A Permissive Change Should Name Its Components

I. Introduction and Summary

Gatewell Group LLC advises buyers and manufacturers on Covered List exposure. It publishes the Gatewell Protocol for Origin Evidence, an open documentation standard for the evidence file behind a not-covered certification. It sells services assembling and verifying files under that standard. Gatewell also prepares filings for manufacturers seeking equipment authorizations. It therefore has a commercial interest in what such a party is required to hold. Gatewell does not ask the Commission to adopt or endorse its standard. Nothing recommended below would require an applicant or a grantee to retain Gatewell or any other party.

These comments address one question in the Notice. Paragraph 52 asks what becomes of the certification requirements for equipment that meets the criteria for covered equipment if new authorizations and permissive changes run through part 25. That question is documentary. It asks what an applicant or a grantee must hold and produce to show that a permissive change under § 2.1043, or a new authorization under part 25, does not add covered componentry. Gatewell takes no position on the proposed allocation, on technical limits, on the licensing framework, on whether a part 25 certification should be required at all, or on the paragraph 60 question about service offerings by Covered List entities.

Gatewell asks the Commission to require a signed statement, from a grantee filing a permissive change and from an applicant seeking a new part 25 authorization of certified equipment, that the change or the equipment adds no logic-bearing hardware component produced by an entity identified on the Covered List. Gatewell further asks that the party hold, and produce on request, the records behind that statement. Appendix A sets out the proposed text. The Commission has proposed to condition hardware permissive changes to already-authorized covered equipment on a representation that the modification does not replace a U.S.-produced component with a foreign-produced component. No rule states what a party must hold to support that representation.

II. The Record in This Proceeding

Paragraph 52 has drawn no answer. As of September 18, 2026 the docket held 28 filings, of which 18 are party filings carrying a document. None of the 18 attached party documents uses the terms "Covered List," "permissive," "2.1043," "2.903," "country of origin," "attestation," or "equipment authorization." One express comment names the Covered List. No filing states what an applicant or a grantee must hold to show that a change adds no covered componentry.

Two filings come near the subject. NextNav Inc. raised foreign-produced componentry in an ex parte addressed to the lower 900 MHz band. NextNav Ex Parte at 2 (dated July 29, 2026, filed July 30, 2026). Its footnote distinguishes the certification procedure from the Supplier's Declaration of Conformity. Id. n.1. Section 2.903(c) already reaches equipment "that would otherwise be subject to Supplier's Declaration of Conformity procedures." 47 CFR § 2.903(c)(2). Steven Quinn Singleton observes that the Notice's concerns are not in its proposed rules, that "[n]o prohibition appears anywhere in Appendix A's rule text." Singleton Comments (filed Sept. 11, 2026). That comment is directed at the paragraph 60 entity-exclusion question. The same observation holds for paragraph 52.

III. The Rules Paragraph 52 Points To

> "In addition, we seek comment on how various equipment certification requirements combined with different authorization requirements and our prospective application of the certification requirements have implications for currently certified equipment that also meets the criteria for covered equipment on the Commission's Covered List as such equipment is not eligible for new certifications or permissive changes."

Unleashing Unlicensed Spectrum for Direct-to-Device, ET Docket No. 26-169, Notice of Proposed Rulemaking, FCC 26-51, ¶ 52 (rel. Aug. 7, 2026) (Notice). If a part 25 certification were required, "we propose that it would be applied only to new equipment authorizations or authorizations being updated through the permissive change process." Id. The footnote cites "47 CFR §§ 2.903, 2.1043." Id. n.112.

Nothing in the proposed rules answers it. The Notice's Appendix A proposes one amendment, a footnote to the Table of Frequency Allocations. No proposed rule text reaches certification, permissive changes, § 2.903, § 2.1043, or the Covered List.

The two rules the footnote cites already prohibit the change. Section 2.1043(b) allows three classes of permissive change "[e]xcept for equipment prohibited from authorization pursuant to § 2.903," 47 CFR § 2.1043(b), and § 2.903(b) extends the prohibition, providing that "[a]ll equipment that incorporates equipment meeting the descriptions in paragraph (a)(1) or (2) of this section is prohibited from obtaining an equipment authorization under this subpart." 47 CFR § 2.903(b). The Commission revised §§ 2.932 and 2.1043(b) to reach equipment that would become prohibited under § 2.903 as a result of the change. Protecting Against National Security Threats to the Communications Supply Chain through the Equipment Authorization Program, ET Docket No. 21-232, Third Report and Order and Third Further Notice of Proposed Rulemaking, FCC 26-50, ¶ 80 (rel. July 23, 2026) (EA Security Third R&O).

The prohibition therefore turns on who produces the equipment. The Commission gave an example.

> "If a device was originally produced by Entity A, that device may not be subsequently redesigned and produced by Entity B if Entity B is a Covered List entity."

Id. ¶ 81. The class-wide waivers permitted authorized UAS, UAS critical components and Routers "to continue to receive software and firmware updates that mitigate harm to U.S. consumers." Id. ¶ 190. In September 2026 the Office of Engineering and Technology stated that "[h]ardware or other permissive changes to Covered Routers are not included in these waivers and are still prohibited under the Commission's rules." Askey Computer Corp., Petition for Expedited Waiver to Permit Targeted Class I and Class II Permissive Hardware Changes to Covered Routers, ET Docket No. 21-232, Order, DA 26-983, ¶ 3 (OET rel. Sept. 15, 2026) (Askey Order). Hardware changes have reached grantees through individual waivers granted on stated facts. The Office granted one such waiver to Askey for a period of one year. Id. ¶¶ 4, 8.

A grantee on that line has to prove a negative about its own hardware. Gatewell stated the difficulty in that docket, that "[a]n absence showing can be graded only against a defined search." Comments of Gatewell Group LLC, ET Docket No. 21-232, § V (filed Aug. 20, 2026) (Gatewell ET Comments). Section IV proposes that defined search.

IV. Recommendation

### A. The certification statement

Section 2.1043(b)(2)(i) already requires the grantee making a Class II permissive change to provide "[a] written and signed certification expressly stating that, as of the filing date, the equipment subject to the permissive change is not prohibited from receiving an equipment authorization pursuant to § 2.903," and "[a]n affirmative or negative statement as to whether the applicant is identified on the Covered List, established pursuant to § 1.50002 of this chapter, as an entity producing covered communications equipment." 47 CFR § 2.1043(b)(2)(i)(B), (C). Section 2.1043(b)(3)(i)(B) and (C) impose the same two requirements for a Class III change. Neither statement reaches the change itself. The second turns on the identity of the applicant rather than on what the change adds.

Gatewell proposes that the Commission add one item to § 2.1043(b)(2)(i) and (b)(3)(i), and require the same statement for a new authorization of equipment certified under part 25. Appendix A sets out the proposed text.

The identification required with that certification is what makes the statement reviewable. A certification that a change adds nothing covered states a conclusion. Naming the components and their producers gives the facts behind it. The list is short because a permissive change touches a defined set of parts.

### B. The records requirement, in three levels

Level one, a production-origin record for the changed components. The record adds the basis for each entry in the identification required above. A line naming a distributor or a brand answers a question the rule does not ask. Gatewell proposes that the applicant traverse to the entity that physically produced the component, regardless of how many intermediaries stand between, and document the traversal path. Gatewell further proposes that a contract manufacturer or an original design manufacturer not be treated as a terminal node for a component it sources on the applicant's behalf. The fields are ordinary bill-of-materials fields: manufacturer part number, the component manufacturer rather than the distributor, country of origin in ISO 3166 alpha-2, and the date origin was last confirmed.

Level two, independent confirmation for the classes that carry the risk. A record of unconfirmed statements moves the question one tier down without answering it. Confirmation should attach to the components whose producer controls what the device does, which Gatewell has proposed defining as "(a) any logic-bearing hardware component as defined in § 2.902; (b) any component that stores, executes, or is capable of receiving updates to firmware or software; (c) any component that provides, or is designed, equipped, or configured to accept, an external communications interface, whether wired or wireless; and (d) any component whose value equals or exceeds a stated percentage of total component cost." Gatewell ET Comments § II. Appendix A states clause (d) as a percentage of total component cost that the Commission sets. For those components the record should rest on a signed supplier declaration. Gatewell proposes that the declaration identify the declaring entity and its country, the part numbers covered, the production site or sites by name, city, and country, the site operator if it is not the declarant, and a contact for confirmation, and that it be dated and signed with the signatory's name and title. If the supplier does not answer, the grantee keeps the request and a record that no response came, and reports the component's origin as undetermined.

Level three, continuous screening against the Covered List. The existing certification is dated by its own terms, running "as of the filing date." 47 CFR § 2.1043(b)(2)(i)(B). The facts under it move. Entries are added to the Covered List. A producer's ownership or production site can change with no change to the device. The Commission has said the obligation continues, giving as an example a UAS certified because it meets the "domestic end product" definition, which "may not subsequently be modified by altering the componentry in such fashion that the modified device would not meet the 'domestic end product' definition." EA Security Third R&O ¶ 81. A grantee should screen the producers named in its record against the Covered List each time that list changes, not only when it files a change. The grantee should record the date of each screening and its result.

Appendix A states these three levels as rule text.

### C. Burden on applicants and grantees

The statement in Section A is an addition to a filing the grantee already makes, under a rule that already requires the two statements quoted above, a designated agent for service of process, and the certifications required by § 2.911(d)(7). 47 CFR § 2.1043(b)(2)(i)(B) through (E). The records in Section B are the documents behind that filing, held rather than filed. The Commission has proposed that if it permits hardware permissive changes to already-authorized covered equipment, it would condition them on representations including that "[t]he modification does not involve the replacement of a U.S.-produced component for a foreign-produced component." EA Security Third R&O ¶ 193. A party that cannot name the producer of the component it installed has no basis for that representation.

Gatewell does not propose to go past the limit the Commission set. The Commission stated in the same order that it is "not, at this time, imposing additional obligations on applicants to investigate component lineage beyond what is ordinarily required for compliance with the equipment authorization rules." Id. ¶ 82. Nothing above reaches below the changed component; it asks for the producer of the part the grantee installed, consistent with the Notice's statement that "the Commission does not propose new mandatory reporting or recordkeeping requirements for small entities." Notice, Appx. B ¶ 9. Retention should run with the records the grantee already keeps under § 2.938, which for certified equipment are held "for a one year period after the marketing of the associated equipment has been permanently discontinued." 47 CFR § 2.938(f).

V. Conclusion

Paragraph 52 asks how the certification rules apply when new authorizations and permissive changes run through part 25. The Notice's Appendix A proposes no text on that question. The rule already prohibits a change that would make equipment covered. The rules do not say what evidence supports a grantee's representation that a change does not.

Gatewell asks the Commission, in the rules adopted here or in the certification form, to require a signed statement from a grantee filing a permissive change and from an applicant seeking a new part 25 authorization of certified equipment, stating that the change or the equipment adds no logic-bearing hardware component produced by an entity identified on the Covered List, naming each added or substituted component and its producer by legal name and country of production. Gatewell further asks that the party be required to hold, and produce on request, the production-origin record, the independent confirmation, and the dated Covered List screening set out in the recommendation and in Appendix A.

Appendix A. Proposed Rule Text

Gatewell proposes the amendments set out below.

1. Section 2.1043 is amended by adding paragraph (b)(2)(i)(F) to read as follows:

> (F) A written and signed certification, filed with the application for the permissive change, stating:
>
> (1) That the change does not add to the equipment any logic-bearing hardware component produced by an entity identified on the Covered List, or any component that would otherwise render the equipment prohibited under § 2.903, and does not transfer production of the equipment or of any component to a producer that would render the equipment prohibited under § 2.903; and
>
> (2) An identification, by manufacturer part number, of each component added, removed, or substituted by the change, and, for each component added or substituted, the legal name of the entity that produced it and the country or countries of production.

2. Section 2.1043 is amended by adding a new paragraph at the end of paragraph (b)(3)(i), in the terms of paragraph (b)(2)(i)(F) above.

3. Section 2.938 is amended by adding a new paragraph at the end to read as follows:

> A grantee that files a certification under § 2.1043(b)(2)(i)(F), or under the paragraph added at the end of § 2.1043(b)(3)(i), shall hold the following records and shall produce them to the Commission on request:
>
> (1) A production-origin record for each component added or substituted by the change. The record shall state, for each such component, the manufacturer part number, the entity that manufactured the component rather than the distributor, the country of origin in ISO 3166 alpha-2 format, the date on which origin was last confirmed, and the path traversed to the entity that physically produced the component. A contract manufacturer or an original design manufacturer is not a terminal node for a component it sources on the grantee's behalf.
>
> (2) For each component described in paragraph (3) of this paragraph, a supplier declaration that identifies the declaring entity and its country, the part numbers covered, the production site or sites by name, city, and country, the site operator if it is not the declarant, and a contact for confirmation, and that is dated and signed with the signatory's name and title. If the supplier does not answer, the grantee shall keep the request and a record that no response came, and shall report the component's origin as undetermined.
>
> (3) Paragraph (2) of this paragraph applies to:
>
> (i) Any logic-bearing hardware component as defined in § 2.902;
>
> (ii) Any component that stores, executes, or is capable of receiving updates to firmware or software;
>
> (iii) Any component that provides, or is designed, equipped, or configured to accept, an external communications interface, whether wired or wireless; and
>
> (iv) Any component whose value equals or exceeds a percentage of total component cost that the Commission sets.
>
> (4) A record of each screening of the producers named under paragraph (1) of this paragraph against the Covered List. The grantee shall carry out the screening each time that list changes and shall state the date of each screening and its result.
>
> (5) The records required by this paragraph shall be retained for the period stated in paragraph (f) of this section.

4. The requirements added by instructions 1 through 3 apply only to new equipment authorizations and to authorizations being updated through the permissive change process.