CROSS-STANDARD public interest · Wireless / IoT device

China-to-US Wireless / IoT Device Compliance Gap Matrix (FCC)

AI-compiled from official public sources — cross-checked by multiple AI models, not human-verified. Informational only; see disclaimer. Public-interest, source-linked comparison of common China Wi-Fi and Bluetooth IoT device documentation against US FCC equipment authorization (Part 15 Subpart C/E Certification), unintentional-radiator EMC (Part 15 Subpart B SDoC), electrical safety (UL 62368-1 via NRTL), FCC ID labelling and US agent requirements, and the voluntary US Cyber Trust Mark cybersecurity program.

Dataset 2026-06-11 Last verified 2026-06-12 5 rows

GAP MATRIX

Compliance Gap Matrix

Gap matrix
Compliance item Common China baseline United States (FCC) Gap / action Source + verification date
US Agent, Equipment Authorization Holder, and FCC ID Labelling (47 CFR Part 2) China requires that the CMIIT ID (Chinese model ID issued upon SRRC approval) be marked on all wireless products sold in China. For CCC-certified products, the CCC mark must appear on the product in accordance with CNCA marking requirements. China does not require a designated US-style agent for regulatory correspondence, but foreign manufacturers selling in China through an importer must ensure the importer is identified on product labelling (for CCC purposes, the importer/responsible party in China serves an analogous function as the FCC's US agent requirement). There is no Chinese equivalent to the FCC e-label rules — physical marking is the standard path. The CMIIT ID and CCC labelling requirements are China-specific and do not substitute for FCC ID marking on products intended for the US market.CMIIT ID marking requirement for wireless products (SRRC approval, MIIT)
CCC mark application rules (CNCA, China Compulsory Certification)		 Foreign manufacturers seeking FCC equipment authorization must meet two distinct requirements under 47 CFR Part 2. First, the grantee of the FCC equipment authorization (FCC ID) must be either a US-based legal entity or a foreign entity that has designated a US agent for service of process and communications with the FCC (47 CFR § 2.911). The US agent must be located in the United States and authorized to accept legal service on the grantee's behalf. Second, every device subject to FCC equipment authorization must display its FCC ID on the device label, or — for devices that are too small to accommodate a physical label — via an electronic label (e-label) accessible through a menu on the device's display or accompanying app, per 47 CFR § 2.935 (e-label rules). The FCC ID must appear in the format: the grantee code (assigned by FCC to the company) followed by the equipment product code. Additionally, devices subject to Part 15 must carry the required FCC Notices (warning statement for Class B devices) in the user manual or product documentation. The responsible party for SDoC (Subpart B) compliance — typically the US importer or brand owner — must be identified in the SDoC documentation.47 CFR § 2.911 — Designation of US agent for foreign grantees of FCC equipment authorization
47 CFR § 2.935 — Electronic labelling (e-label) for FCC ID display
47 CFR § 15.19 — FCC Part 15 labelling requirements for devices subject to Subpart B
47 CFR § 15.21 — User manual FCC Notices requirement		 Chinese manufacturers exporting to the US face two structural gaps beyond testing: (1) Agent / grantee entity: the FCC ID must be granted to a US entity or a foreign entity with a designated US agent under 47 CFR § 2.911. Many Chinese manufacturers use their US importer or distributor as the grantee, or register a US subsidiary — neither CMIIT ID nor CCC certification addresses this requirement. (2) FCC ID labelling: every unit must display the FCC ID. For IoT devices or wearables where the enclosure is too small for a physical FCC ID label, the e-label path (47 CFR § 2.935) must be implemented — typically via the device's app or a setting menu, with specific disclosure text required. Common errors: printing only the SRRC CMIIT ID and CCC mark on the label without the FCC ID; shipping without a US agent designated; and failing to include FCC Notices in the English-language user manual. All three are independently citable violations and can result in Customs detention or FCC enforcement action.[INFORMATIONAL] Every FCC-authorized wireless device sold in the US must display its FCC ID (physical or e-label under 47 CFR § 2.935). Foreign manufacturers must have a US agent or US grantee entity under 47 CFR § 2.911. Chinese CMIIT ID and CCC marking do not substitute for FCC ID labelling. Failure to comply with labelling or agent requirements is independently citable by FCC or US Customs regardless of whether underlying radio testing passes. Electronic Code of Federal Regulations (eCFR) — FCC Part 2 Subpart J (Equipment Authorization)2026-06-12 · unverified
Cybersecurity — US Cyber Trust Mark (Voluntary) China does not currently have a direct equivalent voluntary IoT cybersecurity labelling program matching the US Cyber Trust Mark. China's approach to IoT cybersecurity is fragmented across multiple frameworks: the Cybersecurity Law (2017), the Data Security Law (2021), the Personal Information Protection Law (PIPL, 2021), and sector-specific standards from MIIT and TC260 (National Information Security Standardization Technical Committee). TC260 has published GB/T 37024-2018 (Information security technology — Security requirements for IoT data transmission) and GB/T 36951-2018 (Information security technology — IoT security reference model and general requirements). CCC certification does not include a cybersecurity component. Chinese IoT cybersecurity compliance documentation does not satisfy US Cyber Trust Mark requirements, and there is no mutual recognition between the two frameworks.GB/T 37024-2018 — Information security technology: Security requirements for IoT data transmission (TC260)
GB/T 36951-2018 — Information security technology: IoT security reference model and general requirements (TC260)
Cybersecurity Law of the People's Republic of China (2017)		 The US Cyber Trust Mark is a voluntary IoT cybersecurity labelling program administered by the FCC, launched under FCC Report and Order FCC-24-26 (adopted March 2024). It applies to consumer IoT devices including home routers, smart home appliances, smart speakers, and connected sensors. Devices that meet the program's cybersecurity requirements may bear the US Cyber Trust Mark — a shield-shaped label — and a QR code linking to a public registry of the device's security attributes. The underlying technical requirements are based on NIST IR 8425 (Profile of the IoT Core Baseline for Consumer IoT Products), which draws on NIST SP 800-213 and the NIST Cybersecurity Framework. Key requirements include: unique default passwords per device, capability to update firmware, data protection in transit, incident detection capabilities, and published security support period. The program is voluntary — there is currently no federal law mandating IoT cybersecurity certification for consumer wireless devices as a condition of US market access. However, the program is expected to gain market pull as major retailers and enterprise buyers incorporate it into procurement requirements.FCC Report and Order FCC-24-26 — US Cyber Trust Mark Program (adopted March 14, 2024)
NIST IR 8425 — Profile of the IoT Core Baseline for Consumer IoT Products
NIST SP 800-213 — IoT Device Cybersecurity Guidance for the Federal Government		 The US Cyber Trust Mark is voluntary — there is no current US federal law requiring IoT cybersecurity certification as a market entry condition. However, the gap is strategic rather than immediate: (1) Chinese IoT products are frequently cited in US cybersecurity advisories and executive orders restricting products from specific Chinese vendors — while these do not apply to all Chinese manufacturers, the regulatory trend is toward increased scrutiny of connected devices from China; (2) the Cyber Trust Mark is expected to become a retailer purchase order requirement over 2025-2027, similar to how ENERGY STAR became a practical requirement for appliances; (3) Chinese IoT cybersecurity frameworks (GB/T 37024, GB/T 36951) address data transmission security but do not map to NIST IR 8425 requirements (unique default passwords, public security support period disclosure, over-the-air update capability). Manufacturers targeting US enterprise or government procurement channels should begin aligning product design with NIST IR 8425 baselines even before the Cyber Trust Mark certification process is fully operational.[INFORMATIONAL] The US Cyber Trust Mark is voluntary — no current federal mandate for consumer IoT devices. Chinese GB/T cybersecurity standards do not map to NIST IR 8425 requirements. Manufacturers targeting US retail and enterprise channels should assess alignment with NIST IR 8425 (unique default passwords, firmware update capability, security support period disclosure) to prepare for likely future market pull. The FCC program is administered under FCC-24-26 (adopted March 2024). Federal Communications Commission (FCC) — US Cyber Trust Mark2026-06-12 · unverified
Electrical Safety — UL 62368-1 via NRTL (Market / Retailer Required) China's mandatory safety standard for audio/video and IT equipment is GB 4943.1 (Safety of information technology equipment — Part 1: General requirements), which is the Chinese national adoption of IEC 60950-1 (the predecessor to IEC 62368-1). GB 4943.1 is enforced through China's CCC (China Compulsory Certification) scheme administered by CNCA. Products within CCC scope (which includes wireless IoT devices, routers, and smart home products that are IT equipment) must obtain CCC certification before sale in China. A newer standard GB/T 42315-2023 (aligned with IEC 62368-1) has been published but adoption timelines for mandatory CCC use should be verified with CNCA. CCC certification to GB 4943.1 is not accepted as a substitute for UL 62368-1 NRTL certification in the US market.GB 4943.1 — Safety of information technology equipment — Part 1: General requirements (CCC mandatory, CNCA, aligned with IEC 60950-1) There is no single US federal law mandating electrical safety certification for consumer Wi-Fi/Bluetooth IoT devices as a condition of market entry (unlike the EU's Low Voltage Directive). However, the market effectively mandates NRTL (Nationally Recognized Testing Laboratory) certification: major US retailers (Amazon, Best Buy, Walmart, Home Depot), distributors, and corporate buyers contractually require that consumer electronics carry a safety mark from an OSHA-recognized NRTL (e.g., UL, CSA, ETL/Intertek, TUV). The applicable product safety standard is UL 62368-1 (Audio/Video, Information and Communication Technology Equipment — Part 1: Safety Requirements, 3rd Edition), which replaced UL 60950-1 and UL 60065 and is the US adoption of IEC 62368-1. The standard applies to AV, IT, and communication technology equipment including wireless IoT devices, smart home hubs, routers, and similar products operating at not more than 600 V. NRTL certification involves product testing and factory inspection, and the certified product may carry the NRTL's safety mark (e.g., UL Listed mark, cULus mark for Canada+US).UL 62368-1 (3rd Edition) — Audio/Video, Information and Communication Technology Equipment — Part 1: Safety Requirements (US adoption of IEC 62368-1)
29 CFR § 1910.303 — OSHA requirement for NRTL-listed electrical equipment in workplaces (creates market pull for NRTL listing)		 Chinese GB 4943.1 / CCC safety certification is not accepted by US retailers, distributors, or building code authorities as equivalent to NRTL certification under UL 62368-1. The product must be independently re-tested and certified to UL 62368-1 by an OSHA-recognized NRTL. Key differences: UL 62368-1 supersedes both UL 60950-1 and UL 60065 and applies an energy-based hazard classification approach distinct from the older IEC 60950-1 / GB 4943.1 framework. A product certified only to GB 4943.1 (which follows the IEC 60950-1 approach) will need new testing to UL 62368-1 even if technically similar, because the standards use different classification schemes. Note: NRTL certification is not a US federal legal requirement for consumer products (no equivalent to the EU LVD) — it is a market access requirement driven by retailers, insurers, and state electrical codes (which reference NRTL listing via NEC / NFPA 70). Absence of NRTL certification will result in rejection by major US e-commerce platforms and retail channels.[INFORMATIONAL] UL 62368-1 certification via an OSHA-recognized NRTL is de facto mandatory for consumer Wi-Fi/Bluetooth IoT devices in the US market. Chinese CCC / GB 4943.1 certification does not substitute. The product must be independently tested and certified to UL 62368-1 (3rd Edition). This is a market requirement driven by retailers and state electrical codes, not a US federal safety law, but its absence will block sales through all major US retail channels. UL Standards & Engagement2026-06-12 · unverified
Unintentional Radiator EMC — FCC Part 15 Subpart B (SDoC) China addresses EMC for information technology equipment and similar products through GB/T 9254 (Information technology equipment — Radio disturbance characteristics — Limits and methods of measurement), which aligns with CISPR 22/32. Products within the scope of CCC (China Compulsory Certification) that include EMC requirements must be certified before sale; other products may demonstrate EMC compliance via self-declaration against applicable GB/T standards. The CCC EMC certification process involves testing by a CNAS-accredited laboratory designated by CNCA. GB/T 9254 certification or CCC EMC compliance does not satisfy US FCC Part 15 Subpart B requirements; separate SDoC-backed testing to FCC Part 15 B limits (using ANSI C63.4 or equivalent measurement methods) is required for the US market.GB/T 9254 — Information technology equipment: Radio disturbance characteristics — Limits and methods of measurement (SAC/MIIT, aligned with CISPR 22/32) All digital devices and other electronic equipment that are incidental or unintentional radiators — including the digital and switching circuitry within IoT devices, routers, and smart home products — must comply with FCC 47 CFR Part 15, Subpart B before being marketed or sold in the United States. Compliance is demonstrated via a Supplier's Declaration of Conformity (SDoC), a self-declaration by the responsible party (manufacturer or importer) supported by test data from an accredited test laboratory. The SDoC does not require submission to the FCC or to a TCB — the responsible party holds the test records and makes them available upon FCC request. Class B digital devices (household use) must meet more stringent emission limits than Class A (commercial/industrial) and also require an FCC Notices statement in the user manual or Quick Start guide. The SDoC procedure replaced the older Declaration of Conformity (DoC) framework in 2017 — both terms may appear in legacy documentation but SDoC is now the operative term. Devices that are both intentional and unintentional radiators (as is typical for Wi-Fi/Bluetooth IoT products) must comply with both the Part 15 Subpart C/E Certification requirement AND the Subpart B SDoC requirement.47 CFR Part 15, Subpart B — Unintentional Radiators (FCC)
47 CFR § 15.19 — Labelling requirements
47 CFR § 15.21 — Information to user (FCC Notices in user manual)		 Chinese GB/T 9254 test reports and CCC EMC certificates do not satisfy FCC Part 15 Subpart B SDoC requirements — different measurement methods (ANSI C63.4 vs. CISPR methods), different emission limits, and different frequency ranges apply. A separate SDoC must be prepared by the US responsible party (typically the importer or US subsidiary), supported by test data from a laboratory with US FCC Part 15B measurement capabilities. Common gap: manufacturers submit SRRC and CCC EMC documentation without having conducted FCC Part 15 Subpart B testing — this creates an FCC enforcement risk at the US port of entry. Class B designation (for household/consumer IoT) requires meeting the more stringent Class B limits and including FCC Notices in all product manuals. The SDoC must be kept on file; it is not filed with FCC but must be produced upon request.[INFORMATIONAL] FCC Part 15 Subpart B SDoC is mandatory for all consumer IoT and wireless device electronics before US market entry. Chinese GB/T 9254 / CCC EMC documentation is not equivalent. A US responsible party must prepare an SDoC backed by FCC Part 15 Subpart B test data (ANSI C63.4 method). Class B limits apply to household consumer products. The SDoC is retained on file, not filed with FCC. Electronic Code of Federal Regulations (eCFR) — FCC Part 15 Subpart B2026-06-12 · unverified
Radio Equipment Authorization — Intentional Radiator (FCC Part 15 Subpart C/E) China requires SRRC (State Radio Regulation of China) type approval administered by the Ministry of Industry and Information Technology (MIIT) for all radio transmission equipment sold in China, under the Radio Regulations of the People's Republic of China (2016 revision). Wi-Fi and Bluetooth devices must obtain SRRC approval before sale, and the CMIIT ID must be marked on the product. Separately, networked IoT devices may require network access licence (NAL) approval from MIIT. SRRC approval is China-specific; it does not satisfy FCC requirements and cannot be substituted for FCC Certification.Radio Regulations of the People's Republic of China (2016) — SRRC type approval requirement (MIIT)
CMIIT ID marking requirement for wireless products sold in China		 Wi-Fi and Bluetooth devices sold or marketed in the United States are intentional radiators subject to FCC equipment authorization under 47 CFR Part 15, Subpart C (intentional radiators, general) and Subpart E (unlicensed national information infrastructure — U-NII devices for 5 GHz Wi-Fi). The required authorization procedure is Certification, obtained through an FCC-accredited Telecommunications Certification Body (TCB). Upon grant, the device receives a unique FCC ID (format: grantee code + equipment product code) that must be displayed on the device or, for small devices, via electronic labelling (e-label) per 47 CFR Part 2. The grantee of the FCC ID must be a US-based entity or appoint a US agent. Authorization must be obtained before the device is imported, marketed, or sold. Key technical limits include Part 15.247 (spread spectrum and frequency hopping devices, including 2.4 GHz Wi-Fi and Bluetooth) and Part 15.407 (U-NII devices at 5/6 GHz bands).47 CFR Part 15, Subpart C — Intentional Radiators (FCC)
47 CFR Part 15, Subpart E — Unlicensed National Information Infrastructure Devices (U-NII, FCC)
47 CFR § 15.247 — Operation within the bands 902-928 MHz, 2400-2483.5 MHz, and 5725-5850 MHz
47 CFR § 15.407 — General technical requirements for U-NII devices
47 CFR Part 2 — FCC equipment authorization procedures and FCC ID requirements		 Chinese SRRC approval does not satisfy US FCC Certification requirements — entirely separate authorization is required for the US market. The FCC Certification process requires: (1) testing by an FCC-recognized accredited laboratory to 47 CFR Part 15 limits; (2) submission to a TCB for grant of equipment authorization; (3) assignment of a unique FCC ID to the device; (4) a US-based grantee entity or designated US agent (see also wirus-agent fragment). Products using pre-certified radio modules (e.g., a module already holding an FCC ID) may benefit from a modular authorization path, but only if the final product uses the module within its authorized operating conditions and the host device does not require additional FCC authorization (host product DoC/SDoC typically still required). A common compliance gap: manufacturers obtain SRRC for China and assume FCC is handled by the module — the host device integration test is still required to verify the module's FCC authorization conditions are met in the specific product.[INFORMATIONAL] FCC Certification via a TCB is mandatory for Wi-Fi and Bluetooth devices before US market entry. Chinese SRRC type approval provides no equivalence. Manufacturers must test to 47 CFR Part 15 Subpart C/E limits, obtain an FCC ID, and ensure a US grantee entity or US agent is in place. Products using pre-certified modules still require integration-level verification. Authorization must be in place before importation. Federal Communications Commission (FCC) — Office of Engineering and Technology2026-06-12 · unverified

E-E-A-T

Named editorial review

Pending named reviewer

Official regulator, standards body, notified body, customs, or primary legal source preferred. Local PDFs are not accepted.

Editorial controls

Rows must include publisher, official URL, access date, verification flag, and last_verified before human_reviewed can be true.

SOURCES

Official-source register.