The FCC 2026 order closes a component-part loophole, requires recertification for changes by covered entities and adds marketplace FCC ID requirements. It applies prospectively to new authorizations and does not automatically remove existing equipment, but it changes what a buyer should verify before a new deployment.
The FCC equipment authorization rules are separate from the NDAA procurement restriction. They govern whether new equipment may be authorized and marketed in the United States, which is why a model can be unavailable for a new project even when an existing installation is still running.
The Third Report and Order adopted in 2026 adds three practical changes: component coverage, marketplace disclosure and modification rules. This is a plain-language summary, not legal advice.
The component loophole is closed
Previously, a device could avoid the prohibition by using a covered entity as a component supplier rather than as the manufacturer of the finished product. The 2026 rule prohibits authorization of devices that incorporate logic-bearing hardware components produced by a Covered List entity, where the finished device would itself be prohibited if that entity had produced it.
The rule defines a logic-bearing component by its digital processing or radio capabilities and excludes purely mechanical or passive parts. It applies prospectively to new equipment authorization applications and does not retroactively invalidate previously authorized equipment.
Marketplace FCC IDs and marketing
Online marketplaces that market covered equipment are now treated as part of the distribution chain in clearer terms. Marketplaces with physical access to or title over a device must display a valid FCC ID at the online point of sale; marketplaces relying on third-party sellers must verify the ID and require the seller to certify it.
The compliance dates are staged. This matters for procurement because a listing that does not show a valid FCC ID is a warning sign, not proof that the model is compliant with every requirement.
Modifications and recertification
A Covered List entity seeking a permissive change must now apply for recertification rather than using the lighter modification process. The rule also clarifies that a change which shifts production to a covered entity, or causes a device to lose its domestic end-product status, is prohibited.
For an owner, the practical point is that firmware and hardware revisions are not automatically equivalent. A model that was acceptable at purchase can become a different compliance question after a board revision or a supply-chain change.
What a buyer should verify now
Start with the requirement: federal contract, critical infrastructure, state or local procurement, or private ownership. Then ask the manufacturer for a model-specific statement, the FCC ID, the country of origin and the support path for firmware and replacement parts.
Do not accept “NDAA compliant” as a blanket label. The answer depends on the exact model, the buyer and the contract. If the site is extending an existing system, confirm whether the new device is authorizable before the design is fixed.
What this does not change
The order does not order private owners to remove working equipment, and it is not a general criminal prohibition on ownership. It also does not replace the NDAA Section 889 procurement rule, which applies to federal agencies and covered contracts through FAR Subpart 4.21.
Existing equipment can still raise operational, insurance or contract concerns. The compliance question and the security question are related but not identical; both belong in the replacement plan.
Brands mentioned
Sources
General information, not legal advice. Verify the current FCC rules and the applicable procurement requirement for the specific project.
Frequently asked questions
Does the FCC rule ban existing Hikvision or Dahua equipment?
The 2026 order applies prospectively to new equipment authorization applications and does not retroactively invalidate previously authorized equipment. Federal procurement restrictions and contract terms are a separate question, and state or local rules can be stricter.
What should I check on a new camera listing?
The exact model, a valid FCC ID where applicable, the manufacturer compliance statement for the relevant requirement, the country of origin and the firmware support path. A marketplace listing alone is not sufficient evidence.
Does a new FCC ID guarantee the device is acceptable for my project?
No. An FCC ID addresses equipment authorization. The NDAA procurement rule, the funding agreement, critical-infrastructure requirements and the purchaser’s own policy are separate checks.
Last reviewed: