Rules can be implemented without being a law or a bill. That is the FCC's position, that they can implement this as a rule that implements existing law.
One related element is that there is indeed a bill that has been introduced in both the Senate and House to ban NDAA-covered companies...