Scope of this page
General information for Colorado property owners and procurement teams. It is not legal advice. Federal, state, local and contract requirements can differ; verify the current rule and the specific equipment before acting.
The FCC Covered List names communications and video surveillance equipment that poses a national security risk, including gear from Huawei, ZTE, Hytera, Hikvision, and Dahua. Listing restricts new equipment authorization and marketing in the United States. The 2026 Third Report and Order closes a logic-bearing component loophole and adds marketplace FCC ID requirements effective October 13, 2026.
The FCC Covered List is the supply-chain list most often cited in camera conversations, and it is frequently confused with the NDAA. The two are related but not the same: one governs federal contracting, the other governs which new equipment may be authorized and marketed in the United States.
This page explains what listing does to new equipment, what changed with the 2026 Third Report and Order, and how an organization should check equipment it already owns. It is general information, not legal advice; confirm your obligations with counsel and your procurement team before acting on it.
What the Covered List is
The FCC maintains the Covered Communications Equipment and Services List under the Secure and Trusted Communications Networks Act of 2019. Congress directed the Commission to identify equipment and services that pose an unacceptable risk to national security, and the list covers communications equipment and video surveillance equipment from Huawei, ZTE, Hytera, Hikvision, Dahua, and their subsidiaries and affiliates. The Commission updates it as new products and suppliers appear, so a model absent from an older copy may be listed today. A current copy is published on the FCC site, which makes the list usable as a screening tool at the quotation stage.
Placement on the list has consequences that run through the equipment authorization program. The Commission’s rules prohibit authorizing covered equipment, and the agency has terminated authorizations previously granted for equipment from those five companies. Listing is a supply-chain designation that applies to the equipment; it is not a finding about any individual installation, and it does not by itself rewrite a contract. Nor does it decide whether a device may be sold to a particular customer.
New authorization and marketing rules
Equipment marketed in the United States generally needs an FCC equipment authorization, and the Covered List removes that path for covered gear. The 2026 Third Report and Order tightens two gaps. It closes a loophole that allowed logic-bearing components to reach the market without being treated as covered equipment, and it adds requirements for FCC IDs to be shown in marketplace listings. Both changes shift work onto sellers and buyers alike. A component that performs logic is now treated as equipment rather than as a passive part.
Those requirements take effect on October 13, 2026. After that date, buyers should expect an FCC ID on listings for authorized equipment and should treat a missing or unverifiable ID as a question to resolve before purchase. The order changes what may be newly authorized and marketed; it does not by itself invalidate equipment already deployed, and it creates no removal obligation for existing sites. Sellers carry the labeling duty, and buyers carry the check.
Existing equipment and contract requirements
Existing equipment that was lawfully authorized and installed is not automatically illegal because it appears on the Covered List or because the rules change. The marketing and authorization restrictions operate at the point of authorization and sale, and no general rule requires a business to remove working devices from a privately funded network. That distinction is the one most often lost in summaries of the list. A rule written for new sales rarely reaches backwards into an installed base.
Contract and funding conditions can be stricter. Federal awards bring FAR 4.21 and its clauses; state and local procurement, grant terms, school and healthcare funding, and critical-infrastructure programs may each add restrictions of their own. Some insurers and enterprise customers now ask for equipment attestations as a condition of coverage or of a purchase order, which is a business requirement rather than an FCC one. Read the customer’s own standard as carefully as the statute.
Checking equipment and planning replacement
Read the contract or funding condition first and write down which restriction applies: FCC authorization rules, FAR 4.21, a state procurement rule, or a customer’s own standard. Then inventory installed and proposed equipment by manufacturer, model, and FCC ID, including cameras, recorders, radios, and embedded modules inside products carrying another brand. Photograph the label where the ID is printed, because it settles most disputes faster than a datasheet. One line per device is enough, and a model list beats a rack photograph.
For equipment already in service, confirm when it was authorized and whether a grant still exists, keep that record with the system documentation, and segment covered devices on the network while a replacement plan is funded and scheduled. For new purchases, require an FCC ID and a written component statement before the order is placed, and check state, local, and critical-infrastructure rules rather than assuming one federal rule settles the question. Have counsel and procurement review the conclusion, and record what you asked, what you received, and the date.
Sources
Frequently asked questions
Can I keep cameras that appear on the Covered List?
In most cases, yes. The list restricts new equipment authorization and marketing, and equipment that was lawfully authorized and installed is not invalidated by a later rule. Contract terms, funding conditions, and insurance requirements can still prohibit it on a specific site.
What changes on October 13, 2026?
The 2026 Third Report and Order closes a loophole for logic-bearing components and adds marketplace requirements for displaying FCC IDs. New authorizations and listings are affected from that date; equipment already deployed is not automatically made illegal.
How do I check an FCC ID?
Look for the FCC ID on the product label, the packaging, or the marketplace listing, then confirm the grant in the FCC equipment authorization database. Match the grantee and the product class, and keep a copy of the record with the project documentation.
Last reviewed: