Drone Compliance Matrix
| Regime | Applies to | What it prohibits | Effective | Registry / Citation |
|---|---|---|---|---|
| §889 NDAA FY2019 | Any contractor selling to the US government (enterprise-wide) | Covered telecom / video surveillance gear — Huawei, ZTE, Hikvision, Dahua, Hytera. Not UAS-specific. | 2019-08-13 | FAR 52.204-25 |
| §848 NDAA FY2020 | Department of Defense only | DoD cannot procure or operate UAS made in China or containing Chinese "critical components" (FC, radio, camera, gimbal, GCS software, storage). | 2020 | Pub. L. 116-92 §848 · DIU guidance |
| §817 NDAA FY2023 | Extends §848 to additional federal agencies beyond DoD | Same scope as §848, broader buyer coverage. | 2023 | Pub. L. 117-263 §817 |
| ASDA / FAR 52.240-1 NDAA FY2024 §§1821-1832 (American Security Drone Act) | Government-wide — every federal agency, every contract | Federal agencies cannot procure or operate UAS from "covered foreign entities" as listed by the Federal Acquisition Security Council on SAM.gov. | 2025-12-22 | FAR 52.240-1 · SAM.gov |
| FCC Covered List NDAA FY2025 §1709 | Every US buyer — commercial, hobby, federal, state, local. | FCC will not authorize foreign-produced UAS or critical UAS components for sale/use in the US. DJI and Autel named explicitly. Narrow Blue UAS / Framework carve-out. | 2025-12-22 | FCC DA-25-1086 |
| Blue UAS Cleared DoD curated list | Complete UAS platforms — DoD cyber + hardware review + ATO | Stronger than NDAA alone. Certified airframes with Authority To Operate, not just parts-level compliance. | Ongoing (DCMA since 2025-07-10) | bluelist.dcma.mil |
| Blue UAS Framework DIU component list | Integrators building custom UAS from pre-vetted components | Menu of approved sub-systems (ModalAI, ARK Electronics, Doodle Labs, Auterion, Vertiq, etc.) that can be mixed into custom airframes. | Ongoing | diu.mil/blue-uas |
| TAA Trade Agreements Act 1979 | GSA schedule procurement — not China-specific | Products must be substantially transformed in the US or a TAA-designated allied country (~120 nations). | 1979 | 19 U.S.C. §2511 |
What "critical components" means under §848
DoD guidance enumerates which subsystems must originate outside covered foreign entities. If any of these come from China (or another covered source), the whole UAS is non-compliant — even if the airframe is US-manufactured:
Common misconceptions
"NDAA §848 is from FY2024"
No — §848 is FY2020. The FY2024 action that extends it government-wide is ASDA (codified at §§1821-1832), implemented as FAR 52.240-1. When someone says "the new NDAA drone rule from 2024," they almost always mean ASDA, not §848.
"Blue UAS Cleared and NDAA-compliant are the same"
Every Blue UAS Cleared platform is NDAA-compliant, but not every NDAA-compliant platform is Blue UAS Cleared. Blue UAS adds cybersecurity review, hardware inspection, and an Authority to Operate on top of parts-level compliance. A small FPV shop can ship NDAA-compliant parts tomorrow; getting Blue UAS Cleared takes months and a formal process.
"TAA-compliant = NDAA-compliant"
These are separate regimes. TAA only checks whether a product was substantially transformed in an allied country — a TAA-eligible product could still contain a §848-banned Chinese flight controller. Conversely, an NDAA-compliant product manufactured in the US is automatically TAA-compliant but the reverse is not true.
"The FCC Covered List only affects federal buyers"
No — this is the biggest change. The Dec 22, 2025 FCC action is an equipment authorization prohibition, which means foreign-produced UAS and critical components cannot be legally sold or operated in the US by anyone — commercial operators, hobbyists, state/local government. This is the first US rule that reaches beyond federal procurement into the consumer market. Narrow Blue UAS / Framework exemptions exist.
"Self-attested spec sheets are worthless"
Not worthless, but they carry only as much weight as the manufacturer's reputation. For procurement, Blue UAS Cleared and Blue UAS Framework add third-party DoD verification. For commercial buyers and most contract work, a signed, dated, per-SKU spec sheet from a reputable vendor (the Freefly pattern) is the industry standard.
What a compliance spec sheet should contain
There is no DoD-issued form. The de facto industry standard (set by Freefly's per-SKU PDFs) contains:
- Product identification. Model, variant / bundle part number, revision date.
- Applicable statutes. Usually lists §848, §889, §817, ASDA together.
- Component-origin table. Each critical subsystem with vendor, model, country of manufacture.
- Officer attestation. Signature block from a company officer.
- Sub-vendor declarations. Supporting attestations from component makers (Hylio is the best example — bundles an e-con Systems validation for the camera).
Authoritative sources
- Blue UAS Cleared List (DCMA) — cleared platforms
- Blue UAS Framework (DIU) — cleared components
- SAM.gov — ASDA covered foreign entity list
- FAR 52.240-1 — the ASDA implementing regulation
- FCC DA-25-1086 — the Dec 22 2025 Covered List update
- DoD 1260H List — annual China-military-linked companies