The Federal Communications Commission (FCC) has expanded its Covered List to include foreign-produced mobile robots and networked power inverters, effectively barring new models from obtaining the necessary equipment authorization for importation, marketing, or sale within the United States. This decision, announced on July 28, aims to mitigate potential cybersecurity threats associated with these devices.
Existing models that have already received authorization remain unaffected by this ruling, allowing continued sales and usage. Additionally, devices currently owned by consumers are not impacted. The FCC’s action does not extend to federal procurement or usage of these products.
Manufacturers are permitted to provide security and compatibility updates for previously authorized hardware. However, the FCC’s regulations exclude covered equipment from certification processes for Class I and Class II permissive changes. To address this, the FCC’s Office of Engineering and Technology has granted a waiver, effective until at least January 1, 2029, permitting software and firmware updates that address vulnerabilities and ensure compatibility with various operating systems.
Manufacturers seeking to introduce new models can apply for Conditional Approval through the FCC. The Department of War (DoW) is responsible for approving robotic devices, while both the DoW and the Department of Homeland Security (DHS) oversee approvals for power inverters. Applications must be submitted by January 1, 2028.
The FCC’s definition of “foreign-produced” aligns with the Buy American standard, encompassing any product that does not qualify as a “domestic end product” under 48 CFR 25.101(a). The criteria for mobile robots include mechanical devices capable of ground locomotion, obstacle avoidance, or navigation, operating remotely from a human operator via commands or sensor data. These robots must weigh over 4.4 pounds, carry environmental sensors, support wired or wireless communications at speeds of 200 kbps or faster, and run software locally or remotely to control movement, perception, data collection, or remote command and control. This software requirement encompasses firmware and artificial intelligence or machine-learning model weights.
For power inverters, the definition covers systems that convert direct current to alternating current, or vice versa, and contain components for remote communication, control, sensing, data collection, or monitoring.
The FCC’s recent action does not provide a specific list of affected manufacturers or models. Instead, coverage is determined based on production and technical criteria. Supporting evidence for this decision includes security reports highlighting vulnerabilities in household robots, such as unauthorized access to camera feeds, microphone audio, and floor-plan maps. Additionally, research has documented Bluetooth Low Energy-related vulnerabilities that could allow root command execution on various robot units and potential remote control of certain quadrupeds through cloud services.
While the FCC’s fact sheet refers to the category as “mobile robots, such as humanoids and quadrupeds,” the determination encompasses a broader range of devices. Exclusions include connected road vehicles, rail-only equipment, uncrewed aircraft, unmanned underwater vehicles, FDA-regulated medical and mobility devices, and fixed industrial arms like SCARA, gantry, and delta designs. Devices outside these exclusions are subject to the new regulations if they meet the specified criteria.
This move by the FCC underscores the growing emphasis on securing the nation’s technological infrastructure from potential cyber threats. By restricting the importation and sale of certain foreign-produced devices, the FCC aims to protect critical systems and consumer data from vulnerabilities that could be exploited by malicious actors. Manufacturers and consumers alike should stay informed about these developments to ensure compliance and maintain the security of their devices.
