NDAA-compliant drones for public survey work: what it means, when it's required, and how to check

Status as of October 18, 2026. Agency guidance and the FCC exemptions are still changing, so check dates before you rely on a line.

"NDAA-compliant" shows up in RFPs, scopes and vendor brochures as if it were one standard. It is not. It is shorthand for several different laws and lists, written for different buyers, and each one names different parts of a drone system.

This guide is for agency staff and consultants who have to write the requirement or answer it. It covers what the label means, which jobs need it, how to check a vendor's aircraft and payload, and what a tight set of paperwork looks like. For the funding rules in more depth, see the companion post on federal money, the American Security Drone Act and the FCC Covered List.

The short version

• There is no single NDAA-compliance certificate. The phrase points to several laws, each with its own scope.
• The Defense NDAA provisions bind the Department of Defense. The American Security Drone Act (ASDA) reaches federal contracts and federal funds. Both reach past the airframe: the defense provisions name components, and ASDA's drone-system definition includes communication links and control components.
• The Blue UAS Cleared List is a Department of Defense vetting list. The FCC Covered List is an equipment-authorization rule. Neither is the same test as ASDA.
• Most private jobs with no public money are not covered by any of these. Federal contracts, federally funded work and some state and local agency jobs are, depending on the state (see the state-by-state table).
• Check the aircraft, the payload, the data link, the software and where the data goes. Get the make, model and serial of each, plus a listing or a written statement, plus a dated SAM.gov check.

What "NDAA-compliant" actually refers to

The label grew out of several National Defense Authorization Acts. They overlap, and they do not say the same thing.

The defense provisions (FY2020 to FY2025)

Section 848 of the FY2020 NDAA (Pub. L. 116-92, signed December 20, 2019) is the origin of the phrase. It bars the Secretary of Defense from operating or buying a covered drone. A drone is covered if it, or any of these parts, comes from China or from an entity domiciled there:

• the aircraft;
• flight controllers, radios, data transmission devices, cameras or gimbals;
• a ground control system or operating software;
• network connectivity or data storage.

Two later laws extend it. Section 817 of the FY2023 NDAA (Pub. L. 117-263) names Da-Jiang Innovations and its subsidiaries and affiliates as a "covered unmanned aircraft system company." From October 1, 2024 it bars the Department of Defense from contracting with an entity that operates such equipment while performing a DoD contract. It also widens the list of covered countries to China, Russia, Iran and North Korea.

Section 164 of the FY2025 NDAA (Pub. L. 118-159) is the first one aimed at LiDAR. Effective June 30, 2026, DoD may not operate or buy covered LiDAR, or a system that "incorporates, interfaces with, or otherwise uses" it. The statute names Hesai Technology. It also covers makers on the Consolidated Screening List or the Section 1260H list, and makers domiciled in or under unmitigated influence from a covered country.

All three bind the Department of Defense. They matter to a county or a utility mostly because contract language borrows their wording, and because the component lists became the template for later rules.

The American Security Drone Act

ASDA (Pub. L. 118-31, sections 1821 to 1833) is the one that reaches federal civilian agencies, federal contracts and federal money. Since December 22, 2025 it bars federal funds from being used to buy a covered drone or "in connection with the operation of" one. It sunsets on December 22, 2028. The FAR rule and the clause at FAR 52.240-1 carry it into federal contracts.

The test is a list, not a country. FAR 40.201 defines a covered entity as one on a list kept by the Federal Acquisition Security Council and published in SAM.gov. A SAM.gov notice (last updated November 13, 2024) says that list includes all entities on the Consolidated Screening List and no others at this time. A download of the Consolidated Screening List on October 18, 2026 shows DJI on the Commerce Entity List (added December 18, 2020) and on Treasury's Chinese military-industrial complex list. Check any maker yourself on SAM.gov and save the dated result.

The Blue UAS Cleared List

This is a vetting program, not a statute. DIU created it and handed it to the Defense Contract Management Agency on December 3, 2025. DIU calls it the Department's "trusted catalog of secure, NDAA-compliant drones and components." DIU reported more than 39 certified systems and 165 components as of November 19, 2025, and 81 unique companies processed onto the list.

Two cautions. First, the live list sits at bluelist.dcma.mil, which could not be reached from this research environment, so no current count is given here. Second, a Blue listing is a Department of Defense finding. ASDA's test is the FASC list. Treating a Blue listing as proof of ASDA status is an inference, not something the rule says, so ask the funding agency which evidence it accepts.

How the FCC action differs

On December 22, 2025 the FCC's bureau issued DA 25-1086. It added foreign-produced drones and "UAS critical components" to the Covered List (Appendix A), along with the equipment in section 1709 of the FY2025 NDAA. The National Security Determination attached as Appendix B defines those components to include data transmission devices, flight controllers, ground control stations, navigation systems, "Sensors and Cameras," batteries and motors.

Three differences matter for a buyer:

• What it controls. New FCC equipment authorizations. It is not a purchasing rule.
• How equipment is identified. By place of production, not by company.
• What it leaves alone. The FCC fact sheet says it does not affect drones already purchased or models authorized earlier.

The FCC has also exempted items on the Blue UAS list and "domestic end products." That began with DA 26-22 in January 2026 and was extended to January 1, 2028 by DA 26-761. So the Blue list matters to the FCC action as well.

Which jobs actually require it

Ask four questions, in order. A yes at any step means using non-covered gear and keeping records.

Federal contracts

A direct federal contract that carries FAR 52.240-1 bars delivering a covered drone and bars using one to perform the contract. The contractor searches SAM.gov before proposing or flying. DoD contracts add the three defense provisions above.

Federal funds, grants and pass-through money

Most agency survey work is paid through grants, not FAR contracts. OMB M-26-02 carries the section 1825 bar into grants and cooperative agreements for recipients and subrecipients. Agency notices followed, including FHWA-HIF-26-011 (September 23, 2026) and EPA's RAIN-2027-G01 (October 1, 2026).

The FHWA memo reads "in connection with" broadly. It includes any activity used to "support, inspect, document, monitor, or verify the performance of FHWA funded work," whether or not the flight itself is paid with federal money. A locally funded flight over a federal-aid project can be covered.

For FEMA programs such as Public Assistance or Hazard Mitigation Grant Program, no FEMA guidance on this question could be confirmed. Read the award terms and ask the state administrator in writing.

State rules

Florida is one example of a state rule. Fla. Admin. Code 60GG-2.0075, effective April 5, 2023, bars a Florida governmental agency from purchasing, acquiring or otherwise using a drone or related services or equipment from a manufacturer domiciled in, or believed controlled by, a Foreign Country of Concern. Its "critical component" definition names flight controllers, radio, data transmission devices, cameras, gimbals, ground control systems, operating software, network connectivity and data storage. The rule speaks to agencies. Whether it binds their contractors could not be confirmed, so ask the agency.

California and Georgia: no enacted state-agency drone procurement rule turned up in either. California's AB 1160 (2025), which concerned law enforcement drone purchases, failed in February 2026. Georgia's SB 64 and HB 205 (2025) did not become law as far as we could find, but we could not read an official final-status page. All 50 states and DC are in the table in the section State rules, state by state, below.

Private jobs

A private owner with no public funds and no federal contract is, as far as these laws go, outside all of the above. That is an inference from their scope. Some private clients still write the requirement into their own contracts, for example when a lender, a federal tenant or a utility standard is involved. That comes from the contract, so read it.

What to check: the aircraft and every payload part

A compliant sensor on a covered airframe is not a compliant system. The rules name different parts, as Figure 3 shows.

Two readings of "system" are in play. FAR 40.201 defines an unmanned aircraft system as the aircraft plus associated elements, including communication links and the components that control it. FHWA's memo says that includes "all hardware, software, and firmware components essential for flight, data transmission, or mission performance." A LiDAR scanner and its processing software are mission performance on a survey job. Plan to document them.

Use this as a checklist for each component:

What paperwork to ask for

There is no government certificate for a LiDAR sensor. LiDAR News (June 17, 2026), citing Phoenix LiDAR Systems' president, says compliance is a representation made by manufacturers and contractors, and that a compliant sensor is not enough if the aircraft or data workflow is a problem. So the paper trail is the control. Ask for four things, and name them in the scope.

1. A component list with make, model and serial number for the aircraft, flight controller, data link, camera, gimbal, LiDAR scanner, GNSS unit and ground station.
2. Evidence for each major item. A Blue UAS Cleared List entry where one exists, or the maker's written NDAA statement. Ask for the exact model named on the listing; a product family name is not a listing.
3. A dated SAM.gov search for each maker, saved to the project file. EPA's notice tells grantees to search the Consolidated Screening List by manufacturer name and keep a dated record.
4. A substitution rule. Any swap of aircraft or payload needs written approval before flight.

FHWA tells recipients to keep certifications and provenance records for three years after the final expenditure report. Ask your agency what it expects, and how long.

NDAA status says where a system came from. It says nothing about how well it measures. Ask separately for checkpoints and an error report by land cover, using the ASPRS edition named in the contract. ASPRS Positional Accuracy Standards, Edition 2 calls for at least 30 checkpoints and reports vegetated accuracy as found, not as pass or fail.

Practical tradeoffs

No prices are given here, and none could be sourced for a fair comparison. The tradeoffs below are qualitative, and some are inferred.

The pool is smaller. DIU counted more than 39 certified systems on the Blue list in November 2025. That is far fewer aircraft than the open market. Expect fewer sensor and aircraft pairings, and plan a longer lead for specific combinations (inference).

Sensor choice narrows, and claims are the maker's own. A few examples, none an endorsement:

• Freefly markets the Astro as "MADE IN THE USA | NDAA / BLUE APPROVED," and lists LiDAR payloads from several makers. It labels some payloads NDAA compliant and one as Blue/NDAA approved. Verify each against the listing.
• Phoenix LiDAR says its payloads use "fully approved, industry-leading sensors from RIEGL and Ouster" with NovAtel GNSS. The page does not say where the payloads are built.
• GeoCue says its TrueView 1 NDAA sensor is designed and manufactured in Alabama and built on an Ouster scanner. A sensor claim says nothing about the aircraft it flies on, so the airframe needs its own evidence.

Specs are not field results. Vendor accuracy figures are lab or controlled-site claims. One independent test of a DJI Zenmuse L2 measured about 7 cm RMSE on an open road and about 21 cm under forest canopy (Tamimi and Toth, ISPRS 2024). Whatever the sensor, ask for the same kind of evidence.

Dates shift. The FCC exemption for Blue-listed and domestic items ends January 1, 2028 unless extended, and ASDA's bars sunset December 22, 2028. A multi-year program should name the rule and date it relies on.

Licensing is a separate question

Topography, contours, DTMs and volumes delivered for design or a permit need a licensee in responsible charge. In California that is a PLS, or a civil engineer legally authorized to practice land surveying (BPELSG Bulletin 50). In Georgia it is a PLS only (Ga. Comp. R. & Regs. 180-7-.04). In Florida it is a Professional Surveyor and Mapper, or PSM (Fla. Stat. 472.005). Twinn captures and processes data. A licensed partner stamps it.

State rules, state by state

The federal rules above do not reach work paid for with state and local money alone. States have their own patchwork, and it keeps changing. As of October 18, 2026 we found enacted purchase or use restrictions in 9 states, narrower rules in 4 more, and bills that did not become law in 16. In 22 jurisdictions, including DC, we found no enacted law, which is not proof that none exists. Figure 4 maps the results and the table below gives every state and DC with a source.

Status key: Enacted means a purchase or use restriction is law, with its own start dates. Partial means a narrow scope, such as one use case, a specific list or a grant program. Bill not enacted means a bill was introduced or failed and we found no law. None found means we found no enacted state law; most of those rows rest on web searches, not on the legislature's own database. Rows that say confirm rest partly on secondary sources. This is a research summary as of October 18, 2026, not an exhaustive legal survey and not legal advice. Confirm with your agency or counsel before relying on a row.

Patterns in the enacted laws

• Purchase bans and operation bans differ. Kansas and New Hampshire restrict purchases only, and so does Tennessee after a Senate amendment dropped its use ban. Connecticut, Nevada, Ohio and Utah also reach operation, with delays or carve-outs for drones already owned. Florida's rule bars purchase and other use.
• Dates are spread out and some are already here. Connecticut's purchase bar reached most agencies and municipalities on October 1, 2026, and its operation bar starts October 1, 2028. Nebraska's state-agency purchase bar starts January 1, 2027, New Hampshire's January 1, 2028, and Ohio's section about October 6, 2030. Arkansas reports a 2027 compliance date, which we could not confirm from the statute.
• Few laws name a company. Texas applies to state agencies through a Department of Information Resources list that names SZ DJI and Autel Robotics. Nevada points to the DoD Section 1260H list as it stood on January 31, 2024. Most other states use a definition, such as a foreign adversary or a covered foreign entity, or an approved-drone list as in Nebraska. Tennessee points to the manufacturers banned under NDAA FY2019 section 889, which does not name DJI or Autel. Whether a given maker is covered depends on the text, so read it.
• Contractor coverage is uneven. Connecticut and Utah expressly reach contractors working for public entities. Arkansas DOT's March 18, 2026 notice adds a no-covered-drones provision to new consultant agreements, covering subcontractors, and says existing consultants may be asked to sign a certification. Most other laws are silent on contractors, so ask the agency.

How to check your state

• Ask the agency in writing which state rule applies to the job, whether it covers consultants and subcontractors, and which evidence it accepts.
• Read the procurement rules and the solicitation. Look for foreign-adversary or covered-foreign-entity certifications and for a funding clause.
• Check your state DOT's bulletins and consultant notices. Arkansas DOT's March 2026 notice is one example.
• Open the statute or bill page listed in the table. Bills in this area change every session, and this research is not legal advice.

Next step

Before your next scope goes out, list every funding source and any federal project number, then run the four questions in Figure 2. If the answer is yes, put the component list, the evidence and the dated SAM.gov search into the scope. Twinn rents equipment per job and is equipment-agnostic, so it can provide NDAA-compliant drones and sensors for projects that require them. The paperwork it can document is described on Twinn's compliance page. Survey firms and engineers working on federally funded projects can also see how Twinn works with surveyors and engineers.

This post is general information, not legal advice. Ask your agency counsel how your award terms apply.