The FY2026 NDAA Rewrote the Rules for Defense Contractors. Small Businesses Should Pay Attention.

The FY2026 National Defense Authorization Act, signed into law on December 18, 2025, authorizes $900.6 billion in defense spending. That headline number gets attention. What does not get enough attention is the series of acquisition reform provisions buried across 40-plus sections that fundamentally change how small businesses, startups, and university research labs can compete for defense contracts.

For years, the central complaint from nontraditional defense contractors has been that the Pentagon's procurement system is designed for incumbents. The compliance requirements — certified cost and pricing data, cost accounting standards, government-unique business system audits — create barriers that large primes absorb as overhead but that small companies experience as existential obstacles.

The FY2026 NDAA takes a sledgehammer to several of those barriers. Whether it works depends on how quickly the Defense Acquisition Regulations Council implements the changes and how aggressively contracting officers use their new authorities.

The Threshold Changes That Matter Most

Two provisions in the NDAA will have the most immediate impact on small and mid-size defense contractors.

Section 1804 raises the Truth in Negotiations Act (TINA) threshold from $2.5 million to $10 million, effective June 30, 2026. Under TINA, contractors bidding on contracts above the threshold must submit certified cost or pricing data — detailed breakdowns of labor rates, material costs, overhead allocations, and profit margins that the government uses to negotiate price and can later audit for "defective pricing." Getting the certification wrong carries False Claims Act liability.

For a small company bidding on a $5 million contract, the cost of preparing and certifying that data — and the legal exposure if an auditor later disagrees with your cost estimates — often exceeds the profit margin on the contract itself. By raising the threshold to $10 million, Section 1804 removes this burden from the vast majority of small business defense contracts. A startup that wins a $7 million prototype contract after June 30 will not need to open its books to government cost auditors the way it would have six months earlier.

Section 1806 raises Cost Accounting Standards (CAS) thresholds. The applicability floor goes from $2.5 million to $35 million. Full CAS compliance — the most burdensome tier, requiring consistent allocation of costs across all government contracts — goes from $50 million to $100 million.

CAS compliance requires a dedicated cost accounting system, written disclosure statements, and the ability to demonstrate that indirect costs are allocated consistently across every government contract. For a 50-person startup that just won its second defense contract, standing up a CAS-compliant accounting system can cost $200,000 or more and take months. Raising the threshold to $35 million means most small contractors will never need to worry about it.

These are not cosmetic changes. Together, Sections 1804 and 1806 remove the two compliance regimes that small businesses most frequently cite as reasons they avoid defense contracting entirely.

Nontraditional Contractor Exemptions

Section 1826 goes further, exempting nontraditional defense contractors from FAR Part 31 cost principles, certified cost or pricing data requirements, and certain business system audit requirements. The exemptions require head-of-contracting-activity approval and congressional notification, but the provision creates a defined pathway for commercial companies to sell to DOD without restructuring their entire accounting and compliance infrastructure.

The practical effect: a venture-backed AI company that prices its products based on market rates — not government-approved cost-plus models — can now compete for defense contracts without fundamentally changing how it does business. The company's commercial pricing structure stands on its own terms.

Section 824 addresses past performance, one of the subtler barriers to market entry. Historically, DOD evaluates contractors based on past performance on government contracts. A company with a decade of commercial success but no federal contract history starts at zero. Section 824 directs the Secretary of Defense to issue guidance within one year that allows contracting officers to accept past performance references from commercial and non-government projects and to use "alternative methods of evaluation other than past performance" when a requirement has little precedent.

For defense tech startups and university spinouts — organizations that may have deep technical capability but no government contract record — this is the provision that gets them past the evaluation gate.

Commercial Integration: From Rhetoric to Regulation

The NDAA's Title XVIII represents the most aggressive push toward commercial integration in defense acquisition since the Federal Acquisition Streamlining Act of 1994.

Section 1801 redefines "best value" to explicitly include delivery schedule alongside cost, quality, and technical capability. This sounds procedural until you realize that the previous definition's emphasis on lowest price technically compliant (LPTC) evaluations systematically disadvantaged companies that offered better technology at higher prices. The revised definition gives contracting officers explicit statutory authority to select faster, more capable solutions even when cheaper alternatives exist.

Section 1802 creates a new "portfolio acquisition executive" role whose job is to prioritize commercial products and commercial services across entire acquisition portfolios. Section 1812 requires GSA schedule purchases to use best value rather than lowest cost. Together, these provisions shift DOD procurement from a cost-minimization framework to a capability-optimization framework.

Sections 1821 and 1824 restrict defense-unique contract clauses. Section 1821 requires DOD to develop a defined list of mandatory defense-unique clauses for commercial items. Section 1824 prohibits any clause not on that list from being flowed down as a mandatory requirement to commercial subcontractors. This directly addresses the "clause creep" problem: the accumulation of government-unique terms and conditions in subcontracts that make commercial companies unwilling to participate in defense supply chains.

The AI and Cyber Provisions

The NDAA includes an unusually detailed set of AI governance provisions that create both compliance requirements and market opportunities.

Section 1512 requires DOD to establish a department-wide AI policy covering AI-specific threats, lifecycle security measures, and governance standards within 180 days. Section 1513 mandates a cybersecurity and physical security framework for AI systems aligned with NIST and CMMC standards.

Section 1534 directs the creation of AI sandbox testing environments by April 1, 2026 — controlled environments where DOD can evaluate AI capabilities from commercial vendors without full system integration. For AI startups, these sandboxes lower the barrier to demonstrating capability. Instead of navigating a multiyear Authority to Operate (ATO) process before DOD can even see your product work, you can demonstrate in a sandbox and let results drive the procurement decision.

Section 1532 bans DeepSeek and High Flyer AI from DOD systems within 30 days, with contractor use prohibited unless specifically waived for research or mission-critical purposes. The supply chain implications extend to any software dependency chain that touches these models.

For companies building AI products for defense customers, the combined effect of Sections 1512-1534 is a new compliance baseline: your AI system needs to meet NIST-aligned security standards, operate within DOD-approved governance frameworks, and demonstrate capability in sandbox environments. Companies that invest in that compliance infrastructure now will be positioned ahead of those that wait.

The $145.7 Billion R&D Budget

The NDAA authorizes $145.7 billion for research, development, test, and evaluation (RDT&E) and $161.7 billion for procurement. Within the R&D budget, expanded funding targets five priority technology areas: autonomous systems, microelectronics, cyber defense, advanced materials, and energy resilience.

For SBIR applicants, the NDAA's technology priorities signal where DOD's next solicitation topics will concentrate. The recently reauthorized SBIR/STTR programs — extended through 2031 with new Strategic Breakthrough Awards of up to $30 million — align directly with the NDAA's emphasis on rapid transition from research to fielded capability.

The Defense Innovation Unit (DIU), which has reduced average time from problem identification to prototype deployment to under two years, received continued support. DIU's Commercial Solutions Openings (CSOs) offer a streamlined path from prototype to production contract — and under the NDAA's expanded follow-on production authority in Section 1823, companies that successfully demonstrate prototypes through competitive selection can receive sole-source production contracts without a new competition.

Supply Chain Restrictions Create Opportunities

The NDAA imposes extensive new sourcing restrictions that constrain incumbents but create openings for domestic suppliers.

Critical minerals (Section 848): DOD codifies a prohibition on sourcing critical minerals from non-allied nations, with a five-year implementation period. Sections 844-845 add molybdenum, gallium, and germanium to the restricted list. Section 837 requires DOD to expedite qualification of compliant domestic sources.

Advanced batteries (Section 842): Batteries from foreign entities of concern are banned from new contracts starting January 1, 2028, and from existing programs by January 1, 2031.

Computers and printers (Section 850): A phase-in schedule requires 10 percent non-Chinese sourcing in FY2026, scaling to 100 percent by FY2029.

Optical glass and displays (Sections 834-835): Sourcing strategies due March 15, 2027; full implementation by January 1, 2030.

Each of these restrictions represents a market that domestic manufacturers need to fill. For small businesses with domestic manufacturing capabilities in these areas, the NDAA creates guaranteed demand over a defined timeline — the kind of market certainty that justifies capital investment.

What to Do Now

The NDAA's provisions take effect on different timelines, but the strategic positioning should start immediately.

If you are a startup or nontraditional contractor: Register on SAM.gov if you have not already. Review your pricing structure — after June 30, contracts under $10 million will not require certified cost data, so you can bid using commercial pricing models. Begin building relationships with Defense Innovation Unit program managers and your target agency's small business office.

If you are a university research lab: The expanded R&D authorization, AI sandbox provisions, and past-performance reform create new pathways from lab research to defense contracts. DURIP (Defense University Research Instrumentation Program) provides equipment funding. OTAs (Other Transaction Agreements) allow DOD to fund university research without FAR compliance overhead.

If you are an existing small defense contractor: The CAS threshold increase to $35 million may free you from compliance obligations. Review your current cost accounting disclosure statements with your CPA. The freed resources can be redirected to business development.

If you build AI systems: Start aligning your security and governance documentation with NIST AI Risk Management Framework standards now. When the DOD AI policy drops within 180 days, companies with existing documentation will be first in line for sandbox evaluations.

The defense acquisition system has been criticized for decades as a machine that produces barriers faster than reforms can dismantle them. The FY2026 NDAA is the most concerted effort to reverse that dynamic since the mid-1990s. Whether it succeeds depends on implementation — but the statutory authority is now in place, and the companies that position against these provisions first will hold the advantage.

If you are exploring defense contracting opportunities for the first time, tools like Granted can help you identify relevant solicitations and build competitive proposals before the next wave of opportunities opens.