FCC equipment authorization rules to mandate hardware and software transparency

These proposed mandates represent a significant shift toward deep-tier supply chain accountability for streaming hardware and IoT infrastructure. By requiring granular HBOM and SBOM disclosures, the FCC is moving beyond finished-product oversight to regulate individual semiconductors and optical transceivers. For the streaming ecosystem, this could force a rapid decoupling from cost-effective but restricted component suppliers to maintain access to the U.S. market. The inclusion of software and firmware in these prohibitions suggests a broader definition of national security risks that encompasses the entire technology stack. Industry observers should monitor the September 21 reply comment deadline for pushback from manufacturers regarding the feasibility of real-time HBOM updates.

The FCC's push to mandate HBOM and SBOM disclosures builds on a multi-year effort to tighten supply chain controls around equipment from entities on the Covered List, which includes Huawei and other Chinese vendors. In March 2025, the FCC designated all equipment authorized under its certification process as subject to heightened national security review, expanding the scope of its 2022 rules that had previously banned new authorizations for Huawei, ZTE, Hytera, Hikvision, and Dahua equipment. The agency's latest proposal goes further by targeting individual components rather than finished products, meaning a streaming set-top box or IoT gateway manufactured by a non-restricted company could still fail certification if it contains a single semiconductor or firmware module sourced from a Covered List entity.

Huawei remains the primary target of these escalating restrictions, and the company's continued presence in global telecom infrastructure makes the FCC's component-level approach particularly consequential. In June 2026, the U.S. Commerce Department's Bureau of Industry and Security extended export control restrictions on advanced semiconductors destined for Huawei's HiSilicon subsidiary, reinforcing the broader government strategy of constraining Huawei's access to cutting-edge components. The FCC's proposed HBOM requirement would complement these export controls by creating a domestic enforcement mechanism: even if a restricted chip reaches a device through indirect supply chains, the Bill of Materials disclosure would surface it during the equipment authorization process.

The technical implementation of mandatory HBOM and SBOM filings poses significant challenges for device manufacturers serving the streaming and broadband markets. The Cybersecurity and Infrastructure Security Agency published updated SBOM minimum elements guidance in April 2026, specifying that software bills must include supplier name, component name, version string, and dependency relationships for every software element in a product. For streaming hardware vendors that integrate dozens of third-party SDKs, codec libraries, and firmware modules, meeting this granularity standard within the FCC's proposed timeline will require automated tooling and continuous monitoring. The September 21 reply comment deadline will likely draw opposition from smaller manufacturers who lack the supply chain visibility infrastructure that larger vendors like Arris, CommScope, and Sagemcom have already invested in for federal procurement contracts.