DMCA Section 1201 Exemptions: What the 2027 Rulemaking Means for Repair, Security Research, and Device Access

The Digital Millennium Copyright Act’s anti-circumvention rules are easy to misunderstand because they can apply even when the underlying activity is not ordinary copyright infringement. That distinction is becoming especially important again as the U.S. Copyright Office moves through the 2027 cycle of its triennial rulemaking under 17 U.S.C. § 1201.

The Copyright Office opened the tenth triennial proceeding in June 2026. Petitions to renew existing exemptions and petitions seeking new exemptions were due August 24, 2026, and comments supporting or opposing renewal petitions were due September 28, 2026. The current record now includes requests involving vehicle repair, access to vehicle data, consumer-device repair, medical-device servicing, security research, assistive technologies, text and data mining, abandoned video games, 3D printers, and other software-enabled products.

For technology companies, repair businesses, researchers, equipment owners, and copyright owners, the proceeding matters because the exemptions do not rewrite copyright law generally. They temporarily remove one specific legal barrier—the prohibition on circumventing certain access controls—for defined classes of works and defined noninfringing uses.

Section 1201 regulates access controls separately from infringement

Section 1201 of the Copyright Act generally prohibits circumventing a technological measure that effectively controls access to a copyrighted work. In practical terms, that can include bypassing software locks, authentication mechanisms, encryption, firmware restrictions, or other technological barriers used to control access to copyrighted code or content.

The statute also contains separate anti-trafficking provisions directed at technologies, products, services, devices, and components designed or marketed for circumvention. That matters because the triennial exemptions focus on the prohibition in section 1201(a)(1)(A). An exemption that permits a user to circumvent an access control for a particular noninfringing purpose does not automatically authorize every circumvention tool, service, or downstream use.

Nor does an exemption create a defense to copyright infringement generally. Section 1201 itself states that the triennial exemption is not a defense to other provisions of the Copyright Act. A person still must have a lawful basis for the underlying use, whether because the use is authorized, noninfringing, or protected by a doctrine such as fair use.

Why Congress created a three-year exemption process

Congress built a recurring safety valve into section 1201 because access-control rules can affect lawful uses as technology changes. Every three years, the Librarian of Congress, acting on the recommendation of the Register of Copyrights after a public proceeding, may identify classes of copyrighted works for which the prohibition is adversely affecting or is likely to adversely affect users seeking to make noninfringing uses.

The current exemptions are codified in 37 C.F.R. § 201.40. The Copyright Office has explained that exemptions renewed in the 2027 proceeding would remain in effect for another three-year period, from October 2027 through October 2030.

The Office uses a streamlined renewal process for exemptions granted in the prior cycle. Parties seeking to expand an existing exemption or obtain protection for conduct not already covered must instead pursue a new exemption. That distinction matters because a request that sounds like a “renewal” can become a new-exemption request if it would materially change the scope or regulatory language.

The 2027 record shows where software and ownership collide

The renewal petitions and comments illustrate how section 1201 now reaches far beyond movies, music, and traditional digital media. Modern products frequently contain copyrighted software that controls physical equipment, stores operational information, or determines whether a user can diagnose, repair, modify, or study a device.

Among the renewal requests are exemptions involving computer programs that control motor vehicles, marine vessels, agricultural equipment, consumer devices, commercial food-preparation equipment, and medical devices. Other petitions concern good-faith security research, jailbreaking certain devices, accessing personal medical-device data, and preserving software and video games.

The comments filed by the September 28 deadline also show that some areas remain contested. The Copyright Office’s public record includes opposition to aspects of vehicle repair, vehicle-data access, medical-device servicing, noncommercial video uses, and text-and-data-mining renewals, alongside comments supporting certain educational, vehicle-data, and medical-device exemptions.

Those submissions do not mean the Office has accepted or rejected a position. They are advocacy in an ongoing rulemaking. The Office must evaluate the record before the Librarian ultimately issues the next set of temporary exemptions.

Repair exemptions can be narrower than “right to repair”

Businesses should be careful not to treat a section 1201 exemption as a broad federal right-to-repair statute. The exemption only addresses the anti-circumvention prohibition within its defined boundaries. It does not necessarily override contracts, patent rights, trade-secret law, safety regulations, warranty terms, computer-access laws, or other legal restrictions that may apply to the same conduct.

For example, a business may have a plausible noninfringing reason to access software embedded in a device for diagnosis or repair. If the applicable class in § 201.40 covers that device and purpose, circumvention of an access control may be permitted under section 1201(a)(1). But copying protected source code, distributing proprietary software, misappropriating confidential information, or violating another statute presents different legal questions.

That is one reason companies building software-enabled products should coordinate their copyright strategy with broader intellectual-property planning. Tucker Law’s copyright practice addresses registration, ownership, enforcement, and digital-content issues that may overlap with embedded software and access controls.

Security research has its own boundaries

Security research is another area where the label alone does not answer the legal question. Section 1201 contains statutory provisions addressing security testing, and the triennial regulations also include temporary exemptions for specified good-faith security research.

The details matter. Researchers should examine who is performing the research, what system is being accessed, how the access was obtained, whether the activity is genuinely directed at testing or correcting security flaws, what happens to the resulting information, and whether other laws independently restrict the conduct.

The triennial process therefore should not be viewed as a simple permission slip to defeat technological protection measures. It is a carefully bounded exception within a statute that otherwise treats circumvention as an independent legal issue.

Copyright owners should watch the rulemaking too

The 2027 proceeding is not relevant only to users seeking exemptions. Copyright owners, software developers, device manufacturers, and licensors should review the proposed classes because the final rules can change the circumstances in which customers, repair providers, researchers, or other users may lawfully bypass access controls.

That can affect product design, licensing strategy, service models, technical-support policies, documentation, enforcement decisions, and the way a company frames a dispute. A demand letter alleging unauthorized circumvention should be checked against the current regulatory exemptions before assuming that bypassing an access control creates section 1201 liability.

Similarly, an infringement analysis should not collapse section 1201 and ordinary copyright infringement into a single issue. Tucker Law’s copyright infringement practice addresses the separate questions of ownership, copying, defenses, remedies, and enforcement.

What happens next in the 2027 proceeding

The Copyright Office is now past the initial petition-and-renewal-comment stage. The official 2027 proceeding page states that renewal and new-exemption petitions were due August 24 and that renewal comments were due September 28. The Office will continue developing the record before the Librarian issues the exemptions that will govern the next three-year period.

For existing exemptions, the practical question is whether the record supports streamlined renewal. For newly proposed or expanded exemptions, the process requires a fuller evidentiary showing. Businesses with activities that depend on a current exemption should not assume that the regulatory language will remain unchanged after October 2027.

It is also important to distinguish the current rule from the future one. Until the next exemptions take effect, the present classes in 37 C.F.R. § 201.40 remain the operative regulatory text. The fact that a new or expanded exemption has been proposed does not itself authorize the conduct today.

How companies should evaluate a Section 1201 problem

A useful analysis begins with the copyrighted work and the access control, not with the business label placed on the activity. Is the relevant software or content protected by copyright? What technological measure controls access? What exactly must be bypassed? Who is doing the circumvention, and for what purpose? Is the contemplated use noninfringing? Does the current regulation cover the class of work, user, device, and purpose? Are there separate anti-trafficking concerns if tools or services are being provided to others?

Those questions can produce different answers for a product owner, independent repair shop, security researcher, equipment manufacturer, software vendor, or litigation defendant even when they are interacting with the same device.

Companies whose business models depend on software locks, repair access, embedded systems, security research, or protected digital content should review the current exemptions and monitor the 2027 proceeding rather than waiting for a dispute. Where litigation is already underway, Tucker Law can also serve as Florida copyright litigation local counsel in federal copyright matters.

If a section 1201 issue intersects with copyright ownership, software licensing, infringement, repair access, or enforcement strategy, contact Tucker Law to discuss the specific technology and legal posture.

This article provides general legal information and is not legal advice. Section 1201 exemptions are fact- and regulation-specific, and other federal or state laws may apply to the same conduct.