NDAA compliance refers to a federal law prohibiting the U.S. Department of Defense (DoD) from buying drones:

1. manufactured in a covered foreign country, or by a company based in a covered foreign country; or

2. that use flight controllers, radios, data transmission devices, cameras, gimbals, ground control systems, or operating software manufactured in a covered foreign country or by a company based in a covered foreign country.

That law, Section 848 of the Fiscal Year 2020 National Defense Authorization Act (NDAA), defined a “covered foreign country” to mean China. In 2022, Congress updated the law to include Russia, Iran and North Korea. Recently, Congress extended the law even further to apply to the private sector.

NDAA compliance is primarily focused on the supply chain--where the drone and its key components are made, and where the manufacturer is based. Importantly, it is not a rule that the drone must be 100% free of all parts from a covered foreign country, only those specifically listed above.

To make it easier for military services to buy secure commercial drones, DoD’s Defense Innovation Unit created a program known as Blue UAS; selection as a Blue UAS drone verifies NDAA compliance. In addition to evaluating supply chain security, the Blue UAS program conducts demanding cybersecurity assessments, ensuring approved drones can protect sensitive military information. The result of these extensive assessments yielded the Blue sUAS list, colloquially called the “Blue List.”