On 27 October 2026 the FCC's Public Safety and Homeland Security Bureau released DA 26-1162, a public notice in PS Docket No. 23-239. It seeks comment on label design, certification renewal and post-market surveillance for the U.S. Cyber Trust Mark. The next day, Nextgov reported that Commissioner Olivia Trusty, assigned by Chairman Brendan Carr to oversee implementation, hopes labeled products reach shoppers within a year.
The Commission is working on the rules for policing a label before any product carries it. The program is easy to defend. It is also being built in an order that deserves scrutiny.
The case for the label
The strongest argument for the Cyber Trust Mark is a real market failure. A buyer cannot inspect a baby monitor's update policy on the shelf. The FCC's notice says the program exists to help consumers "compare the risks of the products they bring into their homes." It adds that nearly half of American homes have at least one smart home device, and that households with smart devices report 4.8 connected devices on average. Those figures come from third-party research the FCC cites, not from the agency itself. Trusty's framing was that a parent should not have to "become a cybersecurity expert before selecting a baby monitor."
The label design is also modest. Under the March 2024 Report and Order (FCC 24-26), the FCC adopted a "voluntary cybersecurity labeling program." It uses a single binary mark plus a QR code that links to security information. The notice itself stresses that the mark is a voluntary consumer program, distinct from the mandatory equipment-authorization process. Voluntary disclosure of this kind is a proportionate tool. It informs buyers and does not ban products.
The sequencing problem
Voluntary schemes only work if a label is credible, and credibility has to be built before launch. The record shows the opposite order.
The 2024 order set a path to labeled products. In January 2025, then-White House cyber official Anne Neuberger said officials expected labeled products on shelves that year, according to Nextgov. That did not happen. UL Solutions, the original lead administrator, withdrew in December 2025 after a national security review of its alleged China ties. Wiley's summary places the withdrawal in December 2025. Nextgov reported on 13 April 2026 that the FCC picked ioXt Alliance to replace UL as lead administrator.
The notice also shows how old some of the groundwork is. The recommendations on label requirements and on renewal and market surveillance were submitted by UL, the lead administrator at the time, on 13 June 2025. The Bureau is only now putting them out for public comment, about 16 months later.
The core remains unfinished. Renee Roland of the FCC's Public Safety and Homeland Security Bureau told the Nextgov event that the FCC must finish technical requirements and testing procedures, then accredit the organizations that will test and certify devices. Wiley reports that ioXt released technical standards and test procedures on 26 October and that a second public notice on them will follow. The product registry and consumer education effort are still in progress, according to ioXt's Grace Burkard.
So the Commission has opened a docket on how to audit products carrying a label whose underlying standard has not been formally adopted. Comments on the October notice are due 30 days after Federal Register publication, with replies at 45 days. Those periods had not started when this article was written.
What the surveillance proposals add
The notice's surveillance questions are where the compliance burden will land. Under the 2024 order, certification bodies must do post-market surveillance under ISO/IEC 17065, including testing samples from production or the open market. Wiley reports that the notice proposes a three-year renewal cycle. It also asks whether surveillance test plans should be available to the Lead Administrator and the Bureau on request, whether label administrators should publish their fees, and how ad hoc evaluations after reported cyber incidents should work.
Post-sale checks are the right idea in principle. A label that is never audited becomes marketing. But they raise costs for a voluntary program, and the biggest costs fall on small manufacturers. A large vendor can absorb sample testing and renewal paperwork every three years. A startup selling a niche sensor cannot do so as easily. If fees and re-testing make the mark too expensive, it will cover only the firms that already invest in security. The mark would then signal little about the long tail of cheap devices, where the worst failures tend to happen.
The notice also floats asking vendors to state whether they maintain hardware and software bills of materials. Disclosure of that kind is cheap for the vendor and useful to buyers. It is a better model than prescriptive design mandates.
A proportionate path forward
Four principles would keep the program credible without making it a burden:
- Finish the standard before the audit regime. Adopt the technical requirements and accredit test bodies first, so surveillance rules have something concrete to enforce.
- Scale obligations to risk. Renewal intervals and sampling rates should be lighter for low-risk device classes than for cameras and baby monitors.
- Publish fees and test plans. Transparency about what certification costs and how audits work lets small firms plan.
- Keep it voluntary. The FCC has said the mark is voluntary. Retailer or procurement pressure that makes it de facto mandatory should be raised in the docket, not assumed away.
Trusty's one-year goal is plausible only if the technical rules and lab accreditation move quickly. The FCC's own notice says the Cyber Trust Mark depends on the label "retaining its integrity as a trusted consumer resource." That integrity comes from a finished standard and affordable, predictable audits. A thorough surveillance regime cannot replace those.