FCC Proposal Could Bring Drone Software and Supply Chains Under Greater Scrutiny

Active FCC rulemaking considers hardware and software disclosures that could affect agricultural and commercial drone manufacturers

A new FCC rulemaking could require drone manufacturers to disclose detailed information about the hardware and software inside their products.

The Federal Communications Commission published its Third Further Notice of Proposed Rulemaking in the Federal Register on August 7, opening the proceeding for public comment. The proposals accompany the FCC’s Third Report and Order and Third Further Notice of Proposed Rulemaking, adopted July 22 and released July 23.

For the commercial drone industry, one proposal stands out. The FCC is considering requiring equipment certification applicants to provide a Hardware Bill of Materials, or HBOM, and Software Bill of Materials, or SBOM.

Will Dawson, Director of the Agricultural Drone Initiative, highlighted the proposal in a recent analysis published by the Agricultural Drone Initiative.

“The FCC’s Third Report & Order may be this year’s most consequential, and least noticed, piece of drone regulation. Last year’s Second R&O foreshadowed the hardware clampdowns that surprised the industry this summer; the Third signals that software is next — and will likely be more disruptive.

Hardware manufacturing can be on-shored. The Federal Government has made clear that software security concerns cannot be cured by on-shoring data management, and the FCC is unlikely to deviate from that finding in future rules,” Dawson told DRONELIFE.

What the FCC Is Proposing

The Third Further Notice covers a broad range of possible changes to the FCC equipment authorization system. These include certification requirements, import restrictions, Covered List changes, enforcement procedures and supply-chain disclosures.

Dawson argues that the proposed HBOM and SBOM requirements deserve particular attention.

As he writes in the Agricultural Drone Initiative analysis, “The Third FNPRM opens twenty topics, but the one with teeth is Hardware Bill of Materials (HBOM)/ Software Bill of Materials (SBOM) disclosure: every certification applicant would submit a signed hardware and software bill of materials identifying each component’s producer, production location, and percentage of value by country, updated within 30 days of any change.”

The FCC proposal would require certification applicants to submit signed HBOM and SBOM records identifying hardware, software and firmware components. The records would identify each component’s producer and production location. For production across multiple countries, applicants would report the percentage of component value tied to each location. Grantees would have to update the information within 30 days of a change.

The FCC is seeking comment on the proposal and possible narrower alternatives. Those could limit HBOM and SBOM requirements to Covered List sectors, higher-risk products or certain components.

From Hardware to Software

The FCC is also considering whether equipment containing software or firmware produced or provided by a Covered List entity should be prohibited from receiving authorization. Alternatively, the FCC asks whether such equipment should face a presumption against authorization that an applicant could rebut.

The Commission notes that UAS and UAS critical components may rely on apps and remote platforms for configuration and updates. That raises questions about software and firmware alongside the physical origin of equipment and components.

The FCC is also seeking comment on how to define equipment “produced in a foreign country.” One proposal would consider where design and development take place, in addition to manufacturing and component sourcing.

These questions could matter for drone manufacturers using global engineering teams, third-party firmware, foreign-developed applications or imported components.

New Rules Already Adopted

Some parts of the FCC’s July action are already final.

The Third Report and Order closes what the FCC calls the “component part loophole.” It prohibits authorization of certain devices containing logic-bearing hardware components produced by entities identified on the Covered List.

The FCC also clarified that its equipment marketing rules apply to online marketplaces. Those platforms must display the FCC ID for certified devices at the online point of sale.

The action builds on earlier FCC measures involving drones. In December 2025, the agency added UAS and UAS critical components produced in foreign countries to the Covered List, subject to exemptions and Conditional Approvals.

The new proceeding could extend that framework. The FCC proposes requiring UAS, UAS critical components and routers to undergo the FCC certification process regardless of producer, including devices that might otherwise qualify for another authorization route or exemption.

It is also considering requiring every applicant or grantee for FCC-certified equipment to have a U.S.-based liable party.

Why It Matters for Commercial Drones

The proposals apply beyond agricultural drones, but agricultural UAS show how component and software requirements could affect commercial platforms.

Agricultural drones can combine flight controllers, communications equipment, navigation systems, batteries, battery management systems, motors, sensors and software. Several of these categories fall within the FCC’s definition of UAS critical components.

If adopted, HBOM and SBOM requirements would make detailed supply-chain documentation part of the FCC certification process. Restrictions involving Covered List software or firmware could also make software provenance relevant to whether equipment receives authorization.

For now, these measures remain proposals.

But as Dawson’s analysis points out, the proceeding signals that FCC scrutiny could extend deeper into drone hardware, software and firmware.

For manufacturers and suppliers, the question may no longer be only who makes the drone. Future FCC rules could also require them to document who makes the components and software inside it.

Read more:

• FCC Revokes Drone Approvals After U.S. Assembler Denies Any Connection
• DJI Warns FCC Proposal Could Restrict Widely Used Commercial Drones
• Military or Farm Tool? FCC’s Proposed Drone Categories Blur the Line