NDAA-compliant alternative stack: Federal procurement and the Chinese surveillance restrictions.

The federal procurement frame.

Federal contractors and federally-funded institutions operate under a distinct compliance regime around video surveillance equipment that does not apply to general commercial buyers. The Atlas treats ALPR vendors as a market; this document treats them as procurement subjects under the federal restrictions on Chinese surveillance equipment.

The audience for this document is narrower than the rest of the series. Three groups carry direct compliance obligations:

Federal contractors. Any entity that contracts with a federal executive agency is subject to Section 889 of the FY2019 NDAA, which prohibits not only procurement of covered equipment but also use of covered equipment anywhere in the contractor's operations, regardless of federal-contract connection.

DoD primes and subs. Defense contractors face an additional layer through Section 1260H of the FY2021 NDAA, which establishes the DoD Chinese Military Companies (CMC) List. The compliance deadline activates June 30, 2026 and restricts DoD contracting with listed entities, their affiliates, and contractors who engage lobbyists for CMCs.

Federally-funded research institutions and grant recipients. Federal funding terms typically flow down Section 889 requirements. Universities, hospitals, and research consortia receiving federal grant dollars are subject to the same prohibitions on covered equipment use that bind direct contractors.

The fourth audience, indirectly affected, is the broader commercial market. The FCC's Secure Equipment Act enforcement and the state-level mirror laws (Florida, Texas, others) increasingly extend Chinese surveillance restrictions beyond the strict federal frame.

Section 889 in detail.

Section 889 is the central operational rule. Most ObscureIQ clients with federal contracting obligations encounter Section 889 first and most directly.

Part A: Federal Agency Procurement

Section 889(a)(1)(A) prohibits federal executive agencies from procuring, obtaining, or extending or renewing a contract to procure covered telecommunications equipment or services as a substantial or essential component of any system. Effective August 13, 2019. The rule operates through Federal Acquisition Regulation clauses 52.204-23 (representation) and 52.204-25 (prohibition).

Part B: Federal Contractor Use Anywhere

Section 889(a)(1)(B) is the operationally significant rule. It prohibits federal agencies from entering into, extending, or renewing a contract with any entity that uses covered equipment or services as a substantial or essential component of any system, anywhere in the entity's operations. Effective August 13, 2020. Operationalized through FAR clause 52.204-24 (representation).

The practical effect: a federal contractor with Hikvision or Dahua cameras anywhere in its operations — including private corporate facilities unrelated to federal contract work — is in violation. The "use anywhere" rule is what surprises institutional buyers most consistently. Discovery during the contracting representation process or during downstream audit can result in contract disqualification.

The Five Covered Entities

The two video surveillance entities, Hikvision and Dahua, are the most relevant for ALPR procurement. Together they account for a substantial share of the global low-cost commercial ALPR-capable camera market. They are both on Section 889, Section 1260H, the FCC Covered List, and (since 2024) the BIS Entity List under varying restrictions.

The OEM problem.

The single most common source of inadvertent Section 889 non-compliance is the OEM problem: equipment branded under non-Chinese names that contains Hikvision, Dahua, or Raysharp components or is manufactured at Hikvision or Dahua factories.

The DC Circuit's partial remand in Hikvision USA, Inc. v. FCC (April 2, 2024) vacated the FCC's broad "critical infrastructure" definition but upheld the Covered List placement itself. The result has been that FCC enforcement intensified in late 2025, with major US retailers removing millions of listings for non-compliant equipment after FCC pressure in October 2025. The supply chain availability picture shifted significantly between late 2025 and early 2026; new procurement of OEM-laundered Hikvision and Dahua equipment is substantially more difficult to source through legitimate distribution channels heading into mid-2026.

The audit trail risk is the durable problem. Even if installation predates the Section 889 effective date, the "use anywhere" rule under Part B applies to current state, not historical procurement. A federal contractor with covered equipment installed in 2017 is still in violation as of any current contract representation.

Compliance timeline.

The federal restriction architecture has accumulated incrementally since 2018. The compliance timeline is worth memorializing because the question "what was effective when" matters for audit periods and historical-procurement assessments.

Documented compliance failures.

The pattern across documented compliance failures: institutional buyers procured "American" branded equipment without verifying OEM lineage, leading to disqualifications, grant losses, and forced replacements at significant cost.

The structural lesson: Section 889 compliance is not a procurement-time decision; it is a continuing operational obligation. Equipment installed before the effective date is not grandfathered. The compliance clock runs to current state, not to acquisition state.

What this means.

For federal contractor CISOs and compliance officers. Section 889 compliance is an audit-everything obligation, not a procurement-only obligation. The "use anywhere" rule requires inventory across all corporate facilities, including those entirely unrelated to federal contract work. The OEM problem makes brand-name procurement insufficient; component-level due diligence is the only reliable verification path. Vendors that publish NDAA-compliance attestations covering both the platform and the underlying hardware are operationally preferable to vendors that disclaim hardware responsibility.

For DoD primes and subs. Section 1260H compliance preparation should be in progress now, ahead of the June 30, 2026 deadline. The CMC list expansion has been incremental; entities not currently listed may be added before the deadline. The Section 851 lobbyist-engagement prohibition (FY2025 NDAA) adds an indirect compliance vector that contractors with multiple federal lines of business should map carefully.

For federally-funded research institutions. Grant flow-down typically extends Section 889 to all institutional facilities receiving the federally-funded work, and sometimes to the entire institution. Universities and research consortia with federal funding should treat ALPR procurement as part of broader Chinese surveillance equipment compliance, parallel to the work many institutions have already done on Hikvision and Dahua cameras in security operations.

For institutional ALPR buyers without federal exposure. The federal frame does not directly bind general commercial buyers, but the FCC market-access restrictions are increasingly difficult to work around for new equipment procurement. Major retailers' late-2025 delistings have substantially reduced the available supply of OEM-laundered Chinese surveillance equipment. The practical effect is that commercial buyers entering the market in 2026 face many of the same procurement constraints as federal contractors, even without the direct regulatory obligation.

The implications carry to Document 08 (Defensive Doctrine), which addresses the full set of defensive moves available to institutions and individuals operating in the surveillance ecosystem documented across this series. NDAA compliance is one of several procurement-discipline workstreams that the doctrine document integrates into a unified operational framework.