Two years after President Biden signed the National Defense Authorization Act for Fiscal Year 2024, the drone industry's reckoning arrived on schedule. On December 22, 2025, the American Security Drone Act of 2023 — folded into that NDAA at enactment — became enforceable law. The prohibition it carries is broad enough to catch not just federal agencies but university research teams, government contractors, and anyone else whose work runs on federal dollars. If you operate a drone bought with federal money and that drone came from a covered foreign manufacturer, you are now out of compliance.

Most of the public attention has landed on DJI. That focus is warranted, but the statute's definitions are wider than any single company's name.

A Decade of Incrementalism, Then a Cliff

The legislative lineage of the ASDA runs back further than many realize. Congress first restricted Chinese-made drones in Section 848 of the FY2020 NDAA, which barred Department of Defense procurement of drones manufactured in China, covering DJI and similar hardware. That restriction was DoD-only. DJI's placement on the Department of Commerce Entity List in 2020 added a layer, and its addition to the DoD's "1260H list" of Chinese military companies in October 2022 tightened the DoD purchasing prohibition further. Autel Robotics appeared on that list as well.

The ASDA changed the architecture entirely. By enacting it through the FY2024 NDAA — signed December 22, 2023 — Congress extended the prohibition beyond DoD to every federal agency and every entity performing federally funded work. The two-year grace period ended exactly at midnight on December 22, 2025.

The enforcement mechanism is Federal Acquisition Regulation clause 52.240-1, which carries the ASDA prohibition directly into federal contracts. The GSA issued acquisition regulations in 2024 clarifying the prohibition's scope for contractors. By January 2025, the GSA Office of Inspector General had already documented contractors operating prohibited DJI drones at sensitive federal facilities, including ports of entry and border security sites — prompting a formal Senate inquiry by Senators Hassan and Peters pressing national security contractors on compliance.

What the Statute Actually Prohibits

The ASDA bars the use of federal funds to procure or operate UAS from "covered foreign entities." That definition encompasses three categories: entities appearing on the Consolidated Screening List, entities the Secretary of Homeland Security has determined pose a national security risk, and entities domiciled in or controlled by the People's Republic of China.

The third category is the operative one for most compliance questions. It means any PRC-domiciled or PRC-controlled manufacturer qualifies as a covered foreign entity regardless of whether they appear on any named list. DJI and Autel are the most prominent examples, but the definition is not closed to those two names.

The prohibition extends to procurement and to operation. Owning a covered UAS bought before the effective date is not automatically a violation, but operating it on a federal contract or grant-funded project is. Universities receiving federal research grants, which were not previously understood to be covered by DoD-specific restrictions, now fall squarely within scope. The University of Nebraska–Lincoln issued an institutional compliance notice in December 2025; Penn State followed with its own compliance directive in June 2026.

Compliant alternatives must come from the Defense Contract Management Agency's Blue UAS Cleared List or the Green UAS list. These represent systems that have undergone supply-chain vetting, though the lists remain limited in the payload and range capabilities they cover relative to the commercial DJI product line.

The statute carves out exemptions for the Departments of Defense, Homeland Security, Justice, and Transportation, as well as NOAA, permitting them to exclude certain covered UAS systems deemed expendable due to mission risk or that are one-time-use systems. These are narrow operational carve-outs, not blanket exceptions for those agencies to continue routine DJI procurement.

The Parallel FCC Track — and Why It Went Further

While the ASDA clock ran down, a parallel legislative effort took its own complicated path. Representative Elise Stefanik introduced the Countering CCP Drones Act, which proposed adding DJI directly to the FCC's Covered List under the Secure and Trusted Communications Networks Act — the same blacklist that barred Huawei and ZTE from U.S. telecommunications infrastructure. The bill passed the House in 2024.

It was stripped from the final FY2025 NDAA in conference. In its place, Congress inserted Section 1709, which mandated that an "appropriate national security agency" determine within one year — by December 23, 2025 — whether DJI and Autel equipment posed an "unacceptable risk to U.S. national security." If the review found risk, or if no agency completed it, the FCC was required to add those manufacturers to the Covered List within 30 days.

DJI objected publicly to the mechanism's structure.

"There is no provision for any right of reply or due administrative process,"
the company stated, arguing that Section 1709 created an automatic listing penalty triggered by government inaction — a form of regulatory consequence without due process. DJI also noted that
"neither the CCCPD Act nor any similar proposed legislation were included"
in the final NDAA text, reading the omission as a deliberate choice by conferees.

What happened next moved faster and wider than Section 1709 targeted. On December 21, 2025, an unnamed Executive Branch interagency body convened by the White House issued a National Security Determination concluding that

"unmanned aircraft systems (UAS) and UAS critical components produced in foreign countries"
pose
"unacceptable risks to the national security of the United States and to the safety and security of U.S. persons."
The FCC released a fact sheet on December 22, 2025 adding all foreign-produced UAS and UAS critical components to the Covered List — not just DJI and Autel, but every foreign-made drone platform.

"UAS critical components" under the FCC action includes data transmission devices, communications systems, flight controllers, ground control stations, navigation systems, sensors, cameras, batteries, and motors. The scope of what constitutes a covered component is broad enough to implicate supply chains well beyond the airframe itself.

What the FCC Action Does — and Does Not — Do

The Covered List prohibition prevents new equipment authorizations for foreign-made UAS going forward. Existing models that previously received FCC authorization remain legal to import from existing inventory, sell, and operate — the action is a supply-chain restriction on new market entry, not a grounding order for hardware already in circulation. FAA flight rules are unchanged.

On January 7, 2026, the FCC issued two exemptions. The first covers drones and components appearing on the Defense Contract Management Agency's Blue UAS list. The second covers products meeting Buy American domestic end-product standards — 65% domestic component cost through 2028, rising to 75% for deliveries starting 2029. Both exemptions expire January 1, 2027.

Companies may also seek conditional approval relief from DoD or DHS by submitting information on corporate structure, manufacturing origin, supply chain, and U.S. onshoring plans. For DJI and Autel specifically, however, stricter language in the covered list action means their equipment remains prohibited even if manufactured domestically or produced via joint ventures or licensing agreements with U.S. companies. The nationality of the entity, not the geography of production, governs.

The compliance picture heading into 2026 is layered: the ASDA governs federal procurement and operation across all agencies and federally funded activity; the FCC Covered List governs new equipment authorizations; and the 2027 exemption sunset creates a fixed horizon for the Buy American and Blue UAS carve-outs. Whether the FY2026 NDAA further codifies, modifies, or overrides the December 2025 FCC action remains an open question — but the institutional compliance infrastructure now being stood up at universities and contractors will not easily be dismantled regardless of how that legislative cycle resolves.

Sources