SBIR/STTR for Non-US Drone Companies: 2026 Eligibility and Entity Path

A non-US drone company cannot win SBIR or STTR awards directly. The awardee must be a for-profit US small business, more than 50% owned and controlled by US citizens or permanent residents (or by US small businesses that are), with no more than 500 employees including its foreign affiliates, and the funded research must be done in the United States. The established route is a US company — usually a Delaware C-Corp — controlled by US persons, with a US-based principal investigator and real US operations. Both programmes were reauthorised on 13 April 2026, through 30 September 2031, with tighter foreign-risk rules.

Published by Dronehub. Our US entity, Dronehub Inc., is a US-owned small business that states it is eligible to compete for SBIR/STTR awards; eligibility is not an award. The rules below link to the primary texts, checked on 28 September 2026. This is a guide, not legal advice.

SBIR and STTR eligibility at a glance

Sources: entity, 13 CFR 121.105; ownership and size, 13 CFR 121.702, with the fund rules in 121.701; affiliates, SBA's eligibility guide; investigator, location and work share, the SBA Policy Directive; foreign ties, 15 U.S.C. 638 and SBIR.gov.

What changed in 2026

The programmes' authority expired on 30 September 2025. NIH, for example, declared all its SBIR and STTR funding notices expired and stopped issuing continuation awards until Congress acted (NIH, 17 November 2025). The gap closed with the Small Business Innovation and Economic Security Act (Public Law 119-83, S. 3971), approved on 13 April 2026, which extends SBIR, STTR and their pilot programmes to 30 September 2031. Three changes matter to a founder from outside the US:

1. A harder security screen. Agencies must evaluate whether an applicant presents a security risk, and may not make an award where the agency head finds a security risk connecting the applicant to an entity on any of eight US lists — among them Commerce's Entity List and Military End User List, the Pentagon's Section 1260H list of Chinese military companies, the Section 889 list and the FCC's Covered List — or a risk from a classified source, or any other risk the agency decides warrants denial. The same provision keeps the bars carried over from the 2022 Act: no award where the agency head determines that the applicant has a parent company, subsidiary or other business entity in China or another country of concern, or an owner or covered individual in a malign foreign talent recruitment programme or affiliated with a research institution there. Agencies may tell a denied applicant the basis for the decision, at their discretion and where national security allows.
2. Wider due diligence. Reviews now explicitly cover cybersecurity practices, patents, employees, and foreign ownership including equity, debt and surety ties to a foreign country, person or entity, as well as investment, licensing and joint-venture relationships with entities in countries of concern.
3. A bigger follow-on award. A new Phase II Strategic Breakthrough award of up to $30 million over as long as 48 months, for companies with at least one prior SBIR or STTR Phase II award and matching funds of at least 100%, offered by agencies whose SBIR spending exceeds $100 million a year.

What did not change: the ownership rules in 13 CFR 121.702 and the award-size guidelines. SBA's May 2023 Policy Directive is still the current text.

How the programmes work

SBIR and STTR reserve part of participating agencies' external R&D budgets for US small businesses. The agencies include the Department of Defense, NASA, the Department of Energy, the National Institutes of Health and the National Science Foundation. STTR adds one condition: a partnership with a US research institution, such as a university or federal laboratory.

• Phase I tests feasibility. It normally runs up to six months for SBIR and a year for STTR, with a base guideline of $150,000 before inflation adjustment.
• Phase II is the R&D itself, normally up to two years, with a base guideline of $1,000,000 before inflation adjustment. As a rule, only Phase I awardees compete.
• Phase III is commercialisation, paid from other government or commercial money. The Policy Directive tells agencies to give Phase III work, including sole-source awards, to the company that developed the technology "to the greatest extent practicable".

SBA adjusts the guidelines for inflation every year and agencies may exceed them by up to 50% without a waiver: as of April 2026, SBIR.gov puts the ceilings without SBA approval at $323,090 for a Phase I and $2,153,927 for a Phase II. Properly marked data from an award is protected against unauthorised government use and disclosure for at least 20 years.

The entity path for a non-US drone company

The workable structure is a US company that holds the SBIR work, with the foreign company as a minority owner, a sister company or a commercial partner — never the controlling parent.

Where to incorporate. Any US state qualifies. Delaware C-Corps dominate because US investors expect them and Delaware corporate law is predictable; SBIR itself does not require it. Choose the state where you will actually operate if that is simpler.

Control, not just equity. The rule reads "owned and controlled". SBA's affiliation test treats anyone who owns or can control more than 50% of the voting equity as an affiliate, and it may do so from 40% on the totality of circumstances. A European parent with a majority stake therefore makes the US company its affiliate, and the US company fails the ownership test; a parent that runs the US company's decisions from abroad invites a control finding even without a majority.

Real US substance. The principal investigator must be employed mainly by the US company, the funded work must happen in the US, and at least two-thirds of a Phase I must be done by the awardee itself. A US bank account, US staff and a US facility are not formalities; they are what makes the numbers work.

Registrations. Before you submit, register the company in SAM.gov for a Unique Entity ID and in the SBIR/STTR Company Registry.

Who counts as a US owner

Among individuals, only US citizens and permanent residents count toward the more-than-50% test, which makes the founder's immigration route part of the cap table.

• Green card. The EB-1A extraordinary-ability category leads to permanent residence without a job offer, on evidence of sustained national or international acclaim. Once the founder holds a green card, their shares count as US-owned.
• Temporary visas. O-1, E-2 and L-1 let a founder live and work in the US, but they are nonimmigrant statuses: shares held under them still count as foreign. E-2 is open only to nationals of treaty countries — Poland since 1994 and Ukraine since 1996, for example, but not Russia or mainland China.
• US co-owners. US citizens, permanent residents or qualifying US small businesses can hold the majority instead.
• US funds, for SBIR only. At agencies that opt in — including DARPA, the Army, Navy and Air Force, NIH, CDC, DOE's ARPA-E and the Department of Education — a company may be majority-owned by several venture, hedge or private-equity funds, which must themselves be US-organised with a place of business in the US.

Foreign ties: disclose, don't hide

Since the SBIR and STTR Extension Act of 2022, applicants disclose their investment and foreign ties on a common form. The "foreign countries of concern" are China, North Korea, Russia and Iran, and the Secretary of State has added none. For a founder from Poland, Germany or another allied country, the European shareholder or sister company goes on the form; allied ties are not a bar in themselves. What bars an award is a parent, subsidiary or other business entity in a country of concern, an owner in a malign foreign talent recruitment programme, or a security risk connecting the company to an entity on one of the eight lists above — and due diligence now also looks at investment, licensing and joint-venture relationships with entities in countries of concern.

The product has its own test. If your topic leads to a drone or dock for the Department of Defense, NDAA Section 848 applies to its flight controllers, radios, cameras, gimbals, ground-control software and data services; our Blue UAS, NDAA and FCC explainer covers the component rules.

A realistic sequence

1. Form the US company and set the cap table so that US citizens or permanent residents own and control more than 50%.
2. Register in SAM.gov and the SBIR/STTR Company Registry.
3. Put the principal investigator and the R&D team on the US company's payroll, in a US facility.
4. Match your technology to open solicitations: Defense Department components, including the Air Force's AFWERX topics, NASA and others. The Defense Innovation Unit is a separate, non-SBIR route; see our DIU guide.
5. Win Phase I, deliver, compete for Phase II, and plan Phase III with a named buyer.

Setting up the company takes weeks. Building the US substance a reviewer will check — people, facilities, a commercialisation plan — is what takes months.

Where Dronehub fits

Dronehub is dual-domiciled: Dronehub Inc., a US-owned small business in the Research Triangle, North Carolina, and Dronehub Sp. z o.o., which runs the production line at Jasionka in Poland's Aviation Valley. Our compliance page states that Dronehub Inc. is fully US-owned through the founder's EB1A approval and eligible to compete as a small-business prime across SBIR/STTR pathways. For Dronehub: founder Vadym Melnyk secured EB1A (Extraordinary Ability green card) — the EB1A evidence pack was assembled from EU consortium-leadership credentials, Forbes Polska and Forbes Ukraine recognitions, industry-panel work, and the deployed programme portfolio (HUUVER, AUDROS, Deutsche Bahn, UAV Nomad). Our compliance page also states that no components are sourced from China, Russia, Iran or any sanctioned state.

For an operational deep-dive on the US federal R&D-partnership pathway, see /rd-partnership/us-defense. For procurement-readiness context — what the SBIR diligence panel actually looks for, with the Dronehub portfolio as worked example — see /projects/deutsche-bahn (national-scale deployment evidence) and /projects/audros (EDA-validated capability). For a structured conversation about entity path or partnership, open the contact form.