The Copyright Office Will Renew Every DMCA Exemption but One. Medical Device Repair Has to Start Over.

The U.S. Copyright Office published its proposed rule for the tenth round of DMCA Section 1201 exemptions on October 28, and the headline is that almost nothing goes away [1]. The Register intends to recommend renewing every current exemption but one: the exemption for repairing medical devices [1].

That one exemption survived a federal appeal in September [2]. It still has to start over.

What the notice says

Section 1201 makes it illegal to get around a technical lock on a copyrighted work, and that includes firmware. Every three years the Librarian of Congress grants temporary exemptions for specific classes of works and uses [1]. The last set took effect October 28, 2024 [4].

For this cycle, the Office got 43 renewal petitions and 25 petitions for new or expanded exemptions [1]. Renewals go through a streamlined track: a petitioner swears nothing material has changed, and unless someone shows “meaningful opposition,” the Register recommends readoption [1]. Every existing exemption cleared that bar except medical device repair [1]. That includes the ones a lot of readers depend on without thinking about it: good-faith security research, jailbreaking phones, smart TVs, voice assistants and routers, consumer device repair, vehicle repair and the license-compliance investigations the Software Freedom Conservancy runs on free and open source software [1].

The new requests were consolidated into ten proposed classes [1]. Two other petitions were rejected outright for failing to describe “a particular class of works” [1]. One of those would have let almost anyone get around controls on nearly anything posted online for documentation or research [1].

There’s also a process change. For the first time, comments are capped at 25 pages per class per round, excluding affidavits and exhibits [1].

Why medical device repair is back at square one

Device makers have been fighting this exemption in court since 2022. On September 1, the D.C. Circuit affirmed that the Librarian’s adoption of it was “lawful, reasonable, and supported by ‘thorough and well-reasoned explanations from the Eighth and Ninth Triennial Rulemaking procedures’” [2]. The industry lost.

But the court said why. The challengers’ argument, Judge Childs wrote, “turns centrally on the proposition that there is a distinct body of repair software independent from the clinical-operation software and that it occupies its own standalone market,” and they “made no such record in the rulemaking process or before the district court” [2].

AdvaMed read that as an invitation. Its September 28 opposition calls the ruling “about an insufficient record” and attaches declarations from manufacturers [3]. They split device software into three buckets: “Clinical Operation Software,” “System Servicing/Diagnostic Software” and “Maintenance-Related Documentation” [3]. AdvaMed says the servicing bucket sits behind different locks, administered by a different party, and is licensed in its own market, sometimes in competition with independent service organizations [3].

The Copyright Office bought enough of it to stop the streamlined renewal [1]. It said the D.C. Circuit opinion “did not change the legal framework,” but the new evidence raises questions about whether the current exemption’s wording is “defined with sufficient specificity” [1]. So the existing exemption gets folded into Proposed Class 8(b) with requests to widen it [1]. One of those, from Marshall Shannon, would expressly add installation, calibration, “cybersecurity-related reconfiguration,” and return to service for used and resold devices [1].

What it means if you build hardware

This section is opinion.

Look past the medical fight and read the new classes as a list of product decisions that someone wants the government to override. Four of them land squarely on connected-device teams [1]:

• Ads pushed after the sale. FULU wants owners to be able to “disable, remove, or prevent the rendering of advertising surfaces” added to a device’s interface after purchase, on smart appliances, TVs, e-readers and car consoles. The Office asks whether those devices have enough in common for one exemption.
• Automatic content recognition. FULU also wants the smart TV jailbreak exemption to cover removing ACR software.
• Home cameras. Public Knowledge and FULU want owners of doorbells, baby monitors and security cameras to be able to route video to a local server.
• Cloud shutdowns and enterprise gear. FULU’s repair proposal covers devices whose maker “has discontinued service or software support essential to its use” or “has ceased business,” including swapping in community-built software. Public Knowledge and iFixit want the repair exemption to reach laptops, servers and storage, including devices bought in bulk for employees or students, for enterprise, industrial and government owners. The Register turned down a similar enterprise request in 2024.

The medical device argument is a design pattern, not just a legal theory. AdvaMed’s case rests on service tooling being separately locked and separately sold [3]. If that wins, any company that splits its diagnostics into a licensed service app behind its own credentials has a stronger argument the next time repair exemptions come up. If it loses, that split buys you nothing. Either way, the architecture choice comes first, and the record gets built around it.

The Office also flagged a limit that matters for anyone hoping these exemptions let a third party fix things for customers. It declined again to say whether repair shops circumventing for customers run into the separate anti-trafficking provisions, noting that only Congress can exempt trafficking [1]. A consumer can be allowed to circumvent. A startup selling the tool or the service is a different question.

On AI, two details stand out. Renewing the text and data mining exemption over the Association of American Publishers’ objection, the Office wrote that “circumventing TPMs to compile AI model training data sets is permitted by the exemption” for the nonprofit academic researchers it covers, provided the corpus stays behind “effective security measures” [1]. And none of the ten new classes covers AI red-teaming. In 2024 the Register denied an exemption for generative AI “trustworthiness” research, finding the researchers’ problems came from platform controls rather than Section 1201 [4]. Nobody brought that request back this cycle, so AI researchers are left with whatever the renewed security research exemption already covers [1].

What I’m watching

• December 7. Whether manufacturers file opposition evidence on the ad-removal and local-video classes, or leave them to the content industry groups. Opposition comments are due February 22, 2027 [1].
• The servicing-software line. Whether AdvaMed’s three-category split appears in the Class 8(b) comments from independent service organizations, and whether anyone proposes regulatory text that tracks it [3].
• Spring 2027 hearings. The Office says it will hold online public hearings then, with a separate notice to follow [1].