Autonomy Runway
Where to start

Drone compliance

Guide 4 of 8

The rules for selling drones to government and flying them: NDAA and the American Security Drone Act, Blue UAS, the FCC, FAA Part 107, ITAR, EAR and CMMC.

In this guide

NDAA drone supply chain rules and the American Security Drone Act

Who it is for. Drone makers, drone service companies and parts suppliers that sell to federal agencies, work on federal contracts, or sell to state, local and other buyers who pay with federal grant money.

Congress has passed several laws that limit which drones the federal government can buy, fly or pay for. The American Security Drone Act of 2023 (ASDA) bars federal agencies from buying drones made or assembled by 'covered foreign entities,' and since December 22, 2025 it also bars agencies from flying them and bars federal contract, grant and cooperative-agreement money from paying for them. Separate defense laws (Section 848 of the Fiscal Year 2020 National Defense Authorization Act (NDAA) and Section 817 of the FY2023 NDAA) bar the Department of War (DoW, also called the Department of Defense) from buying or using drones, and key drone parts, from China, Russia, Iran and North Korea.

Steps

  1. Read who counts as a 'covered foreign entity' under ASDAASDA (Sections 1821-1833 of Public Law 118-31, signed December 22, 2023) says a covered foreign entity is one on a list kept by the Federal Acquisition Security Council (FASC) and published in the System for Award Management (SAM.gov). The law says the list includes: entities on the Consolidated Screening List; entities subject to 'extrajudicial direction' from a foreign government; entities the Department of Homeland Security (DHS) finds pose a national security risk; entities domiciled in China or under the influence or control of China's government or Communist Party; and their subsidiaries and affiliates.Public Law 118-31 (ASDA is Title XVIII, Subtitle B)
  2. Note the ASDA effective datesFederal agencies may not procure covered drones from the day the law took effect (December 22, 2023). Government purchase cards may not be used to buy them, effective immediately. Starting December 22, 2025 (two years after enactment), federal agencies may not operate covered drones, including through contracted drone services, and federal funds from contracts, grants or cooperative agreements may not be used to buy or operate them. Sections 1823-1825 end on December 22, 2028 (five years after enactment), according to Section 1833.ASDA text in the U.S. Code notes (41 U.S.C. ch. 39)
  3. Search SAM.gov for the FASC list before proposing a droneThe Federal Acquisition Regulation (FAR) clause 52.240-1 tells contractors to search SAM.gov for the FASC list of ASDA-covered foreign entities before proposing, or using in contract work, any drone. The clause bars delivering a 'FASC-prohibited' drone and, from December 22, 2025, bars operating one on the contract or using federal funds to buy or operate one. The clause says to put its substance into all subcontracts.FAR 52.240-1 on Acquisition.gov
  4. Check the new FAR numbering in overhauled solicitationsUnder the Revolutionary FAR Overhaul, the drone ban appears in FAR 40.202(c), and the details sit in clause 52.240-91, Security Prohibitions and Exclusions, with disclosures under provision 52.240-90. Read the clause numbers in each solicitation, because older contracts may still cite 52.240-1.FAR Overhaul Part 40 on Acquisition.gov
  5. Map where each critical drone part comes from (DoW sales)DoW's rule in the Defense Federal Acquisition Regulation Supplement (DFARS) at 240.7008 (class deviation 2026-O0025, Revision 3, signed September 3, 2026) bars DoW from using or buying a drone, or related services or equipment, that: is made in a covered foreign country (China, Russia, Iran or North Korea) or by an entity domiciled there; uses flight controllers, radios, data transmission devices, cameras or gimbals made there; uses a ground control system or operating software developed there; or uses network connectivity or data storage located in, or run by an entity domiciled in, a covered foreign country. It also covers systems that detect or identify drones.DoW class deviation 2026-O0025, Revision 3 (DFARS Part 240)
  6. Complete the DoW drone representation in each solicitationDoW solicitations use provision 252.240-7993 (a representation about foreign-made drones) with clause 252.240-7994 (the prohibition). The deviation says the clause is left out only when the purchase is for counter-drone surrogate testing and training, or for intelligence, electronic warfare and information warfare operations, testing, analysis and training, or when the Secretary of Defense (also called the Secretary of War) has granted a waiver under the two NDAA sections.DFARS 240.7008-3 in class deviation 2026-O0025
  7. Know the October 1, 2024 DoW contracting ruleThe same DFARS section says that on or after October 1, 2024, DoW may not enter into or renew a contract with an entity that operates, as determined by the Secretary of Defense (also called the Secretary of War), equipment from DJI (or its subsidiaries or affiliates), from a drone company on the Consolidated Screening List, or from a drone company domiciled in, or under unmitigated foreign ownership, control or influence (FOCI) by, a covered foreign country.DFARS 240.7008-2(c)
  8. Note the FCC Covered List entry for DJI and AutelSection 1709 of the FY2025 NDAA gave national security agencies one year to decide whether communications or video surveillance equipment from DJI and Autel Robotics (and their subsidiaries, affiliates, partners and joint ventures) poses an unacceptable risk. On December 22, 2025, the Federal Communications Commission (FCC) added all equipment and services listed in Section 1709(a)(1) to its Covered List. See the FCC program in this guide for what that means.FCC Covered List

What to have ready

  • A bill of materials that names each drone component, its maker and its country of origin
  • Records showing where flight controllers, radios, data transmission devices, cameras and gimbals are made
  • Records showing where ground control and operating software are developed
  • Records showing where network connectivity and data storage are located and who runs them
  • A dated record of each SAM.gov search for the FASC list of ASDA-covered foreign entities
  • The signed DoW representation (DFARS 252.240-7993) when a DoW solicitation includes it

Time, cost, renewal and where to send

TimeThere is no application. These rules apply at each proposal, purchase, contract award, renewal and grant-funded purchase.
CostThe laws set no fee. They are conditions of federal contracts and federal funds.
RenewalOngoing. ASDA Sections 1823-1825 end on December 22, 2028 unless Congress changes the law. The FASC list, the Consolidated Screening List and DoW's determinations can change at any time.
Where to sendNothing goes to a central office. Representations go with each proposal to the contracting officer named in the solicitation. Waivers are agency decisions, not company applications.

Where to get help

Watch out

  • ASDA and the DoW rules are different tests. ASDA looks at who made or assembled the drone (the FASC list). The DoW rule also looks at where key parts are made and where software and data storage come from.
  • Federal money reaches beyond federal agencies. Since December 22, 2025, ASDA bars federal funds 'awarded through a contract, grant, or cooperative agreement, or otherwise made available' from buying or operating covered drones.
  • ASDA has exemptions for certain agencies and missions, such as DHS, DoW, State and Justice for research and security work, wildfire and search-and-rescue operations, and Tribal law enforcement. Agency heads may also seek case-by-case waivers approved by the Office of Management and Budget (OMB). These are agency decisions.
  • Clause numbers are changing. The FAR overhaul moved the drone ban into FAR Part 40, and DoW now uses DFARS 240.7008 through a class deviation. Each solicitation lists the clause numbers that apply.
  • Imports are a separate issue. A presidential proclamation of August 13, 2026 put Section 232 tariffs on imported drones and drone parts starting September 3, 2026. See the FCC program in this guide.

Official sources

Blue UAS (DCMA Blue List): Cleared List and Framework

Who it is for. Drone makers and drone component and software makers that want Department of War (DoW) buyers to find a pre-vetted product, and foreign-made drones or parts that rely on the FCC's Blue UAS exception.

Blue UAS (unmanned aircraft systems) is DoW's list of drones, parts and software that have been checked against defense supply chain law and tested for cybersecurity. The Defense Innovation Unit (DIU) started it in 2020. A July 10, 2025 Secretary of War memo moved it to the Defense Contract Management Agency (DCMA), which launched the Blue List portal on December 3, 2025 and now takes applications from any company.

Steps

  1. Learn the three listsDCMA describes three lists. The Cleared List holds DoW-approved drones that comply with law and policy, are validated as cyber-secure, and are available for DoW purchase and operation. Blue UAS Select holds platforms added for partner needs through competitive processes; these have an Authority to Operate (ATO). The Framework holds NDAA-compliant components, sub-components, modules and software. DCMA's Framework List page says these are approved for use with Blue List platforms 'when properly configured.'DCMA Blue List: About
  2. Pick a path onto the listDCMA's FAQ lists two ways to be added: a DoW customer sponsors the product, or the company goes through the Recognized Assessors process. DCMA says a company no longer needs a military sponsor or a competition win to be considered. DCMA's Cleared List page says drones are validated as cyber-secure either by being added from AUVSI's Green List or by third-party recognized assessors.DCMA Blue List FAQ
  3. Register the company on the Blue List portalGo to bluelist.dcma.mil and register. The portal's September 2026 release notes say new companies must give a CAGE (Commercial and Government Entity) code or a company address to register, and manufacturers must finish Foreign Ownership, Control or Influence (FOCI) screening before they can reach manufacturer tasks. The portal has a FOCI progress tracker.DCMA Blue List portal
  4. Open a product intake case and load the bill of materialsSubmit each product through product intake. The portal lets a company bundle components and platforms in one case, upload bill of materials (BOM) data with an Excel template or by hand, and add documents such as manuals and brochures. If the BOM names a component maker that is not registered, the portal asks for that maker's email so it can register.DCMA Blue List portal
  5. Request quotes from Recognized AssessorsRecognized Assessors send price quotes through the portal. If one assessor passes, a second round of quote requests can go to the other assessors automatically. DCMA does not publish assessor prices.DCMA Blue List portal
  6. Check the listing and keep the configuration fixedThe Cleared List and Framework List are searchable on the portal. 'Date added' shows the date a product became officially listed. DCMA's FAQ says clearance applies only to the specific models and configurations listed, not to a family of models or a manufacturer, and that adding or changing critical components needs its own assessment.DCMA Blue List: Cleared List

What to have ready

  • CAGE code (or company address) to register on the portal
  • Information for Foreign Ownership, Control or Influence (FOCI) screening (manufacturers)
  • Bill of materials in the portal's Excel template, naming each component maker
  • Email contacts for component makers not yet registered on the portal
  • Product manuals, brochures and other product documents

Time, cost, renewal and where to send

TimeDCMA does not publish a processing time.
CostDCMA does not publish a fee. Recognized Assessors quote their own prices in the portal, and the prices are not public.
RenewalDCMA does not publish a renewal period. Clearance covers only the listed models and configurations. New or changed critical components need a new assessment.
Where to sendEverything goes through the DCMA Blue List portal at bluelist.dcma.mil.

Where to get help

Watch out

  • Blue UAS is not required for every sale. DCMA's FAQ says the laws behind Blue UAS apply only to DoW, that other federal, state and local buyers are not held to them, and that any DoW or U.S. government office may buy other certified-compliant drones after its own internal steps.
  • One part can change the answer. DCMA's FAQ says a component made in a non-covered country with its own firmware is still not allowed if it uses a radio module from a covered foreign country.
  • A Remote ID transmitter counts as a critical component, according to DCMA's FAQ, because it is a data transmission device and a radio.
  • Blue UAS matters outside DoW too. The FCC exempts drones and components on the Blue UAS Cleared List (which, for the FCC, includes the Framework) from its foreign-drone Covered List entry until January 1, 2028. The August 13, 2026 tariff proclamation starts its tariffs 180 days after the proclamation date, instead of September 3, 2026, for companies that were on the Blue UAS Cleared List, the Blue UAS Framework or the FCC's Conditional Approval list on September 2, 2026. The later date covers their listed products and those products' components.
  • Old links moved. DIU's Blue UAS page and the old bluelist.appsplatformportals.us site now point to bluelist.dcma.mil.

Official sources

FCC equipment authorization and the FCC Covered List

Who it is for. Companies that make, import or sell drones, drone radios, controllers, cameras or other radio-frequency (RF) devices in the U.S., and especially drone makers that produce outside the U.S.

Most devices with radios need Federal Communications Commission (FCC) equipment authorization before they can be imported, marketed or sold in the U.S. Since December 22, 2025, drones and drone 'critical components' produced in a foreign country are on the FCC Covered List, so new models cannot get authorization unless an exception applies: the DCMA Blue UAS Cleared List or the Buy American 'domestic end product' standard (both until January 1, 2028), a Conditional Approval from the Department of War (DoW) or Homeland Security (DHS), or the 'Toy Drones' exemption. Models the FCC authorized earlier can still be imported, sold and used, although the FCC has proposed limits for some.

Steps

  1. Check whether the device needs FCC authorizationThe FCC says RF devices must be authorized under 47 CFR part 2 before they are marketed in or imported into the U.S. There are two procedures, Certification and Supplier's Declaration of Conformity (SDoC). The FCC rule part that applies to the device decides which one to use.FCC Equipment Authorization Approval Guide
  2. Check the product against the Covered ListThe Covered List includes 'Uncrewed aircraft systems (UAS) and UAS critical components produced in a foreign country.' The FCC lists critical components as data transmission devices, communications systems, flight controllers, ground control stations and controllers, navigation systems, sensors and cameras, batteries and battery management systems, and motors, plus their software. Drone docks are included. The FCC says the nationality of the company does not matter; place of production does. Only parts 'designed and intended primarily' for drones count, so a general-purpose camera is not covered.FCC FAQ: UAS and UAS critical components
  3. If produced abroad, confirm which exception appliesAs of the July 21, 2026 update, the exceptions are: (a) drones and components on DCMA's Blue UAS Cleared List, including the Blue UAS Framework, until January 1, 2028; (b) drones and components that are 'domestic end products' under the Buy American standard (48 CFR 25.101(a)), which the FCC describes as assembled in the U.S. with at least 65% of components by value produced in the U.S., until January 1, 2028; (c) devices with a DoW or DHS Conditional Approval; and (d) foreign-produced 'Toy Drones' and Toy Drones that contain foreign-produced components, as defined in the National Security Determination (the FCC announced this exception on June 15, 2026). The FCC says a U.S.-made drone with foreign parts is not covered if it meets Blue UAS or Buy American.FCC Covered List
  4. Or request a Conditional ApprovalEmail drones@fcc.gov with the information in the DoW and DHS guidance of January 7, 2026. The FCC forwards it to DoW and DHS. The guidance asks for: corporate structure and all owners of 5% or more; board and executives with nationality; any foreign government ownership, control or funding; a detailed bill of materials with country of origin for every component, software and firmware; U.S. content as a share of cost; manufacturing, assembly and test locations; supply chain concentration and single points of failure; and a time-bound U.S. manufacturing and onshoring plan with a named contact who reports progress every quarter. An authorized corporate officer must certify the information.DoW/DHS guidance on Conditional Approval submissions (PDF)
  5. Get an FCC Registration Number and a Grantee CodeFor Certification, the responsible party (usually the manufacturer) gets a 10-digit FCC Registration Number (FRN), then applies for a Grantee Code. The Grantee Code is permanent and becomes the first part of every FCC ID the company uses.FCC Grantee Code page
  6. Test at an FCC-recognized accredited labCertification requires testing by an FCC-recognized accredited testing laboratory. SDoC equipment must also be tested, but the lab does not have to be FCC-recognized; it must keep the records the rules require.FCC testing laboratory search
  7. File with a Telecommunication Certification Body (TCB)Submit the application and the information listed in 47 CFR 2.1033 to a TCB. The TCB reviews it and issues the grant in the FCC's Equipment Authorization System. Every applicant certifies that the device is not covered equipment; for drones this includes certifying, in good faith, that the drone or component was not 'produced in a foreign country' (unless an exception applies). The FCC says no specific document is required, but applicants must be able to show it.FCC TCB search
  8. Label the product and keep recordsLabel the product and put compliance information in the user manual (see FCC Knowledge Database (KDB) Publication 784748). Keep all compliance records. A new FCC rule takes effect October 13, 2026. It requires online marketplaces to show a device's FCC ID at the online point of sale, with limited exceptions. According to the rule, marketplaces must comply by March 1, 2027 if they have physical access to or title over the device, and by June 1, 2027 if they rely on sellers' certifications.FCC final rule, effective October 13, 2026 (Federal Register)

What to have ready

  • FCC Registration Number (FRN) and Grantee Code
  • Test report from an FCC-recognized accredited lab (for Certification)
  • Application information listed in 47 CFR 2.1033, filed with the TCB
  • A good-faith basis showing the drone or component was not produced in a foreign country, or proof of an exception (Blue UAS listing, Buy American domestic end product, Conditional Approval)
  • For a Conditional Approval: ownership chart, owners of 5% or more, board and executive list with nationality, foreign government ties, detailed bill of materials with country of origin, software and firmware origin, U.S. cost share, manufacturing locations, supply chain risk analysis, U.S. onshoring plan with investments and milestones, and an officer's certification
  • Product label and user manual compliance statements

Time, cost, renewal and where to send

TimeThe FCC does not publish review times for TCB grants or Conditional Approvals. The FCC says it received its first UAS Conditional Approvals on March 17, 2026, and it announced them on March 18, 2026.
CostTesting labs and TCBs are private and set their own fees. The FCC pages checked do not list a fee for a Conditional Approval request.
RenewalThe Blue UAS and Buy American exceptions end January 1, 2028 unless extended again. The FCC says UAS Conditional Approvals with no end date stay in effect as long as the company follows its onshoring plan and passes updated vetting. In August 2026 the FCC asked for comment on whether equipment authorizations should expire after a fixed term (it tentatively suggested ten years). Comments were due September 8 and reply comments September 21, 2026. The FCC pages checked show no adopted term limit as of September 25, 2026.
Where to sendCertification applications go to an FCC-recognized TCB. Conditional Approval requests go by email to drones@fcc.gov. Covered List questions go to Chris Smeenk (chris.smeenk@fcc.gov). Equipment authorization questions go through the Inquiry Form of the FCC's Office of Engineering and Technology (OET).

Where to get help

Watch out

  • Import and sale bans on already-authorized drones are proposed, not final. In FCC proceeding PS Docket 26-184, the FCC proposed stopping imports and marketing of covered equipment from named companies (July 17, 2026, including XAG; August 10, 2026, Anzu Robotics). In PS Docket 26-189 (July 21, 2026) it proposed the same for foreign-made 'military-grade' drones: swarming drones, drones built to carry defense articles, thermal imaging and LiDAR drones, drones that spray 'economic poison,' drone docks, and drones of 55 pounds or more. Comments closed August 31, September 2 and September 23, 2026. The proposals would not cover federal government use, commercial testing and product development, or drones already bought.
  • The FCC acts on false 'produced in the U.S.' claims. On July 21, 2026 the FCC began proceedings to revoke two equipment authorizations from a company it said falsely claimed to produce its drone in the U.S. It revoked both authorizations on August 11, 2026.
  • A new FCC rule takes effect October 13, 2026. It bars authorization of devices with logic-bearing hardware parts made by an entity on the Covered List, where the device would be barred if that entity made the whole device, and requires full certification for changes by Covered List entities.
  • Drones made only for federal government use generally do not need FCC authorization, according to the FCC, and the FCC says the Covered List does not affect sales to DoW, DHS or other federal agencies. Agency buying rules still apply.
  • Robotics makers face a parallel rule. On July 28, 2026 the FCC added foreign-produced 'advanced robotic devices' and power inverters to the Covered List, except those with a Conditional Approval.
  • New import tariffs apply. Proclamation 11055 (August 13, 2026) set Section 232 duties from September 3, 2026: 100% on drones with a maximum takeoff weight over 25 kg, drones with thermal imagers, drone docks and listed critical parts; 25% on drones of 25 kg or less; and 25% on other listed parts from February 9, 2027. Rates are capped at 15% for Japan, South Korea, Taiwan, Switzerland, Liechtenstein and EU members and 10% for the UK if substantially all critical parts and technology are certified as from those places or the U.S. The Commerce Department will run an onshoring-plan program: companies with approved plans to build U.S. plants can import parts and production equipment without the Section 232 duties, in amounts tied to planned U.S. output, while the plant is built.

Official sources

FAA Part 107: pilot certificate, drone registration, Remote ID, waivers, and the BVLOS rule (Part 108)

Who it is for. Companies that fly drones under 55 pounds for work, including demos, testing and contract services, and drone makers that must build to the Remote ID rule.

The Federal Aviation Administration (FAA) Small UAS Rule, 14 CFR Part 107, covers work flights of drones under 55 pounds. Each pilot needs a Remote Pilot Certificate, each drone needs a $5 registration that lasts three years, and registered drones must meet Remote ID. Flights outside Part 107 limits, such as beyond visual line of sight (BVLOS), need a waiver; a dedicated BVLOS rule (proposed Part 108) was proposed in August 2025 and had not been published as a final rule as of September 25, 2026.

Steps

  1. Create an IACRA profile to get an FAA Tracking NumberCreate a profile in the FAA's Integrated Airman Certification and Rating Application (IACRA) to get an FAA Tracking Number (FTN). Do this before booking the knowledge test. The FAA lists eligibility as: at least 16 years old; able to read, speak, write and understand English; and in a physical and mental condition to fly safely.FAA IACRA
  2. Pass the knowledge testBook the 'Unmanned Aircraft General - Small (UAG)' test at an FAA-approved Knowledge Testing Center. Bring a government-issued photo ID. Pilots who already hold a Part 61 pilot certificate and a flight review within the past 24 months take the FAA's online course ALC-451 (Part 107 Small UAS Initial) instead, according to the FAA. They then complete Form 8710-13 in IACRA. They bring it, with proof of the flight review, photo ID and the course completion certificate, to an FAA Flight Standards District Office (FSDO), a designated pilot examiner, an airman certification representative or a flight instructor, who confirms their identity.FAA: Become a Certificated Remote Pilot
  3. Apply for the Remote Pilot CertificateIn IACRA, start FAA Form 8710-13 (Pilot, Remote Pilot), enter the 17-digit Knowledge Test Exam ID, sign and submit. The FAA says the test can take up to 48 hours to appear in IACRA. After the Transportation Security Administration (TSA) background check, the FAA emails instructions to print a temporary certificate. The permanent card comes by mail.FAA: Become a Certificated Remote Pilot
  4. Register each drone in FAADroneZonePart 107 registration costs $5 per drone and lasts three years. Part 107 pilots register each drone or broadcast module separately. Have the address, email, phone, make and model, Remote ID serial number and a credit or debit card ready. Mark the registration number on the drone, and carry the registration certificate (paper or digital) when flying. Drones of 55 pounds or more use the FAA Aircraft Registry instead.FAADroneZone
  5. Meet Remote IDRegistered drones must broadcast Remote ID. The FAA lists three ways: fly a Standard Remote ID drone; attach a Remote ID broadcast module (the pilot must keep the drone in sight); or fly without Remote ID only inside an FAA-Recognized Identification Area (FRIA). Check the FAA list of accepted Declarations of Compliance to confirm a drone or module qualifies.FAA list of accepted Remote ID Declarations of Compliance
  6. Drone makers: file a Remote ID Declaration of ComplianceMakers of Standard Remote ID drones and broadcast modules must meet 14 CFR Part 89 and submit a Declaration of Compliance (DOC) through the FAA UAS DOC website. The DOC attests the product meets an FAA-accepted Means of Compliance (MOC); Advisory Circular 89-2 explains the DOC process. Makers seeking FAA design or production approval under Part 21 show Remote ID compliance through that process instead. Kit makers must also file a DOC.FAA: Remote ID for Industry and Standards Bodies
  7. Get airspace authorization for controlled airspaceRequest airspace authorization in FAADroneZone, or through LAANC, which the FAA says Part 107 pilots can use to get airspace authorization. The FAA says authorizations are processed first come, first served, and are still needed for night flights in controlled airspace under 400 feet.FAA: Part 107 Airspace Authorizations
  8. Apply for a Part 107 waiver for operations outside the rulesWaivable rules include 107.25 (moving vehicle), 107.29 (night), 107.31 (visual line of sight, which covers BVLOS), 107.33 (visual observer), 107.35 (multiple drones), 107.39 (over people), 107.51 (altitude, speed, visibility) and 107.145 (over moving vehicles). Apply in the FAA Aviation Safety Hub, which replaced FAADroneZone for waivers. Describe the operation, the risks and how each risk is reduced, using the FAA's Waiver Safety Explanation Guidelines.FAA Aviation Safety Hub
  9. Keep the certificate currentComplete the FAA's online recurrent training every 24 calendar months. Any Part 107 certificate holder can take course ALC-677 (Part 107 Small UAS Recurrent). Part 107 pilots who also hold a Part 61 certificate with a current flight review can take ALC-515. The FAA lists both courses as no cost. Keep the Remote Pilot Certificate easy to reach during every flight.FAA: Become a Certificated Remote Pilot
  10. Track the BVLOS rule (proposed Part 108)The FAA proposed 'Normalizing Unmanned Aircraft Systems Beyond Visual Line of Sight Operations' on August 7, 2025 (90 FR 38212). It proposes performance-based rules for low-altitude BVLOS drone operations and for third-party services such as UAS Traffic Management (UTM). Comments closed October 6, 2025. The FAA reopened comments from January 28 to February 11, 2026 on electronic conspicuity and right-of-way. As of September 25, 2026, no final rule appears in the Federal Register. The federal regulatory agenda lists meetings on the final rule under Executive Order 12866 scheduled through September 29, 2026.BVLOS proposed rule (Federal Register)

What to have ready

  • Government-issued photo ID (for the knowledge test)
  • FAA Tracking Number from IACRA
  • 17-digit Knowledge Test Exam ID
  • For drone registration: physical and mailing address, email, phone, drone make and model, Remote ID serial number, credit or debit card
  • Remote Pilot Certificate and drone registration certificate (paper or digital) during flights
  • For a waiver: flight area and map, altitude, aircraft specs, containment and flight termination methods, crew training plan, and a risk and mitigation explanation
  • For drone makers: Remote ID Declaration of Compliance referencing an FAA-accepted Means of Compliance

Time, cost, renewal and where to send

TimeKnowledge test results can take up to 48 hours to show in IACRA. The FAA says it tries to decide waivers within 90 days and cancels an application if a request for information goes unanswered for 30 days. The FAA does not give a set time for the TSA check.
CostDrone registration is $5 per drone for three years. Testing centers charge for the knowledge test; the FAA pages checked do not state the amount. The FAA waiver page lists no application fee. The FAA lists the recurrent training courses (ALC-677 and ALC-515) as no cost.
RenewalRecurrent training every 24 calendar months. Drone registration every three years in FAADroneZone. Waivers last for the term written on each waiver.
Where to sendIACRA for the pilot certificate; FAADroneZone for drone registration and airspace authorization (or LAANC); the Aviation Safety Hub for Part 107 waivers; the FAA UAS DOC website for Remote ID Declarations of Compliance.

Where to get help

Watch out

  • BVLOS still needs a waiver. Until a final BVLOS rule takes effect, flying beyond visual line of sight under Part 107 needs a waiver of section 107.31.
  • The FAA says it will disapprove waiver applications that do not identify hazards and propose ways to reduce them.
  • A drone registered under the recreational exception cannot be flown under Part 107, and registrations cannot be moved between the two types.
  • The FAA lists drone registration for U.S. citizens and legal permanent residents. For foreign operators, the FAA treats the certificate as recognition of ownership, not as U.S. aircraft registration.
  • Remote ID broadcast modules only work for flights where the pilot can see the drone the whole time.

Official sources

ITAR: State Department (DDTC) registration

Who it is for. U.S. companies that manufacture, export or temporarily import defense articles on the U.S. Munitions List, or furnish defense services, including makers of military drones and military drone parts.

The International Traffic in Arms Regulations (ITAR) require any person in the U.S. in the business of manufacturing, exporting or temporarily importing defense articles, or furnishing defense services, to register with the State Department's Directorate of Defense Trade Controls (DDTC). One occasion counts as being in the business, a manufacturer that never exports must still register, and new registrants pay $3,000 a year.

Steps

  1. Check the U.S. Munitions List (USML)USML Category VIII covers aircraft 'whether manned, unmanned, remotely piloted, or optionally piloted,' including unmanned aerial vehicles (UAVs) specially designed to incorporate a defense article, target drones, and armed aircraft. Aircraft specially designed for military use but not listed there are controlled under the Export Administration Regulations (EAR) as Export Control Classification Number (ECCN) 9A610, according to the USML note. DDTC offers an Order of Review Decision Tool and a Specially Designed Decision Tool.22 CFR 121.1, the U.S. Munitions List
  2. If unsure, ask DDTC for a Commodity Jurisdiction determinationSubmit Form DS-4076 electronically. DDTC decides whether the item is on the USML, in consultation with the Departments of Defense (War) and Commerce. DDTC looks at form and fit, function and performance, and the applicant's product history, specifications and brochures.22 CFR 120.12, Commodity jurisdiction requests
  3. Enroll in DECCSDDTC says the first step in registration is to enroll in the Defense Export Control and Compliance System (DECCS).DECCS
  4. File the Statement of Registration (Form DS-2032)A U.S.-person senior officer (for example the CEO, president or general counsel) signs it. Include documents showing the company is incorporated or authorized to do business in the U.S. The officer certifies whether the company, its affiliates or leaders have been charged with or convicted of listed export crimes or are barred from federal contracts or export approvals, and whether the company is foreign owned or controlled, naming the foreign owners. Subsidiaries and affiliates more than 50% owned or controlled may be included.22 CFR 122.2, Registration statement
  5. Pay the registration feeTier 1 is $3,000 per year for new registrants and for renewing registrants with no favorable license decisions in the look-back period. Tier 2 is $4,000 for renewing registrants with five or fewer favorable decisions. Tier 3 is $4,000 plus $1,100 for each favorable decision over five. DDTC's website lists discounts for 501(c)(3) tax-exempt registrants and for some low-value Tier 3 exporters.22 CFR 122.3, Registration fees
  6. Report key changes within five daysSend DDTC a written notice signed by a senior officer within five days if the company name, address, legal structure, ownership or control, defense-trade subsidiaries, board, senior officers or owners change, or if a listed person is charged or barred. Other changes go in the yearly renewal.22 CFR 122.4, Notification of changes
  7. Renew every yearSubmit the renewal at least 30 days but no earlier than 60 days before the expiration date. DDTC sends notice of the next year's fee at least 60 days before expiration. A company that lets registration lapse and later re-registers must pay fees for any lapsed period in which it was still in the business.22 CFR 122.2(d)-(f), Frequency, renewal and lapse

What to have ready

  • Form DS-2032, Statement of Registration, signed by a U.S.-person senior officer
  • Proof the company is incorporated or authorized to do business in the U.S.
  • Senior officer certification on criminal charges, debarment and foreign ownership or control (with names of foreign owners)
  • List of subsidiaries and affiliates to include (more than 50% owned or controlled)
  • Registration fee payment
  • For a Commodity Jurisdiction request: Form DS-4076 with specifications, brochures and design history

Time, cost, renewal and where to send

TimeRenewals must be filed 30 to 60 days before expiration. For a Commodity Jurisdiction request, 22 CFR 120.12 says DDTC gives a preliminary response within 10 working days of a complete request. If DDTC has not given a final answer after 45 days, the applicant may ask in writing for expedited processing. The sources checked do not state processing times for registration.
CostTier 1: $3,000 per year. Tier 2: $4,000. Tier 3: $4,000 plus $1,100 for each favorable decision over five (22 CFR 122.3).
RenewalEvery year.
Where to sendElectronically through DECCS, following the filing instructions on the DDTC website (www.pmddtc.state.gov).

Where to get help

Watch out

  • Registration is not a license. DDTC says registration gives no export rights; licenses and other approvals are separate.
  • Defense articles include technical data, according to DDTC.
  • The rule exempts companies that only fabricate items for experimental or scientific research, and those that only produce unclassified technical data, but they still cannot get an export license unless registered.
  • 22 CFR 122.2 says registrants may not set up new entities to lower registration fees.
  • Foreign ownership or control must be disclosed in the registration and reported within five days if it changes. 22 CFR 122.4(b) also requires notice to DDTC by registered mail at least 60 days before any intended sale or transfer of ownership or control of the registrant to a foreign person.

Official sources

EAR: Commerce Department (BIS) classification and export licenses

Who it is for. Companies that export, reexport or transfer drones, drone parts, software or technology subject to the Export Administration Regulations (EAR), which covers most commercial drones and military drones not on the U.S. Munitions List.

The Commerce Department's Bureau of Industry and Security (BIS) controls exports of items subject to the EAR. The first step is finding the item's Export Control Classification Number (ECCN), which decides whether a license is needed. BIS eased drone export controls in 2026: since August 13, 2026, civil drones with less than 3 hours of endurance that cannot fly 300 km (and do not meet ECCN 9A120) are controlled only for anti-terrorism reasons (ECCN 9A012.a.1), while military end-use and end-user controls still apply.

Steps

  1. Confirm the item is subject to the EARBIS says to confirm the item is subject to the EAR before classifying it. The EAR says BIS classification answers are not decisions about whether an item is subject to the EAR, and that requesters are expected to have already ruled out another agency's exclusive control, such as the ITAR (see the ITAR program in this guide).BIS: Classify your item
  2. Find the ECCNBIS lists three ways: ask the maker for the ECCN; self-classify using the Commerce Control List Order of Review, the Interactive Commerce Control List or the Order of Review Decision Tool; or ask BIS for an official classification. Items subject to the EAR but not described by any ECCN are 'EAR99.' An ECCN is not the same as a Schedule B or Harmonized Tariff code.BIS: Classify your item
  3. Read the 2026 drone changesUnder the BIS final rule effective August 13, 2026: ECCN 9A012.a.1 now covers UAVs with a maximum endurance under 3 hours, controlled for anti-terrorism (AT1) only if they cannot fly 300 km and do not meet ECCN 9A120; 9A012.a.2 covers 3 hours or more (national security NS1 and AT1, plus missile technology MT1 at 300 km or more). Drones with certain thermal imagers (6A003), lasers (6A005) or gyroscope navigation (7A001-7A005) stay under NS1 at any endurance. Earlier, a January 20, 2026 interim rule let commercial UAVs with under 1 hour endurance go to most Wassenaar Arrangement countries (Country Group A:1) without a license, and let certain long-range cargo and crop-spraying drones go to Country Group A:5 under License Exception STA, with notice and reporting.BIS final rule, Streamlining Export Controls for Drone Exports
  4. Register for SNAP-RBIS takes license applications and classification requests through the Simplified Network Application Process Redesign (SNAP-R). Register on the SNAP-R site.SNAP-R
  5. Submit a classification request if neededLimit each request to six items. Attach PDF specifications, brochures or papers with enough technical detail. Give a recommended ECCN in Block 22(a) and explain why. BIS answers classification requests within 14 calendar days and advisory opinions within 30 calendar days.15 CFR 748.3, Classification requests
  6. Apply for a license when the ECCN and destination require oneSubmit license applications through SNAP-R. BIS says EAR99 items may need a license if they go to a prohibited or restricted end user, end use or destination of concern. BIS's August 2026 rule says drones under 3 hours of endurance stay controlled to sanctioned or embargoed countries and for certain prohibited end uses and end users.BIS: Licensing

What to have ready

  • Technical specifications, brochures or papers for each item (PDF)
  • A recommended ECCN with the reasoning (for a classification request)
  • SNAP-R account
  • Details of the buyer, end use and destination (for a license application)

Time, cost, renewal and where to send

TimeBIS answers classification requests within 14 calendar days and advisory opinions within 30 calendar days (15 CFR 750.2).
CostFree. Federal law says no fee may be charged for export license applications or other requests under the EAR (50 U.S.C. 4815(c)).
RenewalA classification does not renew, but ECCNs change when the rules change, as they did twice for drones in 2026. BIS says to check any ECCN against the current Commerce Control List.
Where to sendOnline through SNAP-R (snapr.bis.gov).

Where to get help

  • BIS export counselorsBIS counselors answer EAR questions Monday to Friday, 8 a.m. to 5 p.m. Eastern, at (202) 482-4811 or by web form.
  • BIS: Classify your itemFree tools and training videos on classifying items and filing classification requests in SNAP-R.

Watch out

  • Low-endurance drones are not free of all controls. BIS kept military end-use and end-user controls on them and added ECCNs 9A012, 9D001, 9D002, 9D004 and 9E001 to the list in supplement no. 2 to part 744.
  • Payloads can change the ECCN. Certain thermal cameras, lasers and gyroscope navigation keep national security controls on a drone of any endurance.
  • BIS published an advance notice on January 3, 2025 about possible rules on drone technology from foreign adversaries under its information and communications technology (ICTS) authority. No final rule was found in the Federal Register as of September 25, 2026.
  • Exports and imports are separate. The EAR covers exports; Section 232 tariffs (from September 3, 2026) cover imported drones and parts.

Official sources

Cybersecurity for defense contracts: NIST SP 800-171, SPRS scores and CMMC

Who it is for. Companies that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on Department of War (DoW) contracts or subcontracts, including drone makers whose designs, data or test results are CUI.

DoW contracts that involve CUI include Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which requires the security rules in NIST Special Publication (SP) 800-171 and reporting cyber incidents within 72 hours. The Cybersecurity Maturity Model Certification (CMMC) program began Phase 1 on November 10, 2025. On July 13, 2026, DoW suspended Phase 2 (planned for November 10, 2026), so DoW contracts may now require only CMMC Level 1 (Self) or Level 2 (Self), with results entered in the Supplier Performance Risk System (SPRS).

Steps

  1. Identify which information the contract involvesFCI is information not intended for public release that is provided by or generated for the government under a contract (FAR 4.1901). CUI is information that law, regulation or government-wide policy requires or permits to be safeguarded (32 CFR 2002.4(h)). FCI points to CMMC Level 1; CUI points to Level 2.DoW CIO: About CMMC
  2. Put the required controls in placeCMMC Level 1 is the 15 security requirements in FAR clause 52.204-21. CMMC Level 2 is the 110 requirements in NIST SP 800-171 Revision 2. During the suspension, DoW enforces NIST SP 800-171 Rev 2 as the baseline, even though NIST published Revision 3 in May 2024.DoW CIO: About CMMC
  3. Write a system security plan and plans of actionDescribe how each requirement is met in a system security plan. For Level 2, open gaps can go in a Plan of Action and Milestones (POA&M), which must be closed within 180 days. POA&Ms are not allowed for Level 1.DoW CIO: About CMMC
  4. Score the self-assessment with the DoD methodUnder 32 CFR 170.24, the top Level 2 score equals the number of Level 2 requirements (110). Each requirement NOT MET subtracts its value (1, 3 or 5 points), so a score can be negative. Evidence must be final, not drafts. Level 1 is scored MET or NOT MET as a whole.32 CFR 170.24, CMMC Scoring Methodology
  5. Get SPRS access through PIEESPRS is reached through the Procurement Integrated Enterprise Environment (PIEE). The company must be registered in SAM.gov with an Electronic Business point of contact and a Commercial and Government Entity (CAGE) code, and must name at least one Contractor Account Administrator per CAGE code. Request the 'SPRS Cyber Vendor User' role. Vendors do not need a Public Key Infrastructure (PKI) certificate.SPRS access instructions
  6. Enter results and affirm in SPRSLevel 1 (Self): assess every year and affirm every year. Level 2 (Self): assess every three years and affirm every year; the status lapses if the yearly affirmation is missed. SPRS offers a tutorial on entering and affirming a Level 2 self-assessment.SPRS
  7. Report cyber incidents within 72 hoursDFARS 252.204-7012 requires rapid reporting, defined as within 72 hours of discovery, to DoW at dibnet.dod.mil. Subcontractors give the report number to the prime contractor.DFARS 240.370-3 in class deviation 2026-O0025
  8. Watch for the CMMC reform resultsDoW's Chief Information Officer (CIO) set up a CMMC Reform Task Force with a 60-day review from July 13, 2026. The implementing memo says further guidance will follow the review. As of September 25, 2026, the CMMC page still shows the suspension notice.DoW CIO: CMMC

What to have ready

  • System security plan covering each NIST SP 800-171 Rev 2 requirement (Level 2) or each FAR 52.204-21 requirement (Level 1)
  • Plan of Action and Milestones for any open Level 2 items
  • Self-assessment results and score
  • Yearly affirmation entered in SPRS
  • SAM.gov registration, CAGE code and PIEE account (for SPRS access)
  • Cyber incident reports and report numbers, when an incident happens

Time, cost, renewal and where to send

TimeSelf-assessment time depends on the company. Level 2 POA&Ms must close within 180 days. After a government Medium or High assessment, the contractor has 14 business days to send more information or rebut findings.
CostSelf-assessments are done in-house and entered in SPRS; the SPRS pages checked list no fee. During the suspension, DoW solicitations may not require third-party certification by a CMMC Third-Party Assessment Organization (C3PAO).
RenewalLevel 1: self-assessment and affirmation every year. Level 2 (Self): self-assessment every three years, affirmation every year.
Where to sendEnter scores and affirmations in SPRS through PIEE. Report cyber incidents at dibnet.dod.mil.

Where to get help

  • Project SpectrumA DoW-supported program with no-cost cybersecurity tools, training and guidance for small businesses, according to DoW CIO.
  • DoW CIO 'Brilliant Basics' IT Top 10DoW's list of core security practices for small and mid-sized defense suppliers, with links to free CISA, NSA, DC3 and NIST resources.
  • SPRS tutorialsFree SPRS training, including a CMMC Level 2 Self-Assessment tutorial.

Watch out

  • Phase 2 is suspended, not canceled. On July 13, 2026 DoW suspended the Phase 2 start and waiver procedures. New DoW solicitations may require only Level 1 (Self) or Level 2 (Self); Level 2 (C3PAO), a certification by a CMMC Third-Party Assessment Organization, and Level 3 (DIBCAC), an assessment by DCMA's DIBCAC team, may not be required during the suspension, and existing contracts with those requirements are to be modified.
  • DFARS 252.204-7012 still applies. DoW says the suspension does not remove the duty to protect covered defense information and report incidents.
  • Revision matters. DoW's baseline is NIST SP 800-171 Revision 2, not Revision 3.
  • Government checks still happen. DoW may run Medium or High NIST SP 800-171 assessments under clause 252.240-7997, and DCMA results take precedence over other assessments.
  • The written rule (32 CFR 170.3) still describes Phases 2, 3 and 4 starting one year apart. Future dates depend on the outcome of the CMMC review.

Official sources

Last checked September 25, 2026. Rules, fees and programs change; the official sources are where to confirm them before applying or spending money.

Previous guideSBA certificationsNext guideDocuments to prepare

Back to Where to start

We help you prepare your documents

With a company account, the Company Toolkit drafts your documents from your company file and your numbers; for drone companies and manufacturers, the readiness guide walks you through each registration. Document Check, a paid review, reads your documents before you send them. Your page puts you in front of buyers, lenders, investors and production partners.

Get help with your documentsFinancing programsHow it works

Autonomy Runway is not a law firm, an accounting firm or a financial adviser, and nothing we publish is legal, tax or financial advice. The guides are general information with links to the official sources, and the tools organize your own facts and decisions. For advice about your situation, talk to a lawyer, an accountant or a financial adviser. See all our disclaimers.