The Federal Communications Commission has expanded its Covered List by adding foreign-produced mobile robots and networked power inverters, a move announced on July 28 that could block new versions of those devices from obtaining the equipment authorization required for importation, marketing, or sale in the United States.
The decision does not affect products that were already authorized. Existing devices owned by consumers remain unaffected, and federal agencies can continue purchasing and using previously approved equipment. Authorized hardware may also continue receiving eligible security and compatibility updates. Under normal FCC rules, covered equipment would otherwise be restricted from certification processes involving Class I and Class II permissive changes.
On the same day, the FCC’s Office of Engineering and Technology issued a waiver lasting through at least January 1, 2029. The waiver allows software and firmware modifications designed to “patch vulnerabilities and facilitate compatibility with different operating systems.”
Manufacturers seeking authorization for future changes can submit applications for Conditional Approval through the FCC. Robotic devices may receive approval from the Department of War (DoW), while power inverters may be approved by either the DoW or the Department of Homeland Security (DHS). Applications must be filed no later than January 1, 2028.
The categories are not tied to specific brands or countries. According to the two national security determinations submitted to the FCC on July 27, the term “foreign-produced” applies to any product that does not meet the definition of a “domestic end product” under the Buy American standard outlined in 48 CFR 25.101(a).
The FCC’s definition of a covered robot includes a mechanically mobile device capable of ground movement, obstacle avoidance, or navigation while operating away from a human operator through commands or sensor inputs. Such devices must weigh more than 4.4 pounds, including any applicable docking station or ground unit, contain an environmental sensor, and support wired or wireless communications at speeds of at least 200 kbps in either direction.
Covered robots must also operate software, either locally or remotely, that manages movement, perception, data gathering, or remote control functions. The software criteria include firmware as well as artificial intelligence and machine-learning model weights.
For power inverters, the FCC’s definition applies to systems that convert direct current into alternating current or perform the reverse conversion. The systems must also contain components capable of remote communication, control, sensing, data collection, or monitoring.
The FCC’s July 28 materials do not provide a list of affected manufacturers or specific models. Instead, coverage depends on whether products meet the production and technical requirements established in the determinations. However, the documents reference certain vendors, products, and security incidents as evidence supporting the decision.
The robot determination highlights three publicly available security reports. One report details an early-2026 discovery in which a researcher was able to access camera feeds, microphone audio, and floor-plan information from thousands of household robots.
Another cited report, known as UniPwn, documented four Bluetooth Low Energy-related vulnerabilities, including CVE-2025-35027. Researchers demonstrated that the exploit chain could provide root command execution on Go2, B2, G1, and H1 units and potentially spread to nearby devices through Bluetooth Low Energy (BLE). The third vulnerability, CVE-2025-2894, could allow anyone with the correct API key to gain complete remote control of Unitree Go1 quadruped robots through the CloudSail service.
The FCC’s fact sheet describes the category as “mobile robots, such as humanoids and quadrupeds,” though the formal determination covers a broader range of devices. It excludes connected road vehicles regardless of weight, rail-only equipment, uncrewed aircraft, unmanned underwater vehicles, FDA-regulated medical and mobility devices, and fixed industrial robotic arms such as SCARA, gantry, and delta systems. Devices outside those exclusions are covered if they meet the stated requirements.
The power inverter determination warns that remote access capabilities could potentially allow devices to be shut down, data to be extracted, surveillance to be conducted, or cyberattacks against critical infrastructure to be supported. The agency cited Forescout’s SUN:DOWN research, which identified 46 vulnerabilities across Sungrow, SMA, and Growatt products and discussed possible fleet manipulation and grid instability risks, though it did not report an actual grid disruption.
Additional references include research from Idaho National Laboratory concerning supply-chain and remote-access risks, analysis from ERCOT regarding the possibility of rapid grid collapse under worst-case conditions, and an incident involving a foreign manufacturer that remotely disabled inverters following a dispute with a US distributor. The manufacturer was not identified.
The FCC described the action as a preventive supply-chain security measure and did not cite evidence of an ongoing exploitation campaign targeting deployed robots or power inverters.
The latest designation marks the third broad Covered List expansion by category, following the addition of foreign-produced drones in December 2025 and consumer routers in March 2026.
