What the FCC Robot Ban Means for the Robots You Already Own
On 28 July 2026 the FCC added all foreign-produced advanced robotic devices to its Covered List, which generally blocks new models from receiving the equipment authorization needed to be imported, marketed, or sold in the United States 1. It does not reach the robots already in your building. Asked directly whether there are any restrictions on using such devices, the FCC's own answer is a single word: "No" 1. That gap is the whole story. The rule sorts robots by where they were built. It never inspects what they are about to do.
Key takeaways
- The Covered List addition is prospective. Previously authorized robots "may continue to be produced, marketed, imported, and used unless the FCC acts further" 5, and existing owners face no use restriction 1.
- Coverage is decided by a Buy America origin test (48 CFR 25.101(a)): domestic component cost must exceed 65 percent through 2028 and 75 percent from 2029 1. That is a supply-chain test, not a security test.
- The largest humanoid vendor’s current lineup cleared the gate first. RankShield verified three original-equipment authorizations to Unitree’s legal entity dated 22 and 30 June 2026, up to 36 days before the ban, directly in the FCC database 2.
- The exploits that motivated the listing, including the wormable UniPwn flaw, remain present in deployed units, and researchers took control of a Unitree humanoid "in about a minute" 7.
- What changes risk on a robot you already own is a control between the command and the actuator: per-device identity, deny-by-default pre-actuation authorization, and a tamper-evident record.
What exactly did the FCC do on 28 July 2026?
On 28 July 2026 the FCC added two categories to its Covered List: foreign-produced advanced robotic devices and foreign-produced power inverters 1. Listing means new models are generally prohibited from receiving FCC authorization to be imported, marketed, or sold in the United States 1. The action followed determinations by a White House-convened Executive Branch interagency body that these devices "pose an unacceptable risk to the national security of the United States and to the safety and security of U.S. persons" 1.
The Covered List is maintained under the Secure and Trusted Communications Networks Act and functions as a market-entry control. The stated reasoning is twofold: supply-chain dependence, and the attack surface that networked robots introduce. As the reporting on the order put it, "the networked capabilities of advanced robotic systems create extensive vulnerabilities and vectors for attacks that can manipulate the data and physical operation," alongside a concern that robots collect data usable for surveillance 4.
There is one exemption route. The listing covers foreign-produced advanced robotic devices "except advanced robotic devices which have been granted a Conditional Approval by DoW" 1. Applications go to the FCC by email and are forwarded to the Department of War for evaluation 1. Devices that receive one are published on the FCC's website.
Does the FCC robot ban apply to robots you already own?
No. The rule is prospective. The FCC states that the update does not affect "the continued importing, marketing, or selling of existing models of advanced robotic devices and power inverters that have already received FCC equipment authorization," nor "the continued use of such devices that consumers already possess" 1. Asked whether there are restrictions on consumers' ability to use these devices, the FCC answers: "No" 1.
Independent coverage is consistent. IEEE Spectrum notes that "this applies to new devices; those already certified are not restricted for sale or use" 3. Forbes described the action as "a forward-looking gate on the U.S. market, not a recall" 4. Legal analysis reaches the same place: previously authorized foreign-produced robots "may continue to be produced, marketed, imported, and used unless the FCC acts further" 5.
Maintenance also continues. Under a waiver of its rules, covered devices "can continue to receive basic software and firmware updates to maintain usability" 1. Practitioners reading the Office of Engineering and Technology waiver more closely report that it permits certain Class I and Class II software and firmware permissive changes, while hardware modifications remain off limits absent a separate waiver 5.
So a warehouse running forty imported autonomous mobile robots on 27 July 2026 was running forty perfectly legal robots on 29 July 2026, and still is. Nothing in the order required an audit, a replacement, a network change, or a single new security control. If the fleet was exposed before the listing, it is exposed by exactly the same amount today.
Which robots meet the FCC definition of an advanced robotic device?
The definition is conjunctive, so every element must be present. A covered device is a mechanical mobile device capable of locomotion, obstacle avoidance, navigation, or movement on the ground; operating at a distance from a human operator based on commands or sensor data; weighing over 4.4 lb (2 kg) including any ground or docking station; and containing all three of a sensor that perceives its environment, connectivity of at least 200 kbps in either direction, and software or model weights controlling navigation, perception, data collection, or remote command and control 1.
The exclusions matter as much as the inclusions. Connected vehicles, rail-only vehicles, uncrewed aircraft, unmanned underwater vehicles, FDA-regulated devices under section 513 of the Federal Food, Drug, and Cosmetic Act, and fixed non-mobile robots including articulating, gantry, and SCARA arms are all outside the definition 1. That last exclusion carves out most of the traditional industrial robot population.
| Device class | In scope? | Why |
|---|---|---|
| Humanoid robot | Yes | Named in the definition; mobile, sensing, connected, autonomous |
| Quadruped | Yes | Named in the definition |
| Warehouse AMR | Yes | Named in the definition; ground-mobile and networked |
| Industrial arm (SCARA, articulating, gantry) | No | Fixed, stationary, non-mobile robots are excluded |
| Surgical robot | Generally no | FDA-regulated devices under FD&C section 513 are excluded |
| Drone / UAS | No | Uncrewed aircraft are excluded; covered under a separate listing |
| Bare platform, no compute or radios | No | Fails the component test, though adding RF components makes it covered 1 |
One consequence surprises people: a networked robot vacuum or robotic lawn mower over 4.4 lb satisfies every element and is in scope 5. The definition is about mobility, sensing, connectivity, and autonomy, not about how industrial the machine looks.
Why did the largest vendor’s current lineup stay legal?
Because it was authorized before the gate closed. Grandfathering turns on the date the FCC granted equipment authorization, and the flagship vendor most associated with the vulnerabilities behind this listing completed its certifications weeks earlier. We verified this directly rather than relying on the reporting, by querying the FCC Office of Engineering and Technology equipment authorization database on 22 August 2026 2.
Under grantee code 2A5PE, registered to YuShu Technology Co., Ltd. of Binjiang District, Hangzhou, which is the legal entity behind the Unitree brand, three original-equipment authorizations carry final action dates inside the five weeks before the listing 2:
| FCC ID | Purpose | Final action date | Days before 28 July 2026 |
|---|---|---|---|
| 2A5PE-YUSHU010 | Original Equipment | 22 June 2026 | 36 |
| 2A5PE-YUSHU011 | Original Equipment | 30 June 2026 | 28 |
| 2A5PE-YUSHU012 | Original Equipment | 30 June 2026 | 28 |
Trade reporting has linked these June grants to the R1 humanoid and to the H2 humanoid and A2 quadruped. We verified the grantee, the FCC IDs, and the grant dates at the source; the mapping of each ID to a specific product name comes from that reporting rather than from the database rows we pulled, so treat the model names as the weaker half of the claim. The dates themselves are not in doubt.
The result is straightforward and worth stating plainly. The vendor whose robots the security community has spent a year writing about holds live US authorizations that the 28 July action does not disturb. Its current models remain importable and sellable. Buyers who already own the previous generation, the Go2, B2, G1, and H1, were never restricted at all.
Does the Covered List measure security or country of origin?
Origin. The trigger word in the listing is "foreign-produced," and the FCC defines it by reference to the federal procurement standard: an article that would not qualify as a "domestic end product" under 48 CFR 25.101(a) 1. That has two prongs. The device must be manufactured in the United States, and "the cost of domestic components shall exceed 65 percent for items delivered in calendar years 2024 through 2028 and 75 percent for items delivered starting in calendar year 2029" 1.
Read that again as an engineer rather than as a lawyer. Whether a robot is covered is decided by a bill-of-materials cost ratio. Two physically identical robots running byte-identical firmware, with the same hard-coded key and the same unauthenticated Bluetooth provisioning path, land on opposite sides of the line if one crosses the domestic-content threshold and the other does not. Nothing in the test asks whether the robot authenticates a motion command.
The escape hatch points the same direction. Conditional Approval is granted by the Department of War, and the underlying determination frames it as helping producers "while they work to onshore manufacturing and address the US government's national security concerns," which reads as a manufacturing-commitment path more than a security audit 5. There is also a domestic end product route, which is purely a content-percentage calculation 1.
None of this makes the rule wrong. Supply-chain provenance is a real national security concern, and the interagency determination cites data collection and remote manipulation risks that are well documented 14. The point is narrower and it is the one operators keep missing: a procurement control and a security control answer different questions. The Covered List decides which robots may enter the country. It is silent on what any robot may do once it is here.
Are the vulnerabilities behind the ban actually fixed?
Not in deployed units. The security research that shaped the policy conversation describes flaws in Bluetooth Low Energy and Wi-Fi provisioning across multiple Unitree models, combining "hard-coded cryptographic keys, trivial authentication bypass, and command injection in the Wi-Fi setup process," where an attacker within radio range gains root access and the compromise propagates wirelessly to form what researchers called a "physical botnet" 7. That is the UniPwn class, and it is wormable 6.
The same body of research documents an undocumented backdoor in an earlier quadruped that let an exposed API "locate devices globally and, if a robot was online, view live camera feeds without authentication," and a humanoid that "continuously exfiltrated multimodal sensor and service-state telemetry every 300 seconds without the operator's knowledge" 7. Researchers demonstrated taking control of a Unitree humanoid "in about a minute," bypassing its normal controller and triggering physical actions 7.
Two structural details make this a durable problem rather than a patch cycle. A shared key is a fleet-wide credential, so recovering it from one unit compromises every unit of that model. And where a cloud backdoor was closed server-side by shutting the endpoint down, the client code and default credentials stayed resident on the robots. The listing on 28 July 2026 changed none of that, because a market-entry rule cannot reach firmware already running in a building.
Our UniPwn analysis covers the exploit class in detail, and the embodied AI threat landscape maps it against prompt-injection and teleoperation attacks that need no firmware compromise at all.
What does the ban actually cost a fleet operator?
For an existing fleet, directly, close to nothing. There is no recall, no forced replacement, no mandated retrofit, and software and firmware maintenance continues under waiver 15. The real cost lands on procurement planning: the pool of lawfully importable new models narrows, replacement units for a grandfathered fleet may become harder to source, and a pending FCC proposal would cut the R&D import allowance for foreign robots from 4,000 units to 40 5.
That makes the arithmetic of a panic response unattractive. Current published hardware prices for the most widely deployed humanoid line run from about $4,900 for the entry R1 and $13,500 for the G1, to $29,900 for the H2, roughly $90,000 for the H1, and $100,000 for the H2 Plus, with education configurations quoted between $43,900 and $73,900 through resellers 8. Those figures are hardware only, before shipping, customs, tooling, integration, and support.
| Response to the listing | Order of cost for a 40-unit fleet | Effect on the exploit risk |
|---|---|---|
| Do nothing, rely on grandfathering | $0 | None. Exposure unchanged |
| Rip and replace with compliant hardware | Hardware alone from roughly $196,000 at $4,900 per unit to $4,000,000 at $100,000 per unit 8 | Changes the vendor, not the control model. A new robot with a shared key has the same class of flaw |
| Add per-device identity and a pre-actuation gate | A control-layer project, not a capital equipment purchase | Removes the shared-key class and bounds what any compromised unit can do |
The middle row is the trap. Replacement is the most expensive response available, it is not required by the rule, and it does not address the defect. A robot manufactured in a compliant country still ships with whatever authentication architecture its vendor chose. Origin is not a proxy for whether a command is checked before an actuator moves.
What actually changes the risk on a robot you already own?
A control that sits between the command and the actuator. Three capabilities do the work, and none of them depend on where the robot was built: a hardware-rooted identity unique to each unit rather than a key shared across a model line; a deny-by-default authorization check that every safety-relevant command must pass before actuation; and a tamper-evident record of what was requested, what was allowed, and what was refused.
Per-device identity is the direct answer to the shared-key class. When each unit holds its own credential, recovering one robot's key compromises one robot, and revocation is a per-unit action rather than a fleet-wide firmware campaign. This is the same reasoning that pushed the wider industry away from shared secrets toward per-device attestation, and it is what our robot identity and attestation layer provides.
The pre-actuation authorization gate is the control the FCC rule structurally cannot be. It evaluates the command, not the manufacturer. A motion request outside the rated envelope, an instruction from an unrecognized principal, or a high-consequence action that was never allow-listed is refused before an actuator moves. That is the property that holds even when a robot is already compromised, and it is the reason prompt injection into a vision-language model does not automatically become motion.
The record closes the loop. Tamper-evident action provenance gives an operator something to show an insurer, an auditor, or a regulator: not an assertion that the fleet is safe, but a verifiable log of which attested robot was authorized to do what, and when. That evidence is also what the EU Machinery Regulation technical file will expect from 2027, so the work is not single-jurisdiction.
To be clear about what this is not: it is not a claim that any of this makes a robot unhackable, and it is not a replacement for vendor patching, network segmentation, or physical safety systems. It is a bound on consequence. A compromised robot behind a deny-by-default gate can still be compromised. What it cannot do is quietly perform a high-consequence action that nobody authorized and nobody can later reconstruct.
How should a fleet operator respond in the next 30 days?
Start with facts rather than posture. Inventory every mobile robot over 4.4 lb, record its FCC ID, and look the grant date up in the FCC equipment authorization database, which lists every device authorized by certification 12. Devices authorized through the Supplier's Declaration of Conformity are not centrally listed and carry no FCC ID, so those need vendor documentation instead 1.
Then separate the two questions the listing tends to blur. Regulatory status tells you what you may lawfully buy and operate. Security exposure tells you what a compromised unit could do this afternoon. The tool below walks both: the six-part covered-device test and its exclusions, the grandfathering question, and an actuation-control coverage score. Everything runs in your browser and nothing is transmitted.
FCC Covered List Check and Exposure Assessment
Work out whether a device is covered, whether it is grandfathered, and what your actuation-control coverage actually is. Nothing you enter leaves your browser.
Frequently asked questions about the FCC robot ban and existing fleets
Does the FCC robot ban mean I have to get rid of my robots?
No. The Covered List addition is prospective. The FCC states that the update does not affect the continued use of devices consumers already possess, and answers "No" when asked directly whether there are restrictions on using foreign-produced advanced robotic devices 1. Legal analysis of the order agrees that previously authorized robots may continue to be produced, marketed, imported, and used unless the FCC acts further 5. There is no recall and no forced replacement. What changes is the pool of new models that can lawfully enter the US market.
When did the FCC robot ban take effect and what does it cover?
The FCC added foreign-produced advanced robotic devices to its Covered List on 28 July 2026 1. Covered devices are ground-mobile robots including autonomous mobile robots, humanoids, and quadrupeds, weighing over 4.4 lb including any docking station, that operate remotely on commands or sensor data and carry an environmental sensor, connectivity of at least 200 kbps, and autonomy or command-and-control software 1. Connected vehicles, rail vehicles, uncrewed aircraft, unmanned underwater vehicles, FDA-regulated devices, and fixed industrial arms are excluded 1.
How do I check whether my robot is grandfathered?
Find the FCC ID on the device label and look it up in the FCC Office of Engineering and Technology equipment authorization database 2. If the grant date precedes 28 July 2026, the model was authorized before the listing and is not restricted for import, sale, or use 1. Devices authorized under the Supplier’s Declaration of Conformity are not centrally listed and have no FCC ID; for those you need compliance documentation from the manufacturer or importer 1. Record the result, because procurement and insurance conversations will both ask for it.
Can covered robots still receive software and firmware updates?
Yes. Under a waiver of its rules, covered devices can continue to receive basic software and firmware updates to maintain usability 1. Analysis of the Office of Engineering and Technology waiver indicates it permits certain Class I and Class II software and firmware permissive changes over a multiyear window, while hardware modifications remain prohibited without a separate waiver 5. That matters for security: the patching path for a grandfathered fleet stays open, so an unpatched vulnerability in a deployed robot is a vendor and operator problem rather than a regulatory blocker.
Does buying a US-made robot solve the security problem?
It answers the supply-chain question the FCC asked, and it does not answer the actuation question. Coverage under the rule is decided by a domestic-content cost test under 48 CFR 25.101(a), requiring domestic components to exceed 65 percent through 2028 and 75 percent from 2029 1. Nothing in that test examines whether the robot authenticates a command, uses per-device rather than shared keys, or refuses an unauthorized high-consequence action. A domestically manufactured robot with a model-wide shared credential has the same defect class as an imported one.
What is Conditional Approval and who can get one?
Conditional Approval is the exemption route. The national security determination provides that foreign-produced advanced robotic devices are covered unless the Department of War transmits a specific determination to the FCC that a given device or class does not pose unacceptable risks 1. Applications are emailed to the FCC and forwarded to DoW for evaluation, and may cover classes of devices rather than single models 1. Approved devices are published on the FCC website. Analysis of the underlying determination suggests the path is oriented toward onshoring manufacturing commitments rather than a pure security audit 5.
How does RankShield Robotics fit into this?
We do not build robots, robot hardware, or ROS integrations, and we do not certify FCC compliance. We build the attestation and authorization layer over robot command and telemetry streams: per-device cryptographic identity that replaces shared keys, a deny-by-default pre-actuation gate that evaluates each command before an actuator moves, and tamper-evident provenance that produces a verifiable record of authorized and refused actions. Those controls are origin-independent, which is precisely why they still apply to the grandfathered fleet the FCC rule leaves untouched.
References
- Federal Communications Commission. FAQs on Recent Updates to FCC Covered List Regarding Foreign-Produced Advanced Robotic Devices and Power Inverters. Updated 28 July 2026. www.fcc.gov/covered-list-faqs-robots-inverters
- FCC Office of Engineering and Technology. Equipment Authorization Search (grantee code 2A5PE, YuShu Technology Co., Ltd.), queried 22 August 2026. 2026. apps.fcc.gov/oetcf/eas/reports/GenericSearch.cfm
- IEEE Spectrum. FCC Covered List Bans New Foreign Mobile Robots in US. 2026. spectrum.ieee.org/fcc-covered-list-mobile-robots
- Forbes. United States Bans Chinese Humanoid And Quadruped Robots, Citing National Security. 28 July 2026. www.forbes.com/sites/johnkoetsier/2026/07/28/united-states-b
- K&L Gates. FCC Adds Foreign-Produced Advanced Robotic Devices to the Covered List: Five Things to Know. 3 August 2026. www.klgates.com/thought-leadership/FCC-Adds-Foreign-Produced
- IEEE Spectrum. Unitree Robot Exploit (UniPwn). 2025. spectrum.ieee.org/unitree-robot-exploit
- Recorded Future. Hacking Embodied AI. 2026. www.recordedfuture.com/research/hacking-embodied-ai
- Unitree Robotics. Humanoid Robot product listings and published prices. Retrieved 22 August 2026. shop.unitree.com/collections/humanoid-robot
Keep exploring
The rule stopped at the border. Your fleet did not.
Per-robot identity, deny-by-default pre-actuation authorization, and provenance you can hand to an auditor.
This article is for general information and does not constitute legal, compliance, or export-control advice. The FCC Covered List and its associated determinations are subject to change, and Conditional Approval status is published separately by the FCC. Confirm your own obligations, and the authorization status of any specific device, with qualified counsel and against the FCC equipment authorization database. Third-party findings and quotations are attributed to their sources in the references, and RankShield does not certify FCC compliance.