Key Takeaways
- On July 28 the FCC added foreign‑produced mobile robots and networked power inverters to its Covered List, blocking new models from obtaining the equipment authorization needed for import, marketing, or sale in the United States.
- Previously authorized devices may continue to be sold, and units already owned by consumers are unaffected; federal purchases and use also remain unchanged.
- Existing hardware can still receive qualifying security and compatibility updates, and the FCC granted a waiver (valid through Jan 1 2029) for software/firmware changes that patch vulnerabilities or improve OS compatibility.
- Manufacturers may seek Conditional Approval via the FCC; the Department of War (DoW) can approve robotic devices, while DoW or the Department of Homeland Security (DHS) may approve power inverters, with applications due by Jan 1 2028.
- “Foreign‑produced” means any article that fails to qualify as a domestic end product under the Buy American standard (48 CFR 25.101(a)).
- Mobile‑robot coverage applies to ground‑locomotion devices > 4.4 lbs (including dock/station) that carry an environmental sensor, communicate at ≥200 kbps, and run software (including AI/ML model weights) for movement, perception, data collection, or remote command‑and‑control.
- Certain categories—connected road vehicles, rail‑only equipment, uncrewed aircraft, unmanned underwater vehicles, FDA‑regulated medical/mobility devices, and fixed industrial arms (SCARA, gantry, delta)—are excluded from the robot definition.
- Networked power inverters are defined as DC‑AC (or AC‑DC) converters that contain components for remote communication, control, sensing, data collection, or monitoring.
- The robot determination cites three security reports: a 2026 finding of unauthorized access to robot cameras, microphones, and floor‑plan maps; UniPwn research revealing four BLE‑related CVEs (including CVE‑2025‑35027) enabling root command execution on several Unitree models; and CVE‑2025‑2894, which grants full remote control of Unitree Go1 quadrupeds via the CloudSail service when an API key is known.
- The inverter determination references Forescout’s SUN:DOWN research (46 flaws across Sungrow, SMA, and Growatt), Idaho National Laboratory’s supply‑chain and remote‑connectivity warnings, ERCOT’s grid‑collapse scenarios, and a documented case where a foreign manufacturer remotely disabled inverters after a dispute with a U.S. distributor.
- The FCC frames the move as a preventive supply‑chain measure; no active exploitation campaign against deployed robots or inverters has been identified. This is the third category‑wide Covered List action, following foreign‑produced drones (Dec 2025) and consumer routers (Mar 2026).
Overview of the FCC Action
On July 28, 2026 the Federal Communications Commission amended its Covered List to include foreign‑produced mobile robots and networked power inverters. The amendment generally prevents any new model of these device types from receiving the equipment authorization required for import, marketing, or sale within the United States. The rule does not retroactively affect devices that have already been authorized; those products may continue to be marketed and sold, and consumers who already own them may keep using them without interruption. Federal government procurement and operational use of the covered equipment are also exempt from the new restriction.
Impact on Existing Devices and Federal Use
Because the FCC’s action targets only new equipment authorizations, previously cleared robots and inverters retain their legal status. Manufacturers may continue to sell existing inventory, and end‑users can maintain operation of devices already in the field. The order explicitly states that federal purchases and usage are unaffected, meaning government agencies may still acquire and deploy covered systems that were authorized prior to the July 28 decision. This approach mirrors prior Covered List actions for drones and consumer routers, where the FCC sought to limit future risk while preserving current operational capability.
Updates and Waivers for Software/Firmware
Recognizing that legitimate maintenance is necessary, the FCC’s Office of Engineering and Technology issued a waiver effective the same day as the listing. The waiver, valid through January 1 2029, permits software and firmware updates that “patch vulnerabilities and facilitate compatibility with different operating systems.” Such changes do not trigger a new equipment authorization requirement, allowing manufacturers to address security flaws or adapt products to evolving OS environments without seeking fresh clearance. The waiver does not extend to functional upgrades that alter the device’s core capabilities beyond security or compatibility purposes.
Conditional Approval Process
Manufacturers wishing to introduce new models of covered robots or inverters after the listing may apply for Conditional Approval through the FCC. The application must be submitted no later than January 1 2028. For robotic devices, the Department of War (DoW) holds authority to grant approval; for networked power inverters, either the DoW or the Department of Homeland Security (DHS) may issue the conditional clearance. This pathway enables limited deployment under strict oversight, provided the applicant can demonstrate that the product meets national‑security safeguards and does not pose an unacceptable risk.
Definition of Foreign‑Produced
The FCC’s Covered List hinges on the notion of “foreign‑produced” as defined by the Buy American standard at 48 CFR 25.101(a). An article is considered foreign‑produced if it fails to qualify as a domestic end product under that regulation. Consequently, the determination is not tied to any specific brand or country of origin; instead, it evaluates whether the product’s manufacturing and supply chain satisfy the domestic‑content thresholds set forth in federal acquisition rules.
Technical Criteria for Mobile Robots
To fall under the robot category, a device must be a mechanical mobile system capable of ground locomotion, obstacle avoidance, or navigation and able to operate at a distance from a human operator via commands or sensor data. It must weigh more than 4.4 lb (including any dock or ground station), incorporate an environmental sensor, and support wired or wireless communication at a minimum of 200 kbps in either direction. Additionally, the robot must run software—either locally or remotely—that controls movement, perception, data collection, or remote command‑and‑control functions; this software requirement explicitly includes firmware and any artificial‑intelligence or machine‑learning model weights.
Exclusions from Robot Coverage
The determination deliberately narrows the scope by carving out several classes of equipment that, despite meeting some technical thresholds, are deemed outside the intended risk profile. Excluded are connected road vehicles of any weight, rail‑only equipment, uncrewed aircraft, unmanned underwater vehicles, FDA‑regulated medical and mobility devices, and fixed industrial arms such as SCARA, gantry, and delta configurations. A device that does not belong to any of these excluded classes and satisfies the robot‑specific criteria will be considered covered, regardless of its exact form factor (e.g., humanoid, quadruped, or wheeled platform).
Technical Criteria for Networked Power Inverters
The inverter definition covers systems that convert direct current to alternating current, or the reverse, and contain components enabling remote communication, control, sensing, data collection, or monitoring. This includes smart inverters used in renewable‑energy installations, energy‑storage systems, and grid‑interactive devices that rely on networked interfaces for performance monitoring, fault detection, or grid‑support functions. The presence of any remote‑access capability—whether for configuration, diagnostics, or control—places the inverter within the scope of the Covered List, provided it is foreign‑produced under the Buy American test.
Security Basis for Robot Determination
The FCC’s robot determination leans on three publicly reported security investigations. First, an early‑2026 study showed that a researcher could access camera feeds, microphone audio, and floor‑plan maps from thousands of household robots, highlighting privacy and surveillance risks. Second, the UniPwn research documented four Bluetooth Low Energy (BLE)‑related CVEs, notably CVE‑2025‑35027, whose exploit chain granted root command execution on Unitree Go2, B2, G1, and H1 units and could propagate to nearby devices via BLE. Third, CVE‑2025‑2894 was cited, wherein possession of a valid API key allowed full remote control of Unitree Go1 quadrupeds through the CloudSail service. Collectively, these findings illustrate how software vulnerabilities in mobile robots can lead to unauthorized data exfiltration, surveillance, and potential weaponization.
Security Basis for Inverter Determination
For networked power inverters, the determination cites multiple lines of evidence. Forescout’s SUN:DOWN research uncovered 46 distinct flaws across products from Sungrow, SMA, and Growatt, demonstrating how attackers could manipulate fleets of inverters to cause grid instability or support broader cyberattacks. The Idaho National Laboratory supplied analysis on supply‑chain and remote‑connectivity risks, emphasizing the ease with which compromised firmware could be inserted. ERCOT modeled worst‑case scenarios indicating that coordinated inverter shutdowns could precipitate rapid grid collapse. Finally, the determination references an actual incident in which a foreign manufacturer remotely disabled inverters after a dispute with a U.S. distributor, underscoring the real‑world feasibility of such actions.
Preventive Nature and Context of the Action
The FCC explicitly frames this Covered List amendment as a preventive supply‑chain measure rather than a response to an ongoing exploitation campaign. No confirmed active attacks against deployed robots or inverters in the United States have been identified to date. By blocking new foreign‑produced models from obtaining equipment authorization, the agency seeks to reduce the future attack surface while allowing existing, vetted equipment to remain in service. This marks the third category‑wide Covered List action undertaken by the FCC, following the December 2025 listing of foreign‑produced drones and the March 2026 inclusion of consumer routers, reflecting a growing focus on securing critical communications‑and‑infrastructure equipment against supply‑chain threats.