Your Vendor Cannot Run It for You

A chief who has been quoted a managed counter-drone service — sensors, software, and a vendor team who monitors and responds — should read one paragraph of the interim final rule before signing anything.

The prohibition

The Act defines who may exercise the authority narrowly on the state and local side. The rule explains why that matters:

"…the SLTT agency, 6 U.S.C. 124n(l)(6)(B), in contrast to the broader personnel definition applicable to Federal operations under 6 U.S.C. 124n(l)(6)(A), which extends to certain contractors, detailed personnel, and deputized personnel. The prohibition on contractor operation of mitigation systems, including arrangements described as turnkey or managed C-UAS services, follows from that statutory structure." [REG-VERBATIM, 91 FR 41466]

Congress wrote two different personnel definitions. The federal one reaches contractors. The state and local one does not. A managed service that puts a vendor's people on the trigger is not a gap in the rule — it is the thing the structure was built to exclude.

That is the preamble. The codified rule is more specific, and it names three prohibited acts rather than one:

"Contractors may provide technical support, system maintenance, and training assistance, but may not operate C-UAS mitigation systems, make credible threat determinations, or execute mitigation actions. An arrangement in which a contractor exercises de facto operational control of a C-UAS mitigation system during an operation, including an arrangement described as a turnkey, managed service, or operator-provided C-UAS service, constitutes an unauthorized delegation of authority and is grounds for suspension of accreditation or certification under § 124.5(i)." [REG-VERBATIM, 6 CFR § 124.4(b); emphasis added]

Read the middle prohibition twice, because it is the one that does not look like a prohibition when you are reading a proposal. A contractor may not make the credible threat determination. That is not a hand on a trigger — that is a judgement, and in a modern system it is very often a piece of software that scores a track and tells an operator this one is hostile. If the vendor's product makes that call and your officer acts on it, ask hard where the determination was actually made.

Note also what rides on this: it is "grounds for suspension of accreditation or certification." The exposure is not the vendor's. It is your agency's authority.

CONFIDENCE: HIGH. Preamble and codified text agree and the codified text names the commercial arrangement explicitly — turnkey, managed service, operator-provided.

What vendors may still do — which is nearly everything else

The same passage continues, and this half deserves as much attention as the first:

"The rule preserves substantial roles for the private sector: contractors and vendors may design, manufacture, sell, install, and maintain C-UAS systems; provide technical support and system-level operator training; receive operational data for diagnostics under the conditions of Sec. 124.14(j); and provide detection services using systems that do not require the authority of the Act or the relief it provides from certain laws." [REG-VERBATIM]

Five commercial roles preserved explicitly, plus training, plus diagnostics, plus an entire category of detection services that sit outside the Act's authority altogether. The rule is not hostile to the private sector. It draws one line: an SLTT agency's own officers and employees operate the systems that need this authority.

Note the third clause carefully, because it cuts both ways for anyone selling into this market. Vendors may provide "system-level operator training." That is permitted. It is also not certification — the rule says elsewhere, in terms, that detection and warning certification "obtained from another agency or a private entity does not satisfy this requirement" [REG-VERBATIM]. Vendor training on a box is legitimate and useful. It is a different thing from the federal certification that unlocks authority, and a procurement that conflates them buys a gap.

The same is true of what we do. DELALLi teaches this framework. It does not certify anyone, and it does not operate anything.

The provision that solves the small-agency problem

The paragraph ends with the part that matters most to departments with nine sworn officers:

"Section 124.4 also permits accredited SLTT agencies to provide C-UAS support to non-accredited SLTT agencies through mutual aid or other written arrangement. This approach reflects the Departments' judgment that public safety is better served by strong regional, county, statewide, and multi-jurisdictional C-UAS programs than by requiring every small or resource-limited agency to establish a separate, rarely used capability." [REG-VERBATIM]

That is an explicit design choice, and it is the realistic path for most of the country. A small agency does not need its own accreditation, its own certified operators, and its own listed technology. It needs a written arrangement with a neighbour who has them.

The condition is that the accredited agency remains the operating agency, and that the actions requiring the Act's authority are still performed by certified personnel. (Paraphrase, not a quotation — an earlier draft of this article tagged this sentence as verbatim regulatory text, which it is not. The underlying provision is § 124.4(c).)

What this changes about how you buy

BOTTOM LINE: the question to put to a vendor is not "can you handle our drone problem." It is three questions: who operates the system, who makes the credible threat determination, and who executes the mitigation action. A proposal that answers any of those three with the vendor is describing an arrangement the rule forecloses by name — and the consequence lands on your accreditation, not theirs.

CONFIDENCE: HIGH on the prohibition and the preserved roles — all quoted above. MODERATE on how any specific contract maps onto them; that is a question for your counsel, and the rule's own structure suggests it is worth asking before award rather than after.

One thing the rule does not address: officers exercising this authority off duty or in secondary employment. The statute and the rule are silent. The contractor prohibition and the "officers and employees" limitation both cut against it, but silence is not permission and it is not prohibition either. Treat it as a counsel question, not a settled one.

The record is open until September 4

The comment period on this rule closes September 4, 2026, at 11:59 p.m. ET — the electronic docket accepts comments "until 11:59 p.m. Eastern Time on that date" [REG-VERBATIM, 91 FR 41466]. The rule sets no grace period and promises nothing about anything filed later. [INFERENCE — the IFR states the cutoff, not a consequence.] If the mutual-aid mechanism does not work the way your region actually operates — or if the line between "system-level operator training" and certification is blurrier in practice than it reads on paper — that is worth putting on the record while the record exists.

Brian Rutherford is a Marine Corps Reconnaissance veteran and a certified combat marksmanship and foreign weapons instructor, an FAA Part 107 certificated pilot, and a former federal government contracting CEO (2009-2013). He founded DELALLi, which builds readiness training for state, local, tribal, and territorial agencies. DELALLi does not certify anyone under this rule and does not operate counter-drone systems; the FBI's National Counter-UAS Training Center is the sole certifying authority. Quotations above come from two sources, labelled at each blockquote: the codified rule at 6 CFR § 124.4(b) and the interim final rule preamble at 91 FR 41466. Bold emphasis inside quoted regulatory text is added for readability unless the source itself emphasises it; the words are unaltered.