Key takeaways
- A US-market AI device checklist splits into three tiers: mandatory rules that apply to almost any connected device (FCC, battery transport), conditional rules that depend on what the device does (UL 3300, FDA, COPPA), and voluntary guidance that no regulator currently requires (the NIST AI RMF).
- There is no separate “AI device” category at the FCC. A WiFi- or Bluetooth-enabled AI gadget is authorized exactly like any other consumer radio product, through Certification for the radio and SDoC or Certification for the rest of the board.
- UL 3300 only applies if your device physically moves or manipulates objects without containment. It explicitly excludes “robotic functions with no safety dependency, such as AI answer accuracy,” so a stationary AI speaker or wearable does not need it.
- COPPA’s biometric-identifier rule, in force since June 2025 with most compliance deadlines from April 2026, now covers facial, voiceprint, and gait data, which directly affects any AI device with those sensing features that is directed to or knowingly used by children under 13.
A US compliance checklist for an AI-enabled physical device has three tiers, not one flat list. Some rules are mandatory for nearly any connected device: FCC equipment authorization and, if the device ships with a lithium battery, transport testing. Some are conditional on what the device actually does: UL safety certification if it moves or manipulates objects, COPPA if children are a likely user, FDA if any marketing claim edges toward diagnosis or treatment. One, the NIST AI Risk Management Framework, is voluntary guidance that no regulator currently requires. Sorting a device into the right tier before development, not after, is what keeps a compliance surprise from showing up at the worst point in the schedule. This checklist assumes you already know what physical AI is and are past the concept stage; if your AI feature is being added to an existing connected product rather than a new physical device, AI in IoT devices covers that narrower decision.
FCC: certification or SDoC, not an AI-specific rule
There is no AI-specific FCC rule. The FCC regulates radio frequency emissions, not device intelligence, so a WiFi- or Bluetooth-connected AI gadget is authorized the same way any other consumer radio product is. Under 47 CFR 15.3, the device’s radio is an “intentional radiator” and generally needs Certification through a Telecommunication Certification Body, while the rest of the board is an “unintentional radiator” that can usually use the simpler Supplier’s Declaration of Conformity instead. The cost mechanics of that process are covered in depth in our guide to FCC certification cost, and which labs can legally perform that testing is covered in FCC recognized test labs; this checklist treats FCC as one line item among several rather than repeating that detail.
Free tool: check if your invention is ready to build, in 3 minutes →UL and NRTL: safety certification, and when it actually applies
“NRTL” (Nationally Recognized Testing Laboratory) and “FCC-authorized” are not interchangeable. NRTL status is an OSHA program recognizing labs to certify products against electrical and fire-safety standards, UL among them, and it has nothing to do with radio spectrum. A device typically needs both an NRTL safety listing and FCC authorization, from two different bodies, under two different statutes.
Whether a specific robot-safety standard applies depends entirely on what the device does physically, not on whether it uses AI:
| Standard | Applies when | Does not apply to |
|---|---|---|
| UL 3300 | The device physically moves or manipulates objects without containment, indoors or outdoors, near consumers | Stationary AI speakers, wearables, or sensors; also excludes “robotic functions with no safety dependency, such as AI answer accuracy” |
| General electrical safety (UL/IEC 60335 or 62368 family) | Essentially every powered consumer electronic device | N/A, this is the baseline most devices start from |
In other words, a stationary AI device, a speaker, a camera, a wearable with no mobility function, does not need UL 3300 at all. It still needs the general electrical-safety listing any powered product needs, which is a separate, broader question from the AI functionality. A borderline design, one with limited internal movement or manipulation that may or may not count as contained, should be checked against the standard’s current text or with a test lab rather than assuming the exemption applies.
Battery safety: two separate requirements, not one
A battery-powered AI device has a product-safety requirement and a transport requirement, and they come from different rules. UL 2054 covers portable primary and rechargeable batteries used as a power source in a product, aimed at reducing fire, explosion, and injury risk; it explicitly does not cover the combined battery-and-host-product system, which is addressed by the host product’s own standard. Separately, under 49 CFR 173.185, every lithium cell or battery shipped by any mode of transportation in the US must be of a type proven to meet the UN Manual of Tests and Criteria, Part III, Sub-section 38.3, commonly shortened to “UN 38.3.” That transport testing applies regardless of whether the product itself has already passed a safety standard like UL 2054; shipping and product safety are two separate boxes to check, not one.
Lithium-battery recalls remain active enough to take seriously: the CPSC’s 2026 recall of roughly 429,000 wireless power banks, reannounced after new reports including one fatality, is a reminder that battery safety is not a box to check once and forget. Check current recall data at CPSC.gov before finalizing a battery choice.
Privacy and children: FTC and COPPA
The FTC has said plainly that “there is no AI exemption from the laws on the books,” and it has brought several enforcement actions against deceptive AI claims. For a physical AI device specifically, the sharper edge is COPPA. The Children’s Online Privacy Protection Rule applies to a product “directed to children under 13,” or to any operator with “actual knowledge” it is collecting personal information from a child that age, regardless of the product’s general-audience marketing. A 2025 amendment to the rule, effective June 23, 2025 with most compliance deadlines from April 22, 2026, added biometric identifiers, fingerprints, voiceprints, gait patterns, and facial templates, to the definition of personal information. Any AI device with facial recognition, voice recognition, or gait sensing that is directed to or knowingly used by children now needs parental notice and verifiable consent before collecting that data, where it did not clearly before. Confirm your specific product’s COPPA exposure with counsel or the FTC’s own COPPA Rule page; this is not a substitute for that review.
FDA: the wellness-versus-medical-device line
An AI sensor or wearable can stay outside FDA device regulation as a “general wellness” product only if it meets two conditions: it is intended solely for general wellness use, and it presents low risk, meaning it is not invasive, not implanted, and does not involve a technology that poses a safety risk without regulatory controls. The moment a device’s marketing claims diagnosis or treatment of a specific disease rather than general wellness, it falls back into regulated medical-device territory, with the registration, labeling, and quality-system obligations that come with it. For any device that does cross that line, the FDA’s Quality Management System Regulation replaces the older Quality System Regulation as of its effective date, February 2, 2026. Where a specific feature or claim sits relative to this line is a product-specific judgment; it is worth a direct check against current FDA guidance or a regulatory consultant before finalizing marketing language, not an assumption either way.
NIST AI RMF: voluntary, and not a substitute for the rules above
The NIST AI Risk Management Framework is intended for voluntary use, not a regulatory requirement, built around four functions: Govern, Map, Measure, and Manage. No FCC, FTC, FDA, or CPSC rule found in researching this checklist incorporates the AI RMF by reference. Treat it as a useful internal planning structure for how your team documents and manages AI-specific risk, not as something that satisfies any of the mandatory or conditional requirements above.
None of the tiers above substitute for each other. Passing FCC testing says nothing about COPPA exposure, and a UL 3300 listing says nothing about FCC authorization. Each has to be checked on its own.
Building compliance into the development timeline
The checklist works best as a feasibility-stage exercise, not a pre-launch one:
- Identify which tier each requirement falls into (mandatory, conditional, voluntary) before finalizing the device’s sensing features and physical behavior.
- Decide early whether the device moves or manipulates objects, since that single design choice determines whether UL 3300 is in scope at all.
- Flag any feature, facial recognition, voice capture, gait sensing, that could trigger COPPA if the product might reach younger users, even unintentionally.
- Review marketing language against the FDA’s wellness-versus-medical-device line before it is finalized, not after a claim has already shipped.
- Treat battery transport testing (UN 38.3) and battery product safety (UL 2054) as two separate line items on the schedule, not one.
Where Inventornest fits
None of the tiers above change based on who builds the device, but getting them identified early changes how smoothly the schedule runs. Physical AI product development at Inventornest starts by mapping which of these requirements actually apply to a specific design, which is a different exercise than discovering them during DVT. If your device also moves through physical space rather than sitting on a shelf, our companion guide on building a robot startup covers the safety-standard and manufacturing side of that question. You can see related connected-product work in our project portfolio, and get a quote once you know roughly which tiers your device falls into.
Frequently asked questions
Does the FCC have special rules for AI-enabled devices?
No. The FCC regulates radio frequency emissions, not AI functionality. A WiFi- or Bluetooth-connected AI device is certified the same way any other consumer radio product is, through Certification for the radio and SDoC or Certification for the rest of the board.
Does my AI device need UL 3300?
Only if it physically moves or manipulates objects without containment. UL 3300 explicitly excludes robotic functions with no safety dependency, such as AI answer accuracy, so a stationary AI speaker, camera, or wearable does not need it. A design with limited or ambiguous movement should be confirmed against the standard directly rather than assumed.
Do I need separate testing for my device’s battery and for shipping it?
Yes. UL 2054 addresses the battery’s product safety; UN 38.3 testing, required under 49 CFR 173.185, addresses whether the battery can legally be transported. They are separate requirements and neither substitutes for the other.
When does COPPA apply to an AI device?
When the device is directed to children under 13, or when the operator has actual knowledge it is collecting personal information from a child that age. That personal information has explicitly included biometric identifiers, such as facial, voice, and gait data, since a 2025 rule amendment.
Is my AI wearable a medical device?
Only if it is not solely intended for general wellness, or if it poses more than low risk. A product marketed as diagnosing or treating a specific condition falls into regulated medical-device territory rather than the lower-burden wellness category.
Do I need to follow the NIST AI RMF to sell an AI device in the US?
No. It is explicitly voluntary guidance. No current FCC, FTC, FDA, or CPSC rule requires it, though using it internally can help structure how your team documents AI-specific risk.
