NDAA-Compliant Drones: What the Rules Actually Require, and Why 'Compliant' Products Still Contain Chinese Parts

In August 2026, The Telegraph reported that cameras fitted to the Royal Navy’s new K3 Scout sea drones contained Chinese-made components transmitting automated heartbeat signals to an IP address in China. The supplier’s response is the line every American buyer should read twice: Kraken Technology Group said those cameras were NDAA-compliant (DroneXL’s report).

The short answer: “NDAA-compliant” is a manufacturer’s self-declaration, not a certification any government issues. Four different federal rules restrict Chinese drones, each binding a different group of buyers, and none of them reaches every part inside the airframe. If you spend federal money, the rules are real and enforceable. If you do not, almost none of this touches you.

That British case is not US law and should not be read as one. It is the clearest public illustration of the gap this guide is about: a Western-branded camera, sold under the compliance label, opening a line home from a military platform.

Is “NDAA-compliant” an official certification?

No. No federal agency certifies NDAA compliance and no compliance mark exists. Manufacturers declare that their hardware meets the sourcing rules Congress wrote into statute, and the buyer is left to verify it. The closest things to third-party verification are the Blue UAS Cleared List and AUVSI’s Green UAS program.

The distinction matters because the phrase does real work in procurement. It appears in bid packages and grant applications and gets treated as a pass/fail credential, when it is a vendor assertion about its own supply chain. A brochure claiming NDAA compliance is not documentation.

What the four rules actually say

Four separate instruments make up what people casually call “the NDAA drone ban,” enacted five years apart with different targets. One covers Pentagon buying, one covers the whole federal government and its grantees, one forced a listing deadline on the FCC, and one gives the FCC power to block equipment approvals.

Section 848 is the origin of the phrase, and it names components, which is why vendors talk about flight controllers and gimbals rather than aircraft brands.

The Section 1709 story ended the way DJI spent a year warning it would. The FY2025 NDAA became law on December 23, 2024, giving DHS, DoD, ODNI, NSA, or the FBI twelve months to run a study. DJI publicly asked for the audit in June 2025 and again three weeks before the deadline, and no agency confirmed it had started. On December 21, 2025, an executive branch interagency body issued a national security determination instead, and the next day the FCC added DJI, Autel, and effectively all foreign-produced drones and UAS critical components to the Covered List. The audit Congress ordered was never completed. The listing happened by default.

Who these rules actually bind

Most people reading this are not covered. The federal restrictions attach to federal money and federal missions, so a recreational flyer, a Part 107 operator, or a farm spending its own capital can legally buy and fly a Chinese-made drone today. The trigger is the funding source, not the flight.

• Department of Defense. Section 848 applies directly, with narrow research and counter-UAS exceptions.
• Every federal agency. ASDA Sections 1823 and 1824 bar procurement and, since December 22, 2025, operation of covered drones, with carve-outs for DHS, DoD, State, DOJ, the FAA, NTSB, NOAA, wildfire and search-and-rescue work, and tribal law enforcement.
• Federal contractors. FAR clause 52.240-1 has been going into solicitations since November 12, 2024, and requires the contractor to check the SAM.gov list of covered foreign entities before proposing or using any drone on the contract.
• Grant-funded state and local buyers. This is the one that catches police and fire departments. ASDA Section 1825 bars federal funds awarded through a contract, grant, or cooperative agreement from being used to procure or operate a covered drone, effective December 22, 2025. A DHS or DOJ grant turns a local purchase into a federal compliance question.
• Nobody else, federally. ASDA Section 1830 leaves state, local, and tribal purchases made with non-federal dollars alone, and Sections 1823 through 1825 sunset in December 2028 (section-by-section).

State law is a separate layer agencies discover late. Florida, Tennessee, Arkansas, Mississippi, Texas, and Utah have all restricted government drone purchasing on their own authority, and Florida’s ban grounded a reported $200 million in public-safety aircraft. A state rule can bind you with no federal money involved.

The component gap: what the statutes do not reach

The statutes regulate country of origin at the manufacturer level and across a named list of components, while a modern drone carries dozens of parts and firmware stacks nobody has inspected. Compliance gets checked where the paperwork is legible, and the risk lives below that line.

DefenseScoop reported in November 2025 that “the majority of the unmanned aerial systems cleared through this effort have motors that are sourced in China,” because non-computerized parts were not classified as critical components under the original framework. A former senior defense official named motors, batteries, and electronic speed controllers as the top three Chinese items in Blue UAS-approved platforms. AUVSI president Michael Robbins gave the reason: “There just hasn’t been a demand signal for non-Chinese motors.” Chinese motors run $12 to $25, American ones $100 to $225.

Visibility fails deeper in the chain too. GAO reported in GAO-25-107283 on July 24, 2025 that DoD could map three tiers of MQ-9 Reaper suppliers and saw a US and European picture, but that “a separate DOD deep-dive analysis identified Chinese integration in the lower sub-tiers of the drone.” Current supplier data, GAO concluded, does not give the department enough visibility to find foreign dependency risks at lower tiers.

Skydio CEO Adam Bry conceded the same limit about his own aircraft in June 2026, saying Chinese content past the first supplier tier is effectively untraceable, and nearly every Western builder still buys from the same handful of Chinese suppliers. A brand-level ban never opens the enclosure. After eight months on this beat, the honest summary is that no confirmed public case exists of a DJI aircraft covertly transmitting to China, while a compliance-labeled Western camera has now been caught at it.

Blue UAS and Green UAS: the closest thing to verification

Two programs put a third party between a vendor’s claim and your purchase order. The Blue UAS Cleared List covers complete platforms vetted for DoD use, the Blue UAS Framework covers vetted components for integrators, and AUVSI’s Green UAS assesses civil and commercial systems needing no DoD authority to operate.

Blue UAS started at five platforms in 2020 and passed 50 by early 2026, from more than 30 manufacturers. Aircraft get on through DoD sponsorship, a competitive DIU process such as the Blue UAS Challenge, or recognized third-party assessors who verify company, software, firmware, and hardware before recommending clearance. Management moved from DIU to the Defense Contract Management Agency in December 2025, and the roster lives at bluelist.dcma.mil.

One detail buyers keep missing: clearance attaches to a specific model in a specific configuration, not to a manufacturer or a product family. Add a third-party radio or swap the payload and you are outside the listing until the change is reassessed. Green UAS works the same way, adding corporate cyber hygiene and connectivity review.

Our guide to the Blue UAS Cleared List covers the tiers, how aircraft join and leave the roster, and the grant money riding on it.

How to verify a vendor’s compliance claim

Ask for artifacts, not adjectives. Every question below has a document or a test behind it, and a vendor who cannot answer within a week has told you something useful. Put the answers in the contract, because a spec-sheet claim is unenforceable and a warranty clause is not.

1. Name the listing. Is this exact model, in this exact configuration, on the Blue UAS Cleared List or Green UAS certified? Ask for the entry, not the logo.
2. Demand a country-of-origin bill of materials covering flight controller, radios and data links, camera and gimbal, ground control hardware and software, data storage, motors, batteries, and speed controllers, to at least tier two.
3. Ask where the data goes. Which servers receive telemetry, imagery, logs, and firmware updates, in which countries, and can the aircraft fly a full mission with no outbound connectivity?
4. Ask who writes and signs the firmware, and whether any third-party payload ships firmware you are not auditing.
5. Write it into the contract: a compliance warranty against Section 848 and ASDA, notice if any covered component changes source, a right to audit, and a right to reject.
6. Run your own capture before acceptance. The Royal Navy found those heartbeat signals in a vulnerability assessment after the boats were already in service. A bench packet capture costs an afternoon.

What to watch

Three threads will decide how much of this changes: an open FCC proceeding on already-approved drones, DJI’s twin legal challenges to the Covered List, and whether Congress redefines which components count. Grandfathering is the status quo, and each thread tests it from a different direction.

The FCC’s July 21, 2026 proceeding in PS Docket 26-189 asks whether to end importation and marketing of already-authorized foreign drones with capabilities the agency calls military-grade, including thermal imaging, LiDAR, docking, sprayers, aircraft at or above 25 kilograms, defense-article integration, and swarming (FCC notice).

DJI is challenging the listing on two fronts, through a petition for reconsideration filed with the FCC on January 21, 2026 and a petition for review in the Ninth Circuit, Case 26-1029. Either could reshape the Covered List’s scope.

On the component side, watch whether “critical component” gets redefined to cover motors, batteries, and speed controllers. Congress has begun writing dated sourcing requirements for exactly those parts, including a CATL battery procurement bar effective October 1, 2027 under FY2024 NDAA Section 154 and the phased motor, battery, and flight-controller rules mapped by Inside Unmanned Systems in July 2026. The FCC has meanwhile extended exemptions for Blue UAS and Buy American products while granting conditional approvals to manufacturers committing to onshoring (exemption tracking).

The direction of travel is toward deeper component scrutiny. Until it arrives, the compliance label tells you where a company is headquartered and very little about what is soldered inside the aircraft.