FCC Moves to Implement IoT Labeling Cyber Trust Mark Program and Seeks Public Comment

October 30, 2026

This week, the Federal Communications Commission (FCC) renewed its focus on the U.S. Cyber Trust Mark Internet of Things (IoT) labeling program, which was first kicked off in 2023. The voluntary program is intended to offer a way for consumer IoT product manufacturers to display a label indicating that they meet the program’s cybersecurity requirements. On October 27, 2026, the FCC issued a Public Notice seeking comment on implementation of the Cyber Trust Mark program. This latest notice, along with the announcement that Commissioner Olivia Trusty will lead program implementation for the FCC, resolves months of uncertainty around the future of the program and provides a clear path to getting labels on products. Companies that make, buy, or sell consumer IoT products should consider providing feedback to the FCC on this Public Notice. Comments will be due 30 days after the Notice is published in the Federal Register, and reply comments 45 days after Federal Register publication.

Key Takeaways

• The FCC is moving forward to implement the IoT labeling program, and Commissioner Trusty has set a goal of getting labels onto products in 2027.
• Manufacturers and sellers of consumer IoT products will need to weigh the benefits of participating in the program against risks of making representations about the security of their products. The FCC has suggested that products bearing the Cyber Trust Mark will have an advantage in the marketplace. However, the FCC declined to preempt state law or implement a “safe harbor” for program participants, so potential litigation risks based on products liability and/or cybersecurity incident theories remain.
• Other key details about the program, including the proposed security controls needed to obtain the Cyber Trust Mark, testing methods for verifying those controls, and the public registry of products that use the Cyber Trust Mark, remain to be worked out.
• The Public Notice provides an opportunity for industry and the public to provide feedback on the specific program components, including the design and substance of the label, and how use of the label will be administered and policed.

Background

The Cyber Trust Mark program dates to the Biden Administration, which announced the program in July 2023. The FCC built out the framework of the program through a March 2024 Report and Order, establishing a tiered administrative program with the FCC overseeing multiple “Cybersecurity Label Administrators” (CLAs), with one CLA appointed “Lead Administrator” responsible for developing specific standards and testing procedures, as well as a network of testing laboratories. The rules establishing the program became effective in August 2024.

Following the withdrawal of the initial Lead Administrator (UL) in December 2025 (stemming in part from Chairman Carr’s concerns about the organization’s ties to China), the FCC named a new Lead Administrator (the ioXt Alliance) in April 2026.

Scope

Under the rules finalized in 2024, the Cyber Trust Mark program is available for “consumer IoT products,” which are defined as those “intended primarily for consumer use, rather than enterprise or industrial use,” and excluding medical devices regulated by the U.S. Food and Drug Administration (FDA), as well as motor vehicles and motor vehicle equipment regulated by the National Highway Traffic Safety Administration (NHTSA). 47 CFR 8.203(b). “Consumer IoT product” is defined as an “IoT device and any additional product components (e.g., backend, gateway, mobile app) that are necessary to use the IoT device beyond basic operational features, including data communications links to components outside this scope but excluding those external components and any external third-party components that are outside the manufacturer's control.” 47 CFR 8.203(j). And an IoT device, in turn, is defined to mean any “internet-connected device capable of intentionally emitting radiofrequency energy that has at least one transducer (sensor or actuator) for interacting directly with the physical world; coupled with … At least one network interface (e.g., Wi-Fi, Bluetooth) for interfacing with the digital world.” 47 CFR 8.203(i). However, consumer IoT products that are on the FCC’s Covered List, products containing devices or product components produced by any entity, its affiliates, or subsidiaries identified on the Covered List as producing covered equipment, or by entities, affiliates, or subsidiaries identified as a Chinese Military Company by the Department of War, or “produced by any entity owned or controlled by or affiliated with any person or entity that has been suspended or debarred from receiving Federal procurements or financial awards” are ineligible to obtain the Cyber Trust Mark. 47 CFR 8.204.

Opportunity to Provide Feedback on Implementation Details

This Public Notice now seeks comment on the specifics of the Cyber Trust Mark, including the proposed labeling standard, post-market surveillance plans, certification applications and renewals, and compliance and enforcement procedures. Below, we summarize the Public Notice and what industry can expect to come next.

Design and Placement of the Label. The FCC seeks comment on detailed recommendations concerning the design and display of the FCC IoT Label, including how and where the label should appear on products and packaging.

• The FCC is proposing to adopt recommendations from the previous Lead Administrator on the design and size of the label, as well as methods of using a QR code to provide access to a digital version of the label. One notable issue is the proposed inclusion of a requirement that a participating vendor state on the label whether it maintains a Hardware and Software Bill of Materials. ¶ 18.

A sample set of labels showing “Level 1” and a proposed supplemental “Level 2” is depicted below:

• The FCC also seeks comment on alternative label display options (such as accessibility devices). ¶ 26.

Obtaining and Keeping Authorization to Use the Label. The FCC seeks comment on how manufacturers will obtain and renew their certifications to use the label. Among other things, the FCC proposes:

• To have CLAs collect certain initial identifying information from manufacturers, while allowing CLAs to use existing (or develop new) electronic application formats and processes, rather than mandating a single application format. ¶¶ 28-29.
• To require a renewal process for products every three years, so that manufacturers would submit renewal applications to a CLA that identify changes to the product since last authorized. ¶ 30.
• A five-step renewal process for CLAs that includes evaluating the product against any new or revised Cyber Trust Mark program requirements, a reevaluation of the product against program requirements, validating an active certification for each backend component, conducting audits of required security documentation, and confirming that the manufacturer has personnel with the required certifications. ¶ 30.
• As part of that process, the Lead Administrator had recommended the development of a Cyber Trust Mark “Qualified Professional” position for manufacturer staff that would include obtaining qualifications associated with knowledge of the program. The FCC supports the recommendation and seeks comment on the logistics of such a certification. ¶

Post-Market Surveillance and Administration. The Public Notice seeks comment on post-market surveillance activities that would have CLAs sample products already on the market using the label to assure compliance.

• The FCC is proposing to adopt the UL-proposed requirements, including that CLAs must have surveillance test plans and provide them to the Lead Administrator and the Public Safety and Homeland Security Bureau upon request, ¶¶ 40-41, and seeks detailed comments about sampling methods and evaluation procedures that CLAs should use. ¶¶ 43-47.
• The FCC also asks about fee issues, including whether CLAs should have to make public the fees they charge to manufacturers, and whether there are enough CLAs to ensure sufficient competition to avoid “onerous fees” on manufacturers. ¶ 53.

Compliance and Enforcement. The FCC is seeking comment on procedures to apply when a product’s use of the label expires or is revoked for failure to comply with the program procedures. ¶¶ 51-52. Notably, this includes a proposal for the FCC to direct CLAs to initiate “ad hoc” surveillance evaluations, such as in response to reported cyber incidents, with accompanying post-incident audit reports from the Lead Administrator. ¶¶ 54-56.

What to Expect Next

In addition to the labeling and post-market surveillance issues discussed in this Public Notice, the FCC also plans to seek public comment on the technical standards and test procedures for the program, which Lead Administrator ioXt Alliance released on October 26. The FCC will issue a second Public Notice seeking comment on those controls and evaluation methods. 

***

Please contact the authors with questions about the Public Notice, the Cyber Trust Mark program and its interaction with current equipment authorization regulations, or how to advocate for your company’s interests as the program becomes a reality.