US FCC Extends Tech Regulations to Chip and Optical Module Supply Chains
Alina Collins
The FCC published its FCC 26-50 rule package on July 23, extending equipment-authorization scrutiny from branded end-products down to chips, modules, firmware, and production locations; this redraws the compliance-cost boundary for optical-module makers and ODM suppliers.
What did the rules actually change?
The FCC used to scrutinize brands and final assembly. The new rule reaches the component level — any product containing a "logic-bearing hardware component" made by a covered entity cannot receive new FCC equipment authorization, regardless of brand or assembly location.
This means → swapping the label or moving assembly offshore no longer works. The chip itself is now the audit target.
Online platforms face new obligations too: those holding inventory must display FCC IDs within 180 days; third-party marketplaces must implement verification within 270 days.
What does the FNPRM proposal require?
The FNPRM (Further Notice of Proposed Rulemaking) is the not-yet-final portion of the package. Public comments close September 8.
Its core ask: applicants must file a Hardware Bill of Materials (HBOM) and a Software Bill of Materials (SBOM), identifying the designer, developer, manufacturer, and assembly site for every critical chip, module, and firmware component.
In plain terms = the FCC used to inspect the finished product. Now it wants you to take the product apart and explain who designed, who built, and where they built every key part.
Other provisions: equipment authorization shifts from permanent to a 10-year term; material supply-chain changes must be reported within 30 days.
How will "where it's made" be determined?
The FCC has not yet decided how to distinguish production in China from production in Vietnam, Thailand, or Malaysia.
It is studying whether to adopt the customs concept of "substantial transformation" — a product counts as made in a country only if it underwent processing there sufficient to change its character.
This means → for suppliers with Southeast Asian plants whose core processes still run in China, the origin-determination standard will directly decide whether their products can enter the US market.
How has the regulatory logic shifted?
Analysts describe the shift as moving from "who is the risk" to "where is the risk" — scrutiny extends from named entities to components, and potentially onward to production sites.
In plain terms = it used to be "blacklisted companies are blocked." Now it is "regardless of the brand, if the critical parts trace back to a problematic source, the product is blocked."
This reflects a US supply-chain security posture moving from the end-product layer down to the component layer.
Have US-China countermeasures already started?
China sanctioned Compliance Testing, an Arizona-based firm that assists FCC compliance checks, on August 5.
China's Cyberspace Administration launched a cybersecurity review of Palo Alto Networks products on August 6.
This means → certification and cybersecurity reviews are increasingly becoming reciprocal instruments in US-China tech friction. The final shape of the FNPRM rules will be the key marker for where compliance costs settle for optical-module makers and ODM suppliers.
Content is for reference only, not financial advice.