FCC Bars New Foreign Robots, Power Inverters on Cyber Risk

The FCC added foreign-produced mobile robots and networked power inverters to its Covered List on July 28, according to The Hacker News. New models in both categories can no longer receive the equipment authorization required to be imported, marketed, or sold in the US. Previously authorized models remain available. Devices already in service are unaffected.

Those two lines are what the action does. It closes the door on new deployments of covered equipment in these categories and leaves everything already installed alone.

What this means for procurement

If you’re buying new mobile robots or networked power inverters, country of origin is now a compliance filter, not just a supply-chain preference. A device from a covered manufacturer that lacks valid equipment authorization cannot be legally imported, marketed, or sold in the US. That’s not a policy suggestion — it’s a condition of market access.

For federal procurement, Covered List restrictions carry additional teeth. If you’re in a federal acquisition role, get current guidance from your contracting officer before placing any new orders in these categories. Don’t assume existing relationships carry forward; get it in writing before the purchase order.

For commercial operators, the burden falls on vendors to maintain authorization — but if a product can’t be authorized, it won’t move through legitimate US channels. Your vendor should be able to confirm current authorization status. If they can’t, that’s an answer too.

Priority call

Mobile robots are embedded in warehousing, logistics, manufacturing, and defense facilities. Networked power inverters sit at the grid edge — solar installations, data centers, industrial UPS systems, anywhere power conditioning interfaces with a control network. Both categories carry real attack surface: a compromised device offers persistent physical access, operational visibility inside a facility, or a network pivot point from hardware that typically gets less scrutiny than servers and endpoints.

The CubePilot DNS hijacking reported two days ago was a reminder that hardware with network dependencies is hardware with exposure — drone flight controller developer CubePilot had traffic intercepted via DNS manipulation. The risk profile for networked robots and power management hardware isn’t fundamentally different.

If you have active procurement requests in either category, check vendor authorization status now, before the purchase order is approved. If you’re planning infrastructure refreshes that include either device type, run your vendor list against the Covered List before finalizing contracts. The time to catch a compliance problem is at evaluation, not delivery.

For the full list of covered equipment and manufacturers: FCC Covered List.