Agency Drone Procurement in 2026: Security Rules, Funding, and RFPs

The single fact most agency buyers get wrong, in both directions: Covered List status does not ground the drones you already own. Aircraft bought before the listings remain legal to operate. What the listing does is block new equipment authorizations, closing the US market to new DJI and Autel models, and reach software updates — waived for pre-listing equipment only through 1 January 2029. That last date is the one to put in your capital plan.

That is the radio-and-equipment side. The money side is separate and stricter. Since 22 December 2025, under the American Security Drone Act of 2023, federal funds may not be used to procure or operate a covered unmanned aircraft system. Since 13 March 2026, FAR 52.240-1 puts the representation into federal contracts. And OMB M-26-02, issued 21 November 2025, pushes security requirements down to non-federal grant recipients through notices of funding opportunity and your own solicitations.

This guide is for the person who writes the specification, defends the sole-source memo, and answers the grant monitor. Status is as of 29 August 2026, and where something is in litigation it says so.

What Covered List status does and does not do to drones you already own

Three separate legal regimes get collapsed into "the drone ban." Sort them before you write anything.

• The FCC Covered List — an equipment-authorization matter under the Secure and Trusted Communications Networks Act. It governs whether a device may be authorized for sale in the US. It does not confiscate, deregister, or ground existing aircraft.
• The American Security Drone Act — a procurement matter. It governs whether federal money may buy or operate covered UAS, and whether federal agencies may operate them at all.
• State statutes — whether your agency may buy or fly a given aircraft, on any funding source.

An agency can be legal to fly its fleet under FCC rules, barred from using FEMA dollars to maintain it, and on a state phase-out clock that ends before the software cliff.

The trap. "Our drones are still legal" and "we can spend grant money on our drones" are different questions with different answers. Do not let a vendor answer the second by citing the first.

The American Security Drone Act of 2023: covered foreign entities and the December 2025 deadline

The ASDA was enacted as part of the FY2024 National Defense Authorization Act, Public Law 118-31, signed 22 December 2023.

A "covered foreign entity" is broader than a named-company list. It includes entities on a Federal Acquisition Security Council (FASC) list published in SAM.gov; entities subject to extrajudicial direction from a foreign government; entities determined to pose a national security risk; any entity domiciled in the People's Republic of China or subject to PRC influence or control; and the subsidiaries and affiliates of any of those. The affiliate reach catches buyers who assumed a US-branded reseller solved the problem.

Two operative dates follow enactment:

• 22 December 2025 — the prohibition on operating covered UAS and on using federal funds to procure or operate them took effect. Two full years of notice, worth remembering when a grant monitor asks why a purchase order dated January 2026 exists.
• 13 March 2026 — FAR 52.240-1 became effective under FAC 2026-01, together with FAR Subpart 40.2. Contractors must search SAM.gov for the FASC list before proposing or using any UAS on a covered contract.

Run that search yourself before you commit federal dollars and save the dated result. It is the compliance artifact. A vendor letter is evidence of what the vendor said, not of what the list said.

OMB M-26-02: the memo grant-funded agencies actually need to read

OMB Memorandum M-26-02, Ensuring Government Use of Secure Unmanned Aircraft Systems and Supporting United States Producers, issued 21 November 2025, does three things a city or county program manager must act on.

It confirms the 22 December 2025 date for the grant-funds prohibition, removing the ambiguity some agencies were relying on.

It imposes security requirements regardless of country of manufacture — which surprises agencies that assumed buying American ended the analysis. Federal agencies must complete FIPS 199 impact assessments, apply security requirements across all acquisition phases, and require multi-factor authentication, encryption at rest, and firmware update controls. A US-assembled aircraft with no MFA on its fleet-management console does not satisfy this.

It flows obligations down to non-federal grant recipients. Expect security requirements written into the NOFO, a demonstrated risk-based approach in your application, security specifications in your own vendor solicitations, and compliance with security award terms. The third item is what changes your RFP.

Exemptions require documented findings. The statutory ones cover DHS, DoD, State, DOJ, DOT/FAA, and NOAA for specified purposes; case-by-case waivers require OMB Director approval and congressional notification, which is not a path a county sheriff's office should plan around.

The unresolved gap. M-26-02 contains no explicit guidance on existing deployed fleets. Agencies flying covered aircraft bought years ago on federal grant funds are reading a memo that does not address them. The answer is not settled; the honest posture is to document your reasoning and budget for replacement.

The downstream effect that catches agencies off guard

The restriction travels with the money into places nobody expected. State departments of transportation — Missouri, Kentucky, and Michigan among them — instructed grantees to halt procurements and to cease operation, maintenance, or data processing of covered UAS on any FHWA-funded project or grant.

Read that scope carefully. It is not just "stop buying" — it reaches maintenance and data processing. A unit that owns a covered aircraft outright, bought with local funds, can still be told it may not process that aircraft's imagery on federally funded work. Segregate mixed-funding missions explicitly.

The FCC Covered List: what happened on 22 December 2025, and what is still in court

The trade-press version is right about the outcome and wrong about the mechanism, which matters because the mechanism is what the Ninth Circuit is reviewing.

Section 1709 of the FY2025 NDAA required a national security agency to determine within one year whether DJI's and Autel's equipment posed an unacceptable risk, with automatic addition to the FCC Covered List if no determination was made. Through late 2025 no agency had begun the audit.

What happened on 22 December 2025 was broader than § 1709 required. The FCC's Public Safety and Homeland Security Bureau, relying on an interagency National Security Determination issued 21 December, added essentially all foreign-produced UAS and foreign-produced "UAS Critical Components" to the Covered List (FCC DA-25-1086A1). Two authorities ran in parallel: § 1709 for DJI and Autel specifically, and the Secure and Trusted Communications Networks Act for the broader categorical listing. DJI and Autel remain covered even if they relocate production to the United States or enter domestic joint ventures.

Autel has two applications for review pending before the full Commission. Nothing here is final. Reported figures put 25 DJI models slated for 2026 among those affected.

Datestamp everything. Any sentence you write about DJI or Autel status needs a date attached. A procurement memo that says "DJI is banned" without one will be wrong within a year in one direction or the other, and a hearing officer will notice.

Blue UAS is a DoD designation, not a compliance certification for you

This is the most common substantive error in agency procurement documents, and vendors have little incentive to correct it.

Blue UAS lists commercial drones assessed for security and performance and compliant with § 848 of the FY2020 NDAA, cleared for Department of Defense purchase without an Exception to Policy. Custody of the Cleared List moved from DIU to the Defense Contract Management Agency's Unmanned Systems–Experimental Command (US-X) in Palmdale, California on 3 December 2025; DIU remains a partner on standards. As of 19 November 2025 it held 39 certified systems and 165 components.

Two structures inside it get conflated. The Cleared List covers complete, vetted platforms; the Blue UAS Framework is a parallel registry of components and software. Building an aircraft out of Framework components does not automatically clear the finished aircraft, and certifications apply only to the specific models and configurations listed — not to a successor sharing a product-family name.

State and local agencies are not bound by Blue UAS and it is not a legal compliance certification for them. For federal-funds compliance the legally operative list is the FASC list in SAM.gov. Blue is useful as a vendor-vetting shortcut, as the literal source text of some state approved-manufacturer lists, and as a rough proxy for ASDA compliance. Treat it as evidence, not the standard: write the specification against the FASC list and your state's list, and cite Blue as supporting.

State drone procurement restrictions, and the Texas claim that is wrong

Two corrections, because both circulate widely.

Texas HB 41 (2025) died in the legislature. It is not law. Vendor decks and consultant briefings still list Texas among the states with a statutory ban. Texas does have a non-statutory Department of Information Resources suspension of DJI purchases dating to 2021 — an administrative action with a different scope and amendment path. If your justification memo cites HB 41, it cites nothing.

Do not rely on a state approved list without checking its currency. Florida is the instructive case: DMS published the original list in late December 2021 with five manufacturers — Skydio, Parrot, Altavian, Teal Drones, and Vantage Robotics — a direct copy of federal Blue UAS 1.0, already carrying a stale company name because Altavian had been acquired more than a year earlier. Pull the list from the state's own site on the day you publish the solicitation, and put the retrieval date in the document.

Grant funding, replacement money, and purchasing vehicles

The programs that most often fund public-safety and infrastructure drone work all carry the ASDA restriction: FEMA's Homeland Security Grant Program, FHWA funds, and DOJ/BJA Justice Assistance Grants. FEMA also runs a separate Counter-UAS Grant Program — a different stream for a different mission, not airframe money.

Florida's FDLE Drone Replacement Program (CSFA 71.092) is the model other states are likely to copy. It reimburses up to $25,000 per compliant drone, including operationally necessary accessories, retroactive to compliant drones purchased after 1 January 2022, measured against Rule 60GG-2.0075. If your state is considering a phase-out, point legislators at it: a mandate without replacement money is how agencies end up grounded.

Sourcewell (for example contract 011223-ADX) is the dominant cooperative purchasing vehicle in public-safety UAS. Members buy from awarded vendors without running their own solicitation, and the value is not only speed — a cooperative award creates a defensible paper trail showing a competitive process occurred, which is what a grant monitor asks for when a large single-vendor purchase appears with no local RFP behind it. Other vehicles include the GSA Schedule, NASPO ValuePoint, HGACBuy, BuyBoard, and state master contracts; verify the vehicle holds a current UAS award before citing it.

Sole source, in order of defensibility

1. A state approved-manufacturer list narrows the field. If your state permits three manufacturers and only one makes a docked aircraft, the record largely writes itself.
2. Genuine integration lock-in with an incumbent stack. The BRINC–Motorola integrations (APX radios, VESTA 911, CAD) and the Flock DFR/ALPR integration are real technical dependencies, not marketing. If you already run the radio or camera network, that is a legitimate finding.
3. Fleet standardization and training continuity. Weakest on its own, but it supports the others.

California caution. Under AB 481 the governing body must approve the ordinance before the agency solicits proposals, and Cal. Gov. Code § 7071(d) requires an affirmative finding that the equipment is cost-effective compared with alternatives. A sole-source posture makes that finding harder to support, not easier. Sequence the ordinance first — see the AB 481 transparency guide for the process and the annual reporting that follows.

What to put in a drone RFP in 2026

Write these as requirements with a mandatory response, not evaluation preferences. A preference gets negotiated away; a requirement gets answered in writing and lands in the contract file.

• Covered-UAS representation. A signed representation that neither the offeror, the aircraft, nor any component supplier is a covered foreign entity under the ASDA — with your own dated SAM.gov FASC list search attached, not just the vendor's assertion.
• Component provenance. Manufacturer and country of origin for flight controller, radios, cameras and gimbals, GPS/GNSS module, and battery cells. Naming the airframe assembler is not provenance.
• M-26-02 security capabilities. FIPS 199 impact level supported, MFA on all consoles and APIs, encryption at rest for imagery and telemetry, and documented firmware update controls — how updates are authenticated, and whether they can be deferred or applied offline.
• CAD/911 integration. Named integration with your specific CAD vendor and version, API documentation, and — in writing — whether it is generally available or a custom development item.
• Dock specifications. Operating temperature range, wind and precipitation limits, ingress protection rating, power draw, network requirements, and battery-swap versus charging cycle time. That tradeoff drives sortie rate more than airframe endurance does.
• Detect-and-avoid matched to your waiver tier. For the 400 ft DAA variant of the Part 91.113 waiver, require a system FCC-approved for aviation use, ASTM and/or RTCA compliant, detecting both cooperative and non-cooperative aircraft. Active radar may require an FCC Station License under 47 CFR Part 87 — ask who holds it.
• Audit logging and role-based access control. Immutable logs of who viewed, exported, or deleted footage, with restricted administrative access.
• Configurable retention. Set retention by category and change it without a vendor ticket. Practice ranges widely — Montgomery County about 180 days for non-evidentiary footage, NYC 30, Chula Vista 90 unless flagged as evidence — and your policy, not the vendor default, has to control.
• Data export. Flight logs, imagery, and metadata in open formats on demand and at contract termination, with the cost stated.

Total cost of ownership over a five-year program

The airframe is rarely the largest number, and a bid scored on unit price picks the wrong vendor. Budget these explicitly:

• Launch-site build-out — rooftop rights, power, network, environmental hardening. A construction line, not an equipment line, and the one most often missing from a first-year budget.
• Dock hardware, plus the charging-versus-battery-swap decision, which sets how many calls you can take.
• Remote operations center staffing — the largest recurring line by a wide margin. See the DFR program guide for staffing models.
• Software subscription, increasingly the primary vendor revenue model rather than hardware margin. Model it as a permanent operating cost with escalation.
• FAA waiver maintenance on a 48-month cycle, plus any supplemental ATO COA the waiver does not cover.
• Training and currency, and the documentation to prove them.
• Evidence storage, which grows with flight hours and never shrinks on its own.
• Replacement-cycle risk. Two clocks are running: the 1 January 2029 software-update cliff for pre-listing equipment, and state phase-outs that arrive earlier — Arkansas 1 May 2027, Connecticut 1 October 2028. An aircraft bought in Arkansas in 2026 has less than a full depreciation cycle of legal life.

Frequently asked questions

Are DJI drones banned for police departments in 2026?

Not uniformly, and "banned" is the wrong word. As of 29 August 2026, Covered List status blocks new DJI equipment authorizations, so new models cannot enter the US market, but aircraft already owned remain legal to operate under federal law, and software updates for pre-listing equipment are waived through 1 January 2029. Separately, federal funds may not be used to procure or operate covered UAS, and several states prohibit agency use outright. Check your state statute and your funding source, not just the FCC list.

What does "NDAA compliant" actually mean for a police drone?

It usually means a vendor is claiming its aircraft is not produced by a covered foreign entity under the American Security Drone Act of 2023, enacted in P.L. 118-31. The phrase has no single legal definition and no certifying body for state and local buyers. The operative check is the Federal Acquisition Security Council list in SAM.gov, which contractors must search under FAR 52.240-1 as of 13 March 2026. Run that search yourself and keep the dated result.

Does the Blue UAS list make a drone legal for my agency to buy?

No. Blue UAS is a Department of Defense procurement designation under § 848 of the FY2020 NDAA, cleared for DoD purchase without an Exception to Policy. State and local agencies are not bound by it, and it is not a compliance certification for them. Custody of the Cleared List moved from DIU to DCMA's US-X on 3 December 2025. For federal-funds compliance the legally operative list is the FASC list in SAM.gov.

Can we still use FEMA or JAG grant money for drones we already own?

Since 22 December 2025 federal funds may not be used to procure or operate covered unmanned aircraft systems, and FEMA's Homeland Security Grant Program, FHWA funds, and DOJ/BJA JAG all carry the restriction. OMB M-26-02 contains no explicit guidance on existing deployed fleets, a genuine unresolved gap. Ask your grant program officer in writing, document the answer, and budget for replacement rather than assuming the fleet is grandfathered.

Did Texas ban Chinese-made drones for government agencies?

No. Texas HB 41 (2025) died in the legislature and is not law, despite appearing on many vendor and consultant lists of state restrictions. Texas does have a Department of Information Resources suspension of DJI purchases dating to 2021, but that is an administrative action rather than a statute, with a different scope and amendment path. Do not cite HB 41 in a procurement justification.

What is the 1 January 2029 date I keep hearing about?

It is the expiration of the FCC's extended software-update waiver for equipment authorized before the Covered List additions, granted in May 2026 under order DA-26-454A1. Until then, pre-listing aircraft continue to receive software updates. After that date continued support is genuinely uncertain, and it is the outer boundary for planning the useful life of covered aircraft already in your fleet.

Where this leaves you

Do four things before you publish a solicitation. Pull the FASC list from SAM.gov and save the dated result. Pull your state's approved-manufacturer list from the state's own site the same day, because the version in circulation is probably stale. Confirm in writing with your grant program officer which restrictions ride on the award you are spending. And in California, get the AB 481 ordinance approved before you solicit, not after.

Then build the specification around requirements rather than preferences, price the program rather than the airframe, and put both replacement clocks — the 1 January 2029 software cliff and any state phase-out that applies to you — into the capital plan now. The compliance record you will be asked for later is largely whatever you saved on the day you decided, which means flight records, currency tracking, and incident documentation need a system of record from the first flight, not a folder assembled under audit.

This area is moving: the Ninth Circuit case is unbriefed, Autel's applications are pending, the categorical exemption expires 1 January 2027, and state legislatures are still filing bills. Re-verify every date here before relying on it.