NAS FCC Certification Requirements: A US Import Checklist

Leo · 2026-10

NAS FCC certification requirements for US import, in one paragraph

If you are importing NAS (network-attached storage: a local file server on your LAN) into the United States, the unit must comply with FCC Part 15 rules for unintentional radiators. That means a valid test report, a supplier declaration, correct labeling, and a paper trail you can hand to customs or a retailer’s compliance team.

This guide is for distributors, system integrators, and private-label buyers who need to check a supplier’s FCC file before a purchase order, not after.

Most sourcing problems are not failed tests. They are missing documents, mismatched model numbers, and suppliers who say “FCC certified” without showing the file. Below is what to ask for, what each document proves, and how to spot a thin file in 20 minutes.

Which FCC rule applies to a NAS device?

Almost every NAS sold in the US falls under FCC Part 15 Subpart B as an unintentional radiator. The device emits radio frequency energy as a byproduct of digital circuitry, but it is not designed to transmit.

Two exceptions deserve attention from buyers. If the NAS ships with Wi-Fi or Bluetooth, the radio module also needs Part 15 Subpart C certification with an FCC ID.

If the unit is a pure wired appliance with no radio, Subpart B verification or a Supplier’s Declaration of Conformity (SDoC) is the normal path.

• Wired-only NAS: Part 15 Subpart B, SDoC procedure, no FCC ID required.
• NAS with Wi-Fi/BT: Subpart B plus Subpart C; the radio module carries an FCC ID.
• NAS with a cellular modem: Part 22/24/27 licensing rules apply to the modem; ask for the module grant.

Ask the supplier which class applies to the exact SKU you are buying. A generic “FCC compliant” line on a spec sheet tells you nothing about the model in the carton.

What documents should a US importer receive?

A complete FCC file for a NAS typically contains five items. Request all five before you wire a deposit.

1. Test report from an accredited lab, showing the standard (usually ANSI C63.4 methods against Part 15 limits), the test dates, and the model tested.
2. SDoC or verification statement signed by the responsible party, naming the US importer or the manufacturer’s authorized representative.
3. Label artwork showing the FCC logo or the compliance statement, plus the model and serial format.
4. User manual section with the required Part 15 interference statement.
5. Model list linking every variant you are ordering to the tested model. This is where files usually break.

If the supplier cannot produce item 5, treat the file as incomplete.

A tested model that does not match your SKU is a documentation gap. A retailer or marketplace can reject the shipment on that basis alone.

Comparison: what each FCC path means for your PO

The table is a starting point, not legal advice. Confirm the classification with your compliance counsel for the exact configuration you import.

Verifying a Supplier’s FCC Claim in 20 Minutes

Start with the FCC ID database if a radio is involved.

Search the ID at fcc.gov/oet/ea/fccid and confirm the grantee name matches the factory, not a trading company.

For wired-only units there is no public ID, so the check moves to the paperwork. Compare the tested model name on the report with the model on your quotation.

The FCC file is only half the package you are evaluating. The box itself still runs an OS you administer over SSH and TLS, exposes a file-sharing protocol to the LAN, and ships a firmware image you will be updating for years. Part 15 says nothing about any of that, but your integration team will, the week after the container clears.

Then read the SDoC signature block. It should name a responsible party with a US address or a named authorized representative.

• Is the test report recent enough for your channel’s expectations?
• Does the report list the same enclosure and power supply you are ordering?
• Does the label artwork show the model you are buying?
• Is the Part 15 statement present in the manual?

Any “no” is a question for the supplier, not an automatic rejection. Suppliers change power supplies and chassis between runs; when the build changes, ask for the updated report.

A worked example: 4-bay NAS for a 60-person firm

Consider a hypothetical 60-person architecture firm in Ohio that wants 40 TB usable for project files. The IT manager shortlists a 4-bay NAS with 2.5GbE and asks two suppliers for FCC files.

In this hypothetical, Supplier A sends a test report dated 2023, an SDoC signed by a US representative, and a model list covering the exact SKU. Supplier B sends a one-page “FCC certificate” with no test standard and no model list.

The firm’s buyer can clear Supplier A in an afternoon. Supplier B means follow-up rounds, and the answer might still be no.

Here is the capacity math the buyer also runs.

Usable capacity for RAID 5 is (N-1) × drive size, and with four 16 TB drives: (4-1) × 16 = 48 TB raw usable. Subtract filesystem overhead and you land near 43 TB in this example, which clears the 40 TB target with headroom for snapshots.

If the firm instead needed 80 TB, it would move to a 6-bay unit: (6-1) × 16 = 80 TB. The FCC question does not change with bay count, but the model list must cover the larger chassis.

Where US importers get caught: labeling and model lists

The most common failure is not a bad test. It is a label that does not match the file.

Retailers and marketplaces can ask for the FCC statement on the product label or in the manual before they list a SKU.

The FCC file is per-model, not per-brand, and a common pitfall is a chassis or power-supply change between production runs quietly invalidating the report you were shown. Ask for the file that matches the exact enclosure and adapter in your carton.

If the factory prints a generic label and the file names a different model, the listing can be pulled.

Private-label buyers face a second trap. When you put your brand on the unit, the responsible party on the SDoC may need to change. Ask the supplier in writing who signs the SDoC for your brand, and get that answer before tooling starts.

For buyers sourcing a private-label NAS, this is a document question first and a hardware question second. Ask which compliance files ship with each order and get the answer in writing before sampling.

If you are evaluating a private-label program, woCyber’s OEM/ODM program page covers the document set. On that page the published MOQ is 100 units per SKU, or 1,000 where a new PCB respin or new tooling is required; terms beyond that are confirmed in writing at quotation.

What changed on 13 October 2026

The FCC published a final rule — “Protecting Against National Security Threats to the Communications Supply Chain Through the Equipment Authorization Program” — in the Federal Register on 11 September 2026.

It took effect on 13 October 2026. Three parts of it change what an importer should ask a storage supplier.

The first piece of the rule bars equipment authorization for a device that contains a “logic-bearing hardware component” produced by an entity on the FCC Covered List, where that device would have been barred had the covered entity built it outright.

The rule defines such a component as one that generates or uses timing signals above 9,000 pulses per second using digital techniques — a description that reaches SoCs, MCUs, FPGAs, ASICs and RF modules.

The second piece closes a modification gap: an existing authorization cannot be used to carry a modification that would make the device covered.

A board respin or a radio module swap can therefore force a fresh application rather than a permissive change.

The third piece shifts the burden to marketplaces: online marketplaces must display a valid FCC ID at the point of sale, on two separate dates: 1 March 2027 for platforms that take title to or possession of the goods, and 1 June 2027 for third-party marketplaces.

The restrictions apply prospectively. Equipment authorized before 13 October 2026 keeps its authorization; the exposure appears when a supplier changes silicon or a radio module and re-files. That is the moment to ask for an updated document set.

What this means for a purchase order: ask the supplier to state in writing which logic-bearing components sit on the current build, and whether any change since the last filing triggers a new application.

For private-label programs where the board may be respun, that question belongs in the sampling stage, not after tooling.

Source: Federal Register, published 11 September 2026, effective 13 October 2026. The emissions limits a digital device such as a NAS is tested against sit in 47 CFR Part 15; the authorization procedure itself sits in 47 CFR Part 2.

What changed on 29 October 2026: where the test is run

The FCC voted on 29 October 2026 to restrict which laboratories may produce test data for US equipment authorisation.

Under the final rule, a laboratory in a country that has no mutual recognition agreement with the United States cannot test, certify or accredit equipment intended for the US market, and the restriction also reaches testing performed inside that territory on behalf of an entity registered elsewhere.

Mainland China has no such agreement, so laboratories there fall inside the exclusion; Hong Kong is treated as an MRA economy and sits outside it.

The rule takes effect on 1 December 2028, and equipment authorised before that date keeps its grant, so nothing already shipped loses its file.

The exposure appears later, when a respin, a radio-module swap or a new model needs fresh test data.

What this means for a purchase order: record where the test was performed and when the report was issued, not only the FCC ID.

What about other US requirements beyond FCC?

FCC is the radio-frequency rule. It is not the only box a NAS must tick to enter the US.

Safety: some channels and insurers ask for a Nationally Recognized Testing Laboratory (NRTL) safety listing. Confirm which listing your channel requires — it is a separate file from the FCC one.
• Customs: HTS classification and country-of-origin marking apply to the shipment, separate from FCC.
• State rules: California and other states have e-waste and packaging rules that can affect retail packaging.

None of these replace the FCC file. They sit alongside it. A supplier that has them ready is usually easier to onboard.

FAQ: NAS FCC certification requirements for US import

Does a wired-only NAS need an FCC ID?

No. A NAS with no radio typically follows the Part 15 Subpart B SDoC path, which does not issue an FCC ID. You should still hold a test report and a signed SDoC naming the responsible party.

Can I use the supplier’s FCC report for my private label?

Often yes, if the hardware is unchanged and the model list covers your SKU. The SDoC responsible party may need to be updated to your brand or a named US representative. Get this in writing before production.

How old can an FCC test report be?

There is no expiry written into the rule itself, but many buyers and retailers treat an older report with caution. Any hardware change (power supply, chassis, radio module) should trigger a fresh evaluation. Ask your channel what recency it expects rather than assuming a fixed window. Ask the supplier to confirm the report matches the current build.

Does FCC certification cover the power supply?

The external power adapter is usually certified separately and carries its own markings.

Ask for the adapter’s file as well, because a swapped adapter can invalidate the system-level assumption in the NAS report.

What happens if a shipment arrives without a valid FCC file?

Customs may hold the shipment. A retailer or marketplace can refuse the listing. The fix is usually paperwork rather than hardware, but it costs you calendar time. Verify the file before the PO, not after the container lands.

Will the 2028 lab rule invalidate an existing FCC grant?

No. The rule is not retroactive: a grant issued before 1 December 2028 remains valid. It governs new applications and fresh test data, so the record that matters in a later audit trail is the one naming the laboratory and the issue date, which the supplier CVE and patch documentation conversation should also cover.

What to put in the purchase order

Write the five documents into the order itself: the test report, the SDoC, the label artwork, the manual statement, and the model list, each matched to the SKU you are buying.

If a radio is involved, check the FCC ID at fcc.gov. If any item is missing, get it in writing before you pay.

That checklist takes less time than a single customs delay. For buyers building a channel program, we think the supplier’s document discipline is a better signal than the spec sheet.

It comes down to this: demanding the full five-item set can add time to supplier onboarding, while a thin file can cost weeks at the border. Do not clear a purchase order on a one-page “FCC certificate.”

Separate from the compliance file, lock the hardware warranty wording into the PO. woCyber publishes a standard 3-year warranty; other warranty terms are confirmed in writing at quotation. Spare-part supply for the project lifecycle is published as part of the same program.

If you want to compare configurations and document sets, start with woCyber’s X4 4-bay platform for office and studio deployments, and keep the NAS buyer FAQ open while you review supplier files.