What happened
The U.S. Federal Communications Commission is reportedly drafting a proposal to add Chinese-made optical transceivers to its Covered List, a designation that would effectively bar new models of the modules from the U.S. market. Transceivers are the small pluggable components that move data between servers inside AI data centers, and Chinese vendors account for the majority of global contract manufacturing capacity, with three suppliers alone representing nearly 46 percent of capacity.
The draft, reported by Reuters, has not been released. No named proceeding, comment deadline, or final product scope has been published, and open questions remain about how the commission would define a new model, what qualifies a manufacturer as Chinese, and whether importers would get a transition period. The FCC said in October that its rules had not applied to a device's component parts, but Chairman Brendan Carr warned that gap could serve as a loophole. A July 23 directive already prohibits authorization of logic-bearing hardware components produced by Covered List entities, and pluggable optical modules carry microcontrollers, memory, and vendor firmware that reports diagnostics to the host switch, placing them in that category.
The move fits a broader pattern. The FCC adopted rules in May 2025 barring test labs owned by foreign adversary governments from its equipment authorization program, and has begun proceedings to withdraw recognition from seven labs owned or controlled by the Chinese government. Nearly three-quarters of FCC-recognized device testing previously happened in China.
Why this is a GRC story
For anyone running infrastructure, this is a third-party and supply chain risk story with a compliance clock on it. The Covered List is not a procurement preference, it is a legal boundary, and it has been expanding all year, from consumer routers to logic-bearing components. If optical transceivers join it, hardware vendors selling into the U.S. will need to demonstrate their supply chains do not depend on the listed suppliers, and that means attestation, documentation, and re-certification work downstream.
The second layer is the certification squeeze. With most testing capacity located in China and the FCC narrowing who may perform authorization testing, getting new hardware approved becomes slower and more expensive. That is a constraint that lands on procurement timelines, not just compliance paperwork.
Critics note that vulnerabilities in edge hardware are often a function of weak patching and end-of-life equipment rather than manufacturer location. That is a fair point, and it is worth holding in mind. Regulatory supply chain action and good operational hygiene are not the same thing.
What to watch
Watch for the actual proposal, the definition of new model, and any transition period. In the meantime, enterprises running AI infrastructure should map where their optical transceivers and similar logic-bearing components come from, and check whether their vendors can trace theirs. The companies that know their supply chain today will have a much easier conversation with their hardware partners if the list expands tomorrow.
Attribution: Analysis based on DataBreachToday reporting and related public FCC actions. This article is original commentary, not a repost of the source material.