FCC Robot Ban Explained: What the Covered List Means for Humanoid Robot Security
The FCC robot ban adds foreign-made humanoids and mobile robots to the Covered List. What it covers, what's grandfathered, and what security teams should do.
Last updated: October 4, 2026
TL;DRThe FCC robot ban is a Covered List entry, not a recall. On July 28, 2026 the FCC added "foreign-produced advanced robotic devices" (mobile robots such as humanoids and quadrupeds) to its Covered List, which blocks new models from getting FCC equipment authorization.Robots already authorized or already bought are not banned. Grandfathered models can still be sold and used, and a waiver lets vendors keep shipping security patches (Class I/II software changes) until at least January 1, 2029.The rationale is security, not just trade. The national security determination points to documented incidents, including exposed robot camera feeds and the 2025 Unitree Bluetooth "botnet" exploit. If you run humanoids, treat patch access and data flows as the things to watch.
The FCC robot ban is the US Federal Communications Commission's July 28, 2026 decision to add foreign-produced "advanced robotic devices" (humanoids, quadrupeds, warehouse AMRs, delivery and household robots) to its Covered List. New foreign-made models can no longer get the FCC authorization needed to be imported or sold in the US, unless the Department of War grants a Conditional Approval. Below we explain what is actually covered, what it changes for security teams, and what it doesn't.
What is the FCC Covered List, and why are robots on it now?
The Covered List is the FCC's list of communications equipment and services judged to pose "an unacceptable risk to the national security of the United States or the safety and security of United States persons." Equipment on it cannot receive new FCC equipment authorizations, and in practice almost every connected device needs one before it can be marketed or imported in the US.
According to the FCC fact sheet, a White House-convened interagency body issued a National Security Determination on July 27, 2026, and the FCC's Public Safety and Homeland Security Bureau added the robots (alongside connected power inverters) the next day, July 28, 2026 (Sidley).
The security reasoning is explicit. As Robotics & Automation News summarized it, connected robots "collect significant amounts of information" and compromised machines "could be remotely controlled, used for surveillance, or provide access to sensitive networks and facilities." Mobility is what makes this different from a smart speaker: a robot carries cameras, microphones and radios through warehouses, labs, hospitals and homes.
Which robots does the FCC robot ban cover?
The definition is broader than "humanoids." Per law-firm analyses of the determination (Sidley, K&L Gates), an advanced robotic device is a ground-mobile machine operating at a distance from a human operator, weighing more than 4.4 lb (including any dock), and containing a sensor, connectivity of at least 200 kbps, and controlling software.
| Covered (if foreign-produced) | Not covered | |
|---|---|---|
| Examples | Humanoid platforms, inspection quadrupeds, warehouse AMRs, sidewalk delivery robots, household robots (K&L Gates notes this can include robot vacuums and lawn mowers meeting the thresholds) | Connected vehicles, rail vehicles, drones/uncrewed aircraft, underwater vehicles, FDA-regulated medical devices, fixed industrial robots such as robotic arms |
| Components | Not listed separately; only assembled devices meeting the definition | |
| Already-authorized models | Grandfathered from the listing | |
| Federal government use | Not affected by this action, per the FCC fact sheet |
Two scoping details matter for anyone buying humanoids:
- "Foreign-produced" is strict. Sidley explains it uses the Buy American Act test: the robot must be manufactured in the US and US components must exceed 65% of component cost (rising in 2029). Components from allied countries do not count as domestic. That means the rule is not limited to Chinese vendors on paper, even though it is widely read as aimed at them.
- Fixed industrial arms are out. Cobots and robot arms, which have their own vulnerability history (for example the critical CVE-2026-8153 command-injection flaw in Universal Robots' PolyScope 5, patched in 5.25.1, as RoboticsBiz reported), are not touched by this action.
Why did the US decide robots are a national security risk?
K&L Gates notes the determination cites documented incidents rather than hypotheticals, including:
- an early-2026 vulnerability that exposed camera feeds (and, per Sidley, interior maps) from thousands of household robots;
- the September 2025 Unitree exploit with "botnet" potential, the wormable Bluetooth issue known as UniPwn;
- an April 2025 discovery of pre-installed backdoors in foreign robotic quadrupeds.
Humanoid-specific research has kept piling up since. TechTimes described UniPwn as giving root access to a G1 humanoid "without Bluetooth pairing" from roughly 30 meters, and we covered the newer root-level flaws in Unitree G1 Vulnerabilities Explained: CVE-2026-76639 and CVE-2026-76640. Independent researchers have also documented telemetry leaving the robot for vendor servers (Help Net Security).
The determination does not name individual manufacturers, according to Robotics & Automation News. Coverage that describes it as "a Unitree ban" is shorthand: it applies to all qualifying foreign-produced mobile robots, from any country.
Does the FCC robot ban affect robots you already own?
Mostly no, and this is the part most headlines miss.
- Existing devices keep working and can still be sold. Previously authorized equipment "may still be produced and marketed, imported, and used in the United States unless the FCC takes further action," per Wiley.
- Security patches are allowed, for now. The FCC waived restrictions on Class I and Class II software/firmware changes that patch vulnerabilities or maintain compatibility, at least until January 1, 2029 (Wiley; Sidley).
- Hardware changes are not. Modifying the radio hardware of a grandfathered model falls outside the waiver.
- Unfinished products are not grandfathered. Sidley notes that models developed or warehoused before July 28 but never authorized cannot use the legacy path.
How does Conditional Approval work?
The only exemption route for robots runs through the Department of War, which can grant case-by-case Conditional Approvals. Applications go through the FCC and, according to Wiley, must describe corporate structure, foreign ownership, supply chains and a plan to "establish or expand manufacturing in the United States." Sidley reports a hard deadline of January 1, 2028 and notes there is no blanket safe-harbor list comparable to the "Blue UAS" list for drones. The incentive is clear: onshore production, or leave the US market for new models.
What should security teams deploying humanoids do now?
A regulatory listing doesn't secure a single robot. Use the moment to tighten what you control:
- Inventory your mobile robots by model, firmware version and FCC ID, and note whether each is grandfathered or new.
- Confirm the vendor patch pipeline. Ask in writing how the vendor will keep shipping security updates under the 2029 waiver and what happens after it.
- Map data flows. Identify every cloud endpoint, telemetry stream and remote-access channel. Block what you don't need at the network edge.
- Disable unused radios (Bluetooth, cellular) where operations allow; BLE was the entry point for UniPwn.
- Segment robots onto their own network zone, away from OT and corporate systems.
- Plan for supply disruption. If your next-generation fleet depends on a foreign model with no Conditional Approval, budget for a longer-lived current fleet, which raises the value of good patching.
Is Europe doing the same?
Not as of this writing. TechTimes reported at IFA 2026 that European buyers face "no equivalent" import restriction. In the EU, robot security is instead being shaped by product rules such as the AI Act and the new Machinery Regulation, which set requirements on products rather than banning suppliers by origin. Expect divergence: the same humanoid may be purchasable in Berlin but not newly authorized in Boston.
FAQ
What is the FCC robot ban? It is the FCC's July 28, 2026 addition of foreign-produced advanced robotic devices (mobile robots such as humanoids and quadrupeds) to the Covered List, which stops new models from receiving the FCC equipment authorization needed for US import and sale.
Can I still buy a Unitree or other Chinese humanoid in the US? Models authorized before July 28, 2026 can still be sold and imported unless the FCC acts further. New models need a Department of War Conditional Approval, or must qualify as domestic end products.
Will my robot still get security updates? The FCC waived the restrictions for Class I and II software and firmware changes that patch vulnerabilities, at least until January 1, 2029. Whether a vendor actually ships patches is up to the vendor.
Does the ban cover industrial robot arms or drones? No. Fixed industrial robots, drones, connected vehicles, underwater vehicles and FDA-regulated medical devices are excluded from the definition.
Is the FCC robot ban only about China? The rule applies to any robot that fails the Buy American Act domestic-content test, regardless of origin, and the determination does not name vendors. In practice, analysts expect Chinese manufacturers to be most affected.
This article summarizes public regulatory documents and legal analyses; it is not legal advice.
Sources
- FCC fact sheet: Covered List update (DOC-423682A1)
- Sidley: FCC Adds All Foreign-Produced Advanced Robotic Devices to the Covered List
- K&L Gates: Five Things to Know
- Wiley: FCC Adds Foreign-Produced Power Inverters and Advanced Robotic Devices to the Covered List
- Robotics & Automation News: Why the FCC now considers advanced robots a national security risk
- TechTimes: Unitree humanoid robots hacked from 30 meters
Get the weekly Humanoid Threats Brief → Subscribe