Key facts
NDAA Section 848 (FY2020), as amended by Section 817 (FY2023) and published at 10 U.S.C. 4871 note, restricts the US Department of Defense from buying or operating uncrewed aircraft systems made in China, Russia, Iran or North Korea, or using flight controllers, radios, data links, cameras, gimbals, ground control software or data services from there.
Source · U.S. Code, 10 U.S.C. 4871 note (Pub. L. 116-92 §848, as amended by Pub. L. 117-263 §817) uscode.house.gov ↗
Section 848 has spread beyond the Department of Defense — DHS, DoE, DOT, and NASA increasingly mirror the rule in their procurement frames, and state-level critical-infrastructure programmes apply equivalent provisions.
Source · Federal agency procurement guidance, 2023–2025
The covered-component scope extends beyond the airframe itself: flight controllers, GPS and GNSS receivers, RF data links, ground-station hardware, and the software supply chain all fall within scope when sourced from covered nations.
Source · DoD acquisition guidance on UAS supply chain
3 more key facts
The Blue UAS list, created by the Defense Innovation Unit in 2020 and run by the Defense Contract Management Agency (DCMA) since 3 December 2025, is the Pentagon's pre-vetted catalog of drones and components assessed against Section 848. Listing is item-specific: drone, dock and components are listed separately. Direct-contract procurement outside Blue UAS remains available for vendors that pass equivalent supply-chain review.
Source · Defense Innovation Unit, 'DIU's Blue UAS List To Transition to DCMA', 3 December 2025 diu.mil ↗
The EU's European Defence Industrial Strategy (EDIS), published March 2024, creates parallel sovereign-supply-chain restrictions for EU member-state defense procurement — applying equivalent origin rules to EU defense buyers.
Source · European Commission EDIS publication, March 2024
Aviation Valley in southeastern Poland is the densest aerospace and defense supply cluster in NATO Europe outside the major prime hubs — the natural sovereign-supply-chain alternative to Chinese manufacturing for US federal procurement under Section 848.
Source · Polish aerospace cluster industrial mapping
In this piece
NDAA Section 848 is the structural rule that determines which drone vendors can sell into US federal procurement. Published at 10 U.S.C. 4871 note and amended by Section 817 of the FY2023 NDAA, the rule restricts the Department of Defense from buying or operating uncrewed aircraft systems made in, or with key components from, China, Russia, Iran or North Korea. The rule has spread beyond the DoD into the broader federal procurement frame, and the EU has implemented a parallel structure under EDIS. A buyer in 2026 evaluating drone vendors for any regulated US federal or critical-infrastructure procurement is operating inside this compliance envelope whether they realise it or not.
This is the practical 2026 buyer's guide to Section 848 — what it requires, what counts as covered, how the rule is verified, and where the sovereign-supply-chain market actually sits.
What Section 848 actually says
Section 848 originated in the National Defense Authorization Act for Fiscal Year 2020 and was amended by Section 817 of the FY2023 NDAA. The current text, published at 10 U.S.C. 4871 note, restricts the US Department of Defense from operating, procuring, or contracting with vendors that supply covered uncrewed aircraft systems containing components originating in a defined list of covered foreign nations. The covered nations are China, Russia, Iran, and North Korea; Section 817 added the last three.
Two structural properties matter for procurement decisions.
First, the rule applies at the procurement contract level, not at the unit level. A DoD office cannot procure a non-compliant UAS, period — the buyer does not have a workaround route via informal acquisition, third-party intermediary, or aftermarket modification. Compliance is a precondition for the contract, not a quality the buyer can confer after the fact.
Second, the rule covers the supply chain, not just the airframe origin. A drone assembled in Switzerland with a Chinese-manufactured flight controller is not compliant. A US-assembled drone running a Chinese GPS receiver is not compliant. The covered-component scope explicitly extends to flight controllers, GNSS receivers, RF data links, ground-station hardware, autopilot systems, and the software supply chain. The compliance verification operates on the bill of materials, not on the final assembly location.
The downstream effect is structural: a vendor cannot become Section 848-compliant by relocating final assembly. Compliance is engineered into the supply chain from the beginning, or it isn't there.
The spread beyond the DoD
Section 848 is a DoD statute. The practical compliance frame has spread well beyond it.
Other federal agencies have mirrored the restriction. The Department of Homeland Security has implemented equivalent rules across its UAS procurement. The Department of Energy applies parallel restrictions to grid-resilience and critical-infrastructure UAS programmes. The Department of Transportation applies equivalent rules to UAS procurement under the Infrastructure Investment and Jobs Act and the Federal Aviation Administration's BVLOS pilot programmes. NASA applies parallel rules to its own UAS programmes. The pattern is consistent: federal procurement increasingly defaults to Section 848-equivalent compliance even where the originating statute does not strictly apply.
State-level procurement has followed. Several US states have implemented equivalent supply-chain restrictions on state-level critical-infrastructure UAS programmes — particularly states with significant defense industrial bases (Texas, Florida, Virginia, California) and states with state-level grid security funding (New York, Massachusetts, the Northwest cluster).
Commercial operators of critical infrastructure increasingly inherit the rule. Electric utilities operating under CIP (Critical Infrastructure Protection) standards face procurement scrutiny on UAS vendor selection. Rail operators subject to TSA security directives face equivalent scrutiny. Port and pipeline operators receive the rule from their downstream customers or insurance carriers.
The practical 2026 procurement frame: any UAS procurement with regulatory exposure should assume Section 848-equivalent compliance is required, regardless of which federal statute strictly applies.
What counts as a "covered component"
The covered-component scope is where buyers most often discover gaps in vendor claims. The acquisition guidance and the practical procurement-panel review treat the following as in-scope:
- Flight controllers — the central avionics unit. Chinese-manufactured flight controllers (including those under common consumer-vendor labels) are not compliant.
- GNSS receivers — GPS, Galileo, GLONASS, BeiDou-receiver hardware. The covered-nation rule applies to component manufacture, not signal source. A receiver manufactured in China that processes US GPS signals is still non-compliant.
- RF data links and command-and-control radios — the radios connecting the UAS to its ground station. Including the chipsets, the RF front-end components, and the modulation stack.
- Ground-station hardware — the operator-side hardware. Compliance verification applies to the ground station's components, not just the airborne system.
- Autopilot systems and inertial sensors — IMUs, gyros, accelerometers, magnetometers, barometers. Frequently the place where compliance gaps appear because sensor-class components are often consumer-grade and Chinese-origin.
- Propulsion components — motors, ESCs, propellers. Less commonly a gap, but verification applies.
- Software supply chain — including over-the-air update channels, software components from covered-nation suppliers, and the build infrastructure. A flight-control firmware that updates from a Chinese-controlled cloud endpoint is a software-supply-chain gap.
A vendor that ships an airframe assembled in a compliant jurisdiction with non-compliant flight controllers is not compliant. A vendor that ships compliant hardware with software-supply-chain gaps is not compliant. The diligence panel checks the full BOM and the full software supply chain.
The Blue UAS catalog — and what's outside it
The Blue UAS programme is the Pentagon's pre-vetted catalog of Section 848-compliant drones and components. The Defense Innovation Unit created it in 2020 and handed it to the Defense Contract Management Agency (DCMA) on 3 December 2025. Vendors on Blue UAS have passed a structured supply-chain review and are pre-approved for DoD procurement.
Blue UAS is item-specific. The list has focused on small UAS — primarily Group 1 and Group 2 platforms by DoD UAS classification — and a drone, its dock and its components are assessed and listed separately. Docks can be cleared: Skydio announced on 23 July 2026 that its Dock for X10 had joined the Cleared List. The addition cycle has been slow; in July 2026 DCMA described a faster route in which a third-party Recognized Assessor evaluates the item and DCMA can add it on the strength of that report.
Blue UAS is not a legal requirement: it is the DoD's shortcut to trusted procurement, and an unlisted system can still be Section 848 compliant. The direct-contract procurement path — where a procuring office runs an equivalent supply-chain review on a non-listed vendor and procures under the same Section 848 standard — remains the active pathway for everything not on the list.
The direct-contract path requires three things from the vendor: a structured Section 848 compliance attestation, traceable BOM provenance documentation, and the willingness to support deep-audit on selective component classes. Vendors that maintain this documentation as a standing pack pass procurement reviews on first cycle. Vendors that don't either fail or trigger extended review cycles that delay award by months.
The EU parallel — EDIS
The European Union published the European Defence Industrial Strategy (EDIS) in March 2024. EDIS establishes parallel sovereign-supply-chain restrictions for EU member-state defense procurement, applying equivalent covered-nation rules across the EU.
The frame is similar to Section 848 in scope and effect: EU defense procurement increasingly excludes UAS vendors with covered-nation components, with national implementation varying by member state. For UAS vendors serving both US federal and EU defense procurement, the practical requirement converges: NATO-allied non-CN/RU/IR supply chain, traceable component provenance, software supply chain inside sovereign infrastructure.
The convergence has procurement implications. A vendor structured to satisfy Section 848 for the US side and EDIS for the EU side serves both markets on a single supply-chain architecture. A vendor structured for the Chinese supply chain is locked out of both. The bifurcation is structural and increasingly hard to bridge.
Where the compliant supply chain actually sits
The set of NATO-allied jurisdictions with credible UAS supply-chain depth is small. The US has prime-led capability concentrated in a small number of vendors. NATO Europe has depth in Poland, the Czech Republic, Germany, France, and Italy. The UK has specialised capability. The Nordic cluster has emerging capability.
Aviation Valley in southeastern Poland is the densest aerospace and defense supply cluster in NATO Europe outside the major prime hubs. The cluster integrates engineering bench, supplier network, certified aerospace materials supply, defense-procurement heritage, and EDIS-aligned industrial-strategy support. The Jasionka factory line that builds the Dronehub portfolio sits inside that cluster.
The structural advantage of Polish manufacturing for Section 848 procurement: full supply-chain provenance documentation, zero covered-nation components, defense-grade environmental specifications inherited from the cluster's aerospace heritage, and the EU industrial-strategy alignment that EDIS depends on. The same factory line serves Section 848 procurement for US federal-civil and defense buyers and EDIS procurement for EU defense buyers without a separate compliance architecture.
What this looks like for the procurement panel
For a US federal-civil buyer (DHS, DoE, DOT, NASA, FAA-funded programmes, state-level critical-infrastructure programmes) — the Section 848-equivalent compliance frame is now the default. Vendor selection collapses to NATO-allied non-CN suppliers with traceable BOM provenance and the documentation pack to survive the diligence review. Dronehub Inc. is the Delaware C-Corp US entity; manufacturing is at Jasionka in Aviation Valley under NATO-allied non-CN supply chain. The compliance pack survives federal procurement review on first cycle.
For a DoD buyer (SBIR/STTR, AFWERX, DIU, USSOCOM) — the rule applies structurally. Blue UAS listing is item-specific, and direct-contract procurement covers everything not on the list. Dronehub procures through the direct-contract pathway, with Blue UAS eligibility in scope by design. The portfolio (counter-UAS interceptor, drone-in-a-box persistent-coverage, hybrid UAV-UGV, mobile-dock convoy escort, AI inspection at infrastructure scale) maps to procurement topics across DoD innovation pipelines.
For an EU defense buyer (EDF consortium, NATO DIANA, national-MoD programmes) — EDIS-aligned sovereign supply chain is the equivalent of Section 848 compatibility. The same Jasionka manufacturing serves both compliance frames simultaneously.
For a commercial critical-infrastructure operator (utility, rail, port, refinery) — the rule is increasingly inherited from the regulator or downstream customer. Procurement of a Section 848-compatible vendor is the future-proof default.
The manufacturing-door page is at /manufacturing. The drone-in-a-box product line under sovereign supply chain is at /drone-in-a-box. The US federal R&D-partnership door is at /rd-partnership/us-defense. The dual-domicile entity structure (Delaware C-Corp Dronehub Inc. + Polish Sp. z o.o.) is documented on /about. For a procurement-readiness conversation, open the contact form.
FAQ
- What should a buyer verify about a counter-drone vendor's NDAA Section 848/817, Blue UAS, and DCMA compliance before signing?
- Verify five things: (1) Section 848/889 compatibility, meaning no covered-nation components in the bill of materials with traceable provenance; (2) Section 817/1260H entity exposure, meaning the vendor is not a covered foreign entity or foreign-owned in a way that triggers the prohibition; (3) Blue UAS status, meaning whether the system is actually on the Blue UAS Cleared List, run by DCMA since December 2025, or only 'in review' (these are different, and a vendor should not present the latter as the former); (4) where the entity is incorporated and how federal awards route (a US entity, not a foreign subsidiary); (5) supporting documentation, meaning a capability statement, past-performance brief, and federal-registration identifiers (UEI/CAGE) available on request. Dronehub is US-owned, Section 848/889/1260H compliant by design, with Blue UAS eligibility in scope but subject to DCMA review.
- What does NDAA Section 848 actually restrict?
- Section 848 — published at 10 U.S.C. 4871 note and amended by Section 817 of the FY2023 NDAA — restricts the US Department of Defense from procuring or operating covered uncrewed aircraft systems if those systems, or their key components, are made in or sourced from China, Russia, Iran or North Korea. The restriction is structural — it applies at the procurement contract level, not at the unit level — which means buyers cannot procure non-compliant UAS even with workarounds. The exact covered-component list has been refined by subsequent NDAA cycles and DoD acquisition guidance, but the core rule has held: no covered-nation components in DoD UAS procurement.
- Does Section 848 apply outside the Department of Defense?
- Structurally, no — the statute as written applies to DoD. Practically, yes — the rule has spread across federal procurement. DHS, DoE, DOT, and NASA increasingly mirror Section 848 in their own UAS procurement frames. State-level grid and critical-infrastructure programmes apply equivalent supply-chain rules. Commercial operators of critical infrastructure increasingly inherit the rule from their regulators or downstream customers. A buyer evaluating UAS vendors in 2026 should assume Section 848-equivalent compliance is required across most US procurement pathways with regulatory exposure.
- What counts as a 'covered component'?
- The covered-component scope is broader than the airframe alone. The current acquisition guidance treats flight controllers, GPS and GNSS receivers, RF data links and command-and-control radios, ground-station hardware, autopilot systems, propulsion components, and the software supply chain — including over-the-air update channels — as in-scope. A drone assembled in a compliant jurisdiction with a flight controller manufactured in a covered nation is not compliant. The diligence panel checks the full bill of materials, not the country of final assembly.
- How does Blue UAS work, and do you need to be on it?
- Blue UAS is the Pentagon's pre-vetted catalog of drones and components assessed against Section 848. The Defense Innovation Unit created it in 2020 and handed it to the Defense Contract Management Agency (DCMA) on 3 December 2025; DIU stays on as a partner on standards. Vendors on the list have passed a structured supply-chain review and are pre-approved for DoD procurement. Listing is item-specific (drone, dock and components are listed separately), and docks can be cleared: Skydio announced in July 2026 that its Dock for X10 had joined the Cleared List. You do not need to be on it, because Blue UAS is not a legal requirement: procurement outside Blue UAS remains available via direct-contract path, where the procuring office runs an equivalent supply-chain review on a non-listed vendor and procures under the same Section 848 standard.
- Are there equivalent EU restrictions?
- Yes. The European Defence Industrial Strategy (EDIS), published by the European Commission in March 2024, establishes parallel sovereign-supply-chain restrictions for EU member-state defense procurement. The framework applies equivalent covered-nation rules across the EU, with national implementation varying by member state. For UAS vendors serving both US federal and EU defense procurement, the practical requirement is the same: NATO-allied non-CN/RU/IR supply chain across the bill of materials, with traceable provenance for every component class the regulator scrutinises.
- How do procurement panels actually verify compliance?
- Through a combination of vendor attestation, bill-of-materials review, and selective deep-audit of high-risk component classes. The vendor provides a Section 848 compliance attestation as part of the standard procurement package. The procurement panel reviews the BOM against the covered-nation list and the covered-component scope. For high-stakes or high-value contracts, the panel runs a deep audit — verifying supplier certifications, traceable provenance documentation, and (for some component classes) physical inspection. Reputable vendors maintain a standing supply-chain documentation pack that survives the audit on first review; vendors that don't either fail or trigger an extended review cycle that delays award by months.
