Gatewell Group
Manufacturers

How a manufacturer proves a device is not foreign-produced under the FCC Covered List

The applicant certifies, under 47 CFR 2.911(d)(5), that the equipment is not prohibited from receiving an equipment authorization under 47 CFR 2.903, and must hold sufficient evidence behind that certification that the device was not produced in a foreign country. The Commission's guidance states that no specific documentation is required.

The Gatewell Protocol for Origin Evidence specifies what a complete file contains, where each fact comes from, how current it has to be, and what happens when it changes. Conformity is a documentation standard, not a determination by the FCC, the Department of War or Homeland Security of a device's regulatory status, and no authorization outcome follows from it.

Source: 47 CFR §§ 2.903, 2.911(d)(5); FCC Covered List FAQs, retrieved September 8, 2026.

Protocol Version 1.0, Public Comment Draft, Revision 2, September 17, 2026.
The test

What the file has to meet, by category.

The outcome standard is not in the Protocol. It sits in the Covered List entry and the determination that created it.

Advanced robotic devices. The National Security Determination of July 27, 2026 defines foreign-produced as any article that does not qualify as a “domestic end product” under 48 CFR 25.101(a): manufactured in the United States, with domestic component cost above 65 percent of total component cost for items delivered in 2024 through 2028, and 75 percent from 2029.

Power inverters. The determination as modified by DA 26-870 of August 20, 2026 sets two exits. An inverter is foreign-produced unless it is either eligible for the Advanced Manufacturing Production Credit at 26 U.S.C. 45X for domestic production, or a domestic end product under 48 CFR 25.101(a). The credit prong needs no cost computation.

COTS parts, both categories. The Commission's guidance states that the commercially available off-the-shelf exception is inapplicable to domestic-end-product status under 25.101(a), and that COTS components are still counted.

Routers and UAS. For routers the published texts give a production gloss rather than a content test. The determination of March 20, 2026 states that production “generally includes any major stage of the process through which the device is made, including manufacturing, assembly, design, and development.” On the UAS entry, domestic end product is a listed exception rather than the definition, alongside the Blue UAS Cleared List, both running to January 1, 2028.

Source: National Security Determinations of July 27, 2026 and March 20, 2026 (at 2); DA 26-870; 48 CFR § 25.101(a); 87 FR 12780; FCC Covered List FAQs, retrieved September 8, 2026; FCC Covered List, UAS entry, July 21, 2026.

The file

Building it, clause by clause.

The file is assembled in this order.

4.2

Coverage determination

Per model, against the operative definition text, with the element analysis, the conclusion and the 25.101(a) position taken.

4.3

Production provenance

Every final-assembly, subassembly, firmware-loading and test site, with its operator and step, and a signed site attestation from each.

4.4

Component origin

The Annex B.1 bill of materials, Annex C declarations one tier up for Annex D deep-trace components, design origin, the concentration summary, the sole-source register.

4.5

Corporate provenance and the screen

Ownership to the ultimate parents, five-percent beneficial owners, board and executive nationality, foreign-government arrangements stated expressly, then the Annex E screen, dated.

4.6

Software, firmware and IP

An SBOM in SPDX or CycloneDX, the IP-owning and software-update entities, software origin, build and code-signing infrastructure, a data-flow summary.

4.7

Evidence quality

Document IDs, a master index against each Part IV requirement, certified translations, the 4.7.3 age limits, ten-year retention.

4.8

Officer attestation (Level 1)

The Annex A certification signed by an officer of the manufacturer, covering the file as of its revision date, current for twelve months.

Part V

Verification (Level 2)

A qualified verifier authenticates the documents, reconciles the schedule and the corporate chain against public records, confirms supplier declarations directly, recomputes the summary, re-runs the screen, and issues the Annex F statement.

Part VI

Change control (Level 3)

Nine events require re-attestation of the affected sections within thirty days. Level 3 adds standing change control and annual re-verification.

Source: Gatewell Protocol, Version 1.0, 4.2 to 4.8, Parts III, V, VI; Annexes A to G.

Covered

If the device is foreign-produced.

A foreign-produced device can still reach the US market through a Conditional Approval, granted by the Department of War or, for some categories, Homeland Security. For power inverters and advanced robotic devices, applications must be submitted by January 1, 2028. A Conditional Approval is not an equipment authorization; it makes the device eligible to obtain one. What the application contains is at Conditional Approval.

Source: Guidance Documents for Power Inverters and Advanced Robotics Conditional Approvals, Annex A to the National Security Determinations of July 27, 2026.

Proposed

The proposed HBOM and SBOM rule.

The Third Further Notice in FCC 26-50 proposes § 2.911(d)(9) and (d)(10). The proposed (d)(9)(ii) would provide that “[t]he HBOM and SBOM shall identify all components of the device, including hardware, software, and firmware components of the device.” The proposed (d)(10) would require, for each critical component, its name and function, its producer, its production locations, and the percentage of component value attributable to each. Both are proposed, not adopted.

Annex B.1 already carries the component manufacturer and country of origin on every line and design origin on deep-trace lines, and 4.6.1 already requires an SBOM in SPDX or CycloneDX. The machine-readable schema and the CSV template are published; the crosswalk maps the file against the proposal.

Source: FCC 26-50 Third Further Notice of Proposed Rulemaking, 91 FR 51139 (August 7, 2026), proposed §§ 2.911(d)(9), (d)(10), at 51144; Protocol 4.6.1, Annex B.1.

Questions manufacturers ask

What counts as sufficient evidence?

The Commission does not say. Its guidance states that an applicant must have sufficient evidence that the device was not produced in a foreign country, and that no specific documentation is required. Part IV of the Protocol specifies a complete file for that certification. Whether a given file suffices in a given case remains the Commission's judgment.

Source: FCC Covered List FAQs, retrieved September 8, 2026; Protocol Part IV.

Do COTS components count?

Yes. The Commission's guidance states that COTS components are still counted toward whether a device is foreign-produced, and that the off-the-shelf exception is inapplicable to domestic-end-product status under 25.101(a).

Source: FCC Covered List FAQs, retrieved September 8, 2026; Protocol 4.2.3.

How old can evidence be?

From document date to the file's revision date: twelve months for registry extracts and standing certificates, five-percent ownership statements, site attestations and deep-trace Annex C declarations; twelve months for the Annex E screen, which re-runs on any Part VI trigger; twenty-four months for photographic and production-flow evidence. The SBOM matches the shipping build, and the concentration summary and sole-source register are recomputed at each revision.

Source: Protocol 4.7.3.

What must a supplier declaration say?

Annex C names the declaring supplier and its country, the part numbers covered, the production sites by name, city and country, the site operator where that differs, and a verification contact. The declarant certifies that the parts are produced at those sites, that it will notify the recipient within thirty days of any change of site, and that the declaration may be relied upon. One in another language needs a certified translation.

Source: Protocol Annex C; 4.7.2.

Who signs the attestation?

An officer, which Part II defines as a person with authority to bind the attesting entity and knowledge of, or verified reports covering, the facts attested. For a file supporting a Conditional Approval submission, an authorized corporate officer within the meaning of the July 27, 2026 guidance. Annex A is executed per file revision.

Source: Protocol Part II and Annex A; Conditional Approval guidance, July 27, 2026.

What changes force a re-attestation?

Nine, each within thirty days: a new, changed or discontinued production, assembly, testing or firmware-loading site; a change of contract manufacturer or ODM; a sourcing change on a deep-trace component; a change in the corporate chain or five-percent ownership; a change in board or executive leadership; a new, changed or terminated foreign-government arrangement; a change of the entity responsible for IP or software updates; a sole-source supplier becoming unavailable; any Covered List addition or guidance change touching the file.

Source: Protocol Part VI.

Can we verify our own file?

At Level 1, yes, because Level 1 is self-declared on the Annex A attestation. Level 2 requires a qualified verifier, which Part II defines as a party competent in supply-chain documentation and the Covered List regime, independent in judgment, who runs the Part V methodology and discloses any assistance it gave in assembling the file.

Source: Protocol Parts II, III and V; Annexes A and F.

Start the file.

Working forms and the standard

Annex A attestationAnnex B templateAnnex C declarationVersion 1.0, full text

To have the file assembled and taken to a verifier, request a diagnostic.

Request a Diagnostic