"Must be NDAA compliant" now turns up in tenders that have nothing to do with the US military: schools, hospitals, housing associations, anyone spending public money or selling to someone who does. It is a real requirement with a precise origin, and a fuzzy edge that catches installers out. This is a designer's summary, not legal advice; for a contract that depends on it, read the clause the client cites and ask them how they interpret it.

Where the rule comes from

Section 889 of the US National Defense Authorization Act for fiscal year 2019 names "covered telecommunications equipment or services". For video surveillance, that means equipment produced by Hikvision, Dahua and Hytera, and their subsidiaries and affiliates, where it is used for public safety, security of government facilities, physical security of critical infrastructure, or other national security purposes. Huawei and ZTE are covered for telecom equipment generally.

It bites in two stages:

  • Part A, in force since August 2019: US federal agencies may not buy covered equipment, or any system that uses it as a substantial or essential component.
  • Part B, in force since August 2020: agencies may not contract with any company that uses covered equipment, anywhere in its business, whether or not the contract involves cameras.

Grants and loans carry the same restriction, which is how the rule reaches schools and local government far from any federal building.

The FCC went further

In November 2022 the US Federal Communications Commission stopped authorising new equipment from the companies on its Covered List, which includes the same camera makers, for the uses the list names. Equipment already authorised can still be sold and used, but new models from those makers do not get the authorisation needed to be marketed in the US for those purposes. Other countries have taken narrower steps: the UK government, for one, told departments in 2022 to stop installing such cameras on sensitive sites.

The part that catches people: relabelled cameras

A large share of cameras sold under other brand names are made by covered manufacturers and relabelled. The rule follows the manufacturer, not the name on the housing, so a camera from a brand you have never associated with the named companies can still be covered equipment. Suppliers usually know; datasheets rarely say. The questions that settle it:

  • Who manufactures this model, and who makes its firmware?
  • Will you state in writing that it is NDAA Section 889 compliant, and on what basis?
  • Does the same apply to the recorder, the video management software and any network switch you are supplying?

Some specifications also ask about components, most often the system-on-chip that encodes the video. Section 889 as written concerns covered equipment as a substantial or essential component of a system; whether a particular chip counts is argued both ways, and some buyers now ask for chips from covered companies to be excluded as well. If the tender mentions components, ask the client what they mean rather than guessing.

Putting it on the drawing

  • Decide the rule at the start of the job and write it in the drawing's notes, so nobody swaps in a cheaper equivalent at order time.
  • The camera schedule should carry the manufacturer as well as the brand for each line when compliance is in scope.
  • Recorders, encoders and the cameras' power and network equipment belong on the schedule too. A compliant camera recorded by a covered NVR is not a compliant system.
  • Keep the supplier's written statements with the project file. The compliance question comes back at handover and at audit.

The camera database lists hardware from every major maker, including the covered ones, because much of the world buys them without restriction. It does not mark NDAA status today, so when a job is in scope, filter by manufacturer yourself and confirm each model with the supplier.