Center for Federal Accountability

Copyright Office sends the medical device repair exemption back for a full record and opens comment on repair, privacy and security exemptions

In its tenth review of exemptions to the Digital Millennium Copyright Act's ban on breaking digital locks, the Copyright Office intends to renew every current exemption except the one for repairing medical devices, which faced new evidence from manufacturers and will be decided on a new record. Supporting comments are due December 7, 2026; opposition comments February 22, 2027; replies March 22, 2027.

2026-10-29 · U.S. Copyright Office, Library of Congress · Information · Docket Docket No. 2026-4

On October 28, 2026, the U.S. Copyright Office published the proposals for its tenth triennial rulemaking under section 1201 of the Digital Millennium Copyright Act (91 FR 67788, Docket No. 2026-4, regulations.gov docket COLC-2026-0199). Section 1201 makes it unlawful to get around technology that controls access to a copyrighted work, including the software that runs phones, cars, televisions and hospital equipment. Every three years the Librarian of Congress, on the recommendation of the Register of Copyrights, can grant temporary exemptions. Comments come in three rounds: supporters and neutral parties by December 7, 2026, opponents by February 22, 2027, and replies from the first group by March 22, 2027. Two comments had been posted as of October 29, 2026, according to the Federal Register record.

## What the notice does

After its June 9, 2026 notice of inquiry (91 FR 34795), the Office received 43 petitions to renew current exemptions and 25 petitions for new or expanded ones (91 FR 67788). It says the Register intends to recommend renewing every current exemption in its existing wording except one: the exemption for diagnosing, maintaining and repairing medical devices and systems, 37 CFR 201.40(b)(17) (91 FR 67790). Renewal under this streamlined process means the exemption carries over without a new evidentiary record.

The new petitions are consolidated into ten proposed classes. The Office declined to put two petitions out for comment, one covering online audiovisual works, web pages and PDFs for a long list of users and purposes, and one seeking a class-wide remedy for optical discs, because they do not describe "a particular class of copyrighted works" as the statute requires (91 FR 67806). For the first time the Office caps comments at 25 pages per class per round, not counting documentary evidence such as affidavits and exhibits (91 FR 67807).

## Medical device repair goes back to a full record

The current exemption lets owners and servicers get around locks on "[c]omputer programs that are contained in and control the functioning of" a lawfully acquired medical device or system, "and related data files," when that is a necessary step for diagnosis, maintenance or repair (37 CFR 201.40(b)(17)). Eight petitioners, most of them independent companies that service medical equipment, asked to renew it. One comment supported renewal and four opposed it: two from the medical device trade group AdvaMed, one from Philips North America and one from a coalition of entertainment industry groups (91 FR 67797).

The opponents pointed to the D.C. Circuit's September 1, 2026 decision in Medical Imaging & Technology Alliance v. Library of Congress, which affirmed the dismissal of a challenge to the exemption, and filed sworn declarations from manufacturers. According to the notice, the declarations say device makers distinguish "Clinical Operation Software" from servicing and diagnostic software and maintenance documentation, protect them with different locks, and license the servicing materials separately (91 FR 67797-67798). The Office said the court decision "did not change the legal framework," but found that the new evidence "may cast uncertainty on the current reliability of the existing administrative record" and amounts to "meaningful opposition" (91 FR 67798).

The existing exemption and requests to widen it are now Proposed Subclass 8(b). One petitioner, Marshall Shannon, asks that it expressly cover "cybersecurity-related reconfiguration" and access to "certificates, credentials, utilities, and technical materials"; another, Trimedx, lists "regulatory compliance" as a use (91 FR 67804-67805). The Office asks commenters to identify each type of program and data file, how it is configured on the device, and whether each use is noninfringing (91 FR 67805).

## Security research and government IT

The exemption for good-faith security research, 37 CFR 201.40(b)(18), drew no opposition and is set for renewal. Professors Matt Blaze and Steven Bellovin told the Office that "one of us has continued to be impacted by threats of prospective litigation from copyright holders in connection with his security research on software in voting systems" (91 FR 67799). The exemption's own text says it is not a safe harbor under other laws, naming the Computer Fraud and Abuse Act (89 FR 85449).

In Subclass 8(a), Public Knowledge and iFixit ask to extend the consumer device repair exemption to "business and enterprise IT devices such as laptops, [secure cell phones,] servers, and storage," with "enterprise, industrial, and government owners and operators" as eligible users (91 FR 67804). Their petition says manufacturers have abandoned many enterprise models, which "raises significant cybersecurity risk for entities---including the federal government---who are working on legacy systems." In 2024 the Register declined a broader commercial and industrial repair class on that record, although the Justice Department's Antitrust Division and the Federal Trade Commission filed comments supporting it and the National Telecommunications and Information Administration supported it (89 FR 85443). The Office now asks for "additional examples" of harm (91 FR 67804).

## Privacy-related proposals

Proposed Class 7 includes a request from the FULU Foundation to allow removal of automatic content recognition software from smart televisions, and a joint request from Public Knowledge and FULU to let owners of doorbell cameras, baby monitors and security cameras route video to their own servers (91 FR 67803). The renewed exemptions include the one letting vehicle owners access, store and share their vehicles' operational and telematics data (91 FR 67796) and the one for patients' access to data from their own medical devices (91 FR 67794).

## CFA's observations

These are CFA's observations from the text, not findings about how the exemptions are used.

In 2024, three organizations opposed renewing the medical device exemption, arguing that it undermined the Food and Drug Administration's maintenance and repair standards and that the Supreme Court's Warhol decision changed the law. The exemption was renewed through the streamlined process, with the Office saying it "generally does not consider other regulatory schemes" (89 FR 85441). This year's notice turns on a different question, how device software is divided and configured, and does not mention the Food and Drug Administration.

Government owners would be eligible users under the enterprise IT proposal, but the notice does not say whether any federal agency has filed in this cycle. It says only that the record "may include submissions from other parts of the federal government" and that the Register will consult the National Telecommunications and Information Administration (91 FR 67808).

The notice has small citation slips: footnote 270 cites "37 CFR 201.40(15)(ii), (16)(ii)" without the paragraph (b) (91 FR 67805), footnote 302 points to "supra page 2" (91 FR 67807), and Section IV.A.1 refers readers to the Addresses section for the legal standards, which are in Section I (91 FR 67807).

## CFA's records on the Library of Congress

CFA's agency scoreboard does not grade the Library of Congress or the Copyright Office. CFA's privacy-notice report links 18 Federal Register documents to the Copyright Office and found no privacy impact assessment pages for it, but those figures do not measure this rulemaking.

## What to watch

Whether the Subclass 8(b) record separates clinical operating software from servicing software, and whether a final medical device exemption is narrower, broader or unchanged.

Whether federal agencies, including those that buy and maintain medical and enterprise IT equipment, file comments, and what the National Telecommunications and Information Administration recommends.

Whether the enterprise IT expansion is supported this time with specific examples of locked or abandoned equipment, including in government.

Whether the smart television and home camera proposals advance to the hearings and the Register's recommendation.

## How to comment

Comments go through regulations.gov. Short comments can be typed into the comment field; longer submissions must use the long comment form on the Office's site at copyright.gov/1201/2027. Each proposed class needs its own submission, and the 25-page limit applies per class per round, with Class 8 limited to 25 pages per subclass. The Office plans online public hearings in spring 2027.

Authorities