rated at 12,000 pulses per second, comfortably above the 9000 threshold, which makes it a covered component.

The new model is scheduled to go into certification in November, right after the firmware freeze. When the lab screens the BOM, it turns out the sensor die was designed by a subsidiary of a listed entity, bought through a module house that never disclosed it, because nobody asked. The authorisation is dead on arrival. To fix it you qualify an alternate sensor from an unlisted supplier, and that part runs 1.40 dollars more per unit, which across 120,000 units is 168,000 dollars a year of pure BOM increase. The lab retest and the certification filing add maybe 12,000 dollars, and the redesign pushes the launch by eight to ten weeks, which in practice means the product misses the Black Friday window entirely.

If you had planned 15,000 units of fourth-quarter sell-through at a retail of 59 dollars, that is roughly 885,000 dollars of revenue sliding into January or not arriving at all, on a product whose whole economics were built for the holiday quarter. That is what a 9000-pulse threshold and a list of company names can do to a P&L when nobody checked the component pedigree in time.

Here is the part that gives me a little comfort, and I want to state it carefully so nobody relaxes too much. The rule applies to equipment authorised on or after 13 October, so whatever you got certified before that date keeps its authorisation. There is grandfathering. If your current model was authorised in August, it stays valid, and your container can still clear. But and this is the but that trips people: the protection attaches to that authorisation, not to your product line forever. The moment you file a permissive change, spin a new variant, refresh the firmware into something the lab considers a new authorisation, or relaunch the model under a new grant, you are back in front of the new rule, and the BOM gets screened again.

So the comfortable middle ground is narrow. You can keep selling what is already certified, but any change that touches the certification file reopens the question. My advice to clients this week has been almost boring: for devices certified before 13 October, touch nothing. Do not file, do not refresh, do not improve the model, until you have screened the BOM and know exactly what the screening will find. The worst outcome is discovering a listed component in the same week you voluntarily handed the file back to the lab.

The marketplace angle deserves its own paragraph, because it is the one that catches e-commerce exporters flat-footed. This order implicates online marketplaces, which means the platforms themselves are being pulled into enforcement thinking, and if you sell through the big US-facing marketplaces you have probably already noticed that compliance requests from the platforms have been getting more aggressive all year. A device that cannot be authorised is a device the platform will eventually delist, and a delisting in November is indistinguishable from a launch that never happened. I had a client two years ago, different rule, same feeling, whose best-selling item was pulled from listing over a paperwork question and took eleven weeks to come back, and in those eleven weeks the imitators took the buy box and never gave it back.

So if your funnel runs through a marketplace, the question to ask yourself is not whether your product is compliant but whether you can prove it to the platform faster than the platform asks. Have the grant, the test reports, the BOM declaration sitting in a folder your marketplace manager can produce in a day.

A word on who feels this hardest, because the pain is not evenly spread. The big brands with compliance departments saw this coming from the day the order was adopted; they have lawyers whose whole job is reading FCC dockets, and they started requalifying parts last quarter. The ones who get hurt are the mid-market exporters, the factory with its own brand, the trading company that designs a product and contracts the manufacture, the startup shipping a clever gadget direct to American consumers.

Those are the businesses where one person, often the founder or the sales director, is also the compliance department, and where the BOM lives in a spreadsheet that the ODM fills in and nobody verifies. If that describes you, I am not judging, I have been that person. But I am telling you that the asymmetry between what this rule demands and what a two-person back office can verify is exactly where the risk now sits. The good news is that the verification work is finite.

One focused week with your ODM, going line by line down the component list, asking for the die designer and the fab behind every critical part, will get you to a defensible answer. What is not finite is the cost of guessing wrong, because a refused authorisation is not a fine you pay and move on; it is a product that cannot legally enter the market you built it for.

Also worth saying out loud: none of this changes what you owe on the freight side, and people conflate the two layers all the time. Your customs broker can clear a shipment perfectly, your freight forwarder can deliver the container on time and at a decent rate, and the cargo can still be unsellable because the device inside never had a valid authorisation. The logistics chain and the compliance chain run in parallel, and this order lives entirely in the second chain. That is why the responsibility here cannot be outsourced to the people who move your boxes. I have watched shippers hand the whole problem to their forwarder for years, and for customs matters that mostly works, but component pedigree is a procurement question, a design question, a contract question. It starts in your purchasing department and ends in your supplier agreements, and the shipping company is neither the first nor the last stop on that journey.

So what do you actually do, starting this week? From where I sit, the work decomposes into screening, then papering, then sourcing, and the order matters. Screening first: pull the BOM for every SKU that needs US authorisation, and go supplier by supplier down to the actual designer and the actual fab of every chip and sensor. Not the module brand, the die. The module house is a middleman, remember, and the rule follows the entity. Cross-check every name against the Covered List, and cross-check the corporate tree too, because subsidiaries and renamed affiliates are exactly how these relationships hide. Give yourself a week; by 18 October you should know, for every product, whether it is clean, dirty or unknown.

Unknown counts as dirty in my book, by the way. Papering second: before you place the next purchase order, get written representations from your component suppliers that no Covered List entity supplies the critical components, with audit rights attached, because a verbal assurance from a sales manager is worth precisely nothing the day a lab asks a hard question. Sourcing third: for any covered category, biometric sensors above 9000 pulses per second, radio chipsets, anything on the sensitive list, start a dual-source plan and get a qualified alternate quoted by the end of the month, even if you do not switch, so that you know your walk-away price.

On timing, let me be blunt about the calendar. Certification labs are about to get busy, because every importer who ignored this order for the last six months is filing at the same time, and lab queues behave like port congestion: the price of a slot does not go down when demand goes up. If your BOM screening comes back dirty, the decision to redesign should be made this month, not after the holidays, because qualifying an alternate sensor, retesting and recertifying is an eight-to-ten-week pipeline in the good case, and the good case assumes the alternate supplier has stock and your firmware team is free.

Set the redesign trigger now, in writing: decide, before the numbers get emotional, at what BOM increase you would rather walk away from the part and redesign the whole board. In my example above, 1.40 dollars a unit was survivable; if the honest alternate is five dollars more, the product case changes and you deserve to know that before you are three weeks into a retest.

A few pitfalls worth naming, because I have watched people step in every one of them. The first is assuming the restriction is about countries and buying through a third-country intermediary; I hope I have killed that one already, but it is the single most common wrong turn, so I will say it again: entity, not country, and the paperwork audit will find the real maker. The second pitfall is treating the SDoC as a fallback, when for covered hardware it is not available at all; plan on full certification costs and timelines from the start and you will not be surprised by a quote.

The third is forgetting that an already-certified device is a fragile asset: one eager firmware engineer pushing a feature update through a permissive change can hand the whole model back to the regulator, so freeze the file until the BOM is proven clean. The fourth is keeping all your compliance evidence in one office, on one laptop, with one person who knows where it is; marketplaces, customs brokers and labs all ask for these documents on their own clocks, and their clocks do not care that your compliance manager is on holiday. Scan it, index it, share it.

One more dimension I keep getting questions about: what happens to goods already sitting in the warehouse when the news lands. The answer is reassuring, as long as you read it carefully. The rule attaches at the point of authorisation, not at the point of sale, so inventory built on devices that were properly certified before 13 October remains sellable, and neither customs nor the marketplace retroactively strips a grant that was valid when issued. I checked this with the notes from two firms and both read it the same way.

But notice the boundary. That protection covers the certified configuration, and the day you want to add a new model, a new variant, a different radio module, a redesigned sensor board, the whole question reopens. So the practical picture over the next two quarters looks like a fork: your legacy stock keeps flowing through the old grant, while any new introduction has to run the full gauntlet of screened components and full certification. Two parallel pipelines, two different clocks, and a warehouse that holds both.

The importers who manage that fork cleanly are the ones who label the pipelines now, in their own systems, before a shipment ever books, because the worst version of this is a team that treats every SKU the same and discovers at the dock that the new model has no grant while the old one did.

Where does this leave the ordinary importer or exporter of electronics into North America? In a position that is uncomfortable but very manageable, honestly. The devices already authorised before 13 October keep selling. The products that were never going to pass, well, better to learn that from your own BOM screening in October than from a lab rejection in December, or worse from a marketplace delisting in January with stock sitting in a Fulfilment centre. The rule is a hard gate, but it is a legible gate, and legible rules reward the people who do the boring homework early. Pull the BOMs, screen the entities, paper the representations, quote the alternates, freeze the certified files, and put the redesign decision on a date instead of leaving it to a mood.

Do that and this rule becomes a checklist. Skip it and it becomes a story you tell about the quarter the launch died. I have told enough of those stories in my career, and I would rather you never get to tell yours, which is why I will keep writing these down for you the week they happen. That is the job, as I see it, one rule, one shipment, one honest note at a time.

↑ Back to the key points

— By Leo