By statute, the U.S. Department of Defense (DoD) must use NDAA-compliant drones. Since FY-2020 NDAA §848, the DoD has been barred from operating or procuring unmanned aircraft systems made in, or containing critical components sourced from, the People’s Republic of China.

Congress broadened these limits in the FY-2024 NDAA (American Security Drone Act), which applies government-wide:

• Federal agencies may not procure covered UAS from covered foreign entities (effective on enactment, December 22, 2023).

• Beginning December 22, 2025, federal agencies may not operate such UAS, and contractors, grantees, or other recipients of federal funds may not use federal money to procure or operate them.

• Covered UAS may also not be purchased with Government purchase cards, effective immediately.

As a result, not only the DoD but also federal civilian agencies, and any state, local, or tribal agencies spending federal grant money, MUST select NDAA-compliant UAS. State and local governments using only their own funds are not legally bound by NDAA or ASDA, but many voluntarily follow the federal standard to align with best practices and preserve eligibility for federal funding streams.

The restrictions are primarily about national security and cybersecurity. Congress first acted in FY-2020 NDAA §848, which barred the Department of Defense from buying or operating drones made in, or containing critical components sourced from, the People’s Republic of China. Lawmakers were concerned that untrusted hardware or software could expose sensitive data to foreign adversaries, either through direct access to imagery and telemetry or through hidden vulnerabilities in critical components such as flight controllers, radios, or data-storage units.

The FY-2024 NDAA (American Security Drone Act) extended those limits government-wide, prohibiting federal agencies from procuring or operating drones from “covered foreign entities” and restricting contractors and grantees from using federal funds on such systems after December 22, 2025. The intent is to reduce the risk of cyber-espionage, unauthorized data exfiltration, or supply-chain compromise involving critical infrastructure and defense missions.

In practice, the government wants to ensure that imagery, operational details, and communications collected by drones cannot be intercepted or manipulated by adversarial actors through backdoors, malware, or other cyber vectors. While the degree of actual compromise risk can vary and should be evaluated with evidence, the statutory framework is designed to minimize exposure to those risks before they materialize.

In the FY-2020 NDAA (§848), Congress prohibited the Department of Defense from operating or procuring unmanned aircraft systems made in, or containing critical components sourced from, the People’s Republic of China. The statute defines “critical components” to include:

• flight controllers

• radios

• data-transmission devices

• cameras

• gimbals

• ground control systems or operating software

• network connectivity devices and data-storage units

If a U.S.-made drone incorporates one of these key subsystems from a covered foreign country, it is still considered a “covered UAS” and is barred from DoD procurement or operation.

The FY-2024 NDAA (American Security Drone Act) broadened the restriction government-wide, applying it not only to DoD but to all federal agencies, and extending it to “covered foreign entities.” While the 2020 law explicitly names China, the 2024 statute allows the Department of Commerce to designate additional covered entities, expanding the scope beyond the original definition. Beginning December 22, 2025, no federal agency, or any contractor or grantee using federal funds, may procure or operate drones from those entities.

In practice, NDAA/ASDA compliance means ensuring that neither the drone itself nor its critical subsystems originate from prohibited sources. This prevents supply-chain dependencies that could expose sensitive operations to cyber or national-security risks.

The FY-2020 NDAA (§848) was the first statute to set hard limits on drone procurement. It prohibited the Department of Defense from buying or operating unmanned aircraft systems manufactured in, or containing critical components sourced from, the People’s Republic of China. The law also defined which subsystems counted as “critical components,” such as flight controllers, radios, cameras, gimbals, ground control systems, operating software, and data-storage units. This created the baseline requirement that DoD drones be free of those foreign-sourced parts.

The FY-2023 NDAA (§817) reinforced §848 and added new provisions:

• It extended restrictions to counter-UAS systems sourced from the same prohibited entities.

• It required that, starting October 1, 2024, the DoD could not award or renew a contract with any company that uses “covered UAS” equipment itself in performing DoD work.

In practice, these two laws forced the DoD to phase out widely used Chinese-made drones, tighten oversight of its contractor base, and accelerate adoption of secure alternatives. Programs like Blue UAS emerged as part of the response, creating a cleared list of compliant systems to ensure operational continuity while meeting the statutory requirements.

The American Security Drone Act (ASDA) of 2023 was enacted as part of the FY-2024 National Defense Authorization Act, signed in December 2023. ASDA expands earlier DoD-only restrictions to the entire federal government.

Key provisions include:

• Procurement ban: Effective immediately upon enactment (Dec 22, 2023), federal agencies may not purchase drones from “covered foreign entities.”

• Operation ban: Beginning December 22, 2025, federal agencies may no longer operate such drones.

• Contractor and grantee funding ban: On the same 2025 date, contractors, grantees, or other entities using federal funds will also be prohibited from buying or operating covered drones.

• Purchase card ban: Agencies may not use government purchase cards to acquire covered drones, effective immediately.

• Inventory and reporting: Agencies must account for existing systems, and GAO must report on prior federal purchases.

Practically, ASDA means that after late 2025, any drone program relying on federal funds—whether at a federal civilian agency, state, tribal, or local level—must phase out and avoid foreign-made drones from covered entities. Popular off-the-shelf models from companies like DJI or Autel, for example, cannot be used in federally funded projects once the deadline arrives.

ASDA effectively closes the gap so that secure, trusted, NDAA-compliant systems are required across all federally supported operations, not just the Department of Defense.

The Blue UAS program is a Department of Defense initiative led by the Defense Innovation Unit (DIU) to accelerate the fielding of secure, NDAA-compliant drones and components for military use. Originally launched in 2020, the program was created to provide trusted alternatives to foreign-made systems, particularly those from covered countries like China

If a drone appears on the Blue UAS Cleared List, it means it has already undergone evaluation and has a DoD-wide Authority to Operate (ATO), significantly reducing the administrative burden for military units.

Importantly, Blue UAS is not the only path to compliance. DoD organizations can still certify other NDAA-compliant drones through their own internal processes, but using a Blue-listed platform provides a fast-track, pre-vetted option. For non-DoD agencies, the AUVSI Green UAS program offers a parallel certification path aligned with Blue standards, ensuring secure procurement across public safety, infrastructure, and state/local government operations.

The Blue UAS Cleared List is the Department of Defense’s official roster of drone platforms that have passed both NDAA supply-chain requirements and cybersecurity assessments through the Blue UAS program. If a drone is on the Cleared List, it has been validated as secure, NDAA-compliant, and approved for DoD-wide procurement without requiring an Exception to Policy (ETP).

Each Cleared List platform carries an Authority to Operate (ATO) across the DoD, meaning units can field these systems immediately rather than conducting their own lengthy compliance reviews. This makes the Cleared List a trusted benchmark not only for the military but also for federal agencies, state and local governments, and critical infrastructure operators seeking assurance of security and compliance.

The list began in 2020 with just a handful of “Blue sUAS 1.0” platforms (e.g., Parrot ANAFI USA GOV/MIL, Skydio X2D, Teal Golden Eagle, and Vantage Vesper) and has since expanded significantly. Today, it includes dozens of systems from U.S. and allied manufacturers, ranging from small quadcopters to larger fixed-wing and hybrid platforms. The Cleared List is continuously updated through DIU’s Blue Portal process and the use of Recognized Assessors, allowing new systems and components to be added on a rolling basis.

It’s important to note that the Blue UAS Cleared List is not the only way for drones to be approved for U.S. government use. Agencies may still certify their own compliant platforms if they meet NDAA and cybersecurity requirements. However, selecting a drone from the Cleared List provides a faster, standardized pathway with built-in assurance of trustworthiness.

The Blue UAS Cleared List is a living resource. It is updated on a rolling basis as new drone platforms and components complete NDAA compliance verification and cybersecurity assessments through DIU’s Blue Portal and the Recognized Assessor process.

The effort often referred to as “Blue UAS 2.0” began in 2021 as DIU’s second phase of the program, designed to expand beyond the original five “Blue sUAS 1.0” models. Instead of relying on a single fixed tranche, DIU introduced an ongoing refresh model, sometimes described as “rolling on-ramps,” to allow new systems to be evaluated and added more frequently.

By 2023–2025, DIU had broadened the scope to include additional categories such as tethered drones, FPV-style platforms, and larger Group 2–3 UAS, responding directly to operator demand. At the same time, DIU began streamlining the list: drones with little DoD adoption or limited mission utility have been cycled off, while new systems with strong user sponsorship continue to be added.

In practice, this means the Blue UAS List will continue to evolve over time rather than through one-off “generations.” DoD users, industry partners, and Recognized Assessors feed into the process to ensure the list reflects the most secure, cyber-vetted, and operationally relevant drones available. The most up-to-date Cleared List is always maintained on DIU’s official Blue UAS website.

No. The Blue UAS Cleared List is a convenient pre-approval pathway, but it is not the only legal route for government procurement.

For the Department of Defense, drones on the Blue List come “policy-approved” with an Authority to Operate (ATO), meaning units can purchase and field them without going through their own lengthy waiver or security review. However, DoD components can still procure other drones if they are NDAA-compliant and the purchasing organization completes its own internal certification or uses the Recognized Assessor process through the Blue Portal.

For civilian federal agencies, as well as state and local governments using federal funds, the binding requirement comes from the FY-2024 NDAA / American Security Drone Act: after December 2025, no federal money can be used to buy or operate drones made in “covered foreign countries.” Agencies may select from the Blue List, the AUVSI Green UAS Cleared List, or other vetted platforms, as long as they meet NDAA and cybersecurity standards.

In practice, many agencies adopt Blue UAS as a baseline standard because it reduces administrative burden and risk. But legally, they are not limited to Blue UAS only—the critical requirement is that any drone procured with federal funds be NDAA-compliant and satisfy the agency’s own cybersecurity and procurement rules.

Green UAS is a certification initiative led by the Association for Uncrewed Vehicle Systems International (AUVSI), launched in 2023 in partnership with the Defense Innovation Unit (DIU). It was created to provide a trusted vetting pathway for non-DoD users—including federal civilian agencies, state and local governments, critical infrastructure operators, and commercial enterprises—who require secure, NDAA-compliant drones but do not need (or cannot afford) the full DoD Blue UAS certification process.

The Green UAS program builds on the same cybersecurity and supply chain standards that underpin Blue UAS, but adds its own frameworks in areas like corporate cyber hygiene, product/device security, remote operations and connectivity, and supply chain risk management. Certification involves a thorough review of hardware, software, data pathways, and manufacturer practices, including a software and hardware bill of materials (SBOM/HBOM).

Drones that pass the review are placed on the Green UAS Cleared List, giving agencies and enterprises a vetted, continuously monitored set of options for secure procurement. Importantly, Green UAS certification does not automatically make a drone Blue UAS–approved for DoD use. However, certified platforms may opt to share their assessment data with DIU through AUVSI, which can streamline consideration for future addition to the Blue UAS Framework.

Both Blue UAS (DIU/DoD) and Green UAS (AUVSI) programs certify drones for NDAA compliance and cybersecurity, but they are built for different users and follow different processes.

• Blue UAS is a DoD-run program designed for warfighting and defense missions. Drones must pass strict cybersecurity, supply chain, and operational tests tailored to military use. These systems are often hardened for offline or air-gapped operations, with features like encryption controls and the removal of non-essential functions. A Blue-listed drone comes with an Authority to Operate (ATO) across the DoD, streamlining defense procurement.

• Green UAS, managed by AUVSI, is an industry-led certification for the civilian and enterprise sector. It applies many of the same standards as Blue UAS but also evaluates corporate cyber hygiene, software update practices, and remote connectivity—factors relevant to commercial and public-safety workflows. Certified platforms appear on the Green UAS Cleared List, giving non-DoD agencies and businesses a trusted baseline for procurement.

A key distinction: 

• Blue UAS = government purchase authority (pre-cleared for DoD use).

• Green UAS = industry “seal of approval” (trusted for public sector/commercial use, but not automatically DoD-approved).

In short, Blue is stricter and tailored for defense, while Green is more adaptable for non-military users—bridging the gap for agencies and companies that need secure, NDAA-compliant drones without undergoing the military’s full certification process.

The right choice depends on your mission and compliance requirements.

• Blue UAS drones are vetted and cleared by the Department of Defense for direct military use. They undergo the strictest security testing, often with hardened configurations designed for sensitive or offline operations. Choosing Blue is the safest route if you are DoD, a defense contractor, or supporting military operations—because these systems already carry an Authority to Operate (ATO) across DoD networks. Keep in mind, Blue UAS drones may cost more, have limited availability, and sometimes ship without features expected in civilian markets (like FAA Remote ID).

• Green UAS drones, certified by AUVSI, are designed for civilian federal agencies, state/local governments, public safety, and enterprise operators. They follow a DIU-modeled security framework but with configurations better suited to non-military missions—such as standard FAA Remote ID and cloud or network functionality. Green certification also ensures NDAA compliance, making these systems eligible for use with federal grants and safe for critical infrastructure or public safety environments.

Rule of thumb:

• Choose Blue UAS if you need military-grade assurance or must meet DoD contract requirements.

• Choose Green UAS (or another NDAA-compliant platform) if you are in the civilian sphere and want strong security plus operational flexibility.

State and local agencies are not directly bound by the federal NDAA, which only applies to the Department of Defense. However, several factors effectively pull state and local governments into compliance:

• Federal funding requirements: Starting in late 2025, the American Security Drone Act (ASDA) prohibits federal grants or contracts from being used to purchase or operate drones from “covered” foreign countries. That means police, fire, and emergency management departments relying on federal funding will have to use NDAA-compliant drones (or risk losing access to those funds).

• State laws and policies: Some states have passed their own restrictions. Florida is the clearest example: a 2022 law banned state and local agencies from operating drones from “foreign countries of concern” (with China the primary target). That law forced agencies to ground DJI fleets by April 2023 and purchase only from a small list of approved U.S. and allied manufacturers—most of which aligned with Blue UAS vendors. Other states, including Arkansas and Tennessee, have considered or enacted similar legislation.

• Security best practice: Even without a legal mandate, many agencies voluntarily choose NDAA-compliant or Green UAS-certified systems. Doing so ensures they remain eligible for future federal funding, avoid cybersecurity risks, and stay ahead of possible state-level restrictions.

Bottom line:

State and local agencies technically have flexibility if they are using only state or local funds. But with federal grant rules tightening and state bans emerging, the safest course is to adopt NDAA-compliant (or Blue/Green certified) drones to avoid costly disruptions later.

If your agency or organization buys drones using federal funds—whether through contracts, cooperative agreements, or grants—you must comply with NDAA and ASDA restrictions.

• Under the American Security Drone Act (ASDA), included in the FY2024 NDAA, starting in December 2025, federal money cannot be used to buy or operate drones from “covered” foreign countries (China, Russia, Iran, North Korea).

• This restriction applies to popular models from Chinese manufacturers like DJI and Autel. Even if a drone is purchased with non-federal dollars, it cannot be operated on a federally funded project once the rule takes effect.

• Agencies will also be required to phase out existing covered drones within two years—meaning by late 2027, no Chinese-made drones should be in use on any federally supported program.

In practice, this means federal grant programs from FEMA, DHS, DOJ, DOT, and others will update their conditions to enforce these rules. For example, a fire department using a FEMA preparedness grant, or a police department applying DOJ Byrne funds, will be limited to NDAA-compliant or Green/Blue UAS-certified platforms once the ASDA deadlines hit.

Some agencies had already informally discouraged DJI purchases through security advisories, but ASDA turns those guidelines into enforceable law. To avoid funding issues or forced replacement later, agencies should transition now to compliant drones from U.S. or allied manufacturers.

NDAA compliance isn’t always obvious, but there are reliable ways to verify:

• Manufacturer disclosure: Reputable manufacturers and resellers will clearly state if a system is “NDAA-compliant” and reference the specific law (Section 848, FY20 NDAA). Look for this in spec sheets, brochures, or on the vendor’s website. Many enterprise drone makers now provide compliance letters upon request.

• Country of origin: If the drone or any critical subsystem is manufactured in a “covered” country (China, Russia, Iran, North Korea), it is not compliant. A U.S. or allied manufacturing location is a good sign, but not sufficient on its own—components still matter.

• Critical components check: The NDAA specifically prohibits sourcing flight controllers, radios, data links, cameras, gimbals, ground control systems, operating software, and data storage from covered countries. If any of these come from a banned source, the drone is non-compliant. Increasingly, enterprise vendors provide supply-chain breakdowns or bills of materials to demonstrate compliance.

• Approved lists: If a drone appears on the DIU Blue UAS Cleared List, it is guaranteed NDAA-compliant and cyber-secure. Similarly, the AUVSI Green UAS list requires passing an NDAA supply-chain check, though certification is geared toward non-DoD users. Absence from these lists does not mean non-compliance—it may just mean the system hasn’t been formally certified.

• Direct confirmation: When in doubt, request documentation from the manufacturer or reseller. A compliance statement or letter of assurance is often available, especially for enterprise or public-sector buyers.

Rule of thumb: If you can’t verify the origin of the critical components, assume the drone may not be compliant. Trusted vendors and government-approved lists are the safest way to confirm compliance.

Yes. NDAA compliance doesn’t stop at the drone’s airframe—it covers all critical parts of the system, including payloads, sensors, radios, software, and ground control stations.

For example:

• A U.S.-made drone carrying a Chinese-manufactured camera would not be compliant, because the camera is a “critical component” under NDAA restrictions.

• Likewise, radios, flight controllers, autopilots, or storage units sourced from a “covered” country (China, Russia, Iran, or North Korea) would make the system non-compliant.

• Even software matters: ground control apps or cloud services tied to a covered country are restricted.

To help manage this, DIU created the Blue UAS Framework—a catalog of vetted, NDAA-compliant components (flight controllers, GPS units, radios, autopilots, firmware, etc.). Manufacturers and integrators can build secure systems using these building blocks, and end-users can be confident their drones remain compliant when adding or swapping parts.

Practical takeaway: If you’re adding a third-party payload—say a thermal camera for law enforcement or an LTE modem for remote ops—you must confirm that the payload itself is NDAA-compliant. Trusted suppliers often provide documentation or assurance letters, and many agencies now require this before approving new equipment.

• Blue UAS Cleared List: The authoritative source is the Defense Innovation Unit (DIU) website at diu.mil/blue-uas. DIU maintains and updates the Cleared List whenever new drones are approved or older ones are phased out. They also issue announcements during annual Blue UAS Refresh/Challenge events, which expand and update the roster.

• Green UAS Certified List: The Association for Uncrewed Vehicle Systems International (AUVSI) publishes announcements for platforms that pass Green UAS certification. AUVSI maintains a Trusted Robotics / Green UAS program page, and new certifications are often highlighted in press releases or industry news. Unlike the DIU list, there isn’t a single consolidated public roster updated in real-time—so checking AUVSI’s website or contacting them directly is the best way to confirm current certifications.

• Advexure Secure Drone Procurement Guide: For convenience, we at Advexure track both the Blue UAS Cleared List and Green UAS certifications. Our team consolidates the latest information and can provide guidance on which models are approved and available for purchase at any given time.

In addition, Advexure’s Secure Drone Procurement page (the one this FAQ is on) is kept updated with the landscape of compliant drones. We at Advexure track the Blue UAS Cleared List and Green UAS certifications, so we can provide guidance on which models are approved at any given time.

For a quick check:

• Blue UAS List: see DIU’s official site .

• Green UAS: see AUVSI’s announcements (e.g., AUVSI news releases or events where they name the certified models).

Not automatically. The NDAA does not grant blanket approval to all drones from allied nations. Compliance is determined by the origin of critical components—not just the country where the drone is assembled or the company’s headquarters.

• A drone made in Japan, France, or another allied nation could still be non-compliant if it uses a flight controller, radio, data link, camera, gimbal, or other restricted part sourced from a “covered” country (China, Russia, Iran, North Korea).

• Conversely, many drones from allied manufacturers are compliant, because they’ve taken steps to source all critical subsystems from approved supply chains.

• Being “Made in the USA” or “Made in Europe” is a good sign, but it’s not enough by itself as you need to verify the bill of materials.

The most reliable way to confirm is by checking whether the drone is listed on the Blue UAS Cleared List (DoD-approved) or AUVSI’s Green UAS Certified list, or by obtaining a compliance statement directly from the manufacturer.

Generally, no—batteries, chargers, and other non-critical accessories are not singled out in the NDAA’s list of “covered components.” The law specifically restricts parts that impact command, control, data, or imaging, such as flight controllers, radios, cameras, gimbals, ground control systems, operating software, and data storage.

That said, there are a few considerations:

• If a “charger” or “battery” includes embedded electronics with data transmission capability, it could raise compliance questions. For example, a smart battery that stores flight logs or transmits data through a management system would likely need to be sourced from a compliant vendor.

• The DoD’s Blue UAS Framework takes a broader view, ensuring that all integrated subsystems (including power systems with embedded software) are vetted for security.

For most users, standard power accessories (batteries, chargers, cases, cables) are not considered restricted components under NDAA. The focus remains on the drone’s critical systems and payloads. Still, if you’re operating in a defense or grant-funded environment, it’s best practice to source accessories from the same trusted suppliers that provide the compliant aircraft.

Yes, in theory a drone can carry both certifications, but they serve different purposes:

• Blue UAS certification (managed by DIU/DoD) means the drone has passed the Department of Defense’s most rigorous cybersecurity and supply-chain reviews and is cleared for military use with an Authority to Operate (ATO).

• Green UAS certification (managed by AUVSI) follows a similar framework but is aimed at civilian, commercial, and public-safety users. It validates NDAA compliance and strong cybersecurity but is not, by itself, a DoD purchase authorization.

If a drone has gone through Blue UAS vetting, it already meets the underlying NDAA and cybersecurity requirements that Green UAS checks for. In practice, a manufacturer could market the same model in two configurations—one as a Blue UAS-approved version for DoD, and another as a Green UAS-certified variant for the civilian sector (with features like FAA Remote ID enabled, or connectivity functions that Blue drones disable).

Remote ID is an FAA regulation, not part of the NDAA. But it interacts with Blue and Green UAS programs in different ways:

• NDAA compliance: The NDAA focuses on supply chain and cybersecurity, not flight rules. A drone can be NDAA-compliant without having Remote ID, though most new enterprise drones are designed to meet both.

• Blue UAS: Because these drones are hardened for military use, many Blue-listed platforms ship with Remote ID disabled or removed. This is intentional as military missions often require drones that do not broadcast their location for operational security. For DoD users, Remote ID is not required.

• Green UAS: Civilian agencies and enterprises must follow FAA rules, so Green UAS drones are certified with standard Remote ID functionality enabled. This ensures compliance for public safety, infrastructure, and commercial operators flying under Part 107 or other FAA-authorized operations.

These terms often get confused, but they mean different things:

• NDAA-compliant: A drone meets the requirements of the National Defense Authorization Act (Section 848, FY20 NDAA, updated in FY23). That means none of its critical components (flight controller, radio, data link, camera, gimbal, operating software, storage, etc.) are sourced from “covered” countries (China, Russia, Iran, North Korea). NDAA compliance is about supply chain security, not necessarily where the drone is physically assembled.

• Made in the USA: The drone is assembled or manufactured in the United States. However, this doesn’t automatically make it NDAA-compliant. if the drone uses a critical subsystem sourced from China (for example, a camera or radio module), it would fail compliance despite being built domestically.

In practice:

• A drone can be NDAA-compliant but not U.S.-made (for example, built in Japan or Europe using vetted components).

• A drone can be U.S.-made but not NDAA-compliant (if it includes restricted parts from covered countries).

The NDAA doesn’t only cover drones. It also extends to counter-drone systems when they include restricted components or are sourced from covered foreign countries.

• FY2020 NDAA (Section 848) began by targeting drones themselves, but

• FY2023 NDAA (Section 817) expanded the restrictions to include certain counter-UAS equipment manufactured in China, Russia, Iran, or North Korea.

That means if a counter-drone platform (such as a radar, RF sensor, or jamming system) contains critical electronics, software, or network services from a covered country, it is barred from DoD procurement.

For military and federal agencies, this ensures both sides of the UAS ecosystem, drones and the systems used to detect/defeat them, are trusted and secure. For state and local agencies, the same logic applies if they are using federal grant funding.

Yes. Under the FY2023 NDAA (Section 817), the compliance burden extends beyond the Department of Defense itself to include contractors and subcontractors working on DoD projects.

• Since October 1, 2024, the DoD is prohibited from entering into contracts with any entity that uses covered UAS equipment (drones or restricted components from China, Russia, Iran, or North Korea) in the performance of their work. This means contractors must ensure both their own operations and those of their subcontractors are free of banned drones.

• The rule applies whether the drones are used directly in service delivery (e.g., aerial inspections, mapping) or indirectly as part of a contractor’s workflow.

• Non-compliance could disqualify a contractor from eligibility, lead to termination of contracts, or trigger penalties.

For contractors outside of DoD (e.g., working with civilian federal agencies), the American Security Drone Act (ASDA) will also apply starting in December 2025, barring federal funds from being spent on covered drones.

NDAA rules don’t stop at the drone’s hardware. They also extend to the software and services that control, update, or store data from the aircraft.

• Software updates: If a drone’s firmware or control software is developed in a covered country, it could render the system non-compliant. Secure platforms ensure updates come from vetted, trusted sources.

• Cloud storage & data services: Using servers or networks tied to covered countries is not allowed under NDAA rules. For example, if flight logs or imagery are automatically stored in covered entity's cloud service, that drone would not be compliant.

• Mobile apps & ground control software: Control apps must also be developed outside covered countries. Many non-compliant drones rely on apps with potential data access back to foreign servers, which is why compliant platforms either use U.S./allied-developed apps or provide local-only control options.

This is one reason the Blue UAS Framework and Green UAS certification both vet not just hardware but also software supply chains and data pathways. For end users, the practical takeaway is that compliance means safe updates, trusted apps, and secure storage. Not just where the drone is built.

Yes. Both programs are designed to evolve as technology and mission needs change.

• Blue UAS (DoD/DIU): DIU now updates the Blue UAS Cleared List on a roughly annual cycle through “Blue UAS Refresh” or “Challenge” events. These competitive evaluations bring in new drones, sometimes entire new categories like FPV, tethered, or larger Group 3 systems, and phase out older models with little demand. The goal is to keep the list relevant and aligned with active DoD requirements.

• Green UAS (AUVSI): Green UAS certifications are issued on a rolling basis as manufacturers apply. Unlike Blue, there isn’t a single annual cycle. AUVSI announces new certifications throughout the year as drones pass evaluation. This makes the Green UAS roster more fluid, expanding steadily over time.