Section 889 Compliance: The Telecom Ban That Can Get You Removed From a Contract

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 does two distinct things. First, it bans the federal government from buying telecommunications equipment and video surveillance systems from five specific Chinese companies. Second — and this is where most contractors get tripped up — it bans the government from contracting with any company that uses that equipment, anywhere in their own business operations.

The second prohibition is not limited to what you deliver to the government. It covers your internal networks, your office security cameras, your phone system, your building access control — anything in your own environment. If your company runs a Hikvision camera over your server room, and you have a federal contract, you have a Section 889 problem.

The law defines covered equipment as “telecommunications equipment or services that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.” That phrase “substantial or essential component” is important — a single banned component inside a larger system can make the entire system covered.

Section 889 names five companies and extends the prohibition to all their subsidiaries and affiliates. Knowing only the five parent names isn't enough — the OEM web is wide, and many of these companies manufacture products sold under dozens of other brand names.

The OEM alias problem is the biggest compliance trap of 2025 and 2026. Hikvision and Dahua together produce a substantial portion of the world's IP camera hardware. Cameras bearing U.S. or European brand names are frequently manufactured by Hikvision or Dahua at the hardware layer. The Section 889 prohibition extends to “any subsidiary or affiliate of such entities” — which means the brand name on the box doesn't matter. What matters is who made the core hardware.

Section 889 is divided into two sub-prohibitions, each with its own effective date, scope, and practical compliance requirements. Most coverage online conflates them. You need to understand both separately because they trigger different compliance obligations.

Part B is the one that surprises people. Under Part A, the question is whether you're delivering banned equipment to the government. Part B asks whether you're using banned equipment anywhere in your company. A router from Huawei in your IT closet. A Dahua camera over your warehouse loading dock. A ZTE handset issued to an employee. All of these can create a Part B violation — even if your government deliverables are spotless.

The DoD received a waiver from the Director of National Intelligence for Part B when it first took effect in August 2020. That waiver expired on October 1, 2022. Since then, full Part B compliance has been mandatory for all DoD contractors — no exceptions, no grace period.

Three FAR clauses implement Section 889 in contracts. If you have a federal contract issued after August 2019, at least one of these clauses is in it. Understanding what each one requires helps you understand exactly what you're certifying every time you sign a contract or submit a proposal.

One practical note: these clauses flow down to subcontractors. If you're a prime contractor, you must include equivalent provisions in your subcontracts, and your subcontractors must comply too. A subcontractor running banned equipment creates a prime contractor compliance problem. Your supply chain liability doesn't end at your company's walls.

Every time you submit a proposal, you're making a representation in SAM.gov and in the solicitation response: you either use covered telecommunications equipment or you don't. That representation is your legal assertion. If it turns out to be wrong — even because you didn't know — you have a problem. If it turns out to be wrong and you did know, you have a False Claims Act problem.

The FCA is the federal government's primary anti-fraud tool. As of July 2025, civil penalties range from $14,308 to $28,619 per violation, plus three times the government's actual damages. In a contract worth $500,000, three times damages plus per-claim penalties can wipe out years of revenue. The DOJ reported nearly 1,000 qui tam (whistleblower) actions in FY2024 — a 37 percent increase from the prior year. Section 889 false certifications are exactly the kind of case these suits target.

Beyond the FCA, non-compliance triggers two other consequences that matter practically: contract termination for default and suspension or debarment. Termination for default creates a negative CPARS performance record that damages every future proposal. Debarment removes you from the federal market entirely for years. The Section 889 exposure isn't a fine you absorb — it's a business-ending risk if mishandled. More on what happens in practice in Section 9.

The FAR standard for Section 889 compliance is a “reasonable inquiry” — not a full-scale third-party audit. A reasonable inquiry is defined as one “designed to uncover any information in the entity's possession about the identity of the producer or provider of covered telecommunications equipment or services used by the entity.” You don't have to hire an outside auditor. But you do have to do something documented and defensible.

Here's a six-step process that satisfies the reasonable inquiry standard and produces the documentation you'd need if someone ever questioned your certification:

According to supply chain compliance reporting in 2025 and 2026, the most common source of Section 889 non-compliance findings isn't deliberate purchasing of Hikvision or Dahua cameras. It's inherited inventory: cameras installed before 2019, cameras acquired through business acquisitions, and cameras sold under U.S. or European brand names that are manufactured by Hikvision or Dahua as the original equipment manufacturer.

This isn't just a physical security camera problem. It applies across the entire covered product category: networking equipment that ships under a telecom carrier's brand but uses Huawei components internally, two-way radio systems that are Hytera hardware sold through a domestic reseller, and building automation systems with ZTE communication modules embedded inside.

If you find covered equipment in your environment, you have a path forward. You can disclose it to your contracting officer, develop a remediation plan with a realistic timeline, and in some cases obtain a waiver. Proactive disclosure is treated far differently from discovered concealment. The contractor who finds a problem and tells the government immediately is in a very different position than the contractor whose covered equipment is discovered during an audit.

Section 889's covered list has grown. On December 22, 2025, the FCC added all foreign-produced uncrewed aircraft systems (UAS) and UAS critical components to the covered list, acting under Section 1709 of the FY2025 NDAA. The FCC specifically named DJI Technologies (Shenzhen Da-Jiang Innovations) and Autel Robotics as covered entities — along with any subsidiary, affiliate, partner, joint venture participant, or licensee of either company.

The scope goes beyond just those two companies. The listing broadly covers UAS and UAS critical components “produced in” a foreign country — which captures a wide range of drone platforms and components. For government contractors that operate commercial drones for site surveys, mapping, inspections, or delivery — this is a new compliance obligation that wasn't there a year ago.

The practical implication for contractors: if your company uses DJI drones for any commercial purpose, you need to assess whether that use is consistent with your federal contract obligations. Companies that use DJI equipment for facility inspections, infrastructure monitoring, or aerial photography now have a Section 889 question to answer before submitting proposals.

The FCC update also maintains and expands restrictions on video surveillance equipment from the original five companies. Late 2025 and early 2026 saw significant enforcement action — major retailers facing delistings, availability changes, and intensified agency scrutiny of physical security infrastructure. The December 2026 facility audit deadline for contractors is directly tied to this escalating enforcement environment.

Non-compliance paths have four distinct consequences, and they can stack. Understanding each one helps you calibrate the actual risk and prioritize your remediation efforts.

The good news: there is a waiver process. The heads of federal agencies can grant waivers in limited circumstances — where a contractor can demonstrate a compelling reason for needing additional time, provide a “laydown” (inventory) of covered equipment in their supply chain, and submit a credible phase-out plan. However, the agency-head waiver authority expired in August 2022. The only remaining waiver authority sits with the Director of National Intelligence (DNI), which is a high bar and a slow process. Waivers are emergency tools, not compliance strategies.

If you haven't done a formal Section 889 review, here's the sequence of steps to get compliant before your next federal proposal. These are prioritized by the most common failure modes — address them in order.

The December 2026 facility audit deadline for video surveillance equipment means the clock is running. That deadline isn't the time to start your compliance review — it's the time to finish it. If you find covered cameras and need to replace them, physical security system replacements take weeks to procure and install. Starting now gives you time to replace without rushing.

Section 889 sits alongside CMMC 2.0 as one of the two major compliance requirements that DoD contractors must address before the end of 2026. The companies that get ahead of both will be better positioned for award — and the ones that get caught flat-footed will have more to explain to contracting officers than they want to.

Your proposal is only as strong as your compliance posture. A strong technical volume and competitive price mean nothing if your Section 889 representation is false. Build the compliance work into your pre-proposal checklist — alongside your bid checklist — so it's never an afterthought.