An NDAA compliant drone is an unmanned aircraft system that meets the security rules set by the National Defense Authorization Act and related laws: no critical components from designated Chinese manufacturers or other covered foreign entities, cybersecurity vetting passed, and clearance for use on federal missions. If you fly drones under a federal contract, subcontract, grant, or cooperative agreement, you need one. As of December 22, 2025, that requirement reaches contractors and grant recipients across every civilian federal agency, not just the Department of Defense.
What Actually Makes a Drone Compliant
Compliance is decided at the component level, not the country of final assembly. A drone built in Ohio can still fail if its flight controller, radio, camera, gimbal, ground control software, data-transmission device, network connectivity hardware, or data-storage unit comes from a restricted source. Those eight parts are the ones Section 848 of the FY2020 NDAA singled out, and if any of them originate with a covered foreign entity, the whole system is non-compliant.
Three laws set the rules. Section 848 barred the Department of Defense from buying or operating drones from covered foreign countries, with China named specifically. Section 817 of the FY2023 NDAA extended the ban to DoD contractors whose work uses covered drone equipment and added Russia, Iran, and North Korea to the covered-country list. The American Security Drone Act, enacted December 22, 2023 as part of the FY2024 NDAA, pushed the same restrictions out to every federal agency and to federal grants and cooperative agreements.1Federal Register. Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities
Under ASDA, the operative list of “covered foreign entities” is maintained by the Federal Acquisition Security Council and published in the System for Award Management at SAM.gov. That means the definition is not frozen in statute; the FASC can add names as new risks surface.
Which Manufacturers Are Off Limits
The Department of Defense’s Section 1260H list of Chinese military companies operating in the United States names several major drone makers, including DJI (Shenzhen DJI Technology Co., Ltd.), Autel Intelligent Technology Corp., Autel Robotics Co., Aerospace CH UAV Co., and Chengdu JOUAV Automation Tech Co.2Department of Defense. Entities Identified as Chinese Military Companies Operating in the United States in Accordance With Section 1260H DJI holds a dominant share of the commercial drone market, so its designation drives most compliance questions in practice.
A separate bill, the Countering CCP Drones Act, would place DJI on the FCC’s list of communications equipment that poses an unacceptable national-security risk. The House passed it in September 2024 and it was referred to the Senate Commerce Committee.3Congress.gov. Countering CCP Drones Act It is not yet law.
Who Needs to Comply
The requirement reaches further than many buyers expect. It covers:
- Every federal executive agency, including DoD.
- Federal contractors and subcontractors whose work involves drone operations. Under the FAR update implementing ASDA, this applies to all acquisitions, including purchases below the micro-purchase threshold and contracts for commercial products or services.1Federal Register. Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities
- State and local agencies spending federal grant money on drones. A police department buying drones with a Department of Justice grant, or an emergency services agency using FEMA funds, has to buy compliant hardware. OMB Memorandum M-26-02 requires agencies to write those security requirements into their notices of funding opportunity.4The White House. M-26-02 Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers
Two deadlines set the current timeline. The first phase took effect November 12, 2024, barring federal agencies from purchasing any drone on the FASC prohibited list. The second, on December 22, 2025, extended the ban to federal contractors using federal funds on prohibited drones and to grant recipients spending federal dollars on covered systems.4The White House. M-26-02 Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers
A boundary worth stating clearly: if you have no federal nexus, none of this restricts you. A wedding photographer or real estate agent using a DJI drone with their own money faces no legal problem. The rules only bind you the moment federal funds or federal contracts touch the operation. Many state and local governments follow the federal standard voluntarily anyway, both for their own security reasons and to protect eligibility for future federal funding.
How to Verify a Drone Is Compliant
The most direct method is to check the Blue UAS cleared list, maintained by the Defense Innovation Unit at DoD. Every platform on the list has been verified for NDAA compliance and cybersecurity, and it satisfies Section 848, Section 817, and ASDA.5Defense Innovation Unit. Blue UAS Refresh List, Framework Platforms and Capabilities Selected6Department of Homeland Security. Blue UAS for First Responders
Approved manufacturers on the current list include Skydio (X10D, X2D), Parrot (ANAFI USA GOV/MIL), Teal (Teal 2), Freefly Systems (Astro, AltaX), AeroVironment (Red Dragon), Inspired Flight Technologies (IF800, IF1200A), Shield AI (V-BAT), Teledyne FLIR (Black Hornet 4), and Wingtra (WingtraRAY, WingtraOne Gen II), among roughly a dozen others. The full, current list is published at diu.mil/blue-uas.
Blue UAS is not the only pathway. Under ASDA, a drone also qualifies if it is entirely American-made, if it is not on the FASC prohibited list published at SAM.gov, if it meets the Buy American standard with supporting documentation, or if the buying agency has an exception or approved waiver. Manufacturers sometimes provide self-certification listing the origin of each critical component; agencies should keep those records for audit, though self-certification carries less weight than a Blue UAS listing.
Mark January 1, 2027 on the calendar. The national security determination recognizing the Blue UAS list as a valid compliance pathway is set to sunset on that date, and the Buy American pathway expires with it.7Federal Communications Commission. Public Safety and Homeland Security Bureau National Security Determination Unless renewed, buyers will need to rely on the FASC prohibited list, fully American-made systems, agency exceptions, or waivers after that date.
NDAA Compliant Is Not the Same as TAA Compliant
The two labels sit near each other on product pages and get confused constantly. NDAA compliance prohibits specific companies and subsidiaries flagged for national-security reasons. TAA (Trade Agreements Act) compliance is a broader procurement rule requiring products sold to the government to be manufactured in the United States or in a country that has signed a qualifying trade agreement. A drone assembled in a TAA-designated country can still contain components from a covered foreign entity, which would make it TAA compliant but NDAA non-compliant. The two tests measure different things, and passing one does not mean passing the other.
Waivers and Statutory Exemptions
The framework carves out narrow exceptions. The Departments of Homeland Security, Defense, State, and Justice can procure or operate otherwise-prohibited drones when the use serves the national interest and meets defined criteria such as counterterrorism, counterintelligence, research and evaluation, or modification to prevent data transfer to covered entities.1Federal Register. Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities The Department of Transportation, NTSB, and NOAA hold narrower mission-specific exemptions. Additional carve-outs cover wildfire management, search and rescue, and certain intelligence operations.
Outside those statutory exemptions, an agency head may grant a case-by-case waiver with OMB director approval and after consulting the Federal Acquisition Security Council, with prior notice to the relevant congressional committees. Under OMB Memorandum M-26-02, an agency head may also grant a written exemption when compliance would prevent the agency from obtaining a drone capable of fulfilling mission-critical needs; that exemption cannot exceed three years and the authority can only be delegated as low as a deputy secretary or equivalent.4The White House. M-26-02 Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers
What Happens If You Get It Wrong
The first consequence is commercial: the government won’t buy from you, and existing contracts can be terminated. The larger risk sits behind that. A contractor who falsely certifies its drones as NDAA compliant on a federal contract is exposed to the False Claims Act, which allows the government to recover treble damages for knowing material misrepresentation and lets private whistleblowers file suit on the government’s behalf and share in the recovery.
The numbers are not hypothetical. A Boeing-owned drone maker paid $25 million to settle FCA allegations that it misrepresented materials used on military drone projects.8United States Department of Justice. Boeing Owned Drone Maker to Pay $25 Million to Settle False Claims Act Allegations It Used Recycled Parts on Military Projects That case involved recycled parts rather than foreign components, but the legal mechanism is the same: knowingly delivering something other than what you certified triggers liability. For a smaller contractor, one bad certification can be ruinous.
Grant recipients face a parallel exposure. Federal funds spent on prohibited drones after the December 22, 2025 deadline may have to be returned, and awarding agencies now build the compliance language directly into their funding agreements. If you operate anywhere near federal money, verify the hardware before you buy, keep the paperwork, and watch the 2027 sunset.