Blue UAS and NDAA-Compliant Drones: A Buyer’s Check

That transition matters to buyers. A 2024 DIU PDF, manufacturer press release, or distributor page may describe a prior configuration or status. The current list is the authoritative starting point. Save the listing, retrieval date, platform name, manufacturer, configuration detail, and any associated components or software evidence with the procurement file.

List status can change as products, supply chains, software, and policy change. Treat verification as an award and acceptance activity, not a one-time market-research task. If delivery occurs months after award, recheck the received configuration before operational approval.

DIU describes the Blue UAS Cleared List as containing commercial drones that underwent security and performance assessments for government use. Its Blue UAS Framework has addressed interoperable components and software. DCMA is scaling that model under the transferred Blue List.

Blue status is meaningful because it links a named system or component to a government vetting process. But the scope is defined. A listed aircraft may be paired on a quote with a different controller, payload, radio, battery, ground station, mapping application, cloud tenant, or third-party integration. Those changes can alter supply-chain, cybersecurity, interoperability, export, radio, safety, and mission conclusions.

Ask four questions:

Do not turn “Blue” into a brand-wide adjective. Write “the listed configuration was verified on [date]” and attach the evidence.

The National Defense Authorization Act is enacted every year and contains many provisions. Several UAS and supply-chain restrictions have appeared across different years, scopes, agencies, products, and dates. A seller saying “NDAA compliant drone” may mean a Blue-listed platform, a representation about certain foreign components, a Defense purchasing rule, Section 889 screening, or the American Security Drone Act. Those are not identical.

Require the seller to identify:

The buyer should independently compare that evidence with the solicitation. A manufacturer representation can support responsibility; it does not replace the contracting officer’s assessment or the government list.

The American Security Drone Act of 2023 created government-wide restrictions involving UAS manufactured or assembled by covered foreign entities. FAR Subpart 40.2 implements the procurement and operation rules. It defines a FASC-prohibited UAS and points to the covered-foreign-entity list maintained through SAM.

The FAR says contracting officers, working with the program office or requiring activity, must review proposals for prohibited delivery and, on or after December 22, 2025, prohibited operation, unless an exemption, exception, or waiver applies. FAR 52.240-1 is prescribed for solicitations and contracts. The rule includes documentation duties for exemptions, exceptions, and waivers.

This is not the same as “must be Blue.” A solicitation can require Blue status, and the Blue List can provide an efficient approved path for Defense use, but the FAR prohibition is framed around covered foreign entities and defined UAS. Read the actual clause and agency requirement.

The FAR also defines the UAS broadly to include the aircraft and associated elements such as communication links and control components needed for safe and efficient operation. That argues against screening only the airframe logo.

Section 889 of the FY2019 NDAA addresses covered telecommunications equipment and services. Part A restricts federal procurement of systems that use covered equipment or services as a substantial or essential component or critical technology. Part B restricts contracting with entities that use covered equipment or services under the statute and implementing FAR provisions, subject to exceptions and waivers.

A drone system can contain cameras, radios, networking equipment, cloud connectivity, or video services that create Section 889 questions. Passing a UAS-specific list does not eliminate the need to review the contract’s Section 889 representations and the complete system. Conversely, a Section 889 representation alone does not establish Blue status or satisfy every UAS restriction.

For component-level review, Section 889 surveillance BOM checklist should be used alongside the UAS procurement file.

The FCC Covered List concerns communications equipment and services deemed to pose an unacceptable national-security risk under the Secure and Trusted Communications Networks Act framework. In late 2025 and 2026, the FCC issued UAS-related updates and established a conditional-approval mechanism reflected in the current list.

The FCC’s public notices emphasize that the Covered List changes and that regulated parties must monitor current notices. Some conditional approvals are device-specific and time-limited. A July 2026 FCC notice explicitly describes the “Blue UAS list” used for its determination as the combination of the Blue UAS Cleared List and the compliant components and software list.

Do not infer that FCC treatment, Blue status, and procurement eligibility are one universal list. They interact, but each authority has its own scope. Check the current FCC record for communications-equipment consequences and retain any conditional approval with its termination date.

Nonfederal buyers can face federal conditions when a grant or cooperative agreement funds the purchase, when they support a federal mission, or when a state law adopts its own UAS restrictions. State requirements vary widely and can name manufacturers, countries, lists, agencies, or use cases.

Start with the funding instrument and state procurement authority. Ask whether restrictions apply to purchase, operation, maintenance, software, or data; whether existing fleets are grandfathered; whether public safety has an exception; and who can issue a waiver. Do not market a Blue-listed platform as automatically satisfying every state statute.

For mixed funding, identify which dollars pay for the aircraft, payload, software, support, and operation. Preserve the grant terms and approval. A platform purchased with local funds can still be operated under a federal award that imposes conditions.

A useful bill of materials extends beyond the aircraft SKU. Record:

Identify manufacturer, model, version, country of origin when required, supplier, approval record, and substitution status for each material item. The depth should match risk and the contract; it does not require disassembling every system without authority. It does require enough traceability to know whether the delivered configuration matches the approved one.

A cleared supply chain does not automatically produce a securely operated fleet. Build a threat model around aircraft loss, account takeover, malicious updates, command-link interception, cloud exposure, sensor-data leakage, insider misuse, compromised support access, and unsafe geospatial information.

Review:

Test the actual configuration. A strong airframe can be undermined by a shared tablet account or public media link. Restrict personal devices and consumer cloud accounts if the mission requires managed custody.

UAS can capture identifiable people, license plates, facilities, radio metadata, thermal imagery, and precise location. Before deployment, define lawful purpose, notice, collection limits, retention, sharing, public-records treatment, evidentiary handling, and deletion.

The contract should state who owns raw and processed data, metadata, models, and derived products; where they are stored; who can use them for product improvement; and how they are returned or deleted at termination. Review whether technical-support personnel can see flight data or imagery.

For public safety and inspection, chain of custody may matter. Record operator, aircraft, sensor, timestamps, location, file hash or integrity method, transfer, access, editing, export, and retention. Security and records teams should agree on the workflow before the first mission.

Supply-chain approval does not grant flight authority. The operator must comply with applicable FAA rules, airspace authorization, remote identification, registration, pilot requirements, operational limitations, waivers, and agency flight policy. Specialized government or public-safety operations can have distinct authorities; involve the aviation program and counsel.

Radio links and payloads can implicate spectrum licensing, authorization, interference, and local coordination. Confirm that the quoted radio configuration is legal and supported for the operating location. An imported or alternate radio can change both compliance and Blue configuration.

Build safety acceptance around mission conditions: weather, night operations, people, vehicles, structures, electromagnetic environment, lost link, return-to-home behavior, geofencing, emergency landing, battery failure, and maintenance. The procurement team should not promise an operational capability the aviation authority has not approved.

Create mandatory gates before performance scoring:

Then evaluate mission performance: payload quality, endurance, environmental limits, link range, navigation, obstacle handling, portability, launch and recovery, repair, training, workflow, data processing, and total cost.

Require a demonstration with the proposed configuration. A different payload or controller can make the demonstration irrelevant. Use representative terrain, connectivity, data workflow, and operator tasks.

The line item should identify exact manufacturer, model, configuration, software, required components, Blue or other official status as of a defined checkpoint, and evidence deliverables. State whether substitutions require contracting-officer and security approval. Require notice of changes that affect supply chain, list status, firmware, cloud, support, ownership, or critical components.

Acceptance should include serial capture, physical inspection, component reconciliation, firmware and application versions, account enrollment, approved configuration, list and FCC recheck, cybersecurity test, data export, maintenance records, and operator documentation.

Avoid broad supplier promises such as “all future upgrades remain compliant.” Require version-specific evidence and a change process. Preserve the original approved configuration so a field repair does not quietly introduce an unreviewed radio or camera.

Plan batteries, propellers, motors, controllers, payloads, cables, cases, chargers, firmware, software subscriptions, training, calibration, and repair. Determine which repairs can be done locally and which require return to the manufacturer. Record chain of custody and data handling during repair.

Monitor official list status, FCC notices, vulnerability advisories, recalls, ownership changes, component substitutions, software release notes, and end-of-support dates. Assign a fleet configuration owner with authority to approve updates. A pilot applying an unreviewed mobile-app update before a mission can change risk.

Maintain a grounded-status process for aircraft affected by a critical vulnerability, expired conditional approval, unsafe component, or missing maintenance. The asset system should identify every affected serial and location quickly.

Run an annual configuration reconciliation even when the fleet has not changed intentionally. Compare every active serial, controller, payload, critical component, firmware, application, cloud tenant, and radio against the approved baseline and current official records. Investigate undocumented field repairs and loaner equipment before the next mission.