Two Lists, One Door: How Washington's Covered List and Brussels' Rulebook Are Splitting the Access-Control Market

A door controller is a computer with a lock on it. Washington now decides which computers may be authorised for sale in the United States at all. Brussels decides what every computer must do once it can reach a network. Both are writing rules about the same device, and the two rules do not produce the same kind of market.

This matters because the entry layer of a building stopped being a hardware category some years ago. The credential decision happens in software, the intercom is a PoE network endpoint with a camera in it, and the device in the lift car is a life-safety function running over a path it does not own. Once all three sit on the same switch, they also sit inside the same regulatory perimeter — and that perimeter is now drawn twice, in two capitals, on two incompatible theories of how to keep a bad device out of a building.

The list Washington keeps — and the hole that was in it

The Federal Communications Commission adopted its Report and Order, Order, and Further Notice of Proposed Rulemaking, FCC 22-84, on 25 November 2022. From 6 February 2023 it prohibited any equipment identified as “covered” on the Commission’s Covered List from obtaining an equipment authorisation through either the certification procedure or the Supplier’s Declaration of Conformity, and removed covered equipment from the Part 15 exemption as well. The practical effect of losing both routes is that such equipment cannot be imported, marketed, sold or operated in the United States.

The named entities are Huawei, ZTE, Hytera, Hikvision and Dahua, together with their subsidiaries and affiliates. Note the category definition, because it is narrower than the list of companies: “telecommunications equipment” and “video surveillance equipment” produced by those entities, but specifically “for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.”

Then the paragraph that did most of the commercial work. The Commission’s own guidance states it plainly: “This prohibition does not apply to any equipment that obtained an equipment authorization prior to this date.” The list, as originally built, stopped the next product from entering. It did not touch the model already on a distributor’s shelf, already specified into a project, already quoted. An integrator could lawfully keep buying and installing previously authorised devices for as long as stock and supply lasted — and in access control, where product cycles are long and the installed base is the business, that is a great deal of time.

What changed on 28 October 2025

The Commission returned to the docket and adopted a Second Report and Order with a Second Further Notice of Proposed Rulemaking, ET Docket No. 21-232. Chairman Brendan Carr’s accompanying statement described the two loopholes in the same terms a security specifier would: rules had not prevented Covered List providers “from continuing to sell previously authorized device models,” and had not applied to “a device’s component parts.”

Two rules followed. First, the Commission adopted a mechanism to prohibit the importation, marketing or sale of previously authorised devices, determined case by case. Second, it adopted rules allowing it to reach not only a finished device produced by a Covered List entity but also an otherwise compliant device that contains certain component parts produced by one.

Both changes alter what a bill of materials is for. Under the first, the stock argument expires the moment a determination is made against a specific model. Under the second, provenance cannot be answered at the level of the badge on the front of the panel; it has to be answered at the level of the module, the system-on-chip and the radio inside it. A reader who buys access-control hardware on brand alone is now buying an unverified regulatory position.

Brussels does not keep a list. It keeps obligations.

Europe has taken the opposite approach, and it is worth being precise about it, because the two instruments most often cited in this sector are routinely described in stronger terms than their text supports.

The Cyber Resilience Act, Regulation (EU) 2024/2847, entered into force on 10 December 2024. Notification of conformity assessment bodies has applied since 11 June 2026; the reporting obligations in Article 14 apply from 11 September 2026; the regulation is fully applicable from 11 December 2027. It applies to “products with digital elements” made available on the Union market, regardless of where the manufacturer is based, and it reaches products placed on the market before December 2027 if they are substantially modified from that date — while the reporting duty reaches all such products already made available.

Nothing in that is origin-based. A door controller assembled in Tennessee and one assembled in Hangzhou carry the same obligations: vulnerability handling, security updates, a declared support period, and a duty to report actively exploited vulnerabilities and severe incidents. The regulatory burden is a fixed cost per product line, which is a very different thing from a politically determined exclusion.

The European Accessibility Act, Directive (EU) 2019/882, has applied since 28 June 2025. Its requirements are functional, not scheduled by vendor. For electronic communications services, including emergency communications, the Directive requires real-time text in addition to voice; total conversation where video is offered; and synchronisation of voice and text, with video where offered, transmitted to the most appropriate public safety answering point. Those are obligations on the service and on the terminal equipment that supports it.

One correction to something I wrote in preparing this piece. I described the Accessibility Act as making compliant two-way emergency communication in lifts a legal requirement across the EU. That is not what the text says. The Act’s emergency-communication requirements bite on electronic communications services; the lift alarm device is governed by the lift safety standards, not by a product schedule inside the Accessibility Act. What the Act does do is put a real-time-text capability into the expectation for any emergency communication path a building operates. The intercom and lift-phone layer inherits that through the service, not through a hardware mandate, and the distinction matters because it decides who is on the hook — the service provider and the manufacturer of the terminal, not the elevator contractor.

Two mechanisms, two bills of materials

Instrument	Mechanism	Date that matters	Who carries the cost
FCC 22-84 and the Covered List (US)	Origin-based exclusion from equipment authorisation; extended in October 2025 to previously authorised devices on a case-by-case basis and to component parts	6 February 2023; extended 28 October 2025	Supplier, importer, distributor holding stock
Cyber Resilience Act, (EU) 2024/2847	Mandatory security lifecycle for every product with digital elements, irrespective of origin	Reporting from 11 September 2026; fully applicable 11 December 2027	Manufacturer
European Accessibility Act, (EU) 2019/882	Functional requirements on products and services, including real-time text in emergency communications	Applicable since 28 June 2025	Service providers and terminal manufacturers

Read the table down the “mechanism” column and the split is obvious. One regime subtracts named vendors and leaves everything else alone. The other leaves every vendor alone and adds a compliance cost to everything. A market shaped by subtraction rewards substitution and channel agility — find the compliant equivalent, move the stock, re-badge the panel. A market shaped by obligation rewards scale, because the cost of certification and lifecycle support is spread across a larger installed base and recovered over a longer support period.

The revenue line says the redistribution is in the mix, not the topline

The FY2025 disclosures are the cleanest test of how far either mechanism has actually moved money.

Company	FY2025 revenue	Growth	Profit signal
Hikvision	RMB 92.51 billion	+0.01% (Pheonix Research calculation: RMB 92,507.8m divided by RMB 92,495.5m)	Net profit RMB 14.20 billion, +18.52%; net margin 15.34% against 12.95% (Pheonix Research calculation: RMB 14.195bn divided by RMB 92.508bn)
Dahua Technology	RMB 32.74 billion	+1.75%	Net profit RMB 3.86 billion, +32.8%; net margin 11.78% (Pheonix Research calculation: RMB 3.858bn divided by RMB 32.744bn)
ASSA ABLOY	SEK 152,409 million	+1% reported; +3% organic, +5% acquired, −7% currency	EBIT SEK 24,664 million at a 16.2% margin; electromechanical sales organically +7%; subscription nearly 6% of sales
Allegion	USD 4,067.3 million	+7.8% reported; +4.1% organic	Adjusted operating margin 23.2%
dormakaba (FY to 30 June 2025)	CHF 2,870.1 million	+4.1% organic; +1.2% reported after a −2.3% currency effect	Access Solutions CHF 2,440.7 million, 85.0% of group sales (Pheonix Research calculation: CHF 2,440.7m divided by CHF 2,870.1m), adjusted EBITDA margin 15.7%

Two facts sit next to each other here and neither is the one the ban narrative predicts. Hikvision and Dahua together turned over RMB 125.25 billion in 2025 (Pheonix Research calculation: RMB 92.508bn plus RMB 32.744bn) on essentially flat volume of revenue — plus 0.01% and plus 1.75% — while both grew net profit substantially faster than sales. That is a cost, mix and geography story, not a demand collapse. The exclusion from the US authorisation pipeline has not yet appeared in either topline, and I am not going to pretend to know the US share of their revenue: neither company discloses it in a form that supports the calculation.

The Western access players tell the mirror-image story. Growth is mid-single-digit and incremental — 3% organic at ASSA ABLOY, 4.1% at Allegion, 4.1% at dormakaba — nothing like the double-digit surge a forced replacement wave would produce. What is growing faster than the group is the electromechanical and software layer: ASSA ABLOY’s electromechanical sales grew 7% organically, 2.33 times its 3% group organic rate (Pheonix Research calculation: 7 divided by 3), with subscription approaching 6% of sales. dormakaba is buying into data centres — more than fifteen projects won in North America and Asia in the year, plus the TANlock acquisition — which is the vertical where a network-reachable lock is a security product rather than a convenience.

So the redistribution is real but it is happening inside the product mix rather than in the revenue totals. That is exactly what a compliance-cost regime does before it does anything else: it changes which products are worth selling, years before it changes who is allowed to sell them.

Three questions a specifier now has to answer

Provenance, at component level. “Where is it made?” was always the wrong question. After October 2025 the question is whether an otherwise compliant device contains a component part produced by a Covered List entity, and the only defensible answer is a supplier declaration that reaches the module. Brand-level assurance no longer answers it.

Support period, as a tender line. The Cyber Resilience Act turns an unstated expectation into a declared property of the product. Once that is true in the EU, it becomes a question buyers ask everywhere, and it will be asked of access-control hardware that was historically replaced on a fifteen-to-twenty-year cycle. A door controller with a five-year software support commitment is a different asset from one with fifteen, and the price does not currently tell you which you are buying.

The emergency path, designed as a service. If the emergency communication in a building is expected to carry real-time text and synchronised voice to a public safety answering point, then the intercom and the lift phone stop being audio devices with a dialler attached. They become terminals in a service that has accessibility requirements, and the design question moves from “does the call connect” to “what happens to the call when the shared router is reconfigured.”

What I would watch

• The first case-by-case determination. The October 2025 order gave the Commission a mechanism, not a list of devices. The first named model converts a new-product rule into a stock rule, and that is the moment distributors reprice inventory.
• The reporting start date, 11 September 2026. From that date, actively exploited vulnerabilities in products with digital elements sold in the EU must be reported. The first public disclosures will tell buyers more about the security of access-control firmware than any vendor whitepaper has.
• Whether procurers move before the deadline. Public and institutional buyers tend to write tomorrow’s regulation into today’s tender. CRA-readiness appearing as an evaluation criterion in 2026, a year before it is mandatory, would be the strongest available signal that compliance is becoming a purchase gate.
• Localisation as an escape route. If manufacturing moves outside the scope of a covered entity, the entity definition becomes the contested ground. That is a legal question with a commercial answer, and it will be settled in production decisions before it is settled in court.

The door is now a regulated endpoint. That is the substantive change, and it is not reversible: neither Washington nor Brussels shows any appetite for treating a networked lock as ordinary hardware. For the people who specify, buy and service these systems, the practical consequence is narrower and more useful than the headlines suggest. Ask for the paperwork before you argue about the price — because in both jurisdictions, the paperwork is now the thing that decides whether the product may be sold at all.

Related reading: Smart Intercom, Access Control and Elevator Emergency Communication: The Phone in the Lift Forced the Convergence, on why the least expensive device in the building sets the timetable for the other two.

Frequently Asked Questions

What does the FCC Covered List actually prohibit?

Since 6 February 2023, equipment identified as covered — telecommunications and video surveillance equipment produced by Huawei, ZTE, Hytera, Hikvision or Dahua and their subsidiaries and affiliates, for public safety, government facilities, critical infrastructure surveillance and other national security purposes — cannot obtain a new FCC equipment authorisation, cannot use the Supplier's Declaration of Conformity route, and loses the Part 15 exemption. In practice it cannot be imported, marketed, sold or operated in the United States. Equipment authorised before that date was expressly excluded from the prohibition.

What did the FCC change in October 2025?

In a Second Report and Order adopted on 28 October 2025 in ET Docket 21-232, the Commission adopted rules allowing it to prohibit the importation, marketing or sale of previously authorised devices on a case-by-case basis, and rules extending its reach to otherwise compliant devices that contain certain component parts produced by Covered List entities. Together these close the two gaps left by the 2022 order: the resale of already-authorised models, and the component-parts route around the equipment authorisation process.

Does the European Accessibility Act require two-way communication in lifts?

Not directly. Directive (EU) 2019/882, applicable since 28 June 2025, sets functional accessibility requirements on products and services, and for electronic communications services — including emergency communications — it requires real-time text in addition to voice, total conversation where video is offered, and synchronisation of those channels to the appropriate public safety answering point. The lift alarm device itself is governed by lift safety standards such as EN 81-28. The Accessibility Act reaches the building's emergency communication through the service obligation rather than through a hardware schedule.

Which regime is changing market share faster?

Neither has moved the topline much yet. In FY2025 Hikvision's revenue was effectively flat at plus 0.01% and Dahua's rose 1.75%, while both grew net profit faster than sales through cost and mix. ASSA ABLOY, Allegion and dormakaba each grew organic revenue in the 3% to 4.1% range. What is growing faster than the group at the Western access players is the electromechanical and software layer — ASSA ABLOY's electromechanical sales grew 7% organically against 3% for the group — which is the product mix a compliance-cost regime rewards first.