NDAA Sections 848 and 889 & Taiwan Drones

The two provisions

Section 889, FY2019 NDAA

Section 889 has two operative prohibitions, and most summaries describe only the first.

Part A — § 889(a)(1)(A), effective August 13, 2019. Federal agencies may not procure covered telecommunications or video surveillance equipment, or any system that uses it as a substantial or essential component, or as critical technology as part of any system.

Part B — § 889(a)(1)(B), effective August 13, 2020. Federal agencies may not contract with any entity that uses such equipment as a substantial or essential component of any system, or as critical technology as part of any system. That reaches the entity's own systems whether or not the use has anything to do with a federal contract.

The named companies are Huawei and ZTE for telecommunications equipment, and Hytera, Hikvision and Dahua for video surveillance and telecommunications equipment — in each case including subsidiaries and affiliates. The second group carries a qualifier the first does not: it covers that equipment when produced "for the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes." Contracting officers have not read that narrowly, and a buyer is not going to argue the point with a supplier.

Enacted in Public Law 115-232 and implemented through FAR subpart 4.21, which puts two clauses in the contract: FAR 52.204-24, the representation an offeror signs, and FAR 52.204-25, the prohibition itself. A parallel rule at 2 CFR 200.216 applies the same bar to recipients of federal grant and loan money. DoD's implementation material sits on the DPC Section 889 page.

Entity-based. The question is whether a named company's equipment is present — not where a part was made.

Why it appears on drone websites anyway: "NDAA compliance" entered general use through Section 889, because that provision drove the first wave of supply-chain compliance work across the electronics industry. The phrase stuck; the section number came along with it.

Section 848, FY2020 NDAA

Bars the Department of Defense from procuring or operating drones manufactured in, or incorporating critical components from, a covered foreign country — principally China. Enacted in Public Law 116-92 and set out as a statutory note to 10 U.S.C. § 4871, under the heading "Prohibition on Operation or Procurement of Foreign-Made Unmanned Aircraft Systems". It has no section number of its own in the US Code, which is why it is cited by its NDAA section rather than a code section.

Origin-based. The question is where the component was made.

The prohibition names the components itself. DoD's implementing clause bars a covered UAS that uses flight controllers, radios, data transmission devices, cameras, or gimbals manufactured in a covered foreign country; a ground control system or operating software developed in one; or network connectivity or data storage located in, or administered by an entity domiciled in, one. That clause text is what a contracting officer applies, and it is the wording a US buyer will flow down to you.

That clause has never been made permanent. DoD has carried it on successive class deviations since 2020 — the same clause number, 252.225-7972, reissued under DEVIATION 2020-O0015 and then 2024-O0014. Do not confuse it with FAR 52.240-1, which is a permanent rule implementing the American Security Drone Act, a different statute with a different test.

Where Section 889 does reach a drone manufacturer

Citing Section 889 as evidence of where a flight controller was made is wrong. Caring about Section 889 is not. There are two exposures, and an origin file answers neither.

In the product. Hikvision and Dahua both sell thermal and imaging modules, and those modules reach drone payloads. Relabeling makes that hard to see: a module can carry a brand with no visible China association while running Hikvision firmware or a Dahua chipset. There is no government-published detection tool. What practitioners check is the MAC address OUI prefix against the IEEE registration authority's public registry, the firmware version strings, and the vendor names the device exposes in its own configuration interface. None of those is conclusive alone. Together they are usually enough to know whether to ask the supplier a harder question.

In your own building. Part B reaches equipment you use, not only equipment you sell. Security cameras on the factory floor and networking equipment in the office are the usual findings. Age is not a defense: a camera installed in 2017 is covered on the same terms as one installed last month. This applies to any company that holds a federal contract, subcontracts on one, or takes federal grant or loan money.

Taiwanese law does not answer this for you. The instinct is that Chinese cameras are already banned in Taiwan, so the building must be clean. That reasoning fails twice. The Executive Yuan's restriction — guidelines from 2019, extended by a December 2020 directive requiring replacement by the end of 2021, and raised to formal regulations in 2025 — binds public agencies; it reaches critical infrastructure operators and government-sponsored foundations only as something their supervising agency is told to urge. A private manufacturer is not covered by it at all. And where it does bind, it tests the brand on the finished product rather than the parts inside. Taiwan's National Audit Office reported in August 2026 that the policy prohibits Chinese-made end products but does not cover individual components, after Hi Sharp Intelligence imported Chinese camera components, assembled them in Taiwan, sold them as made in Taiwan, and won government contracts from 2020 to 2024 — roughly 3,400 products, replacement estimated at NT$40 million. FAR 52.204-25 asks a question your own regulator is not currently asking on your behalf.

The two rules compound. A drone carrying a Hikvision or Dahua thermal module fails Section 889, and separately carries thermal imaging — which places it in Annex I of the Section 232 tariffs at 100 percent. One module, two instruments, and the component-origin documentation that answers Section 848 addresses neither.

Which applies to what

The Section 889 rows turn on vendor identity, not country of manufacture. A Taiwanese company passes them by not having the named vendors' equipment inside the product or inside the building — a records question about purchase orders and installed assets, not a bill-of-materials question.

The parts Section 848 does not name

Motors, ESCs and propellers are absent from the enumerated list, and the enumeration is the operative text here — unlike the FCC's Covered List, which extends to anything "designed and intended primarily for use in UAS". A buyer applying Section 848 strictly has no basis to reject a Taiwanese motor on the ground of the statute alone.

That is not the same as saying it will never be asked about. Procurement practice under the Drone Dominance Program framework has been broader than the statute in places, and a prime flowing requirements down to you may ask for origin on parts the statute does not name. Answering is cheap if the origin file already exists.

What a defensible claim contains

A compliance statement that survives diligence has five elements. Most published Taiwanese statements have one or two.

1. The specific provision. "Section 848 of the FY2020 NDAA," not "NDAA."
2. The specific product line. Model numbers, not the company.
3. The basis. Component-level origin tracing against a bill of materials — not an assertion.
4. A date. Supply chains change. An undated claim is a claim about an unknown moment.
5. A signature. A named person who can be asked about it.

Hedged phrasing — "aligned with," "to the best of our knowledge" — suggests the underlying work was not done, fairly or not.

Why buyers do not correct you

A procurement engineer who sees the wrong section cited does not usually raise it. They stop replying. The supplier records a lost inquiry and never learns the cause.

Because nobody tells the supplier, the same error can run through years of lost inquiries. Correcting it costs nothing.

Section 848 compliance is not Blue UAS

Passing Section 848 does not put a product on the Blue UAS Cleared List. Blue UAS is a list with an application process, covered in the Blue UAS guide. Section 848 is a procurement standard a buyer applies.

Nor does either one grant US market access. That is governed by a separate rule with a different test entirely.

The origin work serves two rules

The component-level origin tracing that supports a Section 848 declaration is substantially the same evidence a US importer needs to certify allied content under the Section 232 tariff cap. Build the origin file once.

Open questions

• Whether a permanent DFARS rule replaces the class deviation. None was published as of August 2026.
• How motors, ESCs and propellers are treated under the Drone Dominance Program framework, which has run broader than the statute in places.
• Whether the FY2027 NDAA amends either section.

Primary sources

• 10 U.S.C. § 4871, statutory notes — where Section 848 is set out in the US Code
• DoD class deviation 2024-O0014 — the clause text enumerating the covered components
• DCMA Blue UAS portal — successor to the DIU Blue UAS policy pages, which moved in July 2025
• FAR 52.240-1 — ASDA prohibition clause
• FAR subpart 4.21 — Section 889 implementation
• FAR 52.204-24 — the Section 889 representation an offeror signs
• FAR 52.204-25 — the Section 889 prohibition clause, with both parts and their effective dates
• 2 CFR 200.216 — the parallel prohibition on federal grant and loan recipients
• DoD DPC Section 889 — the department's own implementation reference
• Federal Register, FAR interim rule implementing ASDA