Cybersecurity Policy Report, Waivers Granted for Hardware Changes to FCC’s ‘Covered List’ Routers, (Sep 24, 2026)

By Lynn Stanton

The FCC’s Office of Engineering and Technology (OET) has granted waivers for CTIA and, in part, USTelecom to allow their members, their members’ suppliers, and, in USTelecom’s case, manufacturers to make necessary Class I and Class II permissive hardware changes to consumer-grade routers that are on the agency’s “covered list” of equipment and services deemed a national security risk.

The USTelecom waiver also covers broadband gateways.

The FCC added foreign-produced routers, except those granted conditional approval by the Department of Defense or the Department of Homeland Security, to the covered list in March (CPR, March 24). In June, USTelecom filed a waiver request to allow targeted Class I and Class II permissive hardware changes to previously authorized covered routers and broadband gateways (CPR, June 25).

In July, CTIA filed a similar waiver request to allow necessary Class I and Class II permissive hardware changes to consumer-grade routers “to substitute memory modules and components affected by the ongoing, worldwide memory shortage and to substitute end-of-life components, including substrate, diodes, crystals, inductors, and RF filters, with available replacements,” OET recalled in one of the two orders adopted and released yesterday, FCC, Order, Dkt. 21-232 (Sept. 23, 2026).

In both orders, OET recalled that it had previously granted similar waivers to AT&T, Inc., NCTA, and Verizon Communications, Inc.

The waivers will be in effect for one year, or until Sept. 16, 2027, in the case of CTIA and until Sept. 18, 2027, in the case of USTelecom.

OET pointed to issues such as supply-chain shortages and the lack of risk to national security in granting the waivers.

“We find that granting CTIA’s waiver request meets the waiver standard because of the specific facts therein. These include unavoidable supply-chain shortages requiring Class I and Class II permissive hardware changes to consumer-grade routers, which, if not addressed, could cause significant disruptions in the availability of broadband for CTIA Members’ consumer broadband services. Moreover, this waiver does not undermine the national security and public safety purpose of the rule, given that, among other facts, the hardware changes will not improve performance or capability or alter the functionality of the previously-authorized device; will not be used to market the device as a distinct model; and will not involve swapping a U.S.-produced component for a foreign-produced component,” OET said.

“We find that partially granting USTelecom’s waiver request meets the waiver standard because of the specific facts in the waiver request. These include supply-chain constraints. USTelecom members rely on previously certified covered routers and broadband gateways to provide broadband service, and their suppliers must manage the substrate, end-of-life component, and memory supply constraints currently affecting the industry,” OET said, FCC, Order, Dkt. 21-232 (Sept. 23, 2026).

“Further, USTelecom asserts that the waiver would not apply to changes that: (i) require a new FCC ID or new equipment authorization; (ii) create a new router model or allow marketing of the modified device as a distinct model; (iii) improve performance or capability or alter the functionality of the previously authorized device; (iv) replace a U.S.-produced component with a foreign-produced component; (v) add a new transmitter, new frequency band, new RF capability, or new operating mode; (vi) alter antennas, antenna gain, antenna location, RF front-end components, power amplifiers, transmit power, frequency range, modulation type, basic frequency-determining or stabilizing circuitry, maximum power or field-strength ratings, RF exposure conditions, or other parameters defining the RF compliance envelope; or (vii) otherwise exceed what the Commission's permissive-change rules allow for previously authorized equipment. Our action is consistent with prior waiver grants we have issued for these purposes,” it added.

However, OET said it was granting USTelecom’s waiver request only with respect to “modifying or replacing substrate materials, memory modules, and discrete end-of-life components, including diodes, crystals, inductors, and comparable non-RF components, so long as they are otherwise consistent with the regulations in 47 CFR § 2.1043. We do not address any other elements of USTelecom’s petition at this time. Furthermore, the prohibitions in 47 CFR §§ 2.932(b) and 2.1043(b) remain in effect for all other hardware modifications to covered equipment.”

News: FederalLegislation DataSecurity