EASA Archives - Blakistons

Navigating UK SORA: A Drone Lawyer’s Guide to CAA Decision No. 60

admin.richard — Mon, 06 Jul 2026 09:53:17 +0000

Drone Law | UK SORA | CAA Regulation | AI Governance

Summary: CAA Decision No. 60 marks a significant development in the regulation of Specific category drone operations in the UK. Coming into force on 1 October 2026, it updates the UK SORA framework and introduces clearer expectations around compliance evidence, ground-risk mitigation, containment, kinetic energy analysis and evidence retention. For operators, the message is clear: compliance is no longer just a narrative safety case. It must be evidenced, retained and auditable.

1. Why Decision No. 60 Matters

The UK’s lower airspace is becoming increasingly complex. Beyond Visual Line of Sight operations, drone delivery, infrastructure inspection, emergency services use, autonomous routing and higher-risk commercial UAS activity all require a more mature regulatory framework.

CAA Decision No. 60 updates the Acceptable Means of Compliance and Guidance Material for UK Regulation (EU) 2019/947. In practical terms, it strengthens the UK Specific Operation Risk Assessment, or UK SORA, for operators seeking authorisation in the Specific category.

The legal significance is that UK SORA is becoming a structured assurance methodology. Operators must not merely state that an operation is safe. They must demonstrate that the aircraft, procedures, people, operational volume, ground environment, airspace risks, mitigations and emergency arrangements meet the required level of safety.

2. UK SORA Is Not a Box-Ticking Exercise

UK SORA exists to support the operational risk assessment required for Specific category operations. It considers both ground risk and air risk, then applies mitigations and operational safety objectives according to the Specific Assurance and Integrity Level, or SAIL.

The updated framework is particularly important because it clarifies how operators must gather, present and retain compliance evidence. This is a move away from generalised operational assertions and towards aviation-grade documentation.

3. The Three Compliance Pathways

Decision No. 60 identifies three broad routes for demonstrating compliance.

Pathway	What It Means	Legal Significance
Declarative approach	The operator declares that it meets the relevant acceptable means of compliance.	Suitable for lower-risk requirements, but the declaration must still be accurate and supportable.
Agreed compliance basis	The operator and CAA agree in advance how compliance will be demonstrated.	Useful for novel or complex operations where evidence may include testing, analysis or design appraisal.
Compliance evidence approach	The operator submits both the compliance basis and the underlying evidence to the CAA.	The most rigorous route, likely to be required for higher-risk or technically complex operations.

Operators must also retain compliance evidence for the duration of the operational authorisation and for three years after operations under that authorisation cease. That evidence may become critical in a CAA audit, incident investigation, insurance dispute or civil claim.

4. Ground Risk: What Happens If the Drone Falls?

Ground risk is central to UK SORA. The law is concerned not only with whether the drone can fly, but with what happens if it fails. Decision No. 60 provides more detailed guidance on how operators may reduce ground risk.

Mitigation	Description	Key Legal Risk
M1A: Sheltering	Relying on people being inside structures.	The aircraft must not be capable of penetrating the relevant structures.
M1B: Operational restrictions	Operating at times or in areas where fewer uninvolved people are present.	Population assumptions must be evidenced and realistic.
M1C: Ground observation	Using observers or technical systems to detect uninvolved people.	Detection capability, observer competence and response procedures must be credible.
M2: Impact mitigation	Reducing impact energy through parachutes, flight termination or design features.	Deployment reliability, minimum altitude, failure modes and secondary hazards must be addressed.

5. Kinetic Energy and Penetration Risk

Decision No. 60 gives particular importance to kinetic energy. This matters because it converts safety claims into measurable injury-risk analysis.

Kinetic Energy	Risk Category	Operator Requirement
Up to 175 joules	Lower hazard	Generally less demanding penetration analysis, subject to the operational context.
175 to 7,000 joules	Medium hazard	Penetration analysis should be conducted against representative structures.
Over 7,000 joules	High hazard	More rigorous evidence is required, potentially including crashworthiness analysis and structural modelling.

Operators should not rely on generic manufacturer statements. They need platform-specific evidence: mass, velocity, terminal impact behaviour, parachute performance, battery fire risk and representative structural analysis.

6. Containment and Fly-Away Risk

Containment is a central pillar of the updated UK SORA framework. It asks whether the unmanned aircraft can be kept within its operational volume and ground risk buffer, even after failure or loss of control.

For lower-risk operations, containment may be assessed qualitatively through design appraisal and procedural evidence. For higher-risk operations, the CAA may expect quantitative probability targets, such as demonstrating that the probability of exiting the relevant volume or buffer is below specified thresholds per flight hour.

Containment evidence may include geo-caging, tethering, independent flight termination systems, lost-link logic, command-and-control resilience, navigation integrity, power-system independence and emergency procedures.

7. EU AI Act and UK AI Standards

Decision No. 60 is not an AI regulation. However, many modern drone operations increasingly rely on AI-enabled functions, including detect-and-avoid, automated route planning, computer vision, landing assistance, ground-person detection, predictive maintenance and autonomous contingency management.

The EU AI Act is relevant as a benchmark for risk management, technical documentation, record-keeping, transparency, human oversight, robustness and cybersecurity. The UK does not currently have a single equivalent UK AI Act. Instead, it follows a sector-led, principles-based model based on safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.

UK SORA Issue	AI Governance Standard	Practical Evidence
Operational risk assessment	Lifecycle risk management	Hazard log, AI failure-mode analysis, operating design domain and residual-risk register.
Compliance evidence	Technical documentation	Version-controlled technical file, test reports, software release notes and design appraisals.
Ground observation	Accuracy and human oversight	Detection metrics, false-negative analysis, lighting limits and observer escalation procedures.
Containment	Robustness and cybersecurity	Geo-cage testing, lost-link logic, GNSS spoofing assessment and command-link resilience.
Evidence retention	Record-keeping and auditability	Flight logs, telemetry, AI outputs, incident reviews and corrective actions.

8. Data Protection and Surveillance Risk

Many Specific category operations involve cameras, thermal imaging, mapping payloads or AI-enabled object recognition. UK SORA primarily addresses safety, but operators must also consider privacy, data protection and surveillance risk.

If cameras or AI systems detect uninvolved persons, personal data may be captured, stored or analysed. Operators may need a data protection impact assessment, retention limits, access controls, privacy notices and clear rules on secondary use.

9. What Operators Should Do Before 1 October 2026

Operators should review their safety cases and evidence packs now. In particular, they should check:

Aircraft mass, speed, kinetic energy and terminal velocity;
Ground-risk assumptions and population-density evidence;
Sheltering, operational restriction and observation claims;
Parachute, flight termination and impact mitigation evidence;
Containment evidence, including geo-caging and lost-link logic;
AI-enabled functions, including detect-and-avoid and automated decision-support tools;
Evidence retention systems;
Supplier contracts for access to technical data.

10. Bottom Line

CAA Decision No. 60 marks a shift from descriptive drone safety cases to structured assurance. Operators must now be able to prove their safety claims through coherent, retained and auditable evidence.

The most important development is the convergence between aviation safety and AI governance. UK SORA asks whether the drone operation is safe. The EU AI Act and UK AI principles ask whether automated systems are risk-managed, documented, robust, explainable, secure and subject to human oversight. For modern drone operations, those are increasingly the same question.

Compliance is not what the operator says it does. Compliance is what the operator can prove.

About the Author

Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, aviation regulation and artificial intelligence. He advises operators, manufacturers and public bodies on UK CAA regulation, UK SORA, BVLOS operations, AI governance and commercial drone operations. He is currently undertaking a PhD at Cranfield University researching the legal framework for autonomous aviation and future airspace integration.

This article is general legal commentary and does not constitute legal advice.

The post Navigating UK SORA: A Drone Lawyer’s Guide to CAA Decision No. 60 appeared first on Blakistons.

How Europe’s new AI rulebook would (and wouldn’t) touch autonomous combat aircraft—and what the defence carve?outs really mean

admin.richard — Thu, 06 Nov 2025 18:28:20 +0000

By Richard Ryan, barrister and drone lawyer

How Europe’s new AI rulebook would (and wouldn’t) touch autonomous combat aircraft — and what the defence carve-outs really mean.

In Brief…

Purely military AI systems are out of scope of the EU AI Act. If an AI system is developed or used exclusively for military/defence or national-security purposes, the Act does not apply. (EUR-Lex)
Dual-use is different. If the same autonomy stack, sensors or models are marketed or used for civilian purposes in the EU (for example, civil UAS, border or law-enforcement tasks), the Act can apply — with stringent duties for “high-risk” systems. (EUR-Lex)
Real-world testing is regulated. Pre-market R&D is generally excluded, but real-world testing isn’t — it requires specific safeguards and registration. (EUR-Lex)
Foundation models (GPAI) have their own rules from 2 Aug 2025; the defence carve-out in the Act is written for AI systems, not explicitly for models. If a model is placed on the EU market generally, the provider’s GPAI obligations can still bite. (EUR-Lex)

Context: sUAS News reports that GA-ASI is showcasing its autonomous fighter portfolio (for example, YFQ-42A CCA, MQ-20 Avenger) at the International Fighter Conference in Rome, 4–6 Nov 2025. This post overlays that scenario with the EU AI Act’s rules.

1) First principles: When does the EU AI Act apply?

The Act has extraterritorial reach. It covers (i) providers and deployers in the EU, (ii) providers placing on the EU market or putting systems into service in the EU — even if they are not established here — and (iii) providers/deployers in third countries where the AI system’s output is used in the EU. (EUR-Lex)

However, Article 2(3) draws a bright line: the Act does not apply to AI systems used exclusively for military, defence or national security. It also does not apply where a system is not placed on the EU market but its output is used in the EU exclusively for those purposes. Recital 24 reiterates this and clarifies that non-defence use falls back under the Act. (EUR-Lex)

What this means in Rome:

A closed, defence-only showcase for European militaries: out of scope.
A civil-use pitch, civil flight trials, or plans to sell autonomy modules to EU civilian buyers: in scope (see the high-risk section below). (EUR-Lex)

2) The key defence carve-outs (and their limits)

Carve-out #1 — Defence/military:

“This Regulation shall not apply to AI systems … used exclusively for military, defence or national security purposes.” (Article 2(3))

Two important nuances:

Exclusivity matters. The moment an autonomy stack or sensor suite is also marketed or used for civilian or law-enforcement tasks, the defence exclusion no longer shields those non-defence uses. (EUR-Lex)
Models vs systems. The text explicitly excludes AI systems for defence; it does not create an explicit defence exclusion for general-purpose AI models. If a GPAI model is placed on the EU market, Chapter V obligations for model providers can still apply — even if one downstream customer is a defence user. (More on GPAI below.) (EUR-Lex)

Carve-out #2 — Pre-market R&D:
R&D before placing on the market is generally outside scope, but real-world testing is not. Testing in real-world conditions triggers a dedicated regime (for example, registration, time limits, informed consent or special conditions for law enforcement, incident reporting). (EUR-Lex)

Carve-out #3 — Emergency derogations (non-defence):
For exceptional public-security reasons (or imminent threats to life/health), market surveillance authorities can authorise temporary use of a high-risk AI system before full conformity assessment — subject to strict conditions. Law-enforcement or civil-protection bodies can also use in urgent cases, then seek authorisation without undue delay. This is not a defence-specific carve-out, but it explains emergency deployments outside the military context. (EUR-Lex)

3) If the defence exclusion doesn’t apply, would autonomous fighters tech be “high-risk”?

Very likely yes — for civil variants or dual-use spin-outs:

Annex I (product-safety route). AI that is a safety component of products covered by sectoral EU safety laws is high-risk where those products need third-party conformity assessment. That list explicitly includes EU civil aviation law (Reg. 2018/1139) — covering unmanned aircraft and their remotely controllable equipment. In a civil-UAS configuration, an autonomy stack acting as a safety component would be regulated as high-risk. (EUR-Lex)
Annex III (stand-alone uses). Separate “high-risk” buckets also capture, for example, remote biometric identification and other sensitive functions (if and where permitted by Union/national law), critical infrastructure safety components, and more. If a fighter-born sensing suite were repurposed for civil border surveillance or public-space identification, you quickly hit these Annex III categories. (EUR-Lex)

What “high-risk” demands in practice
Providers must implement a risk-management system, data governance, technical documentation, logging, transparency/instructions, human oversight, and accuracy/robustness/cybersecurity — then pass conformity assessment, issue an EU Declaration of Conformity, and affix CE marking. Deployers also carry duties (for example, monitoring, data relevance, user notification in some cases). (EUR-Lex)

4) Sensors on show: what about face recognition and other “red lines”?

The EU bans several AI practices outright (from 2 Feb 2025), including:

Untargeted scraping of facial images to build recognition databases.
Biometric categorisation inferring sensitive traits (for example, race, political opinions, religion).
Emotion recognition in workplaces or schools (with narrow safety/medical exceptions).
Predictive “risk assessments” of criminality based solely on personality traits/profiling.
Real-time remote biometric identification (RBI) in public spaces for law enforcement — unless strictly authorised and necessary for narrowly defined objectives (for example, locating a specific suspect in serious crimes, preventing a specific imminent threat, finding missing persons), with prior judicial/independent approval and registration. (EUR-Lex)

Implication for a trade-show demo: training a camera on attendees to test real-time RBI in a public venue would likely be unlawful unless those strict law-enforcement exceptions and procedural safeguards apply — which they typically will not at a commercial defence conference. (EUR-Lex)

5) Real-world testing in the EU (civil or dual-use variants)

If a provider runs real-world flight tests in the EU (outside the defence exclusion), the Act requires — among other things — registration, an EU-established entity or EU legal representative, limits on duration (normally up to six months, extendable once), rules on informed consent (with special handling for law-enforcement tests), qualified oversight, and the ability to reverse/ignore the system’s outputs. Serious incidents must be reported promptly. (EUR-Lex)

6) Foundation models (GPAI): obligations can still attach

From 2 Aug 2025, Chapter V sets baseline transparency and copyright-policy duties for providers of general-purpose AI models (with extra obligations if the model presents systemic risks). The defence exclusion in Article 2(3) is framed for AI systems, not models. So, if a foundation model is placed on the EU market, the model provider can have obligations even if a downstream customer is a defence prime. (Open-source specifics and systemic-risk thresholds also apply.) (EUR-Lex)

7) Timelines you need in Rome (as of 6 Nov 2025)

Entry into force: 1 Aug 2024 (20 days after OJ publication).
Prohibited practices + core chapters (I–II): apply from 2 Feb 2025.
GPAI rules (Chapter V), plus other chapters (III §4, VII, XII, and Article 78): apply from 2 Aug 2025.
General application: 2 Aug 2026 (high-risk regime starts to bite broadly).
Article 6(1) Annex III classification trigger & related obligations: 2 Aug 2027. (EUR-Lex)

8) Enforcement and penalties

Violating prohibited practices (Article 5) can draw fines up to €35m or 7% of worldwide annual turnover, whichever is higher.
Other operator obligations can reach €15m or 3%; supplying misleading information can reach €7.5m or 1% (SMEs benefit from caps). Separate fine scales apply to EU institutions. (EUR-Lex)

9) Practical playbook for IFC attendees

If you are a defence OEM showing autonomy stacks:

Map uses: Defence-only (excluded) vs any civil or law-enforcement pathways (potentially in scope). Document the exclusivity of defence deployments if you rely on the carve-out. (EUR-Lex)
GPAI suppliers: If you place a foundation model on the EU market, expect Chapter V duties regardless of defence customers. (EUR-Lex)
No RBI demos on the show floor. Those prohibitions already apply in 2025. (EUR-Lex)
Planning EU flight tests for civil variants? Prepare for real-world testing conditions (registration, oversight, incident reporting). (EUR-Lex)
For civil UAS commercialisation, treat your autonomy as high-risk (EASA product-safety route), budget time for conformity assessment and CE marking. (EUR-Lex)

If you are a European ministry or agency:

Distinguish military operations (out of scope) from law-enforcement or border uses (in scope; watch RBI limits and high-risk duties). Consider Article 46 emergency derogations only in exceptional and documented cases. (EUR-Lex)

If you are a civil UAS integrator:

Expect the full high-risk package (risk management, data governance, human oversight, cybersecurity, logs, conformity assessment, CE). Build compliance into your system architecture, ML pipelines, safety cases, and ops manuals from day one. (EUR-Lex)

10) Quick decision pathway

Is the use exclusively defence or national security?
Yes: AI system is out of scope.
No: continue. (EUR-Lex)
Is it a civil product or law-enforcement/border use?
Civil product with safety function (for example, civil UAS): High-risk via Annex I ? conformity assessment + CE. (EUR-Lex)
Stand-alone sensitive use (for example, RBI, critical infrastructure): Annex III high-risk or Article 5 prohibition applies. (EUR-Lex)
Is there a GPAI model being placed on the EU market?
Yes: Chapter V duties for model providers from 2 Aug 2025, separate from the defence carve-out for systems. (EUR-Lex)
Is this pre-market testing?
Real-world testing rules apply (registration, oversight, incident reporting). (EUR-Lex)

Bottom line for “Autonomous Fighters in Rome”

A military-only display of GA-ASI’s autonomous fighters is outside the AI Act.
Any civil spin-off (cargo drones, civil surveillance, airport ops) or law-enforcement application in the EU will trigger the Act — often at the high-risk level — together with tight prohibitions around biometric uses in public spaces. Plan your compliance architecture accordingly. (EUR-Lex)

This article is informational and not legal advice. Citations are to the Official Journal text of the Artificial Intelligence Act (Regulation (EU) 2024/1689) for scope (Art. 2), prohibitions (Art. 5), high-risk regime (Ch. III), real-world testing (Arts. 57–61), GPAI (Ch. V incl. Art. 53), timelines (Art. 113), and penalties (Art. 99–101).

About the author — Richard Ryan

Richard Ryan is a UK barrister (Direct Access), mediator and Chartered Arbitrator (FCIArb), and a Bencher of Gray’s Inn. He practises across defence, aerospace, construction, engineering and commodities, with a leading specialism in drone and counter-drone law, unmanned aviation regulation, and AI-enabled safety and compliance. Richard advises government, primes and operators on EU/UK UAS frameworks, BVLOS, U-space/UTM and the EU AI Act. He leads Blakiston’s Chambers and contributes regularly to industry guidance and policy consultations.

The post How Europe’s new AI rulebook would (and wouldn’t) touch autonomous combat aircraft—and what the defence carve?outs really mean appeared first on Blakistons.

Legal Issues in Drone Operations: A UK Perspective on Safety, Compliance, and Lessons from the GEN 3.8 Incident in Ireland

admin.richard — Mon, 11 Nov 2024 07:47:06 +0000

Legal Issues in Drone Operations: A UK Perspective on Safety, Compliance, and Lessons from the GEN 3.8 Incident in Ireland

By Richard Ryan, Blakiston’s Chambers

The recent Air Accident Investigation Unit (AAIU) report on the GEN 3.8 drone accident in Ireland gives us a significant case study on drone operations in urban areas. The incident highlights important safety and legal concerns that apply to unmanned aircraft systems (UAS), which are highly relevant to both Irish and UK drone regulations. This blog explores these issues in the context of the UK’s Aviation Act 1982 and the Air Navigation Order 2016 (ANO) and contrasts them with the legal framework in Ireland.

Overview of the Incident

In July 2022, a GEN 3.8 drone, conducting an urban delivery in Balbriggan, Ireland, experienced a mechanical failure when one of its propeller blades detached. This failure triggered an emergency descent and parachute deployment, causing a minor injury to a bystander. While the consequences of the accident were relatively minor, it underlines the importance of strong legal frameworks for safe drone operations, especially in populated areas.

The UK Legal Framework for Drone Operations

In the UK, drone operations are governed by several key laws and regulations:

1. Aviation Act 1982

The Aviation Act provides the overall legal framework for civil aviation in the UK. It gives the Civil Aviation Authority (CAA) the power to regulate aviation safety and enforce compliance.

The CAA can also develop specific regulations for unmanned aircraft to address the risks and challenges that drone technology presents.

2. Air Navigation Order 2016 (ANO)

The ANO is the primary legislation for regulating UAS operations. It categorizes drones into Open, Specific, and Certified categories, depending on the risk involved in the operation.

Article 241 of the ANO prohibits endangering people or property with a drone, requiring drones to maintain safe distances from people, buildings, and crowded areas. This is especially relevant for urban delivery flights.

3. Requirement for Operational Authorisation

For commercial operations, like the GEN 3.8 urban deliveries, an operational authorisation under the Specific category is required. This involves conducting a risk assessment and putting safety measures in place, such as emergency systems and proper documentation.

UK operators must prove to the CAA that they have identified and mitigated risks, which includes being prepared for mechanical issues like those seen in the GEN 3.8 case.

Comparison with Ireland’s Legal Framework

Ireland’s drone regulations are similar to those of the UK but have some key differences:

1. Regulatory Basis

In Ireland, drone operations are regulated by the Irish Aviation Authority (IAA) under the EU’s Implementing Regulation (EU) 2019/947, which applies to all EU member states. Like the UK’s CAA, the IAA oversees aviation safety and authorises specific operations.

Since the UK left the EU, it has adapted its own regulations to keep pace with the rapid evolution of drone technology.

2. LUC Certificates and Specific Category Requirements

Similar to the UK’s Specific category authorisation, Ireland issues Light UAS Operator Certificates (LUC) to operators meeting specific standards. This allows them to conduct higher-risk operations under IAA oversight.

The GEN 3.8 drone operated under Ireland’s Specific category. However, there were delays in reporting the incident, showing the need for better communication between the operator, IAA, and the AAIU.

3. Accident Reporting Requirements

In Ireland, regulations require that any drone accident resulting in injury or significant damage must be reported to the AAIU. The GEN 3.8 incident was only reported after it appeared on social media, suggesting delays in the reporting process.

In the UK, the ANO 2016 requires that accidents are reported to the CAA immediately, with strict penalties for non-compliance. This ensures a timely investigation and response, which is essential for public safety.

Key Takeaways for UK Drone Operators

The GEN 3.8 incident highlights several important lessons for drone operators in the UK:

1. Strict Compliance with Manufacturer Guidelines

The GEN 3.8 incident showed that its propellers were not designed for the way they were used, which led to the failure. UK law requires operators to maintain drones as per the manufacturer’s guidelines to avoid similar problems.

2. Robust Reporting Mechanisms

The delay in reporting the GEN 3.8 incident shows why prompt reporting is essential. In the UK, operators must report any accidents involving injuries or property damage to the CAA without delay. This helps ensure quick investigation and corrective action.

3. Operational Risk Assessment and Safety Measures

UK operators must conduct a risk assessment before undertaking operations. The GEN 3.8’s emergency parachute deployment is a good example of how an effective Flight Termination System (FTS) can help mitigate risks.

4. Public Liability and Insurance Requirements

UK law requires commercial operators to carry public liability insurance to cover injuries or property damage. The GEN 3.8 accident is a reminder of why adequate insurance is crucial for managing liability in unforeseen incidents.

Conclusion: Strengthening Drone Safety Regulations

The GEN 3.8 incident serves as a valuable lesson for drone operators and regulators in the UK and Ireland. It emphasises the importance of following safety standards, having efficient reporting systems, and conducting thorough risk assessments. In the UK, the Aviation Act 1982 and ANO 2016 provide a solid foundation for managing the risks of urban drone operations. As drone technology evolves and urban deliveries become more common, the UK must keep improving its regulations to ensure public safety.

For operators, compliance is only the beginning. By understanding drone regulations and putting the best safety practices in place, they can ensure their operations are both safe and legally sound.

Richard Ryan is an experienced drone lawyer specialising in unmanned aircraft systems (UAS) and aviation law. He provides expert legal guidance on regulatory compliance, licensing, and operational issues to clients navigating the complexities of drone technology.

Disclaimer: This blog is for informational purposes only and does not constitute legal advice. For legal counsel regarding specific situations, please consult a qualified drone lawyer.

The post Legal Issues in Drone Operations: A UK Perspective on Safety, Compliance, and Lessons from the GEN 3.8 Incident in Ireland appeared first on Blakistons.