Over the last ten years, usage of enterprise drones has increased dramatically, transforming from a nascent, somewhat experimental technology into a mission-critical tool for hundreds of industries and commercial applications—everything from infrastructure inspections and public safety missions to mapping, agriculture, and construction monitoring.
However, with expansive growth comes increased scrutiny around security, privacy, and regulatory compliance.
In this guide, we'll be looking at enterprise drone compliance. Specifically, we're going to explore what drone compliance is, why it matters today more than ever, and how to verify compliance before you buy your next enterprise drone.
What Is Drone Compliance?
Drone compliance is the mandatory adherence to all applicable safety, security, and legal regulations set by your country's aviation authority.
In the United States, drone operations and compliance requirements are primarily governed by the Federal Aviation Administration (FAA), particularly under FAA Part 107, which establishes compliance requirements for hobbyist drones weighing more than 0.55 lb (250g) and commercial and recreational drones weighing less than 0.55 lb.
Compliance requirements vary depending on the type of drone you operate and the use case. For example, compliance requirements for operating hobbyist drones are often far less stringent than those governing the operation of an enterprise drone—which makes sense considering that enterprise drones are commonly used in more sensitive operations, including government-sponsored and other federally funded work.
In the U.S., enterprise drones used in government-sponsored (or otherwise funded) operations must adhere to regulations that come from federal law, specifically Section 848 of the FY2020 National Defense Authorization Act (NDAA) and the American Security Drone Act (ASDA).
What Is the National Defense Authorization Act (NDAA)?
The National Defense Authorization Act (NDAA) is an annual piece of federal legislation that specifies the budget and allowed expenditures of the Department of Defense (DoD) for a fiscal year.
As far as drone compliance is concerned, Section 848 of the Fiscal Year 2020 (FY2020) NDAA is particularly important as it prohibited the DoD from procuring or operating any unmanned aircraft system (UAS) that was made by covered foreign entities (e.g., China).
Jump forward a couple of years to the passing of the American Security Drone Act (ASDA) of 2023, which expanded the scope of Section 848 to include all federal agencies and operations—including those projects receiving federal funding. In other words, if you work for the government or you receive any kind of federal funding (via grants, contracts, etc.), your drone must be NDAA compliant.
TL;DR: Federal law mandates that if you work for a government agency or receive any type of federal funding, your enterprise drone system must be NDAA compliant.
What Makes a Drone NDAA Compliant?
At its core, NDAA compliance is all about answering one specific question: Does the procurement or operation of this drone create a supply chain risk?
According to 10 U.S.C. § 3252, a supply chain risk is the risk that a covered foreign country may sabotage the design, production, distribution, operation, or maintenance of a covered system in order to surveil, deny, disrupt, or otherwise degrade its function.
Currently, the list of covered foreign countries includes:
- The People's Republic of China
- North Korea
- The Russian Federation
- Any country that is designated as a state sponsor of terrorism
An important aspect to keep in mind about NDAA compliance is that it applies to every aspect of the drone system, including the aircraft itself, its critical hardware components (flight controller, radio, etc.), the software it uses, and data flow.
Also keep in mind that if any element of the drone system is noncompliant, the entire system is noncompliant.
So, for example: if your drone and all of its components are made in the U.S., but the Cloud service it uses relies on a data center controlled by a covered foreign entity, your drone is not NDAA compliant.
TL;DR: For your drone system to be NDAA compliant, all of its components must be sourced and manufactured from unrestricted vendors (i.e., vendors not designated as covered foreign entities).
How to Verify NDAA Compliance for Enterprise Drones
There are a number of ways to verify whether a drone is NDAA compliant. The easiest way is to start with either the Blue UAS or Green UAS certification programs.
Blue UAS is the DoD's drone validation program. It provides a "Blue List" of vetted drone systems that are NDAA compliant. If a drone system appears on the Blue List, it is NDAA compliant.
Green UAS is similar to Blue UAS in that it also verifies NDAA compliance. The primary difference between the two programs is that while Blue UAS is geared toward DoD-related operations, Green UAS focuses on civilian and other non-DoD markets. However, just like Blue UAS, if a drone system has Green UAS certification it is considered NDAA compliant.
An important thing to keep in mind about Blue UAS and Green UAS certifications is that while all Blue UAS and Green UAS drones are NDAA compliant, not all NDAA-compliant drones appear on the Blue List, nor do they all have Green UAS certification. Blue UAS and Green UAS are validation programs; they are not the legal definition of NDAA compliance.
If you want to confirm NDAA compliance of a drone system that isn't on the Blue List and doesn't have Green UAS certification, you will need to verify the manufacturer and source of all critical system components (including software and data services) on your own. To do that, you are going to need a formal compliance statement (not a brochure) from the manufacturer.
TL;DR: To verify that your drone is NDAA compliant, first check to see if it appears on the Blue UAS or Green UAS lists. If it does, good news, your drone is compliant. If it doesn't appear on either list, you'll need to verify all critical system components on your own.
Key Points about Enterprise Drone Compliance
If you're using an enterprise drone for any type of government-sponsored operation, it must be NDAA compliant.
For your drone system to be NDAA compliant, all of its components must be sourced and manufactured from unrestricted vendors (i.e., vendors not designated as covered foreign entities). Current covered foreign entities include China, North Korea, Russia, and any other country designated as a state sponsor of terrorism.
To verify that your drone is NDAA compliant, first check to see if it appears on the Blue UAS or Green UAS certification lists. If it does, that means your drone is compliant. If it doesn't appear on either list, you'll need to verify that all of its components (including software and data services) come from unrestricted vendors. As long as all of your drone's components come from unrestricted vendors, it is NDAA compliant.
