FCC Expands its Covered List to Include Foreign-Produced Routers
On March 23, 2026, the Federal Communications Commission (“FCC”) announced the addition of routers produced in foreign countries to the FCC's Covered List, based on a recent National Security Determination (the “Determination”). This action includes routers that are manufactured, assembled, designed, or developed in foreign countries.
As with any equipment on the Covered List, the FCC will not issue new equipment authorizations for covered routers, which will stop new imports, marketing, and sales of foreign-produced routers in the United States, absent a conditional approval granted by the Department of War (“DoW”) or the Department of Homeland Security (“DHS”). The action follows the FCC’s December 2025 addition of foreign-produced uncrewed aircraft systems (“UAS”) and UAS critical components to the Covered List,1 and represents a continued expansion of the category-wide, place-of-production-based approach to Covered List restrictions first seen in that earlier action.
Background
For purposes of the listing, the term “routers” is defined by reference to NIST Internal Report 8425A as consumer-grade networking devices primarily intended for residential use that can be installed by the customer. The Determination identifies routers as “core components” necessary to both the nation's defense and economy. According to the Determination, a majority of routers currently in American homes and businesses are manufactured in foreign countries, and ninety-six percent of Americans use the internet, with routers serving as a primary means of access. The Determination further states that malicious state and non-state-sponsored cyber attackers have increasingly leveraged vulnerabilities in small and home office routers produced abroad to carry out direct attacks against American civilians, including through the Volt, Flax, and Salt Typhoon cyberattacks, which targeted critical American communications, energy, transportation, and water infrastructure. Citing reports from the Cybersecurity and Infrastructure Security Agency, the FBI, the Cyber National Mission Force and the National Security Agency, the Determination notes that compromised foreign-produced routers have been used to create botnets enabling distributed denial-of-service attacks. Additionally, in October 2024, Microsoft publicly disclosed that cyber actors had exploited vulnerabilities in foreign-produced routers for more than a year to conduct extensive password spray attacks against government agencies, NGOs, think tanks, law firms, energy firms, and defense industrial base entities in North America and Europe.
Based on these findings, an Executive Branch interagency body determined that routers produced in a foreign country, regardless of the nationality of the producer, pose two categories of unacceptable risk: (1) introducing a supply chain vulnerability that could disrupt the US economy, critical infrastructure, and national defense; and (2) establishing a severe cybersecurity risk that could be leveraged to immediately and severely disrupt US critical infrastructure and directly harm US persons. Thus, pursuant to the Secure and Trusted Communications Networks Act of 2019, the FCC's Public Safety and Homeland Security Bureau updated the Covered List to include “Routers produced in a foreign country, except routers which have been granted a Conditional Approval by DoW or DHS.” Subject to the exceptions discussed below, pursuant to the FCC’s rules implementing the Secure Equipment Act of 2021, the FCC will not provide certifications for the devices included on the Covered List.
Conditional Approval Process and Business Impacts
Unlike the initial UAS National Security Determination, the router Determination was released alongside detailed guidance for obtaining “Conditional Approvals” (set forth in Annex A to the Determination). This guidance requires applicants to submit extensive information across several categories, including corporate structure and beneficial ownership, manufacturing, and supply chain disclosure (with a detailed bill of materials and country-of-origin analysis), and a detailed, time-bound US manufacturing and onshoring plan, on which updates must be provided quarterly. Conditional Approvals will be granted for periods of up to 18 months. In laying out an application process at the outset for exceptions, this Determination provides more clarity up-front than the UAS conditional approval process, which was initially undefined. As of March 18, 2026, several UAS devices and components have been granted Conditional Approvals through the end of 2026.
The business impacts of the router listing are likely to be significant. Because a majority of the routers in American homes and businesses are currently produced outside the United States, the restriction will affect a wide cross-section of the consumer electronics and networking industry. Companies seeking new FCC authorizations to sell foreign-produced routers in the United States will need to apply for Conditional Approvals, which require not only comprehensive supply chain disclosures but also a commitment to establishing or expanding US-based manufacturing, thereby conditioning continued market access on an onshoring plan.2 Note that the addition of foreign-produced routers to the Covered List does not restrict the import or sale of previously authorized foreign-produced routers—however, firmware and software updates to ensure the continued functionality of these previously authorized routers are currently only authorized through March 1, 2027 as a result of a time-limited waiver issued simultaneously with the additions to the Covered List
Key Takeaways
The router listing reinforces the trend, first established by the UAS action, of using the FCC's Covered List process to restrict entire categories of foreign-produced equipment defined by place of production rather than by specific company. Notably, like the UAS Determination, the router Determination does not reference “countries of concern” or “foreign adversaries”: all foreign-produced routers are treated alike. This continued reliance on a White House–convened interagency body, rather than Team Telecom, the FASC, or direct congressional action, is another example of rapid, broad-based supply-chain restrictions driven from the highest levels of the Executive Branch. Manufacturers of communications-related technology products, and the companies that rely on them, should continue to prepare for the possibility of additional, sweeping restrictions on other categories of foreign-produced equipment.
1 See Mayer Brown’s discussion about this FCC action in our Legal Update, Foreign-Produced UAS and Critical Components Added to FCC’s Covered List.
