Section 889 restricts federal agencies and federal contractors from buying or using covered Hikvision and Dahua equipment. The FCC Covered List separately restricts new equipment authorizations and marketing. Neither rule automatically makes an existing privately owned system illegal, but the requirements depend on the contract, the site and the buyer.
Hikvision and Dahua are still common in existing Colorado camera systems, and owners are often told the equipment is simply "banned." That shorthand hides the part that matters: which rule applies, who is buying, and what the site is required to do.
This update separates the federal procurement rule from the FCC equipment rule and explains what a private owner, a federal contractor and a public agency should check before replacing or extending a system.
What Section 889 actually prohibits
FAR Subpart 4.21 implements Section 889 of the 2019 National Defense Authorization Act. It prohibits federal agencies from procuring or obtaining covered telecommunications and video surveillance equipment, and from extending or renewing a contract that uses it as a substantial or essential component of a system.
The rule also restricts federal contractors from providing systems that use covered equipment in performance of federal work. The named video surveillance producers include Hikvision and Dahua, along with their subsidiaries and affiliates. The restriction is tied to federal procurement and covered contracts, not to every private sale in the state.
What the FCC Covered List changes
The FCC Covered List is a separate supply-chain mechanism. It prevents equipment from covered entities from receiving new FCC equipment authorization and restricts the marketing of unauthorized equipment. The FCC has been tightening the surrounding rules, including a 2026 final rule that closes a component-part loophole and adds marketplace disclosure requirements for FCC IDs.
That matters when a project specifies new equipment. An existing camera that was lawfully purchased and installed is not automatically made illegal by the Covered List, but new models, replacements and some modifications may not be authorizable or marketable.
What it means for a Colorado property
A private business without a federal contract may still choose to keep an existing system running. A federal agency, a federal contractor or a site funded by a federal program has a much narrower set of acceptable equipment. State and local procurement rules, critical-infrastructure requirements and insurer conditions can also be stricter than the federal minimum.
The practical first step is to read the contract or funding condition and ask the compliance or procurement contact which rule applies. "NDAA compliant" is not a universal product label; it is a conclusion about a specific use, supplier and supply chain.
What to do about an existing system
Existing Hikvision and Dahua systems can often be serviced while a replacement is planned. We check firmware, network exposure, recording health and the parts supply before recommending a path. Where a contract requires removal, the replacement is scoped by camera role, recorder compatibility, retention and access-control integration rather than by brand alone.
A staged migration is usually less disruptive than a same-week rip-and-replace: replace the recorder and highest-risk views first, keep the remaining cameras on a segmented network, then retire the rest as budget and downtime allow.
How to choose a compliant alternative
The alternative has to be judged against the actual requirement: federal procurement, critical infrastructure, a private commercial site or a multifamily property. Axis, Hanwha Vision, Avigilon, Bosch, Pelco, i-PRO and VIVOTEK are common commercial alternatives, but the manufacturer documentation and the specific model still have to be checked for the project.
Ask for the manufacturer compliance statement, the FCC ID where applicable, the country-of-origin and supply-chain information, and a written statement of what the product does and does not support. A sales page that says "NDAA compliant" is not a substitute for those documents.
Brands mentioned
Sources
This article is general information, not legal advice. Procurement and compliance obligations depend on the specific contract and jurisdiction. Verify the current FCC Covered List and FAR requirements before purchasing or removing equipment.
Frequently asked questions
Are Hikvision and Dahua cameras illegal to own in Colorado?
No federal rule makes private ownership itself a crime. The restrictions apply to federal procurement and covered contracts, and the FCC rules restrict new authorizations and marketing. State, local and contract-specific requirements can be different, so the applicable rule has to be checked for the site.
Do I have to remove an existing Hikvision system immediately?
Not automatically. A private owner can often keep an existing system while planning a replacement. A federal agency or contractor may have a contractual obligation to remove or avoid covered equipment. The contract and the compliance contact decide the deadline.
Does "NDAA compliant" mean the product is approved for every project?
No. Compliance depends on the buyer, the contract, the funding source and the specific model and supply chain. Ask for manufacturer documentation and verify the requirement with the procurement or compliance contact before relying on a label.
Last reviewed: