Take an inventory of the connected devices in your home and rank them by how much damage they could do if someone else were driving. The smart speaker is a privacy problem. The camera is a privacy problem. The lock is a safety problem.

The solar inverter is a different category entirely. It is a device wired directly into your home’s electrical service, capable of dumping or withholding kilowatts on command, accepting firmware updates from a manufacturer over the internet, and — in a growing number of installations — doing the same job for a battery bank and an EV charger. It is the largest, most physical, most powerful computer you own, and almost nobody thinks of it as a computer at all.

On July 28, 2026, the FCC decided to think of it as one.

What the FCC Actually Did

The Commission added foreign-made connected power inverters to its Covered List, the same mechanism previously used against certain telecom and surveillance-camera equipment. The practical effect: new models cannot be imported, marketed, or sold in the United States without special approval.

The specifics matter, because the coverage is broader than “solar panels”:

Covered: any inverter that converts DC to AC or back — micro, string, hybrid, and battery-based — when it includes a radio for remote communication, whether Wi-Fi, cellular, or Bluetooth.

Exempt: inverters with no wireless connectivity at all, and designs that use air-gapped external control architecture.

Grandfathered: models that already held FCC authorization before July 28, 2026 can continue to be sold from existing inventory.

Existing installations: completely unaffected. If solar, a battery, or an EV charger is already on your roof, in your garage, or on your wall, nothing about this order turns it off, recalls it, or requires you to replace it. Manufacturers seeking new approvals must petition the Department of Homeland Security or the Department of War by January 1, 2028.

Note the dividing line the FCC chose. It is not brand, and it is not country of assembly alone — it is connectivity. The same hardware without a radio falls outside the determination. The regulator’s stated threat model is the remote channel, not the electronics.

Why: The Radios Nobody Ordered

The rationale traces to May 2025, when Reuters reported that US energy-sector investigators inspecting Chinese-manufactured inverters found undocumented communication devices — including cellular radios — inside units where no such component appeared in the documentation. In at least one case, hardware was switched off remotely from China.

That is the entire argument in one sentence. A cellular radio that is not in the bill of materials is not a feature and not a bug. It is an undisclosed channel into equipment attached to the electrical grid, and it bypasses every control a homeowner or utility could apply — your firewall, your VLAN, your router’s outbound rules, all of it — because it never touches your network at all.

The White House framing added the obvious extensions: remotely disabling grid equipment, exfiltrating generation and consumption data, and using the device as a persistent surveillance foothold. When you can push firmware to a large enough fleet of inverters, you are not attacking houses one at a time — you are holding a slice of grid capacity, which is why this landed as a national-security order rather than a consumer-safety recall.

What This Means If You Already Own One

Nothing changes legally. Quite a lot changes in terms of what you should be thinking about.

The uncomfortable truth is that the FCC’s action addresses future purchases — it does nothing for the inverter already humming in your garage. And the risk the order identifies is not hypothetical for you: your inverter almost certainly phones home to a manufacturer’s cloud, accepts firmware from it, and reports a minute-by-minute record of your household’s energy consumption to a company you chose on price and warranty terms three years ago.

Household energy data, incidentally, is remarkably revealing. Load curves show when you wake, when you leave, when you cook, when you travel, and how many people are home. It is the same category of behavioral exhaust we’ve covered in the context of utilities and smart meters building surveillance-grade datasets, except your inverter reports it to a vendor rather than a utility, under a privacy policy nobody read.

Securing the Inverter You Have

Find out what it actually talks to. Log into your router and look at the inverter’s outbound connections and destinations. Many home routers will show you this per-device. You are looking for: how often it connects, to whom, and whether that matches what the manual claims.

Put it on its own VLAN with tight egress rules. The inverter needs to reach its vendor’s cloud and nothing else. It has no business reaching your NAS, your laptop, or your cameras — and nothing on your network needs to reach it. This is the same segmentation discipline that limits the damage from every other appliance, and our complete guide to securing your smart home network covers the setup.

Ask whether it has a cellular radio, and get the answer in writing. This is now a fair question to put to your installer or manufacturer, and their willingness to answer plainly is informative in itself. A cellular modem cannot be firewalled by you. If one is present, you should at minimum know it exists and why.

Check who controls firmware updates. Can the vendor push firmware without your consent? Most can. Can you see a changelog and an update history? Most won’t show you. Can you defer or approve updates? Increasingly, no. Understand which of these applies before you need to know.

Disable remote access features you don’t use. Remote monitoring apps are pleasant and rarely essential. If you check production once a month, the always-on cloud tunnel is a poor trade.

Weigh air-gapped or locally-controlled options on your next purchase. The FCC just made “does it have a radio” a regulatory category. It is also a perfectly good buying criterion. Systems that support local-only monitoring — read the data off the device on your own LAN, no vendor cloud in the path — exist, and they are the same architectural choice as preferring a camera that records locally.

The Broader Pattern

This order belongs to a run of 2026 policy treating ordinary household equipment as critical infrastructure: the FCC’s Cyber Trust Mark labeling scheme for consumer IoT, and the EU Cyber Resilience Act’s 24-hour vulnerability reporting clock starting September 11, 2026. Different instruments, same recognition — connected devices in homes now aggregate into something that matters at national scale, and the market did not price that in on its own.

For homeowners, the practical takeaway is smaller and more useful than the geopolitics: the inverter is a networked computer with its hands on your power. Treat it with the same suspicion you’d give a camera, and considerably more than you give a light bulb.

Bottom Line

The FCC banned new foreign-made connected inverters and left the identical hardware without radios entirely alone. That is a regulator telling you, precisely, where it thinks the danger lives.

Your existing system keeps running, and you should not panic. You should, however, go find out what it is connected to — because it is the one device in your house that can be turned off from the other side of the world, and in 2025 investigators found the radios that would let someone try.

Sources