The FCC's Component Ban Turns on 9,000 Cycles a Second. That's Almost Every Chip on Your Board.

Nine thousand pulses per second. That’s the line in the draft order the Federal Communications Commission votes on tomorrow [1, 3].

If a component on your board generates timing signals faster than that and uses digital techniques, the draft calls it “logic-bearing hardware” [1]. If a company on the FCC’s Covered List made it, the device it sits in would no longer be eligible for a new FCC equipment authorization [1]. Nearly every microcontroller, radio chip and memory part clears 9 kHz without trying.

What’s on the FCC’s July 22 agenda

The item is the Third Report and Order and Third Further Notice in ET Docket No. 21-232, listed as item 5 on the Sunshine notice published this morning [3]. Chairman Brendan Carr circulated it to the other commissioners June 30, announced it July 1, and posted a public draft the same day [2, 4]. Carr’s statement called it “an important step for the FCC to continue its efforts to protect America against dangerous equipment” [2].

Some history. Congress passed the Secure Equipment Act in November 2021, telling the FCC to stop reviewing or approving equipment authorization applications for equipment on the Covered List [5]. The FCC’s first order did that in 2022 for gear from Huawei and ZTE, plus Hikvision, Dahua and Hytera equipment used for public safety and certain security purposes [1]. A second order in October 2025 extended the ban to devices containing a covered modular transmitter [1]. Starting in December 2025, the Covered List also picked up entries defined by where things are made: drones, drone critical components and routers produced abroad, with carve-outs [1].

The draft order would [1]:

• Ban the component, not just the box. No new authorization for a logic-bearing hardware component made by a Covered List entity, or for any device containing one, if the device would have been barred had that entity built the whole thing.
• Pin down the definition. The text of the digital-device definition in section 15.3(k), applied to “any device, system, module, sub-assembly, integrated circuit, or other physical component,” without the exclusion for intentional radiators.
• Treat marketplaces as marketers. Warehousing, order processing, fulfillment and billing for third-party sellers count as “distribution for the purpose of selling,” and marketplaces must show the correct FCC ID for certified devices at the online point of sale.
• Force full recertification for any change a Covered List entity makes to any equipment, covered or not, with no Supplier’s Declaration of Conformity route.
• Narrow “critical infrastructure” to the USA PATRIOT Act definition, after the D.C. Circuit found the 2022 version “unjustifiably broad.”

The draft is explicit about what’s out of scope. The ban doesn’t reach software or firmware made by Covered List entities, though the record stays open on that [1]. It doesn’t cover components from any company tied to a foreign adversary [1]. And it applies only to entities named on the list, so a chip from a company whose routers are covered only because they’re made abroad doesn’t trigger it [1]. A Covered List entry for a service, as opposed to equipment, has no effect on authorizations at all [1].

When the component ban would start

This is the paragraph I’d read twice. The draft makes the component ban “effective as of adoption of this Order, with no transition period” [1]. It “applies immediately for applications in process,” which may be amended to substitute components [1]. Already-authorized devices can keep being marketed, imported and used [1]. Everything else in the order takes effect 30 days after Federal Register publication [1].

The FCC’s reasoning: these companies “have long been flagged,” supply chain reviews “should have identified and mitigated risks,” and a long runway “would allow device makers to flood the market with potentially compromised devices” [1].

What it means if you ship hardware

My read.

Your BOM is now a legal document. You can’t answer the question “does this device contain a logic-bearing component produced by a Covered List entity?” from a datasheet. You need part-level provenance, including who made the module your contract manufacturer substituted last quarter. The FCC knows this; it points to NIST’s supply chain guidance on bills of materials and says the cost should fall on “the device maker that bears a one-time compliance cost to vet its supply chain” rather than the end user [1]. Fair enough as policy. In practice, a big OEM has a sourcing team that already tracks this. A 12-person IoT startup has a spreadsheet and a contract manufacturer on another continent.

The definition is legible, which isn’t the same as narrow. CTIA told the FCC “logic-bearing hardware” wasn’t specific enough to tell what would be prohibited, and Garmin asked for bright-line rules [1]. The FCC’s answer was to borrow a test engineers already know from Part 15 [1]. I’ll give it credit for that. It’s a real definition, not a vibe. But the old digital-device test was built to sort out which products need emissions testing, and almost everything with a clock passes. Applied to components, it takes in nearly every active part on a board. What keeps the rule from being enormous is the “produced by a Covered List entity” condition, not the definition.

“Produced by” is where the fights will be. The draft keeps assessing that phrase under “the totality of the circumstances” [1]. For a Huawei-designed chip fabbed somewhere else, or a module from a subsidiary, that’s a judgment call. OET gets delegated authority to answer questions about what meets the definition [1]. I’d expect a lot of those questions, and I’d expect the answers to arrive slower than your next certification deadline. I covered a version of this problem in June, when Bosch paid for firmware tested on Huawei chips: the government’s view of what counts as “produced by” a listed company tends to be wider than the supplier’s.

The legal hook is the Communications Act, not the 2021 statute. The Secure Equipment Act covers equipment “on the list” [5]. A device built by a company that isn’t listed, holding one listed chip, isn’t obviously that. The FCC says the ban is “generally consistent” with Congress’s acts and leans on its own authority over RF devices under sections 302a and 303 [1]. Someone will test that.

Marketplaces become your compliance check. If listings need the correct FCC ID and the marketplace is liable for errors, expect platforms to start validating IDs against the FCC’s database before your listing goes live [1]. The FCC says the cost of displaying “a single identifier” is minimal [1]. The cost of a wrong one could be the listing. This builds on Operation Clean Carts, the FCC’s effort with e-commerce platforms that it says has pulled more than 4 million devices [2, 4].

The FCC puts the order’s total cost at about $50 million a year, mostly for redesign or component substitution by “a narrow subset of firms,” and it admits “it is unclear at this point which market participants” those are [1].

What I’m watching

• The vote, July 22. Whether the adopted text keeps the immediate effective date and the treatment of pending applications [1, 3]. Drafts change between circulation and adoption.
• The further notice’s HBOM and SBOM proposal. It would require a signed hardware and software bill of materials with every certification application, naming each component’s producer, its production location and the percentage of value by country, with updates within 30 days of any change [1]. The FCC estimates SBOM costs under $5,000 per program and HBOM costs up to $10,000 per device [1]. Comments would be due 30 days after Federal Register publication [1].
• The broader proposals. The same notice floats a ban or presumption against devices with any hardware, software or firmware from a Covered List entity, term limits on authorizations and a U.S.-based liable party for certified equipment [1].