A consumer router is a WiFi system-on-chip, a set of RF front ends and antennas, some flash and RAM, an ethernet switch, and an amount of firmware entirely out of proportion to the size of the box. The silicon is not from here. The WiFi SoC will almost always be Broadcom, Qualcomm, MediaTek or Realtek, American and Taiwanese companies, and no delta house has displaced them. What Shenzhen owns is everything above that line: the integration, the antenna and thermal design, the firmware and cloud stack, the cost engineering, and the manufacturing at a scale nobody else offers. It is also worth knowing that the retail router in a box is the smaller half of this business. The larger half is carrier CPE, the gateways and optical terminals your internet provider hands you, bought in millions by telecoms operators who never put a brand on the outside.
That gives the delta two distinct trades. There are the retail brands, TP-Link and Tenda, competing on shelves and marketplaces worldwide, and there is the carrier ODM layer, which is genuinely enormous and almost invisible: Shenzhen Gongjin, trading as T&W, runs more than ten thousand employees and passed a hundred million units a year, building the modems, PON terminals and home gateways that carry other companies' logos. If you are sourcing networking hardware, the ODM layer is where the capability actually sits.
Now the gate, which is the most consequential single event documented anywhere in this guide. On 23 March 2026 the United States Federal Communications Commission added all consumer-grade routers produced in a foreign country to its Covered List, implementing a national security determination made three days earlier by a White House-convened interagency body. The practical effect is that new models cannot obtain FCC equipment authorisation, and without that they cannot be imported, marketed or sold in the United States. Routers already deployed are not banned or recalled and may continue to receive software and firmware updates, and an exemption route exists through Department of War or Homeland Security approval.
Read the definition carefully, because it is what makes this different from every other restriction in this atlas. A router counts as foreign-produced if any major stage of production occurs abroad, including manufacturing, assembly, design or development, and the location of final assembly is explicitly not determinative. Every previous trade measure could be answered by moving a production line. This one cannot: shifting final assembly to Vietnam does not help if the engineering happens in Nanshan. It is the first rule in this guide aimed at the design rather than the factory, which is precisely the layer this guide is about.
Europe went the other way and regulated the product rather than its origin. Since 1 August 2025 the cybersecurity provisions of the Radio Equipment Directive, Article 3(3)(d), (e) and (f) under Delegated Regulation (EU) 2022/30, have been mandatory, with EN 18031-1 the harmonised standard for anything acting as a network boundary. For a router that means demonstrated network protection, monitoring and anomaly reporting, and traffic controls such as rate limiting, and market surveillance authorities are actively checking. The Cyber Resilience Act reporting duty from September 2026 described on the Android tablets page sits on top. So the two largest markets now ask incompatible questions: one about where you are, the other about what your firmware does. Diligence follows from that. Ask where design and development actually take place rather than where the boxes are packed, ask to see the EN 18031 assessment rather than a CE certificate, and ask how long firmware support runs and how disclosed vulnerabilities are handled.