The Federal Communications Commission added foreign-produced mobile robots and networked power inverters to its Covered List on July 28, a move that generally prevents new models from receiving the equipment authorization required for import, marketing, or sale in the United States.
How the FCC action changes market access and updates
The July 28 action bars new models that meet the determinations from the equipment-authorization process that enables import, marketing, or sale in the U.S. But the FCC made several narrow practical exceptions: previously authorized models can still be sold, devices people already own are unaffected, and federal purchases and use are unaffected by this action. The agency also made clear that previously authorized hardware can keep receiving qualifying security and compatibility updates.
At the same time, FCC rules exclude covered equipment from certification procedures for Class I and Class II permissive changes — a regulatory constraint that limits some routine paths vendors use to alter certified products. The FCC package provides no operative list of covered manufacturers or models; instead, coverage turns on the production- and technical-tests spelled out in the determinations. This is the third category-wide Covered List action, following foreign-produced drones in December 2025 and consumer routers in March 2026.
What counts as a “mobile robot” under the determination
The agency set a specific, technical definition for robots that triggers coverage. A covered robot must be a mechanical mobile device capable of ground locomotion, obstacle avoidance, or navigation, able to operate at a distance from a human operator via commands or sensor data. It must weigh more than 4.4 pounds including any applicable dock or ground station, carry an environmental sensor, and support wired or wireless communications at 200 kbps or faster in either direction.
The device must also run software — locally or remotely — that controls movement, perception, data collection, or remote command and control. The FCC explicitly includes firmware and artificial intelligence or machine-learning model weights within the software requirement. The determination carves out several categories: connected road vehicles at any weight, rail-only equipment, uncrewed aircraft, unmanned underwater vehicles, FDA-regulated medical and mobility devices, and fixed industrial arms (including SCARA, gantry, and delta designs) are excluded; a device outside those exclusions is covered if it clears the stated thresholds.
The robot determination cites published security research as supporting evidence. One early‑2026 report described a researcher accessing camera feeds, microphone audio, and floor‑plan maps from thousands of household robots. UniPwn research documented four Bluetooth Low Energy‑related CVEs, including CVE-2025-35027; that exploit chain gave researchers root command execution on Go2, B2, G1, and H1 units and could spread to nearby devices over BLE. A separate report — CVE-2025-2894 — could give anyone holding the correct API key full remote control of Unitree Go1 quadrupeds through the CloudSail service.
Why networked power inverters were added and the research cited
The inverter determination is framed around remote‑access risks. The FCC said remote access could be used to shut down devices, exfiltrate data, enable surveillance, or support cyberattacks against critical infrastructure. The package cites Forescout’s SUN:DOWN research, which reported 46 flaws across Sungrow, SMA, and Growatt products and described the possibility of fleet manipulation and grid instability, though it did not report an observed disruption.
The determination also cites Idaho National Laboratory on supply‑chain and remote‑connectivity risks, and ERCOT on the potential for rapid grid collapse in a worst‑case scenario. The FCC’s summary notes one incident in which a foreign manufacturer remotely disabled inverters after a dispute with a U.S. distributor, without naming the company.
Waivers, Conditional Approval, and deadlines for manufacturers and reviewers
The FCC’s Office of Engineering and Technology granted a waiver on the same day the Covered List additions took effect, allowing certain software and firmware changes "that patch vulnerabilities and facilitate compatibility with different operating systems" through at least January 1, 2029. Separately, manufacturers may apply to the FCC for Conditional Approval: the Department of War (DoW) may approve robotic devices, while DoW or the Department of Homeland Security (DHS) may approve power inverters. Applications must be submitted by January 1, 2028.
The determinations define "foreign-produced" by reference to the Buy American standard at 48 CFR 25.101(a): any article that fails to qualify as a "domestic end product" under that provision falls within the term as used in the national security determinations sent to the FCC on July 27.
What this means for technologists, manufacturers, and federal purchasers
- Technologists and security teams: the OET waiver preserves a path for security‑and‑compatibility firmware and software fixes through at least January 1, 2029, while the exclusion from permissive‑change certification routes will require attention to certification constraints when modifying covered products.
- Manufacturers and procurement leaders: coverage depends on the technical and production tests in the determinations rather than an ex ante list of vendors; those whose products do not qualify as a "domestic end product" under 48 CFR 25.101(a) should plan for Conditional Approval applications by January 1, 2028 and for a regulatory regime that limits routine permissive changes.
- Federal purchasers and end users: federal purchases and use remain unaffected by this FCC action, and devices already in the field can continue to be used and to receive qualifying updates.
By adding robots and inverters to the Covered List, the FCC framed the step as a preventive supply‑chain action; the package does not identify a confirmed active exploitation campaign against deployed robots or inverters. The calendar now provides two clear regulatory milestones — a Conditional Approval application deadline of January 1, 2028, and an OET waiver window that extends through at least January 1, 2029 — and leaves open how DoW and DHS will exercise their approval authorities and what specific evidence they will require when reviewing Conditional Approval requests.
