The FCC has extended the deadline for prohibiting firmware updates on foreign-made drones and routers, moving the ban from March 1, 2027 to January 1, 2029.

In tandem, the agency pushed the window for software and firmware updates to mitigate harm from these devices to January 1, 2029, extending the previous cutoff by about two years.

Experts anticipate supply chains and manufacturers will pursue localization strategies in response to ongoing cybersecurity concerns and regulatory changes.

Lobbying by the Consumer Technology Association helped shape the decision, with the CTA advocating for longer update windows and clearer guidance for affected products.

The Volt Typhoon advanced persistent threat is cited as an example of how compromised hardware can enable data theft and command-and-control capabilities.

Drones and routers made in China comprise a large share of U.S. availability—roughly 80% of drones and 60% of routers—underscoring the potential scope of impact.

The policy aims to reduce espionage, unauthorized surveillance, and data exfiltration risks linked to backdoor exploits in drones and routers.

The extension is justified on special circumstances and public interest grounds, arguing that continued updates protect U.S. consumers even with the bans in place.

The extension covers uncrewed aircraft systems (drones) and drone components added to the FCC’s Covered List of national security concerns in December 2025, as well as routers manufactured abroad later included on the list.

The CTA requested extending the update window beyond one year and sought clarification on affected products, while urging closer collaboration with the NSC and the DoD to improve transparency for manufacturers.

Industry stakeholders, led by the CTA, pressed for clarification and leniency, contributing to the two-year extension.

The FCC announced the extension on May 8, 2026 through the Office of Engineering and Technology, granting nearly two additional years before updates are banned.