Adopted in July, Effective in October: The Component-Sourcing Rule Gets Its Federal Register Date

The FCC's Third Report and Order barring new equipment authorizations for devices with Covered List logic-bearing components — reported here in July as adopted but 'not yet effective' — published in the Federal Register on September 11, 2026, fixing October 13, 2026 as its effective date. The same document sets separate 2027 compliance dates for online-marketplace FCC ID display and extends a Class I/II permissive-change waiver for Covered List UAS and routers to January 1, 2029. No other new CMMC, SPRS, 800-171, Covered List, or UAS development was found in the trailing window.

This briefing closes a gap. The Federal Register document at the center of it published on September 11, 2026 — after our September 9 briefing on the ASUS and Comtrend conditional approvals, and before our September 21 briefing on NIST's FIPS 140-3 transition. It fell between two issues. Given that it now carries a concrete, near-term effective date, it earns its own entry rather than a footnote.

1. The rule our July briefing flagged as "adopted, not yet effective" now has a date

In our July 27, 2026 briefing we reported that the FCC had adopted a Third Report and Order, FCC 26-50, in ET Docket No. 21-232, barring new equipment authorizations for any device containing a logic-bearing hardware component produced by a Covered List entity. At the time we could state only that the rule "takes effect 30 days after publication in the Federal Register," and that "as of early September 2026 the Third Report and Order had still not appeared there, so no effective date can yet be computed."

That has changed. The order published in the Federal Register on September 11, 2026 as FR Doc. 2026-18535, 91 FR 57798. Its DATES section states plainly: "This final rule is effective October 13, 2026."

Legal status: final rule — adopted, published, not yet in effect. Nothing in this order binds today. It binds starting October 13, 2026, eighteen days from this briefing's publication date.

Nothing about the substance changed between adoption and publication. What changed is that a computable clock now exists, and it is close enough to plan around rather than wait on.

Primary sources:

2. Three dates, not one — and a boundary worth restating

The Federal Register publication carries more than the headline effective date. Three distinct dates attach to three distinct obligations, and conflating them would misstate the rule:

October 13, 2026 — the logic-bearing hardware component prohibition itself takes effect. New equipment authorizations become unavailable, from this date, for any device incorporating a logic-bearing component produced by a Covered List entity, where that entity would itself be barred from producing the finished device.
March 1, 2027 — online marketplaces that market a certified radiofrequency device, or that sell one on behalf of a third-party seller while holding physical access to or title over it, must display a valid and accurate FCC ID at the point of sale.
June 1, 2027 — the same FCC ID display obligation extends to marketplace listings that rely on third-party seller certifications rather than marketplace-held inventory.

A fourth date belongs to a different mechanism entirely, and should not be read as a relaxation of the October 13 prohibition: existing Class I and II permissive-change waivers for Covered List UAS equipment and covered routers remain valid through January 1, 2029. This is a waiver covering the modification pathway for equipment already authorized — it is not the Blue UAS Cleared List or the 48 CFR 25.101(a) domestic-end-product exemption we reported on September 2, 2026 (which runs to January 1, 2028 and applies to a different question — importation and marketing of covered UAS, not permissive-change filings). Two different 2028/2029 dates, two different mechanisms; do not substitute one for the other in a compliance calendar.

Exceptions confirmed in the text: the prohibition does not affect previously authorized equipment; applications pending as of October 13, 2026 are exempt unless later amended to add, substitute, or change a logic-bearing hardware component; and the marketplace display rule exempts used-device listings, non-high-volume third-party sellers, and listings published before the rule's effective date that are not subsequently amended.

Primary source:

FR Doc. 2026-18535 — full text

3. What This Means for Taiwan Manufacturers

The following is our own reading of exposure, not agency language. Read it alongside the rule text above, not as a substitute for it.

Eighteen days is a short runway for a diligence process that, per our July briefing, most manufacturers do not yet have assembled: a component screening sheet that traces every logic-bearing part — chip, module, PCB, controller — to its producer, cross-checked against the Covered List, for every product currently in a US equipment-authorization filing or scheduled to enter one after October 13. If that inventory does not exist yet, the priority between now and the effective date is building it for anything in-flight, not waiting for a final version covering the full catalog.

The pending-application exception is worth a specific check. If you have an application pending as of October 13, confirm with whoever is managing the filing that no amendment adding or changing a logic-bearing component is planned before it clears — an otherwise-routine engineering change control could inadvertently walk a grandfathered application into the new prohibition.

For anyone selling through a US online marketplace, or through a distributor who does, the 2027 dates are less urgent but not negligible: they set the point at which marketplace listings need an accurate, displayed FCC ID matched to the actual product, which is also a good forcing function for reconciling internal grantee-code records against what is actually listed for sale.

The January 1, 2029 permissive-change waiver is relevant only if you already hold a conditional approval or an existing authorization on Covered List-scoped UAS or router equipment and expect to modify it. It buys time on the modification pathway specifically — it does not extend, and should not be confused with, the separate January 1, 2028 Blue UAS and domestic-end-product exemption horizon.

What did not change this window

Checked directly against primary sources for the period September 21–25, 2026: no new Covered List additions, no new router or UAS conditional approvals, no CMMC, SPRS, or DFARS timeline change, and no new NIST 800-171/CUI guidance beyond what our September 21 briefing already covered. The only substantive development in this period is the Federal Register publication above.

About This Briefing

Vantikon tracks U.S. regulatory developments that reach Taiwan manufacturers, their product lines, and their supply chains. We translate those developments into product-level preparation: identifying the affected products and versions, inventorying and organizing technical and supply-chain evidence, and defining a sensible scope of response, so that subsequent dealings with qualified advisors or regulators rest on organized facts.

We are a readiness and advisory partner — not a law firm, not a certification body, and not a testing laboratory. We do not file on your behalf and we do not render legal opinions. If this period's developments touch your product lines or your U.S. market plans, get in touch.

This briefing is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your specific circumstances.