On September 11, 2026, the FCC published the final rule closing the component-part loophole: effective October 13, 2026, any device that incorporates a logic-bearing hardware component produced by a Covered List entity (Hikvision, Dahua, Hytera, Huawei, or ZTE) can no longer obtain a new FCC equipment authorization. [1]
This is the third regulatory front in three years of the NDAA 889 + FCC stack: (i) November 2022, prohibition of new authorizations for Covered List equipment; (ii) July 2026 (DA 26-635), prohibition of continued importation and marketing of 2024-or-earlier authorizations [3]; (iii) October 13 2026 (FCC 26-50), closure of the component-part loophole and the modification loophole. [1] [3]
The structural change on October 13: a logic chip from Hikvision, Dahua, Hytera, Huawei, or ZTE inside a camera assembled by a non-Covered List vendor now blocks the FCC authorization of the finished product. [1] The rule also closes the modification loophole: any modification or permissive change made by a Covered List entity now requires full certification, not a simple permissive-change letter. [1]
The revised definition of critical infrastructure responds to the partial remand by the D.C. Circuit in Hikvision USA, Inc. v. FCC, 97 F.4th 938 (2024) — the panel of Judges Millett and Pan found the prior definition, covering “anything connected to” the 16 PPD-21 sectors, to be “overbroad, unexplained, and arbitrary.” [4]
For a procurement office in Mexico, Brazil, or Argentina signing an enterprise CCTV contract in Q4 2026, three clauses separate a defensible RFP from a vulnerable one:
Clause 1 — Vendor certification of absence of Covered List components. A written vendor certification that no logic-bearing component (SoC, image sensor processor, on-device AI engine) of the device was produced by Hikvision, Dahua, Hytera, Huawei, or ZTE. [1] [2] The certification must be model-specific, not brand-generic.
Clause 2 — Bill-of-materials audit with verification rights. A contractual right to require from the vendor the complete component list of the device, with the buyer’s right (or a third-party auditor hired by the buyer) to verify the supply chain at any point during the contract’s term. [1] ( per Coram’s analysis: “you don’t have to rip out every camera on day one, swap the NVR/VMS for an ONVIF-compatible platform first” — the audit clause makes that NVR-swap verifiable rather than a request loop ). [5]
Clause 3 — Modification notice + good-faith renegotiation. Any post-contract modification made by a Covered List entity to the device’s hardware or firmware triggers automatic notification to the buyer + a good-faith renegotiation window before the change takes effect. [1] This closes the modification-rule gap before the vendor exploits it.
In every RFP review I do for tv4agent, the question is no longer whether your vendor complies with NDAA Section 889. It is whether your contract demands the three structural clauses the October 13 rule makes mandatory in writing. The rule is not retroactive — equipment already purchased continues under the prior regime [3] — but any new contract or renewal in Q4 2026 falls inside the new stack. A non-Hikvision-branded camera that mounts a HiSilicon chip (Huawei subsidiary, on the Covered List since March 2021) [2] now requires your RFP to demand the certification in writing.
P.D. Does your current RFP demand the three clauses (vendor certification + bill-of-materials audit + modification notice) in writing — or does it only mention “compliance with applicable legislation” the way most do? That threshold separates a contract that learns about a Covered List component on October 14 from one that prevented it architecturally.
📰 Sources verified via grounded-citations: Federal Register Sep 11 2026 [1]; FCC Covered List Oct 2 2026 [2]; DA 26-635 Jun 26 2026 [3]; Hikvision USA, Inc. v. FCC, 97 F.4th 938 (2024) [4]; Coram competitor piece Jun 2026 [5].
Frequently asked questions
What concretely changes on October 13, 2026 for my LATAM project? The FCC ‘components’ rule (47 CFR §2.1033) takes effect on October 13 and extends the Section 889 prohibition: it’s no longer enough that the camera manufacturer is not on the list (Hikvision, Dahua, Hytera, etc.); now any critical component (processing chipset, WiFi/LTE module, AI chip) manufactured by those entities also prohibits the equipment. For a LATAM project with a US vendor, this means even if you buy Axis, if Axis uses a HiSilicon chipset from Huawei in any sub-component, your equipment can be seized.
How do I verify if my camera has a prohibited component? Three ways: (1) ask the vendor for a signed ‘Component Declaration Letter’, (2) check the FCC Equipment Authorization (EAS) database with your camera’s FCC ID, (3) physical audit — open the camera and read the chips. Option 1 is the most practical but depends on vendor honesty. Option 3 is the only infallible one. For a 50+ camera project, option 1 + sampling of option 3 on 5% of the lot is sufficient.
Does this rule apply even if my project is 100% in Mexico? Yes, if the vendor is US, if the equipment is imported with US components, or if your company’s network interconnects with a US commercial partner’s network. Extraterritorial jurisdiction applies to ‘any equipment that transmits on FCC-regulated frequencies’ — that includes WiFi and Bluetooth. If your camera has WiFi (almost all modern IP cameras), it falls under FCC jurisdiction. Your RFP must declare the end-use country and the vendor must certify that no component falls on the list.
How much does ensuring compliance with this rule cost? For a new project: $0-2K USD extra (contractual clauses + Component Declaration Letter). For an existing project: $5K-15K USD for a compliance audit + potential re-equipping. The cost of non-compliance is higher: equipment seizure by Customs and Border Protection at the US border + civil fine of $10K-100K USD per unit + reputational damage if the fine is public.
What if my camera uses a HiSilicon (Huawei) chipset as sub-component? Before October 13: the manufacturer must declare it and the equipment is prohibited. After October 13: automatic seizure at the border + fine. The typical supply chain: many ‘Axis’ or ‘Bosch’ cameras use HiSilicon chips in the video compression module (the Hi3516, Hi3519 are ubiquitous). If your vendor doesn’t deliver the Component Declaration, assume there’s something they don’t want to declare. Ask for the list, or change vendors.
What if I’m a pure LATAM retailer with no US integration? Your risk is lower but not zero. Customs and Border Protection at the MX-US border seizes equipment that crosses the border. If your company never imports equipment to the US, there’s no seizure. But if the equipment was manufactured by an entity with global operations (Hikvision with a factory in Mexico, for example), the legal presumption is that the component is ‘covered’. Your shield is: buy from a vendor with a signed declaration + keep the file for 5 years. If in 5 years the FCC asks you for proof of compliance and you don’t have it — fine.
Sources
[1] Federal Register — Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program (FCC 26-50 / FR ID 365005), Sept 11 2026. https://www.federalregister.gov/documents/2026/09/11/2026-18535/protecting-against-national-security-threats-to-the-communications-supply-chain-through-the
[2] FCC Covered List (Public Safety & Homeland Security Bureau), accessed Oct 2 2026. https://www.fcc.gov/supplychain/coveredlist
[3] DA 26-635 — Prohibit the Importation and Marketing of Previously Authorized Covered Communications Equipment Added to the Covered List in 2024 or Earlier (PSHSB + OET), Jun 26 2026. https://docs.fcc.gov/public/attachments/DA-26-635A1.pdf
[4] Hikvision USA, Inc. v. FCC, 97 F.4th 938 (D.C. Cir. 2024). https://courtlistener.com/opinion/9489897/hikvision-usa-v-fcc
[5] Coram — 11 Best Hikvision Competitors and Alternatives in 2026 (Stu Waters, Jun 24 2026). https://www.coram.ai/post/hikvision-competitors