The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28. The move generally prevents new models from receiving the equipment authorization required for import, marketing, or sale in the US.
Previously authorized models can still be sold, and devices people already own are unaffected. Federal purchases and use are also unaffected by this FCC action.
Previously authorized hardware can keep receiving qualifying security and compatibility updates. FCC rules otherwise exclude covered equipment from certification procedures for Class I and Class II permissive changes.
The FCC’s Office of Engineering and Technology granted a waiver the same day, through at least January 1, 2029, for software and firmware changes that “patch vulnerabilities and facilitate compatibility with different operating systems.”
Manufacturers can apply through the FCC for Conditional Approval. The Department of War (DoW) may approve robotic devices, while DoW or the Department of Homeland Security (DHS) may approve power inverters. Applications must be submitted by January 1, 2028.
Neither category is defined by brand or by a named country. Under the two national security determinations behind the action, sent to the FCC on July 27, “foreign-produced” means any article that fails to qualify as a “domestic end product” under the Buy American standard at 48 CFR 25.101(a).
The robot definition covers a mechanical mobile device capable of ground locomotion, obstacle avoidance, or navigation that can operate at a distance from a human operator using commands or sensor data. It must weigh more than 4.4 lbs including any applicable dock or ground station, carry an environmental sensor, and support wired or wireless communications at 200 kbps or faster in either direction.
It must also run software locally or remotely to control movement, perception, data collection, or remote command and control. The software requirement includes firmware and artificial intelligence or machine-learning model weights.
The inverter definition covers systems that convert direct current to alternating current, or the reverse, and contain components for remote communication, control, sensing, data collection, or monitoring.
The FCC’s July 28 package provides no operative list of covered manufacturers or models. Coverage turns on those production and technical tests, although the determinations cite named vendors, products, and incidents as supporting evidence.
The robot determination cites three published security reports. One describes an early-2026 finding that a researcher could access camera feeds, microphone audio, and floor-plan maps from thousands of household robots.
It also cites UniPwn, research that documented four Bluetooth Low Energy-related CVEs, including CVE-2025-35027. The exploit chain gave researchers root command execution on Go2, B2, G1, and H1 units and could spread to nearby devices over Bluetooth Low Energy (BLE). The third is CVE-2025-2894, which could give anyone holding the correct API key full remote control of Unitree Go1 quadrupeds through the CloudSail service.
The agency’s fact sheet calls the category “mobile robots, such as humanoids and quadrupeds.” The determination is wider. It carves out connected road vehicles at any weight, rail-only equipment, uncrewed aircraft, unmanned underwater vehicles, FDA-regulated medical and mobility devices, and fixed industrial arms including SCARA, gantry, and delta designs. A device outside those exclusions is covered if it clears the thresholds.
The inverter determination says remote access could be used to shut down devices, exfiltrate data, enable surveillance, or support cyberattacks against critical infrastructure. Forescout’s SUN:DOWN research reported 46 flaws across Sungrow, SMA, and Growatt products and described possible fleet manipulation and grid instability, not an observed disruption.
The determination also cites Idaho National Laboratory on supply-chain and remote-connectivity risks, ERCOT on the potential for rapid grid collapse in a worst-case scenario, and one case in which a foreign manufacturer remotely disabled inverters after a dispute with a US distributor. It does not name the company.
The FCC package frames this as a preventive supply-chain action; it does not identify a confirmed active exploitation campaign against deployed robots or inverters.
This is the third category-wide Covered List action, after foreign-produced drones in December 2025 and consumer routers in March 2026.
