Blue UAS vs NDAA §848/§817 vs FCC Covered List: What Each Requires in 2026

NDAA §848, as amended by §817, is a law: it stops the US Department of Defense from buying or operating drones — and drones with key parts, software or data services — from China, Russia, Iran or North Korea. The Blue UAS Cleared List is not a law but a catalogue of drones and components already vetted against that standard, run by the Defense Contract Management Agency (DCMA) since 3 December 2025. The FCC Covered List is a telecoms rule: since 22 December 2025 it has blocked new FCC equipment authorisations for drones and drone critical components produced in any foreign country — docks included — unless an exemption applies.

The detail matters because vendor brochures blur the three, and one dock purchase can touch all of them. This explainer is published by Dronehub, which builds and licenses drone-in-a-box infrastructure; where we mention ourselves, we say so and stick to what dronehub.ai states. Every rule below links to the primary text.

The requirement matrix

NDAA §848 and §817: the statute behind "NDAA compliant"

Section 848 of the FY2020 National Defense Authorization Act, enacted on 20 December 2019, says the Secretary of Defense "may not operate or enter into or renew a contract for the procurement of" a covered unmanned aircraft system. Section 817 of the FY2023 NDAA, enacted on 23 December 2022, extended it from China to Russia, Iran and North Korea and added a contractor clause. Today the ban reaches a drone that:

• is manufactured in China, Russia, Iran or North Korea, or by an entity domiciled there;
• uses flight controllers, radios, data transmission devices, cameras or gimbals made there;
• uses a ground control system or operating software developed there; or
• uses network connectivity or data storage located in or administered by an entity domiciled there.

Two details matter for dock buyers. First, the statute defines a covered system as the drone "and any related services and equipment", so the ground segment and the cloud are in scope, not just the airframe. Second, the contractor clause: since 1 October 2024 the DoD may not sign, extend or renew a contract with a company that operates equipment from a "covered unmanned aircraft system company" in the performance of a DoD contract. DJI is named; so is any drone maker on Commerce's Consolidated Screening List or domiciled in, or under the unmitigated ownership, control or influence of, a covered country. The exits, listed in the matrix above, are narrow.

The statute creates no product certificate. "NDAA compliant" on a datasheet is the vendor's own declaration; §817 told the DoD to write a due-diligence policy for its own determinations. That gap is what the Blue UAS list fills. Our Section 848 buyer's guide walks through the component audit.

The American Security Drone Act: the same idea, government-wide

Section 848 covers only the DoD and its contractors. The American Security Drone Act of 2023 — sections 1821–1833 of the FY2024 NDAA, implemented in FAR subpart 40.2 — carries the idea to every federal executive agency. Agencies may not procure a drone "manufactured or assembled by a covered foreign entity", including the communication links and control components that fly it. The entities sit on a list kept by the Federal Acquisition Security Council and published in SAM.gov; the law says it will include companies on Commerce's Consolidated Screening List and companies domiciled in, or controlled by, China, as determined by DHS. Since 22 December 2025 agencies also may not buy services that operate such drones, and no federal funds "awarded through a contract, grant, or cooperative agreement" may be used to buy or operate them. Exemptions, exceptions and waivers are narrow, and the authorities expire on 22 December 2028 unless Congress renews them.

The federal-funds clause reaches beyond Washington: a grant-funded city or utility should check the list, not only the vendor's brochure.

Blue UAS: a list, not a law — and now DCMA's

The Defense Innovation Unit launched Blue UAS in 2020 as the Pentagon's catalogue of drones and components vetted for NDAA compliance and security. It has two parts: the Cleared List of complete systems and the Framework of compliant components and software. On 3 December 2025, ahead of a 1 January 2026 deadline in Defense Secretary Pete Hegseth's July 2025 drone-dominance memo, DIU handed the list to DCMA. Management moved to DCMA's new Unmanned Systems–Experimental Command (US-X) in Palmdale, California, and DCMA now publishes the Cleared List on its Blue List site. DIU stays on as a partner shaping standards and checklists. As of 19 November 2025 the list counted more than 39 certified systems and 165 components, and DIU had processed 81 companies onto it.

The route onto the list has changed too. Under DCMA's current policy, as the agency described it in July 2026, one way in is to submit a checklist packet to the Blue List portal and hire a Recognized Assessor, a third-party organisation, to evaluate the system or components for NDAA compliance; its report goes back through the portal.

Three things buyers get wrong:

1. Blue UAS is not a legal requirement. It is the DoD's shortcut to trusted procurement; an unlisted drone can still be NDAA compliant.
2. Listing is item-specific. A cleared drone does not make its dock cleared. Skydio announced on 23 July 2026 that its Dock for X10 had joined the Cleared List together with the X10 and R10; Ondas says its Optimus drone was granted Blue List status on 28 January 2026, and that release names the drone, not the dock.
3. Blue status now has commercial weight. Since January 2026 it is one of the exemptions from the FCC Covered List.

The FCC Covered List: the rule that reaches the commercial market

The FCC keeps the Covered List under the Secure and Trusted Communications Networks Act. Equipment on it cannot receive an FCC equipment authorisation, and most electronic devices need one before they can be imported, marketed or sold in the US. On 21 December 2025 a White House-convened interagency body issued a National Security Determination; the next day the FCC added "UAS and UAS critical components produced in a foreign country", together with the DJI- and Autel-linked equipment listed in section 1709 of the FY2025 NDAA.

Four points decide what this means in practice, all from the FCC's own FAQ:

• Docks are in. Asked whether drone docks are included, the FCC answers "Yes". Critical components also include data links and radios, flight controllers, ground control stations, navigation systems, sensors and cameras, batteries and motors.
• Place of production decides. The FCC identifies covered drones and components by where they are produced, not by who makes them, and applicants for an authorisation must certify that a device was not produced abroad.
• It looks forward, for now. New models cannot be authorised. Models the FCC authorised before the listing can still be imported, sold and used, and owners can keep flying them. In July 2026 the FCC proposed going further: ending imports and sales, for non-government buyers, of previously authorised foreign-produced "military-grade" equipment that is not exempt, a category that includes thermal and LiDAR drones, swarming drones and docking stations. The proposal had not been adopted by late September 2026, and drones already bought would stay usable.
• Federal-only equipment sits outside it. Drones made exclusively for federal use generally do not need FCC authorisation, so the FCC says the list does not affect sales to the Department of War, DHS or other federal agencies. Those buyers are governed by §848 and the Drone Act instead.

The exits: drones and components on DCMA's Blue UAS list, and "domestic end products" under the Buy American standard, are exempt until 1 January 2028 on the Covered List as updated on 21 July 2026. The January 2026 notice set 1 January 2027, and one answer on the FCC's FAQ page still shows that date, so check the list itself. The Department of War or DHS can also grant a Conditional Approval tied to an onshoring plan; since July 2026 these carry no end date. The first ones came on 17 March 2026, and the published list now names more than a dozen drone makers, among them SiFly Aviation, ScoutDI, Air6 System GmbH and Verity AG.

Key dates at a glance

What this means for buying a dock in 2026

1. Start with who is paying. DoD money brings §848 and §817 in full. Other federal money brings the Drone Act, including grant funds since 22 December 2025. A commercial buyer in the US is mainly affected through the FCC Covered List, which governs what can be newly sold, not what you already own.
2. Audit the whole system, not the airframe. Ask for a component-origin declaration mapped to §817's categories for the drone, the dock's radios and controller, the ground-control software, and the cloud that stores your imagery.
3. Look up the exact item on DCMA's public Blue List. Drone, dock and components are listed separately.
4. Ask for the FCC ID and grant date of every radio device — dock and drone. An authorisation granted before 22 December 2025 keeps that model on sale for now; a new foreign-produced model needs Blue status, Buy American content or a Conditional Approval. Ask how supply and support would continue if the FCC's July 2026 proposal is adopted.
5. Write compliance into the contract: a representation that no component falls under §848, notice if the supply chain changes, and a right to audit.
6. In the EU, none of these rules bind you, though supply-chain questions still apply; our European drone supply chain map covers the EU side.

Where Dronehub stands

We build and license a drone-in-a-box with a two-minute robotic battery swap, and we publish our compliance position on the compliance page. In our own words there: compliance with the NDAA covered-UAS and covered-entity provisions is engineered upstream in the supply chain — designed in from the bill of materials, not patched after an award — and no components are sourced from China, Russia, Iran or any sanctioned state. Blue UAS appears on that page under "positioned for, not yet claimed": eligibility is in scope by design and subject to the programme's own review, and we do not present it as a completed authorisation. Programme offices and integrators can request the credentials package.