Blue UAS and NDAA Drone Rules for Allied Component Makers

U.S. defense drone law restricts drone components, not just whole drones: flight controllers, radios, data links, cameras, gimbals, ground control systems, operating software, and data storage tied to China, Russia, Iran or North Korea. Blue UAS is the Department of Defense (DoD) list of drones and parts vetted against those rules; component makers get on it through a third-party assessment.

Which drone components are restricted under the NDAA?

FY2020 National Defense Authorization Act (NDAA) Section 848 bars DoD from buying or operating a drone that uses five kinds of hardware made in a "covered foreign country", ground control systems or operating software developed there, or network connectivity or data storage located there. Since the FY2023 NDAA, the covered foreign countries are China, Russia, Iran and North Korea.

The statute's own words, from Section 848(a) (enacted December 20, 2019), bar DoD from any covered drone that:

(A) is manufactured in a covered foreign country or by an entity domiciled in a covered foreign country;

(B) uses flight controllers, radios, data transmission devices, cameras, or gimbals manufactured in a covered foreign country or by an entity domiciled in a covered foreign country;

(C) uses a ground control system or operating software developed in a covered foreign country or by an entity domiciled in a covered foreign country; or

(D) uses network connectivity or data storage located in or administered by an entity domiciled in a covered foreign country

Section 848 also bars DoD from detection or identification systems for drones made in a covered foreign country. It originally named only China. FY2023 NDAA Section 817 (enacted December 23, 2022) added Russia, Iran and North Korea and a second prohibition: from October 1, 2024, DoD may not award, extend or renew a contract with a company that operates equipment from a "covered unmanned aircraft system company" in performing DoD work. That term covers DJI and its affiliates, drone makers on the Commerce Department's Consolidated Screening List, and drone makers domiciled in, or under unmitigated ownership or control by, a covered foreign country.

Two tests run side by side. Hardware is judged by where it was manufactured and where its maker is domiciled; software and ground control systems by where they were developed. A part made by an allied company in a covered country fails, and so does a part made anywhere by a company domiciled there.

Section 848 does not name batteries or motors. The FCC's December 2025 action does, and so does the Blue UAS checklist in practice. This table puts the three side by side:

Sources: Section 848; the National Security Determination in FCC DA 25-1086, whose list "includes but is not limited to" the items named; the Blue List portal and DCMA's Blue List page.

DoD can still buy covered drones for counter-drone surrogate testing and training, and for intelligence, electronic warfare and information warfare work. The Secretary of Defense (or a designee) can also waive the restrictions by certifying in writing to the congressional defense committees that the purchase, operation or contract is required in the national interest. Recent DoD and FCC documents call DoD the "Department of War"; the statutes still say "Department of Defense".

Which other U.S. drone rules reach component suppliers?

Three more rules carry the drone restrictions into contracts and beyond DoD: the American Security Drone Act for all federal agencies, its contract clause FAR 52.240-1, and DoD's own clause, now DFARS 252.240-7994. Both clauses must be flowed down to subcontracts, so a component maker selling to a U.S. prime is bound through the prime's contract.

American Security Drone Act. FY2024 NDAA Sections 1821–1833 (enacted December 22, 2023) bar every executive agency from buying drones "manufactured or assembled by a covered foreign entity". Since December 22, 2025, they also bar federal operation of those drones, including through contracted services, and the use of federal contract, grant or cooperative agreement funds to buy or operate them. A "covered foreign entity" is one on a list kept by the Federal Acquisition Security Council and published in the System for Award Management (SAM). The Act names the categories: entities on the Consolidated Screening List, entities domiciled in or influenced by China, and others the Secretary of Homeland Security finds to pose a national security risk. The procurement ban reaches "associated elements", namely communication links and the components that control the aircraft. Sections 1823–1825 expire five years after enactment, on December 22, 2028, unless Congress extends them.

FAR 52.240-1. The clause (November 2024) puts the Act into federal contracts. Contractors may not deliver a drone or associated elements from a covered entity, and must search SAM for the covered-entity list before proposing or using any drone. Paragraph (e) requires the clause in all subcontracts, including for commercial products.

DFARS 252.240-7994. In DoD contracts, Section 848 is implemented by clause 252.240-7994 and representation 252.240-7993 under Class Deviation 2026-O0025, Revision 3 (signed September 3, 2026), part of the Federal Acquisition Regulation (FAR) overhaul. The clause repeats the statutory component list, applies to commercial products, and must be flowed down to every subcontract. Always check the clause numbers in the solicitation itself.

What is Blue UAS, and how is the Cleared List different from the Framework?

Blue UAS is DoD's list of drones and drone parts vetted for NDAA compliance. The Blue UAS Cleared List holds complete small drones. The Blue UAS Framework holds the components and software builders use, so an approved part can be reused by many drone makers without being assessed again. DCMA now runs both as "the Blue List".

The Defense Innovation Unit (DIU) launched Blue UAS in 2020. On December 3, 2025, it handed the list to the Defense Contract Management Agency (DCMA), whose Unmanned Systems–Experimental command (US-X) in Palmdale, California, now manages it. DIU stays on as a partner on standards and checklists. At the handover, DIU reported 81 companies processed onto the list and, as of November 19, 2025, more than 39 certified systems and 165 components.

DCMA describes the list as built around components: the Framework holds "the critical parts, sensors and software needed to repair or build" listed drones. For a component maker, the Framework is the target. A drone maker whose critical components are all already on the Framework has a much shorter path to the Cleared List, which makes listed parts easier to design in.

Two other entry routes apply to complete drones rather than parts. Since July 16, 2025, platforms certified under the Association for Uncrewed Vehicle Systems International's Green UAS program are added to the Cleared List. And a military unit can sponsor a small drone for inspection, with every part checked against the list.

How does a component maker get listed on Blue UAS today?

A component maker submits a checklist packet through the Blue List portal, gets an NDAA compliance assessment from a Recognized Assessor (or certification from an Empowered Agency), and is added to the list once the government accepts the result. The route depends on where the company is headquartered and on whether a military sponsor is backing the product.

The Blue List portal sorts applicants into two groups. Group A is companies whose primary headquarters and domicile are in the United States. Group B is companies headquartered and domiciled outside the United States, excluding China, Russia, Iran and North Korea. An allied component maker is in Group B. Its steps:

1. Prepare the Blue UAS Checklist. It identifies each critical component defined by Section 848 and whether that component is already on the Blue List. The portal's critical components are: flight controller, radio, data transmission device, camera, gimbal, ground control system, operating software, network connectivity and data storage.
2. Submit through the portal. The form asks for the company's CAGE code or Unique Entity ID, country of domicile and of manufacture, any contract manufacturer, battery details, and a software and hardware bill of materials. It also asks whether the company is on the Commerce Entity List or sanctioned by the Treasury's Office of Foreign Assets Control (OFAC), and whether any entity linked to a covered country holds an interest in it.
3. Choose a route. Option A: an Empowered Agency (DIU, the Under Secretaries for Research and Engineering and for Acquisition and Sustainment, the Military Department Secretaries, or U.S. Special Operations Command) agrees to certify the product and submits the checklist with a certification memo. Option B: the company selects a Recognized Assessor through the portal.
4. Contract the Recognized Assessor. After a submission, assessors quote a cost and timeline and the company picks one. They check component-level NDAA compliance, ownership interests, supply-chain and country-of-origin documents, and software, firmware and hardware artifacts.
5. Assessor reports to DCMA. The assessor files a standardized report through the portal.
6. Listing decision. DCMA certifies compliant components and adds them to the Blue List, where DoD buyers can find them.
7. Keep it current. Vendors must tell DCMA about any change to a listed product as soon as possible, using the portal's change request form.

The portal also asks whether a DoD O-6 commander or equivalent wants to nominate the product; a nomination gets priority review. For U.S. companies, a nomination is the start of one of Group A's two routes.

As of September 2025, DIU had named six Recognized Assessors: AUVSI, Dark Wolf Solutions, Edgesource, Legion X, Modern Technology Solutions (MTSI) and SpiderOak. All work to the same Blue UAS standard, and in most cases they contract directly with the company seeking listing.

Cost and time have come down. DCMA's Blue List page puts component assessments at $5,000 to $20,000 each, against $80,000 or more for a full-system assessment, and reports 10 days from first email to listing for its first pilot vendor. A July 27, 2026 DCMA article describes a vendor that submitted in September 2025 and was listed through the Recognized Assessor route. DCMA's stated goal is a full Blue List marketplace for the military services by the end of 2027.

How does the FCC Covered List affect foreign drone components?

Since December 22, 2025, the FCC Covered List has included drones and "UAS critical components produced in a foreign country", meaning any foreign country, not only the four covered by Section 848. Covered equipment cannot receive FCC equipment authorization. Blue UAS listing is the main exemption for a non-U.S. component, and it runs until January 1, 2028.

The December 22, 2025 notice followed a White House-convened interagency National Security Determination and FY2025 NDAA Section 1709, which required a national security determination on DJI and Autel equipment. The FCC's rules bar covered equipment from receiving equipment authorization, and every applicant must certify that its equipment is not covered.

The exemptions have changed several times since:

Sources: FCC DA 25-1086, DA 26-761, DA 26-1063 and DA 26-1130.

The FCC defines its Blue UAS exemption as both DCMA lists: the Cleared List and "the list of compliant UAS components and software", the Framework. A Conditional Approval is another route for a foreign producer. DoD reviews the request, and the exemption lasts only while the company follows the onshoring plan in its application and passes updated vetting of its products. The FCC's notices do not say what replaces the Blue UAS exemption after January 1, 2028.

What should an allied component maker do now?

An allied component maker should treat Blue UAS Framework listing as its entry ticket for both U.S. defense and U.S. commercial drone sales, and build the evidence an assessor will ask for before submitting. For more on the wider supply-chain rules, see our guide to non-red supply chains.

1. Map every part to the table above, including batteries, motors and navigation, which the FCC names even though Section 848 does not.
2. Document origin at two levels: where each part was manufactured, and where its maker is domiciled. Do the same for software: where it was developed and where data is stored or processed.
3. Check ownership: any interest held by an entity linked to a covered country must be disclosed in the portal.
4. Prepare the hardware and software bill of materials, CAGE code or Unique Entity ID, and contract-manufacturer details the submission form requires.
5. Get assessor quotes early. The portal lets you compare cost and timeline across Recognized Assessors.
6. Plan for flow-down. When a prime contract carries FAR 52.240-1 or DFARS 252.240-7994, the prime must pass it on to your subcontract; see how supplier onboarding with U.S. primes works.

What this means for allied companies

The rules now set two different bars. Section 848 and Blue UAS ask whether a part has ties to four countries, a test an allied supplier can pass. The FCC asks whether a part was produced abroad at all, a test it cannot pass on its own. Until January 1, 2028, Blue UAS listing bridges the two, which makes the Framework the most practical route for an allied component into both markets.

A listed component also helps the drone makers that buy it, because their own listing gets faster when every critical part is already on the Framework. That makes listing a sales argument as well as a compliance step. For where drones sit in wider DoD buying, see how the DoD buys commercial technology.