The cellular IoT module is a postage-stamp-sized radio soldered onto the circuit board of nearly every connected device — the part that links a water-treatment monitor, a payment terminal or a connected car to the network. Shanghai's Quectel is the world's largest module supplier — public estimates put its global share at roughly 40–45%, depending on tracker and segment definition — and it moved more than 100 million units in 2024 alone. The top five vendors, four of them Chinese, hold roughly three-quarters of global shipments; China-headquartered manufacturers hold roughly 71%. By one count, only three of the top ten module makers are insulated from Chinese state influence — and one has since left the market.
The risk is not the label on the device; it is the radio inside it. Module firmware is updated over the air by the manufacturer — a standard management channel that, if misused or compromised, could alter the behavior of every deployed unit. China's National Intelligence Law requires organizations to support, assist and cooperate with intelligence work — language US policymakers argue could compel module makers to assist state intelligence services. Congressional letters cite covert data collection from connected infrastructure and the possibility that devices — a grid sensor, a pipeline monitor — could be disrupted in a crisis. The trusted supply base is meanwhile shrinking: in January 2025 Switzerland's u-blox, one of the few Western suppliers at scale, exited the cellular module business, citing pressure from Chinese rivals whose modules sell 30–50% cheaper on state support.
Washington has answered on two tracks, and one just reached its deadline. The Pentagon added Quectel to its 1260H list of Chinese military companies on January 7, 2025, and under Section 805 of the FY2024 NDAA the direct DoD procurement ban on such modules took effect June 30, 2026; it extends to federal contractors' devices on June 30, 2027. The second track runs through the FCC, which cannot self-initiate: adding Quectel or Fibocom to the Covered List requires a formal determination by a national security agency. That mechanism produced the drone designations in December 2025 and a routers determination in March 2026. Modules are the open question.
One case shows why the label is the wrong unit of analysis. In December 2024 — weeks before the Pentagon named it a Chinese military company — Quectel licensed its manufacturing technology and reference designs to Eagle Electronics, a newly funded Ohio startup ($14M) building modules in Solon, Ohio; firmware is to be compiled and audited domestically by partner Finite State, per the companies' announcement. The label reads "Made in the USA"; the design remains Quectel's and generates license revenue for it. To a procurement officer screening brands against the 1260H list, the module presents as American. The same inversion runs through the device layer: a TAA-compliant, Vietnam-assembled router under a US brand can carry a Quectel module undisclosed in any bill of materials.
WireScreen resolves the layer the label hides: the module maker as a verified legal entity, its owners and ultimate state shareholders, its subsidy and party-committee record — each screened against 1260H, the FCC Covered List, the Entity List and Section 889. That resolution surfaces a distinction the federal lists do not: WireScreen classifies two active top-tier makers, Gosuncn Welink and Sunsea AIoT (SIMCom), as state security contractors — entities with documented operational relationships with China's internal security apparatus. Both ship into Western markets — SIMCom through authorized US and European distributors; Gosuncn Welink with FCC- and CE-certified modules carried by European distributors. That is how a bill of materials becomes a risk map — and a listed module gets flagged before a statute does.
| Maker / Base | Products / Role | Flag | Market Signal |
|---|---|---|---|
| — China: The Dominant Suppliers | |||
Quectel Shanghai, China · SH:603236 |
EC/RG/BG series — 4G/5G/NB-IoT/GNSS; the global volume leader | China 1260H-listed Jan 2025; DoD procurement restrictions under Section 805 · not on FCC Covered List · MIIT "Single Champion" |
~40–45% world · 100M+ units 2024 |
Fibocom Shenzhen, China · SZ:300638 |
FG/FM series — 5G, automotive & FWA; Europe via Rolling Wireless (2023) | China FCC referral to security agencies (2023) · House Select Cmte. flagged |
~10% · global #2 |
China Mobile IoT Beijing, China |
NB-IoT / LTE Cat.1 bis volume modules for the mass market | China State-owned; parent's US telecom services on the FCC Covered List |
~7% · fastest-growing vendor |
Sunsea AIoT (SIMCom) Shanghai, China |
SIM7xxx series — LTE/NB-IoT/GNSS; staple of tracking and metering | China WireScreen: state security contractor |
~5% |
MeiG Smart · Gosuncn Shenzhen / Guangzhou, China |
SLM series — 5G smart modules; expanding internationally | China Gosuncn Welink — WireScreen: state security contractor |
~2% · expanding abroad |
| — Trusted Alternatives (US · Japan · Emerging) | |||
Telit Cinterion Irvine, Calif., USA |
FE/ME/LE series — 5G/4G/LPWA, eSIM; the largest trusted supplier | USA US/EU ownership post-Thales merger |
~7% |
Semtech (Sierra Wireless) Camarillo, Calif., USA |
AirLink routers, LoRa/LPWA, 4G/5G cellular; acquired Sierra Wireless 2023 | USA Controls its own module layer end-to-end |
~3% |
Murata Manufacturing Kyoto, Japan |
Type 1SC/1DX — Wi-Fi/BT/GNSS combo modules | Japan Partial manufacturing footprint in China |
~4% |
Cavli Wireless San Jose, Calif., USA |
C-series — eSIM-native LTE/NB-IoT; emerging US alternative | USA Watch — US-origin capacity play |
<1% |
| — The Exit | |||
u-blox Thalwil, Switzerland |
SARA/LARA cellular lines (GNSS retained); assets to Trasna, Jun 2025 | CH Exited cellular modules Jan 15, 2025, citing Chinese price pressure |
trusted base −1 |
The direct DoD ban took effect June 30. The 2027 indirect phase is murkier — Section 805's component exemption leaves enforcement scope debated — but grey area is compliance risk, not safe harbor. With transitions running 12–18 months, the move now is a BOM-level discovery audit, then a phased shift to Telit, Semtech or Cavli sequenced against the 2027 deadline.
The missing legal step is a formal national-security determination; without one, the FCC cannot add Quectel or Fibocom on its own. The mechanism was exercised for drones in December 2025 and routers in March 2026 — and under FCC 25-71, a designation would bar the modules and every host device incorporating one from authorization.
Telit Cinterion and Semtech hold under 10% combined; u-blox is gone; Chinese modules undercut Western ones by 30–50%. The shrinking trusted pool would complicate any rapid replacement of Chinese modules should further restrictions arrive.
The next supply-chain fight will not be won by reading the label on the device. It will be won by knowing who made the radio inside it — and which government can reach them.
