The Federal Communications Commission (FCC) officially announced on March 23, 2026, that it has added foreign-made consumer-grade routers to its “Covered List.” This move marks a significant policy escalation in safeguarding the security of communications equipment supply chains and cybersecurity in the United States.

National Security Considerations: Routers as Critical Risk Nodes

According to joint assessments by the FCC and executive agencies, foreign-made routers have been identified as posing “unacceptable risks to national security,” including:

• Supply chain vulnerabilities that may impact the U.S. economy and critical infrastructure
• Cybersecurity weaknesses that could be exploited for cyberattacks and espionage
• Prior involvement in major cyber incidents (e.g., Volt, Flax, Salt Typhoon)

These devices may serve as entry points for attackers into home, enterprise, and even government networks, potentially leading to data breaches or infrastructure disruption.

Regulatory Impact: Ban on New FCC Equipment Authorization

Under the latest regulations:

• All equipment listed on the Covered List will not be eligible for new FCC Equipment Authorization
• As a result, new models of foreign-made routers will be unable to enter the U.S. market

• However, the following are not affected:

    - Products already on the market or previously certified
    - Consumers’ continued use of existing devices
    - Sales of existing inventory in the market

Exception Mechanism: Conditional Approval

The FCC has also introduced an exception mechanism:

• Manufacturers may apply for “Conditional Approval” through the Department of Defense (DoD) or the Department of Homeland Security (DHS)
• Devices deemed to pose no national security risk may still obtain FCC certification
• Approval may be granted for up to 18 months

This mechanism is intended to balance national security requirements with industry transition needs.

Transitional Measures: Software Updates Allowed Until 2027

The FCC’s Office of Engineering and Technology (OET) also announced:

• Previously authorized routers may continue to receive software and firmware updates (Class I permissive changes)
• Including security patches and compatibility updates
• This measure will remain in effect until March 1, 2027

This ensures that existing user devices can maintain basic cybersecurity protection.

Industry Impact and Future Trends

This policy is expected to have a profound impact on the global networking industry:

Short-Term Impact
• Significantly higher barriers for foreign router brands entering the U.S. market
• Adjustments required for testing laboratories and certification processes (FCC ID)
• OEM/ODM supply chains will need to reassess manufacturing locations and design strategies
Long-Term Trends
• Acceleration of onshoring and supply chain restructuring
• Stronger emphasis on secure-by-design principles
• Increased government regulation of communications equipment

Conclusion

This FCC policy update reflects a broader shift: communications equipment is no longer viewed merely as a technical product, but as a critical component of national security infrastructure.

In the future, manufacturers must not only comply with traditional RF and EMC requirements, but also integrate cybersecurity and supply chain transparency as core competitive capabilities.