The phrase turns up on spec sheets and in tender documents, usually without explanation: NDAA compliant. It is worth understanding what it actually refers to, because the honest answer for a Canadian business is more nuanced than either “you must have it” or “it does not apply here”.
What the rule actually says
NDAA is the National Defense Authorization Act, an annual piece of United States legislation. The part everyone means is Section 889 of the 2019 Act. It does two things. First it stopped US federal agencies buying certain telecommunications and video surveillance equipment. Then, a year later, it stopped those agencies contracting with organizations that use that equipment, whether or not the equipment has anything to do with the government work.
The restriction is written against named manufacturers rather than against a technical standard. The video surveillance names in it are Hangzhou Hikvision and Dahua, alongside telecommunications names including Huawei, ZTE and Hytera, and it extends to their subsidiaries and affiliates.
So “NDAA compliant” is not a certification anybody issues. It is shorthand for equipment that does not come from those manufacturers or their affiliates.
Why it reaches a Canadian business
Section 889 is US law, and it does not place a legal obligation on a private business operating in Canada. That is the accurate starting point. It still reaches buildings here through four ordinary routes.
Your customers inherit it
If any part of your organization sells to US federal agencies, or works as a subcontractor to somebody who does, the second half of the rule is the one that matters: it looks at what you use, not just what you supply. That question arrives as a procurement form long before anybody inspects a camera.
Large enterprises adopted it as policy
Plenty of organizations with no federal exposure copied the restriction into their own standards because it is a simple line to draw. Landlords, franchisors and national accounts increasingly ask the question, and the answer needs to be in writing.
Rebadging makes ownership unclear
This is the practical trap. A restricted manufacturer may build hardware that is sold under a different brand entirely, and the brand on the housing tells you very little about who made the board inside. Buildings regularly discover that equipment bought in good faith from a reputable local supplier traces back to a restricted manufacturer.
It affects what the system is worth later
Equipment that fails a procurement question is difficult to extend and awkward to hand over when a building changes tenant or owner. The cost of that shows up years after the install, which is exactly when nobody has budget for it.
How to actually check
Ask the supplier for a written statement that the equipment is not produced by, and does not incorporate components from, the manufacturers named in Section 889. A serious manufacturer publishes this and will not hesitate.
Ask who makes it, not whose name is on it. The useful question is which company manufactures the camera and the recorder, and whether any part of the video path is OEM from another maker.
Get it in the quote rather than the conversation. If compliance matters to your organization, it belongs in the specification you are signing, so it survives a change of salesperson.
Check what is already installed before you assume. Existing equipment is where the surprises live, and it is easier to find out during a planned upgrade than during a client audit.
The honest answer
If your business has no US federal exposure and no client asking the question, Section 889 is not a legal requirement and nobody should tell you it is. What it has become is a procurement filter that costs very little to satisfy at the design stage and a great deal to retrofit.
Our position is straightforward: we specify equipment that answers the question cleanly, because the difference in price is small and the difference in flexibility later is not. If you have a reason to prefer otherwise, that is a decision to make deliberately, with the tradeoff written down, rather than discovering it when a form arrives.
Common questions
Is NDAA compliance a certification?
No. There is no certificate and no auditing body. It is a statement about who manufactured the equipment, which is why a written declaration from the manufacturer is what people ask for.
Does this apply to access control and intercoms too?
The statute names telecommunications and video surveillance equipment. In practice the same manufacturers appear across access control, intercoms and networking, so the question is worth asking about the whole system rather than the cameras alone.
We already have restricted cameras. What now?
Nothing breaks. If no client is asking, it becomes a planning matter for the next refresh. If a client is asking, the practical route is usually a staged replacement starting with the cameras that are visible in the procurement scope.
Is compliant equipment more expensive?
At the budget end there is a difference, because some of the lowest cost hardware on the market comes from the restricted manufacturers. At the specification level most buildings work at, the choice is wide and the price difference is not the deciding factor.
If you are unsure what is already in your building, that is a reasonable thing to want checked before somebody else asks. Tell us about the building and we will go through what is installed and what it would take to answer the question cleanly.
