The newsletters keep landing in my inbox with their countdowns. The latest one fixes on 2 August; the date the AI Office acquires real teeth over general-purpose AI models. I read these updates the way a coastal town reads tide tables: not because every wave matters to me, but because I need to know which ones will reach the door. So let me work through what this particular tide actually touches, from the perspective of someone who spends their days arguing about machines that fly.

The autonomy problem nobody wants to define

Start with the thing that makes drones legally interesting in the first place: autonomy is a spectrum, and the law hates spectrums.

A consumer quadcopter holding position in a breeze is running control loops that would have been called “artificial intelligence” in a 1980s research paper. A military loitering munition selecting between candidate targets is doing something most people would unhesitatingly call AI, and find alarming. Between those two poles sits an enormous, messy middle; obstacle avoidance, automated return-to-home, “follow me” tracking, swarm coordination, automated target recognition that merely flags rather than decides. Where on that spectrum does a drone become an “AI system” in the meaning of Article 3?

This matters enormously and almost nobody asks it cleanly. The Act’s definition turns on a system that infers, from inputs, how to generate outputs that influence environments. Plenty of drone autonomy stacks meet that bar comfortably. Plenty of others; deterministic flight controllers executing fixed logic; arguably don’t. I have sat across the table from engineers who insist their navigation system is “just maths,” and they’re not entirely wrong, but “just maths” is also a fair description of every neural network ever trained. The line is not where intuition puts it.

Why the military carve-out is a trap, not a shield

Here is where I watch clients relax too early.

The AI Act contains an exclusion for systems used exclusively for military, defence or national security purposes. Counter-drone work, in particular, loves to shelter under this. The reasoning goes: we detect and defeat hostile UAS, this is inherently a security function, therefore the Act doesn’t reach us. Lovely. Except “exclusively” is doing ruthless work in that sentence, and the dual-use reality of this entire sector makes the exclusion far narrower than people want it to be.

The same RF-detection and optical-tracking stack that protects an airbase gets sold, with a different sticker, to protect a stadium, a prison, a private estate. The moment that system has a civilian commercial life; the moment it is placed on the EU market for protecting critical infrastructure rather than fighting a war; the exclusion frays. And critical infrastructure protection is precisely the kind of use the high-risk classification regime is built to capture. A counter-UAS platform that automatically classifies an incursion and cues a response near an airport is not obviously outside the high-risk net just because its cousin wears camouflage.

The targeted consultation on the high-risk classification guidelines, open until late June, is therefore not abstract bureaucracy to me. Those guidelines are where the boundary between “this is a security tool, leave it alone” and “this is a high-risk system, document everything” will actually get drawn through worked examples. Anyone in this sector who isn’t reading those drafts is choosing to be surprised later.

Article 50 and the drone you can’t see

Now the part that genuinely changes behaviour on the ground.

Article 50’s transparency obligations don’t care about risk tiers. They bite on situations; and one of those situations is biometric categorisation, another is emotion recognition, and another is content that interacts with or affects people. Picture the increasingly common deployment: a drone with a camera doing crowd monitoring, perimeter patrol, or event security. The instant that payload starts categorising people by biometric attributes, the deployer owes the exposed individuals notice. You cannot quietly run biometric categorisation from 120 metres up and treat the altitude as a privacy shield. The obligation attaches to what the system does, not to how far away the lens sits.

I find this is the provision that catches operators off guard, because it cuts against the entire instinct of aerial surveillance, which is to be unobtrusive. The law is, in effect, telling a category of drone operator that unobtrusiveness is now sometimes unlawful. That is a genuinely interesting collision between the technology’s reason for existing and the regulation’s reason for existing, and it is going to generate litigation.

The sandbox that slipped a year

There was a small piece of news in the recent updates that I suspect most readers skimmed: the establishment deadline for regulatory sandboxes has been pushed from August 2026 to August 2027.

For most industries that’s a footnote. For drones it’s meaningful, because the sandbox model is arguably better suited to unmanned aviation than to almost any other AI domain. We already have a mature culture of supervised, geographically-bounded testing; segregated airspace, specific operational risk assessments, temporary danger areas. A regulatory sandbox is conceptually just that culture extended from airworthiness into algorithmic compliance. The delay means the one mechanism that could let a counter-UAS startup test automated-response logic on real incursions, under supervision, with some shelter from fines, won’t materialise on the original timetable. The companies most in need of a structured way to prove their systems are safe will spend another year improvising compliance instead. Whether that protects the public or merely protects incumbents is the kind of question I find genuinely unresolved.

What I’m telling clients

The honest summary I give, stripped of comfort, runs roughly like this. The August date isn’t your date; it’s aimed at the makers of large general-purpose models, and most drone autonomy doesn’t live there. But the regime those powers belong to is the same regime whose high-risk rules and Article 50 duties absolutely will reach you, and the classification guidelines being drafted right now are where your fate gets decided. Don’t wait for enforcement to tell you which side of the line you’re on. The structured dialogue the AI Office favours means the first contact is likely to be a request for documentation, not a fine; which means the clients who survive comfortably are simply the ones who wrote the documentation before anyone asked.

Drones made autonomy visible; something you can point at in the sky. That visibility is exactly why this sector will be among the first places the AI Act’s abstractions get tested against physical reality. I’d rather my clients be the test case that wins than the cautionary one. The tide tables are right there in my inbox. The only real choice is whether to read them.

This is not legal advice; if you’re making compliance decisions about a specific system, get advice tailored to it.

About the author
Richard Ryan is a Direct Access Barrister at Blakiston’s Chambers, and a chartered arbitrator and accredited mediator, specialising in drone and counter-drone law. He advises operators, manufacturers, UTM providers, insurers and public bodies across the full UAS spectrum — regulatory permissions and BVLOS approvals, C-UAS deployment at airports, prisons and critical infrastructure, data and privacy, liability and high-value disputes. Instruct him directly or through solicitors.

The post The Drone in the Room: What the AI Act’s August Deadline Actually Means for Unmanned Aircraft appeared first on Blakistons.

Transforming UK Airspace: A New Era for Drones and Aviation with NATS OpenAir

By Richard Ryan, Drone Lawyer

The skies over the UK are on the verge of a transformative shift, thanks to the ambitious NATS OpenAir initiative. Designed to integrate drones and advanced air mobility (eVTOLs) into shared airspace alongside traditional aircraft, the proposal promises innovation, efficiency, and safety. But as with any grand vision, the devil is in the detail.
Here’s an in-depth look at what the OpenAir initiative is getting right, where there are gaps, and how it can evolve to meet the needs of all airspace users.
________________________________________
1. Prioritising Data Privacy and Ownership

One of the most valuable resources in aviation is data. For drone operators, who depend on real-time information about flight paths, weather, and airspace restrictions, access to reliable data is critical. However, the OpenAir proposal is light on specifics about who owns the data and how privacy will be protected.
Without clear protections, drone operators might worry about their data being exploited—whether commercially or in ways that jeopardise their competitive edge.

The Fix:
OpenAir must adopt a clear data privacy framework. Operators should retain ownership of their data, with mandatory anonymisation for any information shared beyond essential safety and operational use. Only the bare minimum of data required for regulatory compliance should be shared, and stringent safeguards must prevent its misuse.
________________________________________
2. Keeping the Playing Field Fair

OpenAir is envisioned as a centralised hub for managing UK airspace, which sounds great—until you consider the potential impact on smaller players. Consolidating services under one entity like OpenAir might inadvertently stifle competition among Uncrewed Traffic Management Service Providers (UTMSPs).

The Fix:
To level the playing field, OpenAir should adopt open standards that allow seamless third-party integration. Smaller UTMSPs must be supported, not sidelined. Clear rules around equitable access to data and services will ensure innovation thrives without creating monopolies.
________________________________________
3. Setting Realistic Timelines

Integrating drones and eVTOLs into shared airspace isn’t a simple task. OpenAir’s proposed rollout timeline—beginning pilots in 2025 and achieving full deployment by 2028—might be overly ambitious, especially given the complexity of regulatory approvals and the need for robust infrastructure.

The Fix:
A phased approach with realistic benchmarks is the way forward. OpenAir should focus on pilot projects in key areas where demand is highest (e.g., urban delivery drones or emergency medical services). This would provide valuable data to refine the system while reducing the risk of rushed implementation.
________________________________________
4. Managing Costs for Drone Operators

OpenAir’s “user pays” principle makes sense in theory—those who use the airspace services should cover the costs. But smaller operators, such as local delivery drone companies, could be disproportionately affected by high fees, potentially pricing them out of the market.

The Fix:
Introduce tiered pricing. Small operators should pay less, at least during the initial phases. Alternatively, subsidies or credits could be offered to early adopters, ensuring fair access while fostering adoption across the board.
________________________________________
5. Addressing Legal Grey Areas

OpenAir aligns with the UK’s Airspace Modernisation Strategy, but its relationship with existing regulations like CAP 722 (which governs drone operations) needs to be crystal clear. Ambiguities in compliance requirements could delay approvals or lead to legal disputes.
Similarly, liability concerns loom large. If there’s a system outage or data error, who’s responsible for the fallout? Drone operators? OpenAir? The CAA? NATS? DfT?

The Fix:
OpenAir must explicitly state how its services integrate with CAP 722, especially for critical areas like Beyond Visual Line of Sight (BVLOS) operations. As for liability, service agreements must clearly define responsibilities, ensuring all parties—operators, OpenAir, and regulators—understand their obligations.
________________________________________
6. Building Trust Through Transparency

For OpenAir to succeed, trust is key. Stakeholders—including drone operators, regulators, and public service agencies—must feel confident in the system’s fairness and security.

The Fix:
Establish an independent advisory board with representatives from all key groups, including Blakiston’s Chambers! This board would oversee the rollout of OpenAir, ensuring transparency and accountability. Regular public updates and feedback sessions would further build trust and address concerns early.
________________________________________
7. Looking to the Future

The potential of OpenAir is undeniable. By creating a unified platform for managing UK airspace, it could unlock opportunities ranging from efficient logistics to life-saving medical deliveries. But to truly succeed, OpenAir must:
1. Prioritise data privacy and ownership.
2. Ensure fair competition for all service providers.
3. Adopt a phased, realistic rollout plan.
4. Keep costs manageable for smaller operators.
5. Align with existing regulations like CAP 722.
6. Address liability concerns upfront.
7. Foster trust through transparency and stakeholder engagement.

The skies above us are changing, and with thoughtful planning, OpenAir could make the UK a global leader in integrated airspace management. But to get there, it must balance ambition with practicality, ensuring the system works for everyone—from global eVTOL operators to local delivery drones.
________________________________________
What do you think about the OpenAir proposal? Share your thoughts, especially if you’re a drone operator or part of the aviation industry. Your feedback could shape the future of our skies!

About the Author
Richard Ryan is a UK-based barrister and drone law expert with over 20 years of legal experience. Specializing in regulatory, operational, and safety challenges, Richard advises defence companies, regulatory bodies, and government agencies on the complexities of UAS operations. A former advisor to the UK Civil Aviation Authority and the House of Lords’ AUTMA committee, Richard is currently pursuing a PhD at Cranfield University, focusing on the legal implications of drone integration into global airspace.
Richard combines his legal expertise with a deep understanding of defence operations, having served in the British Army, including deployments to Iraq and Afghanistan. His insights bridge the gap between operational realities and legal requirements, ensuring clients navigate the rapidly evolving world of drone technology with confidence.

The post Transforming UK Airspace: A New Era for Drones and Aviation with NATS OpenAir appeared first on Blakistons.

Given that many people last year suffered a phishing attack from the CAA, you may have legitimate concerns as to the risk of your personal data. Not only will your concerns relate to your personal information, but also your operator ID and/or your flyer ID being compromised by a nefarious operator of drones. You may also have noticed that at the time, your data was not independently verified, but it would appear that Experian was in fact used.

Once you completed your registration, you would have been forced to accept the CAA terms and conditions that relate to your personal data. You would not have been able to amend these terms and conditions as this would have prevented you from flying because you would not have had the appropriate registration.

The CAA has a privacy policy and they are the data controller. You would have entered your full name, address, date of birth and an email address in order to register. The Government Digital Service or GDS as it is known promises not to transfer your data outside of the European Economic Area, sell or rent your data to 3^rd parties or share your data with third parties for marketing purposes. Your data is now also processed in accordance with GDS’s privacy notice, which means the GDS may collect more information:

• “questions, queries or feedback you leave, including your email address if you contact GOV.UK
• your email address and subscription preferences when you sign up to our email alerts
• how you use our emails – for example whether you open them and which links you click on
• your Internet Protocol (IP) address, and details of which version of web browser you used
• information on how you use the site, using cookies and page tagging techniques

We use Google Analytics software to collect information about how you use GOV.UK. This includes IP addresses.”

So not only is your data passed onto GDS and they seek to get more information, but did you know that your information is also passed onto a customer support provider which is a 3rd party is called “Teleperformance?” This company has offices all over the globe and works in many different sectors. How sure are you that this company will not share your data?

Did you also know that you agreed to limit the CAA’s liability in the event of a claim? If you run a drone business and your information has been compromised, for example, whereby all your drones have been seized because there has been some confusion over the operator ID, the CAA have excluded the following losses:

• “losses not foreseeable to you and us when these terms were formed
• losses not caused by any breach on our part
• business losses
• losses to non-consumers”

Additionally, the CAA terms also say that they will have no liability for any breach of the privacy terms as a consequence of a breakdown of systems or network access. Does that offer you a sufficient level of comfort after the phishing attack in 2019?

In summary, you have agreed to the privacy notice of the CAA, the privacy notice of the GDS, personal information being analysed by Google analytics, and personal information being utilised and stored by a global company called Teleperformance with limited ability to make a claim in the event you have suffered loss and damage.

If you’re not happy with this you are free to contact the government privacy team: gds-privacy-office@digital.cabinet-office.gov.uk or the Information Commissioner, who is an independent regulator: casework@ico.org.uk

If you would like to discuss this or any other drone law issues, please contact us.

The post Drone Registration – How safe is your personal registration data? appeared first on Blakistons.