NDAA drone compliance is required first and foremost for the U.S. Department of Defense (DoD) – by law the DoD cannot procure or use drones from “covered” foreign sources. In fact, since FY2020, the DoD has been prohibited from operating or contracting for drones made by entities in countries like China. This requirement has tightened over time; the FY2023 NDAA added that after October 1, 2024, DoD may not even work with contractors who themselves use banned drones during contract performance .

Beyond the military, many federal agencies have adopted similar policies (even if not initially mandated). Critically, a new law in the FY2024 NDAA (the American Security Drone Act) will prohibit any federal grant or contract funds from being used to buy or operate foreign-made drones after late 2025. In other words, federal civilian agencies and any state/local agencies using federal grant money will also be required to stick with NDAA-compliant UAS. State and local governments using their own funds aren’t directly bound by the NDAA law, but many choose to follow it for security best practices or to ensure eligibility for federal funding.

The main concern is security. Drones made by companies in certain countries (especially adversarial nations) could pose risks such as unauthorized data access or cyber-espionage. By restricting foreign-made drones and components, the government aims to prevent sensitive data (like aerial imagery, infrastructure details, or tactical information) from being transmitted to or accessed by hostile actors. There are also fears that malware or backdoors could be introduced via untrusted hardware or software. In short, the NDAA restrictions are aimed at reducing the risk of data breaches, cyberattacks, or foreign surveillance. While concerns around technology from adversarial nations are valid, it's important to substantiate claims of data risk with empirical evidence.

The NDAA (as it relates to drones) defines “covered foreign countries” and critical components that trigger a ban. The list of banned countries currently includes: China (People’s Republic of China), Russia (Russian Federation), Iran (Islamic Republic of Iran), and North Korea (Democratic People’s Republic of Korea). Drones manufactured in these countries (or by companies domiciled there) are prohibited for DoD use, as are drones that incorporate certain key components from those countries.

The covered components include things like flight controllers, radios, data transmission devices, cameras, gimbals, ground control systems, operating software, and network or data storage services . In essence, if any of those critical parts of the UAS come from a covered country (or if the drone’s control software or data storage is tied to those countries), the drone is considered a “covered UAS” and is banned for DoD procurement. This means, for example, a drone might be U.S.-made but still non-compliant if it uses a Chinese-made camera or communication module. NDAA compliance requires that none of those key subsystems originate from the prohibited countries.

The Fiscal Year 2020 NDAA (Section 848) was the initial law that prohibited the DoD from operating or buying any UAS that is a “covered UAS” – essentially banning drones made in or containing parts from the countries listed above. This 2020 law established the baseline restrictions on foreign drones and components.

In late 2022, the Fiscal Year 2023 NDAA included Section 817, which updated and tightened those rules . Section 817 reinforced the Section 848 ban and added new provisions – for instance, it extended the prohibition to certain counter-drone systems from those countries and, importantly, set a deadline (Oct 1, 2024) after which the DoD cannot enter into contracts with any entity that uses equipment from a covered UAS company in performing a DoD contract.

In plain terms, FY2023’s law not only reaffirmed the ban on DoD itself using foreign drones, but also said DoD suppliers and contractors must rid their operations of banned drones by that date if they want to do business with the DoD. These NDAA provisions have had a sweeping effect – DoD had to discontinue use of popular foreign-made drones and replace them with compliant systems. The laws also pushed the development of domestic or allied alternatives (e.g. through the Blue UAS program) to fill capability gaps created by the bans.

The American Security Drone Act (ASDA) of 2023 is a piece of legislation aimed at extending the drone restrictions beyond the DoD to the rest of the federal government (and indirectly to state/local agencies using federal funds). It was included in the FY2024 NDAA passed in December 2023 . The act prohibits the use of federal funds (contracts, grants, or cooperative agreements) to purchase or operate any off-the-shelf UAS made in a covered foreign country (like China) . This prohibition takes effect starting in late 2025 and is set to last through at least 2028 .

Practically, ASDA means that by the end of 2025, federal civilian agencies and any organizations spending federal grant money must stop buying drones from those banned sources. It also mandates phasing out existing covered drones – agencies will have a two-year window to replace or retire Chinese-made drones they already have. For example, popular models from DJI or Autel will no longer be allowable on any federally-funded project after 2025. The ASDA is essentially the government’s way of closing the gap so that it’s not just the DoD, but all government-funded drone operations that must use trusted, secure UAS.

The Blue UAS program is a Department of Defense initiative (spearheaded by the Defense Innovation Unit, DIU) to rapidly vet and scale secure, trusted UAS for military use. Launched in 2020, Blue UAS was created to find alternatives to Chinese-made drones by identifying commercially available drones that meet DoD standards . Drones that go through the Blue UAS program undergo rigorous evaluation for NDAA compliance (i.e. no banned components) as well as extensive cybersecurity testing.

In essence, Blue UAS serves as a pipeline to approve drones that the DoD can use without needing special waivers. If a drone is listed as a Blue UAS platform, it means it’s “policy approved” – military units can purchase and operate it without needing an exception to policy. The program continuously works with industry to evaluate new systems, ensuring the military has access to up-to-date, secure drone technology on a faster timeline than traditional acquisition programs. It’s important to note that Blue UAS is not the only way a drone can be approved for government use, but it has become the most streamlined path. By trusting DIU’s vetting, government agencies save the time and effort of doing their own full security assessments on a drone.

The Blue UAS Cleared List is the official roster of drone systems that have been approved by the DoD through the Blue UAS program. In other words, it’s the list of specific drone models that military and other government users can buy knowing they’ve passed NDAA compliance checks and cybersecurity evaluations. Drones on the Cleared List comply with Section 848 of FY20 NDAA, Section 817 of FY23 NDAA, and the American Security Drone Act requirements – they have been validated as cyber-secure and safe to fly.

Being on the Cleared List means a drone has an Authority to Operate (ATO) from DIU and does not require further waivers for DoD use. This list initially included a handful of small drones (the first “Blue sUAS 1.0” models like Parrot ANAFI USA, Skydio X2D, Teal Golden Eagle, Vantage Vesper, etc.), and it has expanded over time. The Cleared List is regularly updated and published by DIU to give all government stakeholders an easy reference to which drone platforms are vetted and approved at any given time . If a drone is on the Blue UAS Cleared List, it’s essentially “pre-cleared” for procurement by DoD units and often trusted by other agencies as well as a gold standard for security.

The Blue UAS list is not static – it’s continually refreshed to keep pace with new technology and mission needs. After the initial batch (Blue UAS 1.0), DIU launched “Blue UAS 2.0” which opened the door for more commercial drones to be added via an On-Ramp process. In 2023–2024, the DoD began a major refresh: for example, in February 2025 the Blue UAS “Challenge” event led to 23 new drone platforms being selected for NDAA verification and cybersecurity review. These will be added to the official Blue UAS list once they complete the review process . The 2025 refresh notably expanded categories to include first-person-view (FPV) racing-style drones, tethered drones, and larger Group 3 UAS, directly responding to field operator feedback .

DIU intends to hold such events annually, meaning the Blue UAS List will be updated on a roughly yearly cycle with new approved models . It’s worth noting that as part of the 2025 refresh, DIU also streamlined the list by focusing on drones with significant DoD user demand. Some previously listed systems (from companies that had little direct DoD uptake) were removed in this competitive refresh, as DIU narrows the list to drones meeting current military priorities . Going forward, the Blue UAS Cleared List will continue to evolve – new drones will be added as they pass vetting, and outdated or less utilized ones may be cycled off – ensuring the list reflects the best available secure options. The latest list is always available on the DIU’s Blue UAS website.

Not necessarily – being on the Blue UAS Cleared List is not a strict requirement for all government purchases, especially outside the DoD. The Blue UAS program provides a convenient pre-approval path, but it is not an exclusive path for acquiring drones . The Department of Defense itself can still procure other drones as long as they meet NDAA compliance and the purchasing organization certifies them (or obtains an appropriate waiver). DIU emphasizes that Blue UAS listing does not preclude the government from buying any other UAS that a government entity deems compliant.

In practical terms, this means a federal or state agency could choose a drone that isn’t on the Blue list, but they would then shoulder the responsibility to verify it meets security requirements (and if DoD, they’d need an exception-to-policy approval). Many public sector organizations adopt the Blue UAS list as a safe baseline, since it reduces the administrative burden of verification. However, agencies are free to consider other NDAA-compliant drones that suit their mission, provided those drones don’t violate any applicable bans and the agency’s own policies allow it . For example, a law enforcement agency might use a domestically made drone that isn’t officially “Blue” if it meets their needs and they trust its compliance – nothing in the law forbids this, as long as federal funds or DoD rules aren’t imposing stricter requirements. The key is that the drone must still be NDAA-compliant and meet the agency’s internal security standards. Blue UAS just simplifies the choice by offering a vetted menu of options.

Green UAS is a certification initiative led by the Association for Uncrewed Vehicle Systems International (AUVSI) in cooperation with DIU. Announced in early 2023, the Green UAS program is designed to expand the pool of secure, vetted drones for non-DoD users (e.g. federal civilian agencies, state/local governments, and enterprise customers) . Like Blue UAS, Green UAS focuses on drones that meet high cybersecurity and NDAA supply chain standards, but it is an industry-led, voluntary certification rather than a direct DoD approval pipeline . The goal of Green UAS is to provide an affordable and accessible alternative to Blue certification .

Manufacturers can submit their drones to AUVSI for evaluation, where experts review the product’s security (hardware, software, cloud connectivity) and supply chain for any red flags. Drones that pass these checks are granted “Green UAS certified” status. In essence, Green UAS creates a trusted list of drones for the broader public sector and commercial market, similar to how Blue UAS serves the DoD. One key difference is that Green UAS does not automatically meet DoD-specific requirements – it’s aimed at everyone outside the DoD who still cares about security . By establishing this program, AUVSI is widening the options for secure drones beyond the few that DoD directly sponsored, helping local agencies and companies confidently choose compliant systems even if they’re not on the Blue list.

While both programs vet drones for cybersecurity and NDAA compliance, Blue UAS and Green UAS serve different audiences and have some process differences. The Blue UAS program is run by the DoD (DIU) and is geared toward military “warfighting” use – meaning Blue UAS drones are often locked-down configurations tailored for DoD needs (with special encryption, no reliance on internet services, and even removal of features like Remote ID broadcasts).

Blue UAS certification can be a lengthy and costly process for manufacturers, as it involves intensive testing to meet military standards . In contrast, the Green UAS program is managed by AUVSI as a more streamlined, cost-effective certification for the commercial and civil sector . Green UAS still holds drones to rigorous security benchmarks (the framework is modeled on DIU’s approach ), but it also evaluates criteria important to enterprise use – such as corporate cyber hygiene practices and the ability to safely update software or use remote operations connectivity . Essentially, Green UAS expands the vetting to ensure the drone is not only secure, but also suitable for civilian agency workflows (e.g. compliant with FAA rules like Remote ID, and capable of cloud or network use where appropriate).

Another difference is in official standing: Blue UAS is effectively a government purchase authorization, whereas Green UAS is more of an industry “seal of approval.” A Green UAS drone is not automatically on the DoD’s Cleared List, but it’s expected to be much easier to transition to Blue if needed. On the flip side, Blue UAS drones, built for the battlefield, might lack certain features or flexibility that commercial users need – which is where Green UAS bridges the gap. In summary, Blue UAS = military-grade certification, stricter and for DoD use; Green UAS = commercial-focused certification, aligned with Blue principles but more adaptable to non-military requirements.

It depends on your organization’s needs and requirements. If you are in the DoD or supporting the military, a Blue UAS drone is generally the safest choice because it’s already approved for DoD networks and missions. Blue UAS drones come with the highest level of scrutiny and often have extra-hardening (but note, they might lack certain features like Remote ID or might be limited to specific configurations intended for military use). On the other hand, if you are a non-DoD federal agency, a state or local public safety department, or a commercial enterprise, a Green UAS certified drone may be more appropriate. Green UAS platforms still offer strong security and NDAA compliance, but with configurations that align better with civilian use (for example, they will have standard FAA Remote ID and the ability to utilize connectivity features) . Importantly, Green UAS certification provides assurance for public safety and critical infrastructure operators that a drone meets high cybersecurity standards without being a strictly DoD-specific variant . Cost and availability might be factors too: Blue UAS models can be more expensive and sometimes in limited supply, whereas Green UAS opens up more options (including some of the same models in a slightly different form).

As a rule of thumb:

• Use Blue UAS if you have DoD procurement requirements or extreme security mandates that mirror military needs. For example, a defense contractor performing work on base might be required to use a Blue UAS-listed system.

• Use Green UAS or other NDAA-compliant drones if you’re in the civilian sphere but still need a trusted drone. A Green UAS drone will satisfy federal grant rules and internal IT security concerns, and it will be easier to integrate into regular operations (with features like software updates, cloud integration, etc., that are restricted on Blue).

A: State and local agencies are not directly bound by the federal NDAA law, but there are a few important considerations for them. First, if those agencies use federal grant money (which many police, fire, and emergency management departments do), they effectively will need to comply with NDAA restrictions to keep that funding (as discussed above, federal grant guidelines will prohibit buying banned drones after 2025).

Second, some states have enacted their own laws or policies that mirror or even go beyond federal requirements. A notable example is Florida: in 2022, Florida passed a law banning its state and local agencies from using any drones from “foreign countries of concern” (China being the primary target) . That law, which took effect in April 2023, forced Florida public safety agencies to ground all their DJI drones and only allowed them to use drones from an approved list of manufacturers (which corresponded closely to the Blue UAS makers) . This meant dozens of drones had to be shelved in departments across Florida, requiring expensive replacements to comply with the law . Other states have considered similar bans or at least strongly encourage using NDAA-compliant drones for government operations.

In summary, outside of DoD, state/local agencies technically have a choice, but federal funding rules and state policies are increasingly pushing them toward NDAA-compliant (or even Blue UAS-approved) systems. At a minimum, using compliant drones ensures a department won’t run into funding issues or security conflicts down the line.

If you plan to buy drones using federal grant funds or other federal money, you must pay close attention to NDAA compliance. The latest law (the American Security Drone Act as part of NDAA 2024) explicitly prohibits the use of federal funds to buy or operate drones from covered foreign countries starting in December 2025.

This means that grant programs from agencies like FEMA, DHS, DOJ, etc., will be enforcing that rule in their grant conditions. For example, a fire department using a FEMA preparedness grant or a police department using a DOJ Byrne grant to acquire drones will not be allowed to spend that money on DJI or other Chinese-made drones once the rule kicks in. They will be limited to NDAA-compliant options (e.g., drones from U.S. or allied manufacturers). Additionally, the law calls for phasing out existing foreign drones from federally funded projects within two years after the ban starts – so by late 2027, agencies should not be operating Chinese-made drones on any project that involves federal dollars. It’s also worth noting that even before this law, some grant-making agencies had informal policies steering recipients away from Chinese drones (due to security advisories). Now it’s moving from guidance to an enforceable rule.

Determining NDAA compliance can be done by checking the drone’s specifications and origin. Here are a few steps:

• Manufacturer Disclosure: Many reputable drone manufacturers will explicitly state if their product is NDAA-compliant. Look for documentation on the company’s website or spec sheet that says “NDAA compliant” or references Section 848 (FY20 NDAA) compliance. For example, some companies label models as “US-made, NDAA-compliant” as a selling point.

• Country of Origin: Identify where the drone is manufactured or where the parent company is based. If it’s made in China, Russia, Iran, or North Korea, it is not NDAA-compliant by definition. If it’s made in the USA or an allied country, that’s a good sign (though not a guarantee by itself, since components matter too).

• Components Check: NDAA specifically calls out certain components: flight controller, radio, camera, gimbal, etc. If any of those are made by a Chinese or other covered-country company, the drone is non-compliant. Sometimes manufacturers will provide a parts breakdown. For instance, if a drone uses a Pixhawk-based controller (open source hardware often made in various countries) versus a DJI flight controller – that difference affects compliance. This level of detail can be hard to obtain, but enterprise drone providers are increasingly offering “bill of materials” assurances for compliance.

• Approved Lists: Cross-reference the drone with known approved lists like the Blue UAS Cleared List or the Green UAS list. If a drone appears on the DIU’s Blue UAS list of approved systems, it is definitely NDAA-compliant (and more) . Similarly, if it’s on AUVSI’s Green UAS certified list, it has passed an NDAA supply chain check. However, many NDAA-compliant drones won’t be on either list (especially newer or smaller vendors), so absence from Blue/Green lists doesn’t automatically mean non-compliance.

In practice, doing a bit of research on the manufacturer is key. If you’re unsure, ask the vendor directly – they should be able to confirm compliance and provide a letter or documentation. And of course, consult any updated guidance (the DIU and AUVSI websites, or trusted resellers) which often maintain lists of compliant products. When in doubt, err on the side of caution: if you can’t verify that none of the critical components are from a banned source, then the drone may not be fully NDAA-compliant.

Yes – NDAA compliance isn’t just about the drone’s airframe; it extends to all critical parts of the system, including payloads and components. The law’s intent is to prevent sensitive technology from adversary nations in any part of the unmanned system. For example, a drone might be built in the U.S. but if it carries a camera made in China, that camera is a “critical component” that would violate NDAA rules . This is why many enterprise drone makers ensure not only the drone body but also the sensor, gimbal, and communications modules are sourced from compliant countries.

The DoD’s Blue UAS program has an element called the Blue UAS Framework, which specifically focuses on approved components and modules. The Blue UAS Framework is essentially a list of interoperable, NDAA-compliant UAS components and software (like flight controllers, GPS units, radios, autopilots, etc.) that have been vetted for use in DoD projects . Using those building blocks, manufacturers or integrators can assemble fully compliant systems. For end users, this means if you’re adding or swapping parts – say putting a new camera or LTE modem on your drone – you need to ensure those additions are also compliant. A common scenario is law enforcement agencies adding third-party payloads (thermal cameras, for instance) – they must choose models from companies like FLIR or others that are not based in China. Another scenario is software: even the ground control software or mobile app should not be developed in a covered country.

For the Blue UAS Cleared List, the authoritative source is the Defense Innovation Unit’s official website. DIU maintains a page for Blue UAS that includes the current list of approved drones . As of 2025, they update this site whenever new drones are added (or occasionally when older ones are phased out). The site URL is typically diu.mil/blue-uas – on that page you’ll find a “Cleared List” section showing all drones that are approved, along with any notes or datasheets. DIU also issues press releases for significant updates (e.g. new “Blue UAS 2.0” additions), but the web list is the most up-to-date reference.

For the Green UAS list, AUVSI publishes information on which platforms have received Green UAS certification. You can check AUVSI’s website and press releases for announcements of Green UAS certifications. AUVSI had a dedicated page for Green UAS, and they also often coordinate with industry news outlets. For instance, press releases in 2024 announced additions to the Green UAS certified roster (drones like the Spirit, eBee TAC, IF1200A, etc. as mentioned above) . While AUVSI may not have a single continuously updated public list as DIU does, they do publicize each batch of approvals. It may be useful to contact AUVSI or consult their Trusted Robotics/Green UAS program page for the current list.

In addition, Advexure’s Secure Drone Procurement page (the one this FAQ is on) is kept updated with the landscape of compliant drones. We at Advexure track the Blue UAS Cleared List and Green UAS certifications, so we can provide guidance on which models are approved at any given time.

For a quick check:

• Blue UAS List: see DIU’s official site .

• Green UAS: see AUVSI’s announcements (e.g., AUVSI news releases or events where they name the certified models).