Autel Robotics pushed a routine maintenance firmware update to both variants of its EVO Lite Enterprise drone this week — the thermal-imaging 640T and the high-resolution optical 6K. DroneDJ’s coverage describes a quiet release: flight performance optimisation, an updated online map service, and unspecified bug fixes, with no new camera modes or flight capabilities. The package covers four components — Enterprise App v1.4.280, aircraft firmware v1.0.3.154, Smart Controller v1.6.3.159 and SE V2 Controller v1.0.3.149 — and Autel’s own release notes page lists v1.0.3.154 as the current October release for the line.
By itself, that would not be news. What makes it interesting is the regulatory position the update arrives in. Autel’s equipment was added to the FCC’s Covered List in December 2025 — the designation under the Secure and Trusted Communications Networks Act that marks communications equipment as posing an unacceptable risk to US national security. Under rules that took effect in late 2025, listed equipment is locked out of the normal certification process for firmware changes. Yet this update shipped anyway, and the reason it could is spelled out in an FCC document: Public Notice DA 26-454, released 8 May 2026, in which the Commission’s Office of Engineering and Technology extended a waiver letting already-authorised foreign-made drones, their critical components and routers “continue to receive software and firmware updates that mitigate harm to U.S. consumers” at least until 1 January 2029.
The FCC’s stated logic is the part worth sitting with. Blocking maintenance updates to a fleet of deployed aircraft does not make anyone safer — it grounds the patch pipeline and leaves known vulnerabilities unpatched in aircraft that are already flying. The waiver is an explicit acknowledgment that cutting off security updates to a designated-risk device creates a second-order security problem worse than the pipeline it closes. The designation stays; the maintenance carve-out rides on top of it. TechTimes, which covered the same release, puts the sharpest point on it: “The FCC calculus is the most consequential context in this firmware release, and it is not in Autel’s update notes.”
The context TechTimes argues matters most is Chinese law. Under Article 7 of China’s 2017 National Intelligence Law, organisations are obligated to support and cooperate with state intelligence work, and TechTimes contends that this creates a standing legal obligation for Autel to cooperate with Beijing’s intelligence services “regardless of where Autel’s servers are located or what its privacy policy says.” That framing is the outlet’s analysis rather than a legal ruling — no court has adjudicated the question, and as of publication no US enforcement action tied to a specific security incident has been brought against Autel. Autel, for its part, disputes its designation entirely, arguing it amounts to guilt by jurisdiction without evidence of a specific security incident, asserting that drone data stays local on the aircraft and controller with AES-256 encryption, and pressing a due-process challenge that remains pending. US agencies’ concern is documented, though: FBI and CISA advisories name Chinese-manufactured UAS including Autel as a data-risk source, citing the legal-compulsion framework rather than any documented incident.
There is a genuine tension in Autel’s position worth naming. The company’s technical argument — data stays on-device, transmissions are encrypted — is an argument about architecture. The national-intelligence-law argument is an argument about jurisdiction, which no amount of encryption can reach, because the legal obligation attaches to the company and its personnel rather than to the data’s location. Both can be true at once, and operators buying enterprise drones for inspections, security patrols or emergency response are left managing that overlap on their own: TechTimes’ practical guidance is network segmentation, disabling telemetry uploads that a mission does not need, and thinking hard about which mission types are appropriate at all.
The deeper story is that the FCC has essentially admitted its strongest tool cannot be used bluntly. A hard cutoff would have been the clean signal; instead the Commission has built a maintenance lane for designated equipment, with an expiry date of January 2029, and says it may codify the arrangement through rulemaking. The site has covered the wider sweep of this before — the FCC’s import ban on Chinese humanoid robots showed the hard end of the same policy, where new product categories simply stop getting authorised. Drones are the pragmatic counterpoint: millions of deployed units, an installed base that cannot be recalled, and a regulator choosing managed risk over clean gestures.
For NZ readers, the procurement question here is not abstract. New Zealand agencies and enterprises fly exactly this class of commercial drone, the same FBI/CISA risk framing applies to any gear made under Chinese jurisdiction, and there is no local equivalent of an FCC Covered List to lean on — which is what makes drone-class procurement disputes a live regulatory question worldwide. The lesson from the FCC’s waiver is uncomfortable but useful: banning procurement is easy, managing an installed base is not, and any NZ response will eventually face the same choice between clean gestures and patched aircraft. Autel’s quiet maintenance release will reach NZ fleets the same way it reached US ones — through the app, before the next flight, with the politics riding silently along.
Sources: DroneDJ, TechTimes, FCC Public Notice DA 26-454, Autel release notes.
