FCC Adds Foreign-Produced Consumer Routers to FCC Covered List

The FCC’s Public Safety and Homeland Security Bureau added all consumer-grade routers produced in foreign countries to the Covered List. When an item is placed on the covered list it is deemed an unacceptable US security risk. Routers were “directly implicated” in attacks (e.g. Volt/Flax/Salt Typhoon) targeting U.S. communications, energy, transportation, and water infrastructure. Further information on the risks are contained in the FCC Public Notice, DA-26-278A1.

Effective March 23, 2026, consumer-grade routers produced in a foreign country are prohibited from receiving new FCC equipment authorizations. For routers produced in the United States, applicants must formally certify that the equipment is not 'covered'. Note that this restriction is determined strictly by the place of production, including design, development, and assembly rather than the manufacturer's corporate identity.

Existing authorizations for covered routers remain valid unless revoked or limited by the FCC; however, modifications including Class I permissive changes—are generally prohibited. However, to ensure device security and functionality, the Office of Engineering and Technology (OET) issued a Blanket Waiver (DA 26-286). This waiver permits critical firmware and software updates, such as vulnerability patches and operating system compatibility fixes, through at least March 1, 2027.

To define routers, the FCC followed the definitions in the National Security Determination, which states that “Routers” is defined by National Institute of Standards and Technology’s Internal Report 8425A to mean consumer-grade networking devices that are primarily intended for residential use and can be installed by the customer. Routers forward data packets, most commonly Internet Protocol (IP) packets, between networked systems. Consequently, a device is considered covered equipment if all the following conditions are met:

• It is a router
• It is consumer grade
• It is customer-installable
• It is produced outside of the USA (produced includes design or manufactured or assembled)

For example, an ISP‑provided home gateways produced outside of the USA is covered equipment. A foreign produced wired ethernet router with no wireless functionality that can be installed at home or small office without professional installation is also covered equipment. Industrial routers or managed service provide CPE that are not customer-installable would not be considered covered equipment. A cell phone with hotspot functionality would not be considered covered equipment as its primary function is not a router. However, a foreign produced portable hotspot device which connects to WAN and recreate a Wi-Fi system is covered equipment if used by a consumer due to the hotspot being its primary function.

A Conditional Approval procedure is available in Annex A in the Public Notice for applicants seeking exemption imposed by the restrictions or to maintain FCC authorization while mitigating national security concerns. To obtain approval from the Department of War (DoW) or the Department of Homeland Security (DHS), applicants must provide comprehensive disclosures for an individualized assessment of potential risks:

• Full supply chain disclosure
• Ownership and governance transparency
• Component origin details
• Cybersecurity posture
• A plan to transition production to trusted locations

Submit Conditional Approval requests for foreign-produced routers to conditional-approvals@fcc.gov and UAS requests to drones@fcc.gov. If approved, the authorization remains valid for up to one year.

Here are some FAQs from the FCC website on Recent Updates to FCC Covered List Regarding Routers Produced in Foreign Countries.

If you have any questions, please contact us here.