Legislation Hub: NDAA Compliance Regulatory Framework
United States
NDAA Section 889 (P.L. 115-232)
The John S. McCain National Defense Authorization Act for Fiscal Year 2019 is the primary legislative foundation for compliance requirements.
Section 889(a)(1)(A) — Effective August 13, 2019: Federal agencies are prohibited from procuring or obtaining equipment, systems, or services that use “covered telecommunications equipment or services” as a substantial or essential component.
Section 889(a)(1)(B) — Effective August 13, 2020: Federal agencies are prohibited from entering into contracts with any entity that uses covered telecommunications equipment anywhere in its operations. This is the “taint rule” — a federal contractor with banned cameras in their own private facilities is in violation.
The Five Covered Entities: Huawei Technologies, ZTE Corporation, Hytera Communications, Hangzhou Hikvision Digital Technology, and Zhejiang Dahua Technology — and their subsidiaries and affiliates.
Secure Equipment Act of 2021
Requires the FCC to cease reviewing or approving equipment authorizations for companies on its Covered List. This restricts market access, not just government spending.
FCC Covered List — Q2 2026 Timeline
| Date | Action |
|---|---|
| August 13, 2019 | Section 889(a)(1)(A) procurement ban effective |
| August 13, 2020 | Section 889(a)(1)(B) contractor use ban effective |
| December 22, 2025 | All foreign-produced UAS and critical components added to FCC Covered List |
| January 7, 2026 | DoW authorized Blue UAS / domestic end product exemption until January 1, 2027 |
| March 23, 2026 | All foreign-produced consumer-grade routers added to FCC Covered List |
| May 8, 2026 | Software update window for pre-ban drones/routers extended to January 1, 2029 |
American Security Drone Act (ASDA) — NDAA FY2024
Incorporated into the NDAA for Fiscal Year 2024. Prohibits federal agencies from procuring or operating drones manufactured by “covered foreign entities.” The FCC added all foreign-produced UAS to the Covered List on December 22, 2025.
FY26 NDAA Proposals (Upcoming)
Proposed legislation would expand the banned list to include foreign-produced cellular modules, AI chips, and integrated software. This poses a future risk to currently compliant IoT devices using Chinese communication modules (e.g., Quectel).
United Kingdom
Procurement Act 2023
Came into full force in 2025. Introduced the National Security Debarment Register, allowing ministers to exclude suppliers on national security grounds from all public procurement.
Cabinet Office Directive (2022) — Sensitive Sites
Following concern over visual surveillance equipment from companies subject to China’s National Intelligence Law, the Cabinet Office issued a directive in 2022 mandating removal from all “sensitive” government sites. The April 2025 deadline was enforced.
NPSA (National Protective Security Authority) Standards
Current benchmark for UK public sector procurement. Acts as the de facto standard for local councils, NHS sites, universities, and schools. Effectively bans Hikvision and Dahua from all public sector procurement, not just “sensitive” sites.
Frequently Asked Questions
Does NDAA Section 889 apply to private companies?
Section 889 does not directly regulate private companies that do not hold federal contracts. However, Section 889(a)(1)(B) prohibits the government from contracting with any entity that uses banned equipment. Any company in the defense industrial base — including construction firms, IT services providers, and consultants with federal contracts — must audit and replace banned equipment across all facilities.
What is the May 2026 FCC software update extension?
On May 8, 2026, the FCC extended the software update window for already-owned foreign-made drones and routers to January 1, 2029. Organizations can continue applying critical security patches to pre-ban devices during this window while procuring compliant replacements.
Is the UK ban legally equivalent to NDAA Section 889?
The mechanisms differ. The US operates through statutory procurement prohibitions. The UK operates through the Procurement Act debarment register and NPSA guidance. For sensitive sites, the practical outcome is equivalent: Hikvision and Dahua equipment is effectively banned.
Does the March 2026 router ban affect existing installations?
The FCC’s software update extension (May 8, 2026) provides a window until January 1, 2029 for organizations to continue patching pre-ban routers. New procurement of foreign-made consumer routers post-March 23, 2026 requires compliance verification.