Walk a defense trade-show floor in 2026 and you will see the words NDAA-compliant on roughly every third small UAS booth.1 Most of the vendors making the claim have not read the statute. Several of the platforms making the claim are not compliant. The phrase has migrated from a legal standard into a marketing label, and the gap between the two is now wide enough that a procurement officer can write a defective contract without realising it.
The proximate cause is that "NDAA compliance" for small unmanned aircraft is not one statute. It is a stack of at least four, layered across six fiscal years, each addressing a different procurement vector — and a Blue UAS listing on the Defense Innovation Unit's vetted-platforms page, which is helpful but is not the law and does not displace any of the underlying obligations. This piece is a practical guide to that stack for the contracting officer, the requirements writer, the program manager, and the operator who has to defend the file.
[01] · THE STATUTE STACK§889, §848, §1260H, ASDA — what each does and does not cover
The four federal authorities that bind a 2026 UAS procurement, in the order they entered force:
| Authority | Vehicle | What it does |
|---|---|---|
| §889 | FY2019 NDAA, Pub. L. 115-232 | Prohibits federal agencies from procuring, using, or contracting with companies that use "covered telecommunications equipment or services" from five named PRC entities and their subsidiaries.2 |
| §848 | FY2024 NDAA, Pub. L. 118-31 | Prohibits DoD operation or procurement of foreign-made small unmanned aircraft systems from "covered foreign entities," with a phased compliance schedule and a limited waiver authority for the Secretary.3 |
| §1260H | FY2021 NDAA, Pub. L. 116-283 | Directs the Secretary of Defense to publish, and annually update, a list of "Chinese military companies" operating directly or indirectly in the United States. Inclusion on the list triggers downstream prohibitions and signals to procurement.4 |
| ASDA | American Security Drone Act, in FY2024 NDAA Title XVIII | Extends DoD-style prohibitions on covered-foreign-entity UAS to all federal agencies, with a phased effective date and a state/local grant restriction layered on top.5 |
These four authorities are commonly collapsed into a single phrase — "NDAA-compliant" — which is wrong. They cover overlapping but materially different procurement vectors, and a UAS can satisfy one and fail another. A platform with a domestic airframe, an open-source autopilot, and a flight-controller link operating on an off-the-shelf 2.4 GHz radio module sourced from a Hytera subsidiary will pass casual marketing inspection and fail §889 Part B.6
The covered companies under §889
§889 names five PRC entities by statute: Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company — together with their subsidiaries and affiliates.2 The covered equipment is telecommunications and video-surveillance gear from these companies and any product or service that uses such equipment "as a substantial or essential component of any system, or as critical technology as part of any system."
Two distinctions matter for UAS:
- Part A (effective August 13, 2019) prohibits agencies from procuring covered equipment.
- Part B (effective August 13, 2020) prohibits agencies from contracting with any entity that uses covered equipment, regardless of whether the contract itself involves that equipment. This is the clause that catches most non-defense-pedigree drone OEMs.
[02] · §848 AND ASDAThe two statutes that actually ban DJI
§889 does not name DJI. The statutes that do the work of restricting Chinese-origin small UAS specifically are §848 of the FY2024 NDAA and the American Security Drone Act, also passed as part of the FY2024 NDAA.
§848 prohibits DoD components from operating or procuring a "covered unmanned aircraft system" from a "covered foreign entity," which the statute defines by reference to entities domiciled in the PRC and to entities subject to PRC government influence — capturing DJI, Autel Robotics, and any of their direct or indirect subsidiaries.3 The prohibition phases in over a multi-year window with a narrow waiver authority for the Secretary of Defense; that waiver authority is not delegated freely and has not been used at scale.
The American Security Drone Act extends a parallel regime to federal agencies outside DoD — Department of Homeland Security, Department of Interior, Department of Justice, the intelligence community, and others — and adds restrictions on the use of federal grant money by state and local agencies to procure covered foreign UAS.5 The federal-agency procurement prohibition was scheduled to take effect by late 2025 under the bill's phased schedule, with the grant restriction following on a longer ramp.
The shorthand "DJI ban" is two statutes doing two different things. §848 covers DoD operation and procurement. ASDA covers everyone else in the federal procurement chain plus federal grants to state and local users. A procurement officer who only checks one is exposed.
[03] · THE BLUE UAS MISUNDERSTANDINGWhat DIU's list does, and does not, certify
The Defense Innovation Unit's Blue UAS program is the most-cited shortcut in federal drone procurement and the most-misunderstood. Blue UAS has two tracks:
- Blue UAS Cleared List. A small set of Group 1 and Group 2 systems vetted by DIU and the National Defense Information Sharing and Analysis Center against NDAA §889 and a layered set of cybersecurity and supply-chain criteria. Cleared-list platforms are pre-approved for DoD procurement under streamlined authorities.7
- Blue UAS Framework. A broader assessment framework that allows vendors to submit components and platforms for vetting, generating a larger universe of "Blue-aligned" products that are not necessarily on the cleared list.
Two things to remember about the Blue UAS list:
First, it is not a statute. Inclusion on Blue UAS does not by itself relieve a contracting officer of the §889 representation requirement under FAR 52.204-25 — the contractor still must represent compliance, and the agency still must do its own due diligence proportional to the risk of the procurement.
Second, Blue UAS coverage is narrow. The cleared list at any given time contains roughly two dozen systems across Group 1 and Group 2 — enough to meet many tactical-ISR mission profiles, not nearly enough to cover counter-UAS interceptor, one-way attack, or long-endurance ISR roles where the requirement does not yet have a fielded answer. Most of the platforms that will solve the mass-attrition counter-UAS problem we wrote about in our analysis of cost-per-kill economics are not yet on the cleared list because the cleared list lags the requirement.
[04] · THE BILL-OF-MATERIALS PROBLEMWhere compliance actually breaks
The hard part of NDAA compliance is not the airframe and it is not the autopilot. The hard part is the long tail of the bill of materials — the components a vendor's procurement team did not personally select, that came in through a sub-tier supplier, that the integrator may not even know are in the box.
The components most likely to break §889 compliance on an otherwise-compliant small UAS:
| Component class | Common failure mode |
|---|---|
| Radio links / telemetry | Off-the-shelf 900 MHz / 2.4 GHz / 5.8 GHz modules sourced from Hytera or Hytera-linked suppliers. |
| Video transmitters | Dahua and Hikvision OEM modules embedded in low-cost analog/digital video links. |
| GPS / GNSS receivers | White-label receivers with PRC-origin baseband silicon — the "compliant casing, covered chip" pattern. |
| Camera / EO-IR sensors | Hikvision and Dahua OEM imaging modules behind a relabelled brand. |
| Lithium-polymer cells | Cells from covered or §1260H-listed manufacturers integrated into a U.S.-assembled pack. |
| Brushless motors and ESCs | T-Motor and equivalent-brand parts in non-Blue product lines; a known supply-chain trap. |
This is the layer at which the phrase "NDAA-compliant" most often dissolves under scrutiny. A finished-goods OEM can be domestically owned, domestically integrated, and ITAR-registered, and still ship a non-compliant article if the BOM was not audited at the sub-tier. Procurement teams that have not asked for a written component-level NDAA representation are, in practice, accepting the marketing claim.
For an in-depth look at the U.S. suppliers that make a §848-compliant combat UAS economically viable in 2026, see our companion piece on building a domestic drone supply chain.
[05] · WHAT TO ASK FORThe four-clause RFP language that survives audit
A procurement officer writing a small-UAS RFP in 2026 should not delegate compliance to vendor marketing. The following four clauses, embedded in the solicitation, materially reduce the risk that a procurement will be unwound, paused, or referred:
- Statutory representation. Vendor shall represent and warrant compliance with §889 of the FY2019 NDAA (FAR 52.204-25), §848 of the FY2024 NDAA, the American Security Drone Act, and shall further represent that no component, subcomponent, or service in the supply chain originates from any entity on the §1260H list current as of the contract award date.
- Component-level bill of materials. Vendor shall provide a written, signed bill of materials at the component-level granularity (typically two tiers below the integrated platform) identifying country of origin and manufacturer of all radio, video, GNSS, imaging, energy-storage, and propulsion components. The BOM shall be updated upon any production-line change.
- Flow-down to subcontractors. Vendor shall flow the §889, §848, and ASDA representations down to all subcontractors and sub-tier suppliers and shall maintain records of those flow-downs available for government audit for a period of not less than six years following final delivery.
- Right-to-audit and right-to-cure. The government reserves the right to audit the bill of materials and supply chain at any point during the contract period of performance, and the vendor agrees to a defined cure period and remediation pathway in the event a non-conforming component is identified post-award.
None of these clauses is exotic. All four are present, in some form, in well-written DoD UAS solicitations issued in the last twenty-four months. The reason they remain absent from many federal, state, and local solicitations is institutional, not technical.
[06] · CLOSINGThe procurement file is the policy
NDAA compliance in 2026 is not a checkbox and it is not a Blue UAS sticker. It is a chain of representations and a documented bill of materials, evaluated under four overlapping statutes, defensible under audit. Vendors who treat that chain as a discipline produce platforms that survive procurement review. Vendors who treat it as marketing produce platforms that get paused at the contracting officer's desk three weeks before delivery.
At Vertex Autonomy we built our compliance documentation as a first-order design constraint, not a sales overlay. Every component on the X-7 Talon counter-UAS interceptor and the X-4 Raptor loitering munition is selected against the four-statute stack, audited at the sub-tier, and represented in writing. See the platforms. Open a procurement channel if you would like the compliance documentation walk-through.