FCC Cyber Trust Mark Label: Renewal and Surveillance Rules
FCC Cyber Trust Mark Label: FCC Proposes Design, Three-Year Renewal and Post-Market Surveillance Rules
The FCC Cyber Trust Mark label is one step closer to appearing on store shelves. On 27 October 2026, the FCC's Public Safety and Homeland Security Bureau released Public Notice DA 26-1162 in PS Docket No. 23-239. It asks for comment on the design of the FCC IoT Label, the information linked from its QR code, how often manufacturers must renew their authority to use the mark, and how certified products will be monitored once they're on the market.
Background: a voluntary label still being built
The U.S. Cyber Trust Mark is a voluntary program for consumer wireless IoT products such as smart home devices, wearables and connected appliances. Products that meet baseline cybersecurity requirements can carry the FCC IoT Label: the Cyber Trust Mark plus a QR code that links to security information about the product. The program runs through a Lead Administrator and Cybersecurity Label Administrators (CLAs), with testing by CyberLABs.
In June 2025, the first Lead Administrator submitted stakeholder recommendations on label design, renewal and surveillance. It later withdrew, and in April 2026 the FCC selected the ioXt Alliance as the new Lead Administrator. This Public Notice seeks comment on the 2025 recommendations, with FCC changes. Technical requirements will come in a separate notice.
Key Changes in the FCC Cyber Trust Mark Label Proposals
Label design
The FCC proposes basing the physical label on CTA-2120, with the QR code and "bounding box" it describes. Both horizontal and vertical layouts would be allowed. The recommended minimum font is 4 point, but CTA-2120 refers to 5 point, so the FCC asks which to adopt. The recommended minimum size is 1 × 2 inches.
Small products and other formats
Three space-saving options were recommended: a 1 × 1 inch shield-only label, a ⅝ × ⅝ inch shield inside a QR frame, or just the shield and a URL where there's no flat surface. Because the FCC's rules require the QR code wherever the mark appears, it asks whether options without one are allowed. It also proposes allowing hangtags or placards, linked marks on retail web pages, and the label in both online and printed documentation.
Cyber nutrition label
The information behind the QR code would follow a "nutrition label" format, in English and Spanish. The FCC wants to rename the "Security Updates" heading to "Support Period", covering the support period and its end date.
Renewal
Stakeholders recommended renewal every five years. The FCC proposes three, citing fast-changing IoT threats. Renewal applications would need a CyberLAB report covering any new or revised requirements plus 70% of the remaining ones. The notice also lists what initial applications should include, such as a US agent for service of process and a signed test report from an accredited CyberLAB.
Post-market and ad-hoc surveillance
Each CLA would file a sample test plan every September. After major cyber events affecting consumer IoT products, the FCC could start ad-hoc surveillance, with CLAs meeting within 30 days to decide whether an audit is needed.
What This Means for Manufacturers
Packaging will need room for the label and QR code, which matters most for small products.
The support end date you put on the cyber nutrition label becomes a public commitment.
A three-year renewal with 70% retesting would add recurring CyberLAB costs to the program.
Expect sample testing of products bought on the open market.
The program is still voluntary, but retailers and buyers may start asking for the mark once it's live.
Certification Impact Summary
Area | Before | After | Impact level |
Label design | Mark plus QR code, no detailed spec | CTA-2120 basis, 1 × 2 inch minimum, 4 or 5 pt font | Medium |
Small products | No specific options | Alternatives proposed; QR-free versions questioned | Medium |
Cyber nutrition label | Content set out in 2024 order | English and Spanish; "Support Period" heading | Medium |
Renewal cycle | Not set (five years recommended) | Three years proposed | High |
Renewal testing | Not set | New or revised requirements plus 70% of the rest | High |
Post-market surveillance | CLA duty, no procedure | Annual sample test plans; ad-hoc audits after major events | Medium |
Timeline and Required Actions
Key Dates
Date | Milestone |
13 June 2025 | Lead Administrator recommendations filed |
April 2026 | ioXt Alliance selected as Lead Administrator |
27 October 2026 | Public Notice DA 26-1162 released |
To be confirmed | Comments due 30 days after Federal Register publication |
To be confirmed | Reply comments due 45 days after Federal Register publication |
Required Actions for Manufacturers
Decide which consumer IoT products you'd put through the program.
Check packaging space for a 1 × 2 inch label with a scannable QR code.
Agree a support period you can publish and keep.
Budget for CyberLAB testing at certification and at renewal.
Comment on the renewal cycle, label size and surveillance proposals before the deadline.
Conclusion
The FCC Cyber Trust Mark label proposals fill in much of how the program will work day to day, from label size to renewal. A three-year renewal with 70% retesting is the point most likely to affect cost. Contact our team for help preparing products, documentation and comments for the Cyber Trust Mark and similar IoT labels in other markets.
