Tomorrow, October 13, 2026, the FCC’s Third Report and Order in ET Docket No. 21-232 (FCC 26-50) takes effect. The Commission adopted it on July 22 and released it on July 23, and the summary was published in the Federal Register on September 11.
It’s the latest step in a long run of FCC actions aimed at Chinese-made communications and surveillance gear, and it lands on top of a June public notice that already restricted importing and marketing older Hikvision and Dahua models. If you buy, sell, install or maintain IP cameras in the U.S., two parts of it matter: a new rule on components, and a new definition of critical infrastructure.
I’m not a lawyer, and nothing here is legal advice. This is how I read the orders as an integrator, and what I’m telling clients who ask “can I keep my cameras?”
The short version
- Cameras you already own and legally bought can keep running. Nothing in the June notice or in FCC 26-50 orders anyone to rip out installed equipment.
- New models from Covered List companies are largely done. Since November 2022 the FCC hasn’t authorized new equipment within the scope of each company’s Covered List entry. For Hikvision, Dahua and Hytera that scope is use-based (more on that below), but in practice the supply of new models has dried up.
- Older, previously authorized models are now restricted too. The June 26 public notice (DA 26-635) prohibits continued importation and marketing of previously authorized covered equipment from companies added to the Covered List in 2024 or earlier.
- Starting October 13, the “it’s a different brand on the box” route gets narrower. FCC 26-50 blocks authorization of devices built around logic-bearing parts from Covered List companies, where the device would be barred had that company made it.
The diagram above is the decision tree I use when a client hands me a spec sheet or an existing system.
What changes on October 13: components
Until now, the Covered List rules mostly looked at who made the finished device. FCC 26-50 closes what the Commission calls the component part loophole. In the Commission’s words, it prohibits the authorization of logic-bearing hardware components produced by entities identified on the Covered List, and of any device that incorporates such a component where the device would be prohibited had the Covered List entity produced the device itself.
A few details from the compliance write-ups that matter in practice:
- Existing grants aren’t affected. A device that already has its FCC authorization doesn’t lose it on October 13 because of this rule.
- Applications pending on October 13 are exempt, unless they’re later amended to add, swap or change a logic-bearing component.
- Covered List companies need full recertification before making modifications or permissive changes to their authorized equipment.
For camera buyers, the practical effect is on future products. A camera or NVR whose system-on-chip or other logic-bearing part comes from a Covered List company shouldn’t be getting new FCC authorizations where the camera would be barred had that company built it, even if the name on the housing is different.
What changes on October 13: “critical infrastructure”
This is the part that matters most for the camera makers on the list. Hikvision, Dahua and Hytera aren’t covered for every use. The FCC’s Covered List entry for Hikvision, for example, applies “to the extent it is used for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.”
That made the definition of critical infrastructure the whole ballgame, and Hikvision took it to court. In Hikvision USA, Inc. v. FCC, the D.C. Circuit sent the definition back to the Commission. FCC 26-50 amends Section 1.50001(f) to use the definition from Section 1016(e) of the Patriot Act, and drops the “connected to” language from the earlier version. Wiley’s summary describes it as matching the Patriot Act definition without expanding its scope.
The June public notice had already said that once the Commission adopted a critical infrastructure definition, importing and marketing covered equipment for security surveillance of critical infrastructure would be prohibited on that order’s effective date. FCC 26-50 is that order, which is why October 13 shows up in so many compliance write-ups as the day that piece kicks in.
What does that mean for a site here? If a client operates something that plausibly falls under the Patriot Act definition (a utility, a water or wastewater system, a communications facility), I’d treat Hikvision and Dahua as off the table for that site, full stop, and I’d let their counsel decide the edge cases. For everyone else, the use-based limit still exists on paper, but the supply side is drying up fast enough that it doesn’t change my recommendation.
Online marketplaces come later
FCC 26-50 also requires online marketplaces to show a device’s FCC ID at the point of sale, with limited exceptions. Those duties don’t start October 13. The compliance summaries put them at March 1, 2027 for marketplaces with physical access to or title over the device, and June 1, 2027 for marketplaces that rely on third-party sellers’ information.
That’s good news for anyone who has watched clients buy “4K PoE camera, works with Hik-Connect” listings online. Once the FCC ID has to be on the listing, it gets much easier to check what you’re actually buying.
What I tell clients
Here’s the practical advice, in the order I’d do it:
- Inventory what you have. Manufacturer, model, firmware, where it’s mounted, and what it’s recording. Record the real manufacturer, not just the label. Rebranded hardware is common in this market, and the web UI, firmware file names or the mobile app it pairs with usually give it away.
- Don’t panic-replace working cameras. Continued use of legally purchased equipment with an existing authorization isn’t prohibited. Budget a replacement on a normal lifecycle instead.
- Treat covered gear as unsupported, from a security standpoint. Isolate it on its own VLAN with no internet access, block cloud P2P services, and access it only through the VMS or a VPN. GreyNoise reported a burst of exploitation attempts against CVE-2021-36260, an old Hikvision command-injection flaw, between September 21 and October 1, 2026. That bug has been in CISA’s Known Exploited Vulnerabilities catalog since January 2022 and is still being thrown at cameras.
- Buy from the replacement side of the market. For new work I spec cameras and NVRs that don’t come from Covered List companies or depend on their parts, and I ask vendors for NDAA Section 889 statements in writing.
- If you might be critical infrastructure, ask your counsel now, not when the next camera fails.
A quick inventory check
Most of my camera inventories end up in a CSV exported from the VMS or a network scan. This short Python script flags rows whose manufacturer matches a Covered List camera or telecom company. It’s a first pass, not a compliance determination, and the name list is something you should keep current from the FCC’s Covered List page.
#!/usr/bin/env python3
"""Flag cameras/NVRs from Covered List companies in an inventory CSV.
Usage: python3 covered_check.py inventory.csv
CSV needs at least: site, manufacturer, model
"""
import csv
import sys
# Keep this in sync with https://www.fcc.gov/supplychain/coveredlist
COVERED = {
"hikvision": "Hikvision",
"hangzhou hikvision": "Hikvision",
"dahua": "Dahua",
"zhejiang dahua": "Dahua",
"hytera": "Hytera",
"huawei": "Huawei",
"zte": "ZTE",
}
def covered_name(manufacturer: str) -> str | None:
m = manufacturer.strip().lower()
for key, name in COVERED.items():
if m.startswith(key):
return name
return None
REQUIRED = {"site", "manufacturer", "model"}
def main(path: str) -> int:
flagged = 0
with open(path, newline="", encoding="utf-8-sig") as f:
reader = csv.DictReader(f)
missing = REQUIRED - {h.strip().lower() for h in reader.fieldnames or []}
if missing:
sys.exit(f"Missing column(s): {', '.join(sorted(missing))}")
for row in reader:
row = {k.strip().lower(): (v or "") for k, v in row.items() if k}
name = covered_name(row["manufacturer"])
if name:
flagged += 1
print(f"{row.get('site', '?'):<20} {row.get('model', '?'):<24} -> {name}")
print(f"\n{flagged} device(s) flagged for review.")
return 1 if flagged else 0
if __name__ == "__main__":
if len(sys.argv) != 2:
sys.exit(__doc__)
sys.exit(main(sys.argv[1]))It stops with an error if the CSV is missing a required column, and it exits non-zero when anything is flagged, so you can drop it into a scheduled job that checks a fresh export each month.
📝 Note: A clean result here doesn’t mean a device is NDAA-compliant. Rebranded hardware won’t match on manufacturer name, which is why step 1 says to record the real maker.
Where this leaves North Coast buyers
For most small businesses, ranches and homeowners up here, October 13 doesn’t change what’s on the pole today. It changes what you’ll be able to buy to replace it, and it makes the cheap online listings riskier to rely on. If you’re planning a system in the next year, plan it around hardware that isn’t on the list and doesn’t depend on parts from companies that are. If you’re running covered gear now, lock it down and put its replacement in next year’s budget.
Sources
- Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program (FCC 26-50 summary), Federal Register, September 11, 2026
- FCC 26-50, Third Report and Order, FCC, adopted July 22, 2026, released July 23, 2026
- FCC Expands Covered List Prohibitions to Devices with Certain Logic-Bearing Hardware Components, Imposes Compliance Obligations on Online Marketplaces, Wiley, on the order released July 23, 2026
- US: FCC Component Ban Effective Oct 13, Marketplace IDs in 2027, Obsidian Regulatory Intelligence, September 11, 2026
- Public Notice DA 26-635, FCC Public Safety and Homeland Security Bureau, June 26, 2026
- Prohibiting Importation and Marketing of Previously Authorized Covered Communications Equipment Added to the Covered List in 2024 or Earlier, Federal Register, July 6, 2026
- List of Equipment and Services Covered by Section 2 of the Secure Networks Act, FCC, updated October 9, 2026
- Spike in attacks targeting digital video recorders in Ukraine, GreyNoise, covering activity from September 21 to October 1, 2026