Autelrobotics.com

Autel Robotics has pushed a firmware update to both variants of its EVO Lite Enterprise drone series — bringing flight performance improvements, an enhanced online map service, and a round of bug fixes to the thermal-imaging 640T and the high-resolution optical 6K — but every professional currently flying these aircraft should carry a second piece of context alongside the update notes: Autel is listed on three separate US government security registries, and Chinese national law creates a standing legal obligation for the company to cooperate with Beijing's intelligence services, regardless of where Autel's servers are located or what its privacy policy says.

DroneDJ reported Monday morning that the firmware package is available now through the Autel Enterprise App. The update is not a capability upgrade — no new features are listed — but steady maintenance support for the EVO Lite line matters in enterprise procurement, where platform longevity is a direct cost driver. The same update also arrives under an unusual regulatory posture: the Federal Communications Commission specifically permits these updates to continue, not because it has cleared Autel's national security designation, but because it has determined that cutting off security patches to already-deployed Chinese drones would create greater risk than allowing the pipeline to remain open.

That FCC calculus is the most consequential context in this firmware release, and it is not in Autel's update notes.

What the October Firmware Package Contains

The update touches three areas across four component-level version bumps:

Version numbers:

• Autel Enterprise App: v1.4.280
• Aircraft firmware: v1.0.3.154
• Smart Controller firmware: v1.6.3.159
• SE V2 Controller firmware: v1.0.3.149

Flight performance optimization: Autel has optimized aircraft flight behavior. The company's release notes do not detail which specific parameters changed — operators should read this as a behavioral refinement rather than a guarantee of extended endurance or altered handling limits. In professional operations where aircraft behavior must be predictable and reproducible across a deployment, incremental refinements to flight control algorithms matter more than headline-grabbing capability expansions.

Online map service optimization: The map layer used during mission planning and flight has been updated. Enterprise drone operators rely on accurate mapping for terrain analysis, site boundary delineation, and target location during pre-flight planning. No specific change to map resolution or provider is described in the release notes.

Bug fixes: The release addresses unspecified bug fixes and general optimizations. Autel describes the release as containing "significant changes," though no individual bugs are named.

Installation procedure: Power on aircraft and controller, confirm pairing, verify both batteries are above 50%, and connect the controller to a network. Open the Autel Enterprise App and select the available update (or find it through the app's settings menu), then tap "Update All." Allow approximately 20 minutes depending on network speed, keep both devices powered and connected throughout, and restart when prompted. Autel recommends completing the update before the next mission.

FCC Allowed This Update — Here Is Why That Matters

Autel Robotics was added to the FCC Covered List on December 22, 2025, which designates its communications equipment as posing an "unacceptable risk to the national security of the United States or the security and safety of United States persons" under the Secure and Trusted Communications Networks Act of 2019. That designation would ordinarily suggest a hard stop on new product activity — but the FCC issued FCC Public Notice DA 26-454 on May 8, 2026, granting a waiver that specifically permits Class I and Class II firmware and software changes to Autel devices through January 1, 2029.

The FCC's rationale makes the regulatory picture concrete: preventing security patches from reaching devices already deployed in the US field would expose those aircraft to known vulnerabilities without offering any compensating security benefit. The commission is essentially acknowledging that banning maintenance updates to a national security risk device creates a second-order national security problem. The waiver does not rescind the national security designation — it is a pragmatic accommodation that accepts ongoing firmware updates as the lesser risk compared to an unmaintained fleet.

Operators receiving this update are therefore receiving it under an active national security designation, delivered through a pipeline the FCC has provisionally authorized specifically because the alternative is worse.

Autel disputes its designation. The company has publicly argued that its FCC listing represents "guilt by jurisdiction" — that it has been treated as a security threat without evidence of a specific security incident. Autel claims all data from its drones is stored locally on the aircraft and controller, that it does not transmit mission data to Autel's own servers, and that its systems use AES-256 encryption. The company has offered to make its firmware source code available for independent review and has alleged Fifth Amendment due process violations in the FCC's process, arguing it was listed based on information it was never permitted to see or contest.

Those are substantive legal arguments. They do not address the Chinese law framework.

What Chinese Law Requires of Autel — Regardless of Its Privacy Policy

China's National Intelligence Law Article 7 (2017) states that "all organizations and citizens shall support, assist, and cooperate with national intelligence work in accordance with law." This obligation is not conditional on whether an organization considers itself a national security actor, where its servers are located, or whether it has a corporate subsidiary in the United States. It applies to Autel Robotics' Chinese operations and personnel as a matter of Chinese law, and no corporate privacy policy can waive it.

Two additional Chinese laws reinforce this framework. China's Cybersecurity Law (2017) requires network operators to provide technical assistance to public security agencies, and includes data localization provisions. China's Data Security Law (2021) includes extraterritorial provisions and requires cooperation with government data requests.

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint advisory in 2022 — updated in 2023 — specifically naming Chinese-manufactured UAS (including Autel) as a source of data risk, citing this legal compulsion framework rather than any documented incident. The advisory recommends network segmentation and avoiding use over sensitive sites.

What data the EVO Lite Enterprise collects that falls within this legal framework:

The EVO Lite 640T Enterprise records high-resolution thermal imagery (heat signatures of people, vehicles, and structures), precise GPS flight paths, visible-light imagery at 48MP, and mission telemetry through the Autel Enterprise App. The EVO Lite 6K Enterprise records 20MP stills and 4K video with GPS coordinates and flight logs. Both share controller connection data (network names and addresses) and app usage data from the Autel Enterprise App. Under Chinese law, this entire data set is potentially subject to compelled disclosure to Chinese intelligence authorities, with no requirement to notify the data subject and no mechanism by which Autel can lawfully refuse a valid intelligence request.

What independent security audits have confirmed: No comprehensive independent third-party security audit of the EVO Lite Enterprise series has been published in any source reviewed during research for this article. Two CVEs (CVE-2023-47335, a geofencing bypass and CVE-2023-50121, a denial-of-service vulnerability) have been documented for the EVO Nano, a different and less capable Autel model, at firmware version 1.6.5. No equivalent public CVE record exists for the EVO Lite Enterprise. The absence of a CVE is not a security certification — it reflects the current state of public research, not a completed audit.

Practical risk-reduction steps for operators:

• Run the EVO Lite Enterprise on a network-isolated subnet with no direct internet access during missions
• Disable any telemetry upload or data-sync features in the Autel Enterprise App that are not required for the specific mission
• Conduct an internal policy review of which mission types (critical infrastructure surveys, law enforcement sensitive operations, grid mapping near sensitive facilities) are appropriate given the legal framework
• Confirm your organization's compliance posture with respect to the FCC Covered List, Commerce Entity List, and Pentagon CMC designation before committing to additional Autel deployments

Three Government Lists: What Each Designation Means

Autel Robotics now appears on three distinct US government security registries, each with different legal consequences:

Commerce Department Entity List (July 2024): Subjects Autel to export licensing requirements for items subject to the Export Administration Regulations. Technology transfer to Autel requires a license. Existing US operators' use of already-purchased devices is not directly prohibited.

Pentagon Section 1260H CMC designation (January 7, 2025): Designates Autel as a company operating within China's military-civil fusion development strategy. This designation triggers investment restrictions under NDAA Section 1260H and signals elevated national security concern to US government procurement teams.

FCC Covered List (December 22, 2025): Prohibits use of Universal Service Fund dollars to purchase Autel equipment and restricts federal agency deployment of Autel devices. The FCC waiver DA 26-454 carves out firmware and software maintenance updates through January 1, 2029.

No criminal enforcement action against Autel in connection with a specific security incident has been issued in the US as of the research date. Autel's challenge to the FCC designation is pending.

What Makes These Drones Worth Understanding Technically

The EVO Lite Enterprise series represents a genuine technical proposition for enterprise imaging: a compact airframe (866 grams [1.91 lbs]) offering both a thermal and an optical configuration with professional-grade specifications. Understanding why the platform is capable — and where its engineering tradeoffs land — is relevant to any operator weighing whether to extend its service life or transition to an alternative platform.

Thermal imaging: how the 640T actually works

The 640T's thermal camera uses an uncooled microbolometer — a 640×512 array of resistive elements made from vanadium oxide or amorphous silicon that change electrical resistance as they absorb long-wave infrared (LWIR) radiation in the 7–14 μm band. Unlike military-grade cooled detectors (which use indium antimonide or mercury cadmium telluride arrays held at cryogenic temperatures), uncooled sensors do not require active cooling, dramatically reducing cost, weight, and power draw at the expense of some sensitivity.

The key performance figure is NETD — noise-equivalent temperature difference — typically 50 millikelvins or better in commercial uncooled sensors. Lower NETD means finer temperature discrimination. The practical floor for useful thermal detection is determined by NETD: at 50 mK, the sensor can reliably distinguish objects whose surface temperatures differ by about 0.05°C (0.09°F).

The dual measurement range is implemented by calibrating the sensor's linearization curve against known reference temperatures at the range boundaries — not by switching detector hardware. Selecting -20°C to 150°C (-4°F to 302°F) optimizes the thermal curve for the temperature region where human subjects (approximately 37°C / 98.6°F), vegetation, and building surfaces fall. Selecting 0°C to 550°C (32°F to 1,022°F) expands the upper range to capture furnace exhaust, electrical arc signatures, and engine hot-spots — at the cost of finer discrimination in the lower portion of the range.

SLAM navigation: GPS-denied flight without active ranging

Both EVO Lite Enterprise variants include visual SLAM (simultaneous localization and mapping) for operation in environments where GPS is unavailable or unreliable. The system uses the front binocular vision pair to compute depth from disparity — the geometric difference between matched features in the left and right frames, resolved by the known baseline distance between the cameras.

Depth estimates are fused with accelerometer and gyroscope data from the onboard IMU through an Extended Kalman Filter or equivalent state estimator, which tracks the drone's position and orientation as it builds a sparse map of visible landmarks. When the drone returns to a previously mapped area, a loop-closure algorithm matches current observations against the stored landmark set, correcting accumulated positional drift.

The practical implication: GPS-denied SLAM navigation extends useful operating range into GPS-degraded environments (below-deck inspections, interior surveys, urban canyons), but it is not a substitute for GPS over long-range outdoor missions, where landmark drift accumulates without an external position reference. The EVO Lite Enterprise is positioned as a GPS-supplement rather than a GPS-replacement platform.

A-Mesh networking: multi-drone relay operations

A-Mesh supports up to two aircraft and two controllers in a relay topology, using the SkyLink protocol with adaptive frequency hopping across the 2.4 GHz, 5.2 GHz, and 5.8 GHz bands. In relay mode, one drone acts as an airborne repeater between the ground controller and a second aircraft operating beyond direct radio line-of-sight — allowing operations over terrain, structures, or obstacles that would otherwise interrupt the control link. Formation flight mode enables a polygon survey area to be segmented across both aircraft, reducing total mission time proportionally to the number of units deployed.

The rated 12 km (7.46 miles) maximum video transmission distance is measured under interference-free conditions; real-world range in typical urban or industrial environments is shorter. The adaptive frequency hopping is designed to reduce co-channel interference with other 2.4/5 GHz devices on-site, but operators conducting simultaneous multi-unit mesh operations in RF-dense environments should account for spectral competition.

The shared AI target recognition system — which can identify and locate up to 64 object types including personnel, vehicles, and watercraft using a fusion of the wide-angle visible camera and infrared lens — runs on-board and does not require a cloud connection for classification.

Performance Context: What Independent Benchmarks Show

Autel's published specifications represent controlled-condition figures. The 40-minute rated flight time applies under specified test conditions — typically mild weather, low altitude, minimal payload interaction, and steady hover — not in operational environments involving wind shear, cold temperatures, or active video streaming at range. No independent flight-time verification study of the EVO Lite Enterprise was found during research.

The thermal sensor specification (640×512 LWIR with dual range) is consistent with commercial uncooled microbolometer offerings from established Western suppliers at similar price points. No independent benchmark comparison between the EVO Lite 640T thermal performance and DJI's Zenmuse H20T or FLIR's Vue Pro R was found in sources reviewed.

Autel's Chinese-market benchmark reporting has not been verified by named independent Western auditors in publicly available sources. Operators should treat all published performance figures as manufacturer-stated specifications pending independent confirmation.

Ecosystem friction for non-Chinese operators includes: English-language documentation that lags behind the Chinese release by several weeks; US-based technical support availability limited compared to market incumbents; and an evolving compliance posture as the FCC and Commerce Department designations affect enterprise procurement eligibility.

Decision Framework for Operators Considering the October Update

The October firmware release is a standard maintenance package for a professionally capable platform that carries an unusual regulatory profile. For operators who have already standardized on the EVO Lite Enterprise, the update decision is straightforward on technical grounds: flight performance refinements and map service improvements are worth applying before the next mission, and the installation procedure takes approximately 20 minutes.

The more consequential decision — for new procurement and for ongoing deployment on sensitive missions — requires weighing four dimensions that Autel's update notes do not address:

1. Performance and gap context: The EVO Lite Enterprise delivers legitimate enterprise capabilities (640×512 thermal, SLAM, A-Mesh, 40-minute endurance) in a compact form factor. No independently verified performance gap relative to Western alternatives was documented in this research, but no independent benchmark audit was found either. Published specs should be treated as unverified manufacturer claims until confirmed by a third party.

2. Benchmark reliability and independent verification: Autel's performance claims have not been confirmed by named independent Western auditors in publicly available sources. Any procurement decision that treats Autel's published specifications as equivalent to independently audited specifications is operating on incomplete information.

3. Ecosystem and operational immaturity in the US market: The FCC, Commerce Department, and Pentagon designations create procurement restrictions that may affect operators seeking federal contracts or USF-funded infrastructure work. Documentation lag and limited Western support infrastructure are real operational costs not captured in hardware price comparisons.

4. State data-sharing legal obligations: China's National Intelligence Law (2017) Article 7 compels Autel to cooperate with Chinese intelligence services on demand. This obligation is not waivable by Autel, is not addressed by local data storage, and is not resolved by the FCC's update waiver. It is a fixed legal condition of operating under Chinese law. Any mission that generates data with national security, critical infrastructure, or law enforcement sensitivity should be evaluated against this framework before deployment.

Operators running mixed fleets — with Autel for lower-sensitivity missions and Western-manufactured platforms for sensitive operations — should ensure that network and data segregation is enforced at the system level, not only as a policy guideline.

The FCC's own waiver logic is the clearest available statement of the regulatory position: the US government has determined that allowing these updates is a better security outcome than prohibiting them. That determination does not clear Autel's national security designation. It reflects the practical reality that enterprise drone fleets do not disappear when governments add their manufacturers to watch lists — and that the most accurate picture of what it means to operate one requires understanding both the technical update and the legal framework it lands in.

Frequently Asked Questions

Is Autel EVO Lite Enterprise firmware update v1.0.3.154 safe to install?

Autel's October 2026 firmware update (aircraft firmware v1.0.3.154, app v1.4.280) is a standard maintenance release covering flight performance, map service improvements, and bug fixes. The FCC has specifically granted a waiver (DA 26-454) permitting Autel to continue releasing firmware updates through January 1, 2029, because the Commission determined that blocking security patches creates greater risk than allowing the update pipeline. No independent third-party security audit of this specific release was available at the time of publication. Operators should apply standard network hygiene practices: complete the update on a network-isolated connection where possible, and confirm the aircraft's behavior matches expected flight characteristics on a test flight before returning to operational missions.

Is Autel on the FCC Covered List, and what does that mean for my operation?

Yes. Autel Robotics was added to the FCC Covered List on December 22, 2025, designating its communications equipment as presenting an "unacceptable risk to national security" under the Secure and Trusted Communications Networks Act of 2019. In practical terms: Universal Service Fund dollars cannot be used to purchase Autel equipment; federal agencies cannot deploy Autel devices; and the designation signals elevated concern for any operation with government contracting or critical infrastructure ties. The FCC's waiver (DA 26-454) allows firmware and software updates to continue until January 1, 2029, but does not lift the underlying designation. Private-sector operators are not directly prohibited from using existing Autel equipment, but should evaluate their specific mission types and compliance requirements accordingly.

What does Chinese law require Autel to do with user data?

China's National Intelligence Law (2017) Article 7 requires all Chinese organizations and citizens to "support, assist, and cooperate with national intelligence work in accordance with law." This means Autel Robotics is legally obligated to provide Chinese intelligence services with access to any data it holds or controls — including flight logs, GPS mission paths, imagery, and app usage data — if a valid intelligence request is made. This obligation cannot be waived by Autel's own privacy policy, its US subsidiary structure, or local data-storage practices. It applies regardless of where the data is physically stored and regardless of whether a specific security incident has occurred. Operators with data sensitivity requirements should assess which mission types are appropriate given this legal framework before continued deployment.

What should I do if I need to keep using an Autel EVO Lite Enterprise on sensitive missions?

The FBI and CISA recommend network segmentation as the primary technical mitigation: operate the drone on an isolated subnet with no direct internet access during the mission, so that the Autel Enterprise App cannot transmit data to external servers while the aircraft is airborne. Additional steps: disable any telemetry-upload or cloud-sync features in the Autel app that are not operationally required; air-gap the controller from your organization's primary network; review firmware update packages before installation on a test aircraft before fleet-wide deployment; and conduct a formal assessment of which mission types — particularly those involving critical infrastructure mapping, law enforcement operations, or sensitive site surveys — warrant platform transition to a Western-manufactured alternative. No mitigation fully addresses the structural legal obligation created by China's National Intelligence Law, but layered technical controls reduce the attack surface for any incidental data exposure.