When an agency asks for an NDAA-compliant UAS, they are typically asking whether the platform appears on an approved list or whether the manufacturer has provided a self-certification letter. Both of those answers can be technically accurate and still leave significant compliance exposure unaddressed.
Platform-level compliance certification and component-level supply chain verification are not the same thing. Understanding what each covers — and where the gaps are — is increasingly important as NDAA enforcement attention moves from platform-level screening toward deeper supply chain scrutiny.
What Platform-Level Compliance Actually Certifies
A platform-level NDAA compliance certification typically addresses two things: whether the UAS manufacturer is a covered foreign entity under NDAA Section 848, and whether the platform’s telecommunications and video surveillance components comply with Section 889’s prohibition on covered equipment from specific Chinese manufacturers.
What it does not independently verify is the origin and compliance status of every component in the platform’s supply chain. A platform manufactured by a U.S. company is not automatically built from U.S. or approved-country components. Component sourcing is a separate question from manufacturer origin, and the two are frequently conflated in compliance documentation that agencies accept without examining the underlying supply chain data.
Where Compliance Exposure Accumulates
The compliance exposure in UAS supply chains tends to concentrate in specific component categories.
Battery cells. The dominant lithium polymer and lithium ion cell manufacturers globally are Chinese. A UAS manufacturer using battery packs with cells from manufacturers on covered entity lists may have a platform-level compliance certification while carrying a component-level compliance problem. The question to ask: where are the battery cells manufactured, and are those manufacturers covered under NDAA restrictions?
Electronic speed controllers and motor controllers. ESC manufacturing is concentrated in China, and many ESC suppliers serving the commercial UAS market are affiliated with or sourced from manufacturers that are covered entities or their subsidiaries. This is an area where supply chain documentation is frequently incomplete.
Radio modules and communications hardware. Section 889 specifically covers telecommunications equipment. The radio modules embedded in UAS platforms — telemetry links, video downlinks, and command-and-control communications hardware — require specific attention to manufacturer origin, not just the platform manufacturer’s country of incorporation.
Camera and sensor systems. This is the most scrutinized component category given the original Section 889 focus on video surveillance equipment. But the scrutiny has not been uniform. EO/IR sensors from manufacturers that have not been specifically listed but whose parent companies or technology suppliers are covered entities remain an area of active compliance attention.
Printed circuit boards and chipsets. Component-level supply chain traceability becomes increasingly complex at the PCB and chipset level, where the number of manufacturers and contract fabricators involved in producing a single component can be extensive. This is the frontier of current NDAA compliance attention and the area where supply chain documentation is weakest across the industry.
What Defensible Compliance Documentation Looks Like
A platform-level self-certification letter is the beginning of compliance documentation, not the end. For programs that need to survive audit scrutiny — IG reviews, GAO assessments, or NDAA enforcement actions — the documentation standard is significantly higher.
Defensible compliance documentation includes the following: a bill of materials identifying the manufacturer and country of origin for components in the categories described above; attestations from component suppliers that their materials do not originate from or include technology from covered entities; documentation of how the UAS manufacturer’s supply chain was verified, not just what their conclusion was; and a process for how changes in component sourcing will be identified and documented over the platform’s lifecycle.
This documentation standard is not currently required for simplified acquisition threshold purchases in most cases. But programs procured below the SAT are not immune from post-procurement compliance reviews, and the agencies that have faced the most significant NDAA compliance problems have often been those who treated simplified acquisition as an exemption from supply chain diligence rather than as a streamlined process for a well-documented acquisition.
The Market Certification Shortcut
The Blue UAS program provides an important shortcut for the platform-level and Section 889 compliance questions. Platforms on the Blue UAS Cleared List have been evaluated by DIU against established criteria, and that evaluation provides a documented basis for procurement decisions that is more robust than manufacturer self-certification alone.
However, Blue UAS certification does not eliminate the component-level supply chain question. The DIU evaluation process addresses cybersecurity architecture and top-level NDAA compliance, not full bill-of-materials component traceability. Agencies procuring Blue UAS-listed platforms are in a better compliance posture than agencies procuring non-listed platforms without independent verification, but they are not in a posture that eliminates the supply chain questions addressed above.
The Questions to Ask
Procurement officers and contracting officers evaluating UAS vendors for compliance-sensitive programs should be asking the following specific questions — not accepting general compliance certifications as a substitute for answers.
Where are your battery cells manufactured, and by whom? What ESC suppliers are you using, and what is their supply chain provenance? What radio modules are integrated into the platform, and are those manufacturers free of covered entity relationships? Do you maintain a current bill of materials with manufacturer identification for the component categories covered by NDAA Sections 848 and 889? How do you handle compliance documentation when a component supplier changes?
Manufacturers who cannot answer these questions with specificity either do not know their own supply chains well enough to certify compliance confidently, or they know something their certification letter is not disclosing. Either situation represents compliance exposure that will belong to the procuring agency, not the vendor, if it surfaces after contract award.
Why It Matters More Now
NDAA enforcement attention on UAS supply chains has increased consistently since Section 848 took effect. The enforcement trajectory is toward more scrutiny, not less. Programs procured today with insufficient supply chain documentation are taking a risk against a regulatory environment that is moving in the direction of greater accountability.
The agencies that have invested in understanding their UAS supply chain compliance at the component level — not just at the platform certification level — are building an acquisition record that will hold up under the scrutiny that is coming. Those that have not will be rebuilding their documentation retroactively under circumstances that are significantly more difficult.
Forge & Flight Labs LLC maintains full supply chain documentation for all platforms, with bill-of-materials traceability to component manufacturer for the categories addressed above. For programs requiring detailed compliance documentation, we provide that documentation as part of the acquisition package, not as an afterthought requested after contract award.