DJI Matrice Review: The Enterprise Line an FCC Proposal Would Call Military-Grade

The Matrice line is the best-supported enterprise drone platform in the world and the one a US buyer has the least certainty about owning in three years. That tension is the whole review.

On 21 July 2026 the FCC released Public Notice DA 26-758, opening PS Docket No. 26-189. It proposes to prohibit the continued importation and marketing of previously authorised equipment that is both on the Covered List and "military-grade" under a definition whose categories 3, 4 and 5 are thermal imaging sensors, LiDAR sensors, and UAS docking stations. DA 26-758 states only that comments are due 30 days after publication in the Federal Register, so the closing date depends on when that publication lands. Check the docket rather than a secondary summary. The proposed implementation timeline: all parties cease importation and marketing 180 days after publication in the Federal Register.

There is a second, wider proceeding that matters more and gets almost no coverage. DA 26-758 cites it in its own footnotes: on 17 July 2026 PSHSB and OET opened PS Docket No. 26-184 (Public Notice DA 26-742), proposing to prohibit continued importation and marketing of covered UAS and UAS critical components together with equipment listed in section 1709 of the FY2025 NDAA. Docket 26-189 reaches the enterprise line through the thermal, LiDAR and docking-station definitions. Docket 26-184 is the one that would reach it directly. Anyone tracking only the military-grade proceeding is watching the narrower of the two.

Read that definition against the Matrice catalogue. The M4T, M4TD, M30T and M3T carry thermal. The Zenmuse L2 and the M400's integrated rotating obstacle-sensing LiDAR are category 4. Dock 3 is category 5 on its own. The proposal captures much of the enterprise line by definition rather than by name. DJI itself addressed the risk on its corporate blog on 7 August 2026, in a post titled "The FCC Could Cut Off Future Access to Popular DJI Drone Models in the U.S." The Matrice 400 and Dock 3 product pages carry no mention of it. That gap between the corporate blog and the buying pages is the finding.

Companion reading: How to choose a drone · Drone regulations and licensing · Drone and UAV hardware · Inspection robots · Robot cybersecurity

Table of contents

1. Key takeaways
2. The regulatory timeline that actually governs this purchase
3. The firmware cliff: patching as a licensed privilege
4. Security disclosures, and what the vendor-paid audit does and does not cover
5. Advertised price against working price
6. Measured against marketed, and why this section is thin
7. Deployment reality and the rivals
8. Verdict
9. Frequently asked questions

The regulatory timeline that actually governs this purchase

FY2025 NDAA section 1709 directs the FCC to update the Covered List for certain UAS equipment and services when "an appropriate national security agency" makes a determination. The statute names the category of agency rather than a specific one. DJI's corporate blog attributes the December 2025 listing to a government audit deadline nobody met, and has said so repeatedly.

On 22 December 2025 the FCC's Public Safety and Homeland Security Bureau issued DA 25-1086, adding UAS and UAS critical components produced in foreign countries to the Covered List, and adding the communications and video surveillance equipment and services listed in section 1709. The underlying National Security Determination was received on 21 December 2025 and is attached to the notice in full. Neither the public notice nor the determination names DJI or Autel anywhere in the document.

What the listing does: it bars new equipment authorisations. It did not by itself revoke previously granted authorisations or prohibit import and sale of previously authorised models. That distinction is the load-bearing beam under every "your fleet is fine" reassurance in the dealer channel, and Docket 26-189 is a proposal to remove it.

The precedent is worth stating precisely, because it cuts against the reassurance. The FCC's November 2022 rules barred authorisation of Covered List equipment without revoking prior grants. In October 2025 the Commission adopted a procedure to limit the scope of an existing authorisation, stopping continued importation and marketing without revoking the underlying grant, and directed the Bureau and OET to open proceedings applying it. That machinery has already been used once: a 26 June 2026 Public Notice applied the prohibition to covered equipment added to the Covered List in 2024 or earlier, effective 16 July 2026, ten days after Federal Register publication. Docket 26-189 is the same machine pointed at drones, with a 180-day runway instead of ten days.

Two other pressures run in parallel. CBP has been citing the Uyghur Forced Labor Prevention Act in withholding DJI drones from import since October 2024, and we found no dated resolution in either direction, so treat it as unresolved. DJI disputes the forced-labour premise and points to manufacturing in Shenzhen and Malaysia. UFLPA and the Covered List are independent chokepoints, and clearing one does nothing for the other. Separately, following a Department of War determination the Covered List entry was updated on 7 January 2026 to remove certain categories until 1 January 2027: devices on DCMA's Blue UAS Cleared List, and UAS that qualify as "domestic end products" under the Buy American standard. No DJI or Autel product received relief.

Litigation is slow. SZ DJI Technology Co. and DJI Service LLC v. FCC, 9th Cir. No. 26-1029, was filed on 20 February 2026; the FCC moved to dismiss and DJI filed a 32-page response on 15 April 2026, so the case has not reached the merits. On 14 August 2026, in SZ DJI Technology Co. v. Department of Defense, No. 25-5367, the DC Circuit affirmed in part, reversed in part, and remanded DJI's challenge to its placement on the section 1260H "Chinese military company" list. The reversal is narrow and procedural: the district court had upheld the Secretary's finding that DJI contributes to the Chinese defence industrial base using reasoning the Secretary had not himself invoked, which the panel called "a straightforward violation of the Chenery principle." The remand sends the classified record back to the district court to examine in the first instance. The opinion does not order DJI off the list. Nothing changes for a buyer today.

State procurement rules pre-date all of this. Several states restrict government purchase or use of Chinese-made drones, Florida's approved-manufacturer list among the earliest and strictest. If you are a public agency in one of those states, the federal timeline is academic. Check your own state's current list rather than any summary, including this one.

The firmware cliff: patching as a licensed privilege

This is the second finding, and it is subtler than the first.

Once foreign-produced UAS were on the Covered List, even a software update touched authorisation rules, because the Commission's October 2025 revisions to 47 CFR 2.932(b) and 2.1043(b) exclude Covered List equipment from the permissive-change procedures. The FCC's Office of Engineering and Technology issued a waiver on 21 January 2026 (DA 26-69) so that authorised UAS and UAS critical components "may continue to receive software and firmware updates that mitigate harm to U.S. consumers at least until January 1, 2027," including updates "that patch vulnerabilities." On 8 May 2026, DA 26-454 extended that at least to 1 January 2029 and expanded it to analogous Class II software and firmware changes. OET said it would recommend that the full Commission consider codifying the waiver through a rulemaking.

Read that as a security fact. For a US-market Matrice, the ability to receive a patch is a regulatory permission with an expiry date on it, granted twice and codified never. Budget your fleet's security life to 1 January 2029 and treat any extension as upside.

Security disclosures, and what the vendor-paid audit does and does not cover

The disclosed CVE picture for the Matrice specifically is thinner than the consumer line, and older.

The one public flaw that names a Matrice airframe is CVE-2023-51456, published 2 April 2024 at CVSS 6.8. It is an improper input validation issue in the v2_sdk_service running on port 10000 that allows an out-of-bounds read and write into process memory through a crafted payload, in the v2_pack_array_to_msg function in libv2_sdk.so, with memory leaks or arbitrary code execution as the stated consequence. Its affected list includes Matrice 300 before v57.00.01.00, Matrice M30 before v07.01.0022, and Mavic 3 Enterprise before v07.01.10.03. It is a fixed defect in the prior generation, disclosed alongside six sibling CVEs in the same service. It says nothing about the M400 or the Matrice 4 series.

The 2026 batch is consumer-facing. CVE-2026-78251 (CVSS 9.3) covers an FTP service with hardcoded credentials shared across models that permits unbounded uploads into /blackbox/upgrade/, exhausting storage so flight records, logs and telemetry cannot be written and firmware updates can be blocked. CVE-2026-78255 (CVSS 8.7) covers an HTTP media server serving stored photos and video through a /v2 endpoint without authenticating the client, with predictable filenames. Both list only consumer airframes: Neo, Neo 2, Flip, Air 3, Air 3S, Avata 2, Avata 360, the Mavic 3 family, Mavic 4 Pro, and Mini 2 through Mini 5 Pro. CVE-2026-26673 (CVSS 7.5) is a remote denial of service via the DJI Enhanced-WiFi transmission subsystem, and its affected list is older and narrower still: Mavic Mini, Spark, Mavic Air, Mini and Mini SE at 0.1.00.0500 and below. Its rated impact is availability only.

No Matrice appears in any of the 2026 lists. Whether the underlying code is shared is not something an outside reader can determine.

DJI's counter-evidence is real and worth weighing. OnDefend, a US cybersecurity firm, assessed the DJI Air 3S with RC 2 and the DJI Matrice 4E with RC Plus 2 Enterprise, published 28 May 2026. DJI reports that "No Critical or High-risk findings were observed," and that the assessment "did identify a number of low and very low risk findings, but none represent a realistic risk to safe operation or widespread data exposure." This is the only public adversarial test touching a Matrice and it is the strongest single piece of evidence DJI has. It is also scoped and vendor-paid, covering two airframe-and-controller pairs. FlightHub 2 cloud, Dock 3, the Zenmuse payloads, the M350 and the M400 sit outside it.

Advertised price against working price

Prices below are US dealer listings read in August 2026 and they move. Treat them as a band, not a quote.

At one large US enterprise dealer the M400 is listed two ways: a base configuration with no batteries or charging station at $10,450, and a combo bundle at $13,920. The bundle is 1.33x the base listing, and neither figure includes a payload. Add a Zenmuse imaging or LiDAR payload and the working machine costs materially more than the headline again, which is the shape of the trap even where we could not verify a specific configured quote. Get the payload, batteries, charger and case priced in writing before you compare anything.

Dock pricing is quote-gated. DJI publishes no fixed Dock 3 price, and configuration, payload, region, installation and commissioning are all extra. FlightHub 2 is the one pleasant surprise: the Business tier is listed around €1,920 a year with 500 GB of storage, a Standard tier is free with quotas, and Enterprise is quote-only. Software is where DJI extracts least.

The genuine cost trap sits elsewhere. A US Matrice fleet is terminal by law. No new model can be authorised, spares and payloads are themselves listed critical components, and Docket 26-189 would close resupply of the current models. Amortise over a legally bounded life rather than the usual five-to-seven-year refresh.

Measured against marketed, and why this section is thin

This is the weakest evidence area in the review and it deserves the admission.

DJI's specifications for the Matrice 400, announced 10 June 2025: 59 minutes max flight time, 53 minutes hover, 6 kg max payload via the quick-release third gimbal connector, 40 km transmission range under FCC (20 km under CE, SRRC and MIC), IP55, and a -20°C to 50°C operating range without solar radiation. Both the 59-minute and 53-minute figures carry DJI's own qualifier: no wind, with the H30T payload, at sea level. A drone-as-first-responder or inspection duty cycle mixes flight and hover, and the headline number is the more favourable half.

We found no independent instrumented endurance, payload or positional-accuracy test of the M400, M4E, M4T or M4TD from a neutral lab. Everything search returns is spec repetition or dealer content. Anyone quoting a real-world figure to you is quoting DJI. Ask any dealer for the release-note history of the model you are buying: a defect and fix log is the closest thing to a reliability record DJI publishes.

Deployment reality and the rivals

Kansas City, Missouri went live with a DJI drone-as-first-responder programme in early March 2026, running Matrice 4TD aircraft on DJI Dock 3 across eight nests, seven fixed and one relocatable, and it remains the best-documented at-scale Matrice deployment. Flying a mixed fleet across DJI and US-made platforms is becoming common in agencies that started before the listing.

Displacement is equally documented. Redmond, Oregon's city council awarded a $410,762 five-year contract to Axon on 23 June 2026 for six Skydio drones for a police drone programme that began in 2019. Park City, Kansas signed a five-year Axon Air and Skydio X10 contract at $78,712 covering hardware, software, service and cloud storage, with US-manufactured compliance named explicitly. Both readings are true in the same quarter: DJI still wins named enterprise DFR accounts in states without procurement bans, and loses named accounts on compliance grounds.

Capability ranking and compliance ranking point in opposite directions here, which is the entire buying problem.

Who should buy it. Non-US operators, and US commercial operators outside public safety who need thermal plus LiDAR plus docked autonomy today, who can write off the hardware inside three to four years, and who can stock spares now. Nothing else on the market matches the M400 payload count or the Dock 3 and FlightHub 2 stack.

Who should not. Any US public agency, any federal contractor, anyone in a state with a government-use restriction on Chinese-made drones, and any buyer whose finance model assumes a five-to-seven-year life with mid-life spares. If a procurement has to survive an audit in 2029, buy Skydio or Parrot and accept the capability gap.

Verdict

The Matrice is the most capable enterprise drone platform available and, for a US buyer, the one with a countdown attached. Two deadlines govern the purchase and neither appears on the product pages: the comment window on the proposals that would classify thermal, LiDAR and docks as military-grade and end import and marketing of already-approved units 180 days after Federal Register publication, and 1 January 2029, when the waiver that allows firmware patches expires.

Outside the US the aircraft stands on its merits and this review's regulatory sections mostly do not apply. Inside it, "your existing DJI fleet is fine" is a statement with an expiry date. Buy it as a depreciating three-year asset with spares bought up front, or buy compliant and accept less drone. Both are defensible. Buying it on a normal refresh cycle is not.

One caveat, stated plainly and in the FCC's own words: the proposal "would not affect continued use or operation of already-purchased UAS or UAS critical components." It removes future purchasability, and with it replacement units and spares.

Frequently asked questions

Is my existing Matrice illegal to fly? No. Covered List status bars new equipment authorisations, and Docket 26-189 as proposed would end importation and marketing rather than operation. The notice says the prohibition "would not result in the revocation of an existing authorization" and would not affect devices consumers already possess.

Can I still buy a new Matrice in the US right now? As of 24 August 2026, previously authorised models have not been subject to a final import and marketing prohibition. CBP has been withholding DJI drones under UFLPA since October 2024 and we found no dated resolution in either direction.

Which DJI products lost their FCC authorisation? DJI's 15 April 2026 Ninth Circuit filing argues the December 2025 listing set aside equipment authorisations already granted for DJI products. We found no FCC publication naming them. Whether any Matrice is included is the question we would put to a dealer in writing before signing.

Will DJI win in court? Unknown. The Ninth Circuit case is still at the motion-to-dismiss stage, and the DC Circuit's 14 August 2026 ruling affirmed in part, reversed in part and remanded the 1260H challenge to the district court without ordering DJI off the list.

Does the OnDefend audit settle the security question? It covers the Air 3S with RC 2 and the Matrice 4E with RC Plus 2 Enterprise, and reports no critical or high-risk findings alongside a number of low and very-low-risk ones. It is scoped and vendor-paid, and it does not cover FlightHub 2, Dock 3, Zenmuse payloads, the M350 or the M400.

Is the 59-minute flight time real? It is DJI's figure with no wind, the H30T payload and sea level. Hover is 53 minutes on the same qualifiers. No independent instrumented test of the M400 appears to exist publicly, so there is no confirming or refuting evidence either way.

Why is the M400 more expensive than the listed price? The cheapest listing is a base airframe without batteries or a charging station. Batteries, charging, case and any payload are extra, and dock pricing is quote-gated on top.

What about "American" drone brands that turn out to be Chinese? Active enforcement area. OET and PSHSB issued an Order to Show Cause to Odyssey Robot LLC on 21 July 2026 (DA 26-746) and revoked its two equipment authorisations on 11 August 2026 (DA 26-839), finding false statements that the equipment was not covered. The Texas company Odyssey named as its assembler told the FCC it had "no affiliation, business relationship, contractual relationship, agency relationship, ownership interest, or other connection with Odyssey," and the RF test reports were produced by TÜV Rheinland (Shenzhen). The revocation order does not name DJI, and neither do we. Verify the supply chain of any white-label compliant drone.