An NDAA compliant camera is a video surveillance device that contains no components, chipsets, or software from the five Chinese manufacturers banned under Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019: Huawei, ZTE, Hytera Communications, Hangzhou Hikvision Digital Technology, and Dahua Technology. The prohibition also reaches their subsidiaries and affiliates, and any entity in which one of them holds majority ownership or significant operational control.1Acquisition.GOV. Section 889 Policies For camera buyers, the two names that come up most often are Hikvision and Dahua, the world’s two largest surveillance manufacturers. Their hardware turns up in far more places than the brand label suggests.
Why the Brand on the Box Isn’t Enough
The most common way buyers end up with banned equipment isn’t purchasing a Hikvision camera. It’s purchasing a camera sold under a different name that Hikvision or Dahua actually built. This practice, called original equipment manufacturing or white-labeling, is widespread in security hardware.
Hikvision alone supplies dozens of brands. EZVIZ, HiLook, and HiWatch are its own sub-brands. Beyond those, brands including LTS, LaView, Annke, and Oculur have sold rebranded Hikvision hardware. On the Dahua side, Amcrest, some Lorex product lines, and others have used Dahua as their OEM. The housing may look different and the software interface may carry a different logo, but the internals trace back to a prohibited manufacturer, and the camera fails Section 889 regardless of what the sticker says.
If a vendor cannot clearly state who manufactured the hardware and where the internal processor comes from, that alone is reason to walk away. Cross-referencing model numbers against known OEM product lines, comparing chassis designs, and asking for a manufacturer’s declaration of origin are all part of routine due diligence.
The Chip Inside the Camera
A camera can fail compliance even when the assembler is not on the banned list, because the processor doing the video encoding is. The usual culprit is HiSilicon, a semiconductor subsidiary of Huawei. Until U.S. export restrictions disrupted its supply chain, HiSilicon was the dominant chipset provider for the global surveillance industry, and many mid-range and budget cameras used its processors by default. Any camera built around a HiSilicon chip is non-compliant no matter who assembled the finished product. Brands including Lorex and Amcrest have had product lines affected.
Compliant manufacturers use processors from companies such as Ambarella, Qualcomm, or Intel, and they say so in their documentation. Before purchasing, request a Bill of Materials that identifies the system-on-a-chip and major internal components. Reluctance to share that information tells you what you need to know.
Who Actually Has to Comply
Section 889 contains two prohibitions that catch different activities, and the second one is broader than most contractors realize.
Part A took effect August 13, 2019. It prohibits federal agencies from buying equipment, systems, or services that use covered telecommunications or video surveillance equipment as a substantial or essential component.2Acquisition.GOV. Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment The government cannot purchase banned cameras or systems built around them.
Part B took effect August 13, 2020. It prohibits federal agencies from contracting with any entity that uses covered equipment anywhere in its operations, whether or not that equipment touches the government contract.1Acquisition.GOV. Section 889 Policies Hikvision cameras watching the parking lot of a company bidding on a federal IT contract are still in scope. The contractor’s entire technology environment counts.
The compliance obligation radiates outward from federal agencies through the contracting ecosystem:p>
- Federal agencies and departments cannot purchase or use covered equipment under either part.
- Contractors and subcontractors must represent during bidding whether they provide or use covered equipment. FAR 52.204-26 requires every offeror to confirm both points. A false representation can lead to contract termination and debarment.3Acquisition.GOV. Covered Telecommunications Equipment or Services – Representation
- Federal grant and loan recipients, including FEMA award recipients, face the same restrictions when spending those funds.
FEMA recipients have specific rules to follow. Any purchase order, contract, or subcontract that is new, renewed, or extended on or after August 13, 2020, falls under the prohibition regardless of dollar amount, and recipients must include a Section 889 provision in all new contracts issued on or after November 12, 2020.4Federal Emergency Management Agency (FEMA). Prohibitions on Expending FEMA Award Funds for Covered Telecommunications Equipment or Services Section 889(b)(2) directs agencies to prioritize funding and technical support for recipients replacing prohibited equipment, so organizations facing rip-and-replace costs should ask their FEMA program office whether replacement is an eligible expense.
One boundary is worth naming. Private businesses with no federal contracts, grants, or loans are not legally required to remove banned cameras. Many do so anyway, because the security vulnerabilities that motivated the federal ban apply to any network.
How to Verify a Specific Camera
Confirming compliance takes more than trusting a marketing label.
Read the Manufacturer’s Compliance Statement
Reputable manufacturers that sell into the government market publish NDAA compliance statements, sometimes called country-of-origin letters. The document should explicitly confirm that the product contains no components from the five banned entities or their subsidiaries. A vague statement about “meeting applicable regulations” without naming Section 889 is not enough.
Ask for the Bill of Materials
Get confirmation in writing that the chipset comes from a non-banned source such as Ambarella, Qualcomm, or Intel rather than HiSilicon. Any pushback on this request should end the transaction.
Trace the OEM Behind an Unfamiliar Brand
If a brand name is unfamiliar, research whether it’s a white-label product. Compare the physical chassis and interface screenshots against known Hikvision and Dahua product lines. Rebranded cameras are often cosmetically identical to their OEM source, and a few minutes of research can prevent months of compliance problems.
Camera Brands Commonly Used for Compliance
Several established manufacturers produce cameras that meet NDAA requirements using processors from non-banned sources. Brands commonly deployed for compliant installations include Axis Communications (Swedish, now part of Canon), Hanwha Vision (South Korean, formerly Samsung Techwin), Bosch Security Systems, Verkada, Pelco, Digital Watchdog, Vivotek, and Mobotix.
Compliance is a product-level determination, not a brand-level one. A manufacturer’s newer product lines may be compliant while older models still contain HiSilicon chips. Verify the specific model you’re buying rather than assuming an entire catalog qualifies, and keep the compliance documentation from the time of purchase for audit purposes.
If You Discover Banned Equipment on a Federal Contract
Contractors who identify covered equipment in their systems during performance of a federal contract have a tight reporting window under FAR 52.204-25. The initial report is due within one business day and must include the contract number, supplier name, brand, model number, item description, and any readily available information about steps already taken.5Acquisition.GOV. Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
A more detailed follow-up is due within 10 business days, describing the efforts the contractor took to prevent the use of covered equipment and the additional measures being put in place.5Acquisition.GOV. Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment The one-day deadline is aggressive, which is why organizations with federal contracts should audit their camera fleet proactively rather than discover the problem mid-contract.
A Second Wave Arrives in December 2027
A separate layer of restrictions takes effect December 23, 2027, under Section 5949 of the FY2023 NDAA. This provision targets semiconductor products and services from specific Chinese chipmakers, adding a category of banned components beyond the Section 889 list.
The covered entities include Semiconductor Manufacturing International Corporation (SMIC), ChangXin Memory Technologies (CXMT), and Yangtze Memory Technologies Corp (YMTC), along with their subsidiaries and affiliates. The Secretary of Defense or Secretary of Commerce can designate additional entities owned or controlled by a foreign government of concern.6Federal Register. Federal Acquisition Regulation – Prohibition on Certain Semiconductor Products and Services
Federal agencies will be prohibited from purchasing electronic parts, products, or services that incorporate semiconductors from these companies. Unlike Section 889’s Part B, agencies are not required to remove equipment already installed before the effective date, and lifecycle maintenance of existing systems using covered components remains permitted.6Federal Register. Federal Acquisition Regulation – Prohibition on Certain Semiconductor Products and Services Procurement cycles for large camera deployments can stretch past December 2027, so hardware supply chains should be reviewed against the new list now rather than closer to the deadline.