Drone Law | UK SORA | CAA Regulation | AI Governance

Summary: CAA Decision No. 60 marks a significant development in the regulation of Specific category drone operations in the UK. Coming into force on 1 October 2026, it updates the UK SORA framework and introduces clearer expectations around compliance evidence, ground-risk mitigation, containment, kinetic energy analysis and evidence retention. For operators, the message is clear: compliance is no longer just a narrative safety case. It must be evidenced, retained and auditable.

1. Why Decision No. 60 Matters

The UK’s lower airspace is becoming increasingly complex. Beyond Visual Line of Sight operations, drone delivery, infrastructure inspection, emergency services use, autonomous routing and higher-risk commercial UAS activity all require a more mature regulatory framework.

CAA Decision No. 60 updates the Acceptable Means of Compliance and Guidance Material for UK Regulation (EU) 2019/947. In practical terms, it strengthens the UK Specific Operation Risk Assessment, or UK SORA, for operators seeking authorisation in the Specific category.

The legal significance is that UK SORA is becoming a structured assurance methodology. Operators must not merely state that an operation is safe. They must demonstrate that the aircraft, procedures, people, operational volume, ground environment, airspace risks, mitigations and emergency arrangements meet the required level of safety.

2. UK SORA Is Not a Box-Ticking Exercise

UK SORA exists to support the operational risk assessment required for Specific category operations. It considers both ground risk and air risk, then applies mitigations and operational safety objectives according to the Specific Assurance and Integrity Level, or SAIL.

The updated framework is particularly important because it clarifies how operators must gather, present and retain compliance evidence. This is a move away from generalised operational assertions and towards aviation-grade documentation.

3. The Three Compliance Pathways

Decision No. 60 identifies three broad routes for demonstrating compliance.

Operators must also retain compliance evidence for the duration of the operational authorisation and for three years after operations under that authorisation cease. That evidence may become critical in a CAA audit, incident investigation, insurance dispute or civil claim.

4. Ground Risk: What Happens If the Drone Falls?

Ground risk is central to UK SORA. The law is concerned not only with whether the drone can fly, but with what happens if it fails. Decision No. 60 provides more detailed guidance on how operators may reduce ground risk.

5. Kinetic Energy and Penetration Risk

Decision No. 60 gives particular importance to kinetic energy. This matters because it converts safety claims into measurable injury-risk analysis.

Operators should not rely on generic manufacturer statements. They need platform-specific evidence: mass, velocity, terminal impact behaviour, parachute performance, battery fire risk and representative structural analysis.

6. Containment and Fly-Away Risk

Containment is a central pillar of the updated UK SORA framework. It asks whether the unmanned aircraft can be kept within its operational volume and ground risk buffer, even after failure or loss of control.

For lower-risk operations, containment may be assessed qualitatively through design appraisal and procedural evidence. For higher-risk operations, the CAA may expect quantitative probability targets, such as demonstrating that the probability of exiting the relevant volume or buffer is below specified thresholds per flight hour.

Containment evidence may include geo-caging, tethering, independent flight termination systems, lost-link logic, command-and-control resilience, navigation integrity, power-system independence and emergency procedures.

7. EU AI Act and UK AI Standards

Decision No. 60 is not an AI regulation. However, many modern drone operations increasingly rely on AI-enabled functions, including detect-and-avoid, automated route planning, computer vision, landing assistance, ground-person detection, predictive maintenance and autonomous contingency management.

The EU AI Act is relevant as a benchmark for risk management, technical documentation, record-keeping, transparency, human oversight, robustness and cybersecurity. The UK does not currently have a single equivalent UK AI Act. Instead, it follows a sector-led, principles-based model based on safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.

8. Data Protection and Surveillance Risk

Many Specific category operations involve cameras, thermal imaging, mapping payloads or AI-enabled object recognition. UK SORA primarily addresses safety, but operators must also consider privacy, data protection and surveillance risk.

If cameras or AI systems detect uninvolved persons, personal data may be captured, stored or analysed. Operators may need a data protection impact assessment, retention limits, access controls, privacy notices and clear rules on secondary use.

9. What Operators Should Do Before 1 October 2026

Operators should review their safety cases and evidence packs now. In particular, they should check:

• Aircraft mass, speed, kinetic energy and terminal velocity;
• Ground-risk assumptions and population-density evidence;
• Sheltering, operational restriction and observation claims;
• Parachute, flight termination and impact mitigation evidence;
• Containment evidence, including geo-caging and lost-link logic;
• AI-enabled functions, including detect-and-avoid and automated decision-support tools;
• Evidence retention systems;
• Supplier contracts for access to technical data.

10. Bottom Line

CAA Decision No. 60 marks a shift from descriptive drone safety cases to structured assurance. Operators must now be able to prove their safety claims through coherent, retained and auditable evidence.

The most important development is the convergence between aviation safety and AI governance. UK SORA asks whether the drone operation is safe. The EU AI Act and UK AI principles ask whether automated systems are risk-managed, documented, robust, explainable, secure and subject to human oversight. For modern drone operations, those are increasingly the same question.

Compliance is not what the operator says it does. Compliance is what the operator can prove.

About the Author

Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, aviation regulation and artificial intelligence. He advises operators, manufacturers and public bodies on UK CAA regulation, UK SORA, BVLOS operations, AI governance and commercial drone operations. He is currently undertaking a PhD at Cranfield University researching the legal framework for autonomous aviation and future airspace integration.

This article is general legal commentary and does not constitute legal advice.

The post Navigating UK SORA: A Drone Lawyer’s Guide to CAA Decision No. 60 appeared first on Blakistons.

White Paper

Beyond 2019

A New Counter Uncrewed Systems and Air Threat Resilience Strategy for the United Kingdom, After Ukraine and Iran

By Mr Richard Ryan, Barrister, Blakiston’s Chambers · June 2026

The United Kingdom’s published national counter drone policy; the UK Counter-Unmanned Aircraft Strategy, presented to Parliament as Command Paper 187 on 21 October 2019^[1]; is materially out of date as a strategic document. It remains the only published national strategy in the field for the whole of government, yet it is now approximately six years and seven months old, and roughly three and a half years beyond its own planning horizon.

The strategy was sound for its time. It identified the highest harm illegal uses of small drones; terrorism, smuggling into prisons, disruption of critical national infrastructure; and prescribed layered intervention, industry standards, responder powers and public education.^[2] But it was expressly confined to malicious and illegal use of small aerial drones, in a domestic policing and protective security frame. That frame has been overtaken by operational reality in Ukraine and the Iranian theatre: massed one way attack drones, combined drone and missile salvos, container and special forces launch, dense electronic warfare, fibre optic command links and AI assisted guidance now define the threat.

Subsequent UK documents do not update the 2019 strategy; they work around it. The Defence Drone Strategy (2024),^[3] the Strategic Defence Review 2025,^[4] NPSA’s site specific guidance,^[5] and the Ministry of Defence’s 2026 pursuit of new defeat powers at military sites^[6] together form a patchwork of sectoral adaptations laid over an unrevised core. This paper argues that the 2019 strategy should be retired as a standalone statement and replaced by an integrated Counter Uncrewed Systems and Air Threat Resilience Strategy, supported by a consolidated legal code for detection, disruption and defeat, and by an annual ministerial statement to Parliament.

1.  The threat has become a strategic mass system

The central lesson of 2024–2026 is not that drones have become more common but that they have become a strategic mass system — a consumable class of munition and sensor used for saturation, decoying, attrition of intelligence assets, target acquisition and the deliberate erosion of a defender’s cost exchange ratio. On the night of 2 June 2026, Ukraine’s air force reported that Russia had launched 656 drones and 73 missiles in a single overnight barrage, of which 602 drones and 40 missiles were downed or suppressed.^[7][8] Single salvos now routinely exceed several hundred drones.

Critical infrastructure has been directly affected. In February 2025 a Russian Geran-2 (Shahed type) drone struck the New Safe Confinement over Chornobyl’s reactor four;^[9] by December 2025 the International Atomic Energy Agency assessed that the structure had lost its primary safety functions, including confinement.^[10] In May 2026 a drone strike caused a fire at an electrical generator on the perimeter of the United Arab Emirates’ Barakah nuclear plant; a civilian reactor site; leaving one unit running on emergency diesel generators.^[11][12]

The homeland and deployed force dimension is now concrete for the United Kingdom. In early March 2026 a Shahed type drone struck a runway at RAF Akrotiri in Cyprus; a British Sovereign Base Area; causing limited damage,^[13] and the UK flew defensive sorties and, where requested, acted in the collective self defence of regional allies.^[14] Ukraine’s Operation Spider’s Web (June 2025) had already shown that 117 first person view drones launched from concealed truck borne containers could strike strategic bomber bases far from any front line, damaging more than 40 aircraft, with some guidance reportedly AI assisted.^[15]

A necessary qualification

Not every battlefield lesson maps to the British mainland. The most credible open analysis holds that long range Shahed type strikes on Great Britain would face high attrition because of geography and warning time, while shorter range drones launched from containers or by hostile special forces remain a credible risk to high value assets at home. The policy implication is to discriminate between vectors; not to import foreign assumptions wholesale, and not to dismiss the threat. A refreshed strategy should say so candidly.

2.  Why the 2019 strategy can no longer stand alone

The clearest institutional signal came in February 2026, when the Ministry of Defence reported 266 drone incidents near UK military sites during 2025 (up from 126 in 2024) and sought fresh statutory powers through the Armed Forces Bill; extending beyond aerial drones to land and maritime systems; to allow Defence personnel to defeat drones at their own sites without waiting for police intervention.^[6] When the armed forces must legislate around a framework built for policing to protect their own bases, that framework has expired.

3.  The legal framework: developed, but fragmented

Domestic powers have expanded since 2019 but remain complex. The Air Traffic Management and Unmanned Aircraft Act 2021 created bespoke constabulary powers to ground, stop, search, inspect and seize unmanned aircraft, and amended section 93 of the Police Act 1997 to facilitate authorisations for certain counter drone measures.^[17][18] In the civil regime, the Civil Aviation Authority’s Direct Remote ID requirements came into force on 1 January 2026 for UK1, UK2, UK3, UK5 and UK6 class drones, with extension to most drones carrying a camera from 1 January 2028.^[19]

Yet lawful defeat is markedly harder than detection. Operational use of a jammer is generally an offence under section 68 of the Wireless Telegraphy Act 2006, and Ofcom has no power to authorise operational use; only narrow trial and research licences in shielded conditions.^[20] Government is separately examining the enforcement framework around jammers.^[21] Kinetic or electronic interference may amount to unlawful property or wireless interference absent proper authorisation; the Act’s own explanatory notes acknowledge as much. Techniques that take over a drone by software may engage the Computer Misuse Act 1990 and the Investigatory Powers Act 2016, and sensing engages the Data Protection Act 2018, the UK GDPR and the Human Rights Act 1998, which requires the state both to protect life from foreseeable threats and to keep its sensing and defeat measures necessary and proportionate. A lawful defeat chain is a designed legal artefact, not an improvisation.

Overseas action sits within international law. The Government’s March 2026 legal position on Iranian regional attacks invoked the collective self defence of allies under Article 51 of the UN Charter, subject to necessity and proportionality and Security Council notification.^[14] Once in armed conflict, drones attract no special category: they are governed by the ordinary rules of distinction, proportionality and precaution applicable to all weapons.^[22]

4.  Recommendations

The Government should replace the 2019 strategy with a new instrument covering the whole of government. Five propositions should anchor it:

1. Integrate, do not append. A single Counter Uncrewed Systems and Air Threat Resilience Strategy spanning the Home Office, MoD, Cabinet Office resilience, CAA, Ofcom, NPSA, the intelligence community, prisons and CNI operators, aligned to NATO’s integrated air and missile defence framework.^[16]
2. Consolidate the law. A statutory code (or, at minimum, statutory guidance) defining who may detect, disrupt and defeat uncrewed systems, where, against which threat category, under what authorisation, with what recording and what review after an incident — differentiating urban areas, prisons, airports, defence sites and overseas operations.
3. Adopt a layered baseline that is alert to cost. Use NPSA’s site specific, threat informed model as the national spine,^[23] plugging into a wider air and missile defence architecture for higher end threats, and prioritising defeat options that are low in collateral, deep in magazine and economically rational. A missile fired at every cheap drone is not a strategy; it is a budgetary confession.
4. Treat industry and export control as readiness. Link procurement, export licensing, sanctions intelligence and sovereign industrial strategy, with secure by design and open architecture requirements across C-UAS procurement. A state that cannot source the components of its own counter drone systems is not strategically autonomous.
5. Compliance and oversight by design. Require a written legal basis, data minimisation, retention limits and human oversight for every C-UAS deployment by a public authority; subject identification by AI to documented necessity and a review of error rates; and provide Parliament an annual ministerial statement on C-UAS powers, deployments, tests, safety incidents, rights compliance and lessons learned, with NPSA and the ICO involved where domestic surveillance is concerned.

5.  Conclusion

None of this discards the 2019 strategy’s best inheritance; its insistence on layered intervention over an optimism founded on gadgets, an instinct NPSA’s later guidance has only reinforced.^[5] The task is not to repudiate 2019 but to lift its sound protective security spine into an architecture wide enough for the threat that now exists: a spectrum of low cost, autonomous and electronically contested uncrewed systems, ranging from nuisance to war. The 2019 strategy answered the question of its decade. It is time to ask the question of this one.

The post appeared first on Blakistons.

The newsletters keep landing in my inbox with their countdowns. The latest one fixes on 2 August; the date the AI Office acquires real teeth over general-purpose AI models. I read these updates the way a coastal town reads tide tables: not because every wave matters to me, but because I need to know which ones will reach the door. So let me work through what this particular tide actually touches, from the perspective of someone who spends their days arguing about machines that fly.

The autonomy problem nobody wants to define

Start with the thing that makes drones legally interesting in the first place: autonomy is a spectrum, and the law hates spectrums.

A consumer quadcopter holding position in a breeze is running control loops that would have been called “artificial intelligence” in a 1980s research paper. A military loitering munition selecting between candidate targets is doing something most people would unhesitatingly call AI, and find alarming. Between those two poles sits an enormous, messy middle; obstacle avoidance, automated return-to-home, “follow me” tracking, swarm coordination, automated target recognition that merely flags rather than decides. Where on that spectrum does a drone become an “AI system” in the meaning of Article 3?

This matters enormously and almost nobody asks it cleanly. The Act’s definition turns on a system that infers, from inputs, how to generate outputs that influence environments. Plenty of drone autonomy stacks meet that bar comfortably. Plenty of others; deterministic flight controllers executing fixed logic; arguably don’t. I have sat across the table from engineers who insist their navigation system is “just maths,” and they’re not entirely wrong, but “just maths” is also a fair description of every neural network ever trained. The line is not where intuition puts it.

Why the military carve-out is a trap, not a shield

Here is where I watch clients relax too early.

The AI Act contains an exclusion for systems used exclusively for military, defence or national security purposes. Counter-drone work, in particular, loves to shelter under this. The reasoning goes: we detect and defeat hostile UAS, this is inherently a security function, therefore the Act doesn’t reach us. Lovely. Except “exclusively” is doing ruthless work in that sentence, and the dual-use reality of this entire sector makes the exclusion far narrower than people want it to be.

The same RF-detection and optical-tracking stack that protects an airbase gets sold, with a different sticker, to protect a stadium, a prison, a private estate. The moment that system has a civilian commercial life; the moment it is placed on the EU market for protecting critical infrastructure rather than fighting a war; the exclusion frays. And critical infrastructure protection is precisely the kind of use the high-risk classification regime is built to capture. A counter-UAS platform that automatically classifies an incursion and cues a response near an airport is not obviously outside the high-risk net just because its cousin wears camouflage.

The targeted consultation on the high-risk classification guidelines, open until late June, is therefore not abstract bureaucracy to me. Those guidelines are where the boundary between “this is a security tool, leave it alone” and “this is a high-risk system, document everything” will actually get drawn through worked examples. Anyone in this sector who isn’t reading those drafts is choosing to be surprised later.

Article 50 and the drone you can’t see

Now the part that genuinely changes behaviour on the ground.

Article 50’s transparency obligations don’t care about risk tiers. They bite on situations; and one of those situations is biometric categorisation, another is emotion recognition, and another is content that interacts with or affects people. Picture the increasingly common deployment: a drone with a camera doing crowd monitoring, perimeter patrol, or event security. The instant that payload starts categorising people by biometric attributes, the deployer owes the exposed individuals notice. You cannot quietly run biometric categorisation from 120 metres up and treat the altitude as a privacy shield. The obligation attaches to what the system does, not to how far away the lens sits.

I find this is the provision that catches operators off guard, because it cuts against the entire instinct of aerial surveillance, which is to be unobtrusive. The law is, in effect, telling a category of drone operator that unobtrusiveness is now sometimes unlawful. That is a genuinely interesting collision between the technology’s reason for existing and the regulation’s reason for existing, and it is going to generate litigation.

The sandbox that slipped a year

There was a small piece of news in the recent updates that I suspect most readers skimmed: the establishment deadline for regulatory sandboxes has been pushed from August 2026 to August 2027.

For most industries that’s a footnote. For drones it’s meaningful, because the sandbox model is arguably better suited to unmanned aviation than to almost any other AI domain. We already have a mature culture of supervised, geographically-bounded testing; segregated airspace, specific operational risk assessments, temporary danger areas. A regulatory sandbox is conceptually just that culture extended from airworthiness into algorithmic compliance. The delay means the one mechanism that could let a counter-UAS startup test automated-response logic on real incursions, under supervision, with some shelter from fines, won’t materialise on the original timetable. The companies most in need of a structured way to prove their systems are safe will spend another year improvising compliance instead. Whether that protects the public or merely protects incumbents is the kind of question I find genuinely unresolved.

What I’m telling clients

The honest summary I give, stripped of comfort, runs roughly like this. The August date isn’t your date; it’s aimed at the makers of large general-purpose models, and most drone autonomy doesn’t live there. But the regime those powers belong to is the same regime whose high-risk rules and Article 50 duties absolutely will reach you, and the classification guidelines being drafted right now are where your fate gets decided. Don’t wait for enforcement to tell you which side of the line you’re on. The structured dialogue the AI Office favours means the first contact is likely to be a request for documentation, not a fine; which means the clients who survive comfortably are simply the ones who wrote the documentation before anyone asked.

Drones made autonomy visible; something you can point at in the sky. That visibility is exactly why this sector will be among the first places the AI Act’s abstractions get tested against physical reality. I’d rather my clients be the test case that wins than the cautionary one. The tide tables are right there in my inbox. The only real choice is whether to read them.

This is not legal advice; if you’re making compliance decisions about a specific system, get advice tailored to it.

About the author
Richard Ryan is a Direct Access Barrister at Blakiston’s Chambers, and a chartered arbitrator and accredited mediator, specialising in drone and counter-drone law. He advises operators, manufacturers, UTM providers, insurers and public bodies across the full UAS spectrum — regulatory permissions and BVLOS approvals, C-UAS deployment at airports, prisons and critical infrastructure, data and privacy, liability and high-value disputes. Instruct him directly or through solicitors.

The post The Drone in the Room: What the AI Act’s August Deadline Actually Means for Unmanned Aircraft appeared first on Blakistons.

The post How Europe’s new AI rulebook would (and wouldn’t) touch autonomous combat aircraft—and what the defence carve?outs really mean appeared first on Blakistons.

Military Drones and AI Regulation: A UK Drone Lawyer’s Perspective

By Richard Ryan, UK Drone Lawyer

On 7 January 2025, The Guardian published an article highlighting the British AI consultancy Faculty AI’s involvement in the development of drone technology for defence clients, prompting renewed questions about where legal, ethical, and regulatory boundaries should lie for AI-driven military applications.
Faculty AI, already prominent for its work with various UK government departments (including the NHS and the Department for Education) and advisory services for the AI Safety Institute (AISI), has reportedly developed and deployed AI models on unmanned aerial vehicles (UAVs) for military purposes. Although it remains unclear whether these drones are intended for lethal operations, the revelations have amplified concerns about how best to regulate or restrict the use of AI in weapon systems.
Below, I explore the key legal issues and examine how the recently adopted EU AI Act—as well as the evolving UK regulatory framework—may shape the future of this sector.
________________________________________
1. Faculty AI’s Defence Work: A Brief Overview
1.1 Government and Public Sector Ties
Faculty AI, known for its work with the Vote Leave campaign in 2016, was later engaged by Dominic Cummings to provide data analytics during the pandemic. Since then, it has won multiple government contracts worth at least £26.6m, extending its work into healthcare (via the NHS), education, and policy consulting with the AISI on frontier AI safety.
1.2 UAV Development
The Guardian reports that Faculty AI has experience in deploying AI models on UAVs. Its partner firm, Hadean, indicated that the two companies collaborated on subject identification, tracking objects in movement, and exploring swarm deployment. While Faculty states that it aims to create “safer, more robust solutions”, details on whether these drones might be capable of lethal autonomous targeting remain undisclosed.
________________________________________
2. The EU AI Act: A New Regulatory Milestone
2.1 Status of the EU AI Act
Introduced by the European Commission in 2021 as a proposed regulation, the EU AI Act has since been adopted via the EU’s legislative process. As of early 2025, it is recognised as a binding regulation designed to harmonise AI rules across all EU Member States. Although the UK is no longer part of the EU, any UK-based company offering AI products or services within the EU must ensure compliance with the regulation’s requirements.
2.2 Risk-Tiered Framework
The EU AI Act operates on a tiered risk basis:
• Unacceptable risk: Certain AI applications (e.g., social scoring) are outright banned.
• High risk: This category includes critical infrastructure, healthcare, and—potentially—defence-related AI systems that could significantly affect people’s safety or fundamental rights. Such systems must meet strict transparency, oversight, and data governance requirements.
• Limited or minimal risk: These uses are subject to fewer obligations, generally focused on transparency (e.g., disclosing AI usage to end users).
For high-risk AI in military contexts, the EU AI Act demands robust human oversight, thorough documentation, and strict compliance obligations, particularly around accountability and the prevention of harm.
2.3 Potential Impact on Military Drones
While national security and defence largely remain the prerogative of individual EU Member States, the EU AI Act’s principles can still influence how companies and governments view the development of autonomous or semi-autonomous drones. Key considerations include:
• Transparent Data and Design: Documenting data sets, development processes, and operational parameters.
• Human in the Loop: Ensuring a human operator is always able to override or intervene in the AI’s decision-making. Other terms such as Human on the Loop and Human outside the Loop are also referred to.
• Liability and Penalties: Breaches can incur hefty fines—up to 6% of global turnover—thus acting as a significant deterrent against unethical or unlawful AI deployment.
________________________________________
3. The UK’s Approach to AI Regulation and Military Drones
3.1 Divergence from the EU?
Post-Brexit, the UK has chosen a “pro-innovation” approach to AI regulation. Rather than adopting a single, all-encompassing statute akin to the EU AI Act, the UK is implementing a sector-by-sector and risk-based strategy, guided by existing regulators such as the Information Commissioner’s Office and the Competition and Markets Authority.
3.2 AI Safety Institute (AISI)
Established under former Prime Minister Rishi Sunak in 2023, the AISI focuses on frontier AI safety research. Faculty AI’s role in testing large language models and advising the AISI on threats like disinformation and system security places the company in a key position to influence UK policy. Critics argue that this may create potential conflicts of interest if the same organisation is also developing AI for military use.
3.3 House of Lords Recommendations
In 2023, a House of Lords committee urged the UK Government to clarify the application of International Humanitarian Law (IHL) to lethal drone strikes and to work towards an international agreement limiting or banning fully autonomous weapons systems. The Government response acknowledged the importance of maintaining “human control” in critical decisions but did not enact binding legislation banning lethal autonomous drones outright.
________________________________________
4. Legal and Ethical Concerns for AI-Enabled Drones
4.1 International Humanitarian Law (IHL)
IHL principles—distinction (separating combatants from civilians) and proportionality (limiting harm relative to military objectives)—are central to discussions on AI-driven drones. Fully autonomous UAVs, capable of selecting and engaging targets without human intervention, raise profound legal questions on accountability, particularly if biases or system errors result in wrongful casualties.
4.2 Allocation of Liability
Traditionally, accountability in military operations lies with commanders and operators. With increasingly autonomous systems, however, liability could extend to technology developers, programmers, or even the purchaser of the system. Clarifying how legal responsibilities are distributed may become a focal point for future litigation and regulatory reform.
4.3 Export Controls
Companies like Faculty AI must also comply with arms-export rules when providing AI-targeting systems or related software to foreign entities. In the UK, export licences for military-grade technology are subject to domestic legislation and international protocols, such as the Wassenaar Arrangement on dual-use goods.
________________________________________
5. Looking Ahead: Balancing Innovation, Safety, and Accountability
5.1 Stronger National Frameworks
Although the UK favours a pro-innovation stance, there is growing pressure from Parliament and civil society for more rigorous, enforceable rules on potentially lethal AI applications. The EU AI Act may serve as a reference point for the UK to consider stricter domestic regulations.
5.2 International Collaboration
Calls for global agreements—treaties or non-binding accords—to prohibit fully autonomous weapons continue to gain momentum. The House of Lords committee specifically recommended international engagement to ensure that lethal force remains under human control.
5.3 Corporate Accountability
Organisations operating at the intersection of commercial defence contracts and government policy—such as Faculty AI—need transparent internal processes and robust ethics boards to mitigate conflicts of interest. Demonstrating genuine corporate responsibility will be vital for maintaining public trust.
5.4 Ethical and Safety Audits
As AI becomes more embedded in defence, mandatory ethical and safety audits may become standard practice. These would scrutinise algorithmic fairness, training data, and how effectively systems can identify and mitigate unintended harms.
________________________________________
6. Conclusion
Faculty AI’s role in developing AI for military drones underscores how high the stakes are when cutting-edge technology meets defence applications. With the EU AI Act now in force as a binding regulation, Europe has provided a blueprint for tighter control over “high-risk” AI systems. In contrast, the UK’s approach still offers substantial flexibility for companies, potentially raising both legal and ethical concerns around autonomy, accountability, and conflicts of interest.
From an IHL standpoint, keeping a human responsible for any life-and-death decision is imperative. As a UK drone lawyer, I urge policymakers, regulators, and industry stakeholders to keep asking: Where do we draw the line between legitimate defensive innovation and an unacceptable risk to civilians? Only by establishing clear, enforceable legal standards—anchored in international law and ethical scrutiny—can we ensure AI-powered drones serve to protect rather than endanger fundamental human values.

Bio – Richard Ryan, UK Drone Lawyer

Richard Ryan is a UK-based drone lawyer specialising in the regulatory, ethical, and commercial aspects of unmanned aerial vehicles (UAVs) and artificial intelligence (AI). Through a series of blogs, Richard Ryan has explored critical issues such as the EU AI Act, the UK’s evolving “pro-innovation” regulatory landscape, and the legal considerations surrounding military drones and lethal autonomous weapons systems.

Drawing on extensive experience in advising government bodies, technology companies, and public institutions, Richard Ryan brings a deep understanding of how international humanitarian law (IHL), export controls, and data protection obligations intersect in modern drone operations. Their writing emphasises the importance of maintaining human oversight in AI-driven systems, championing ethical development and transparent accountability mechanisms.

A trusted voice in the field, Richard Ryan regularly comments on emerging case law, parliamentary recommendations, and global discussions around frontier AI safety. The mission is to help stakeholders—from hobbyist drone operators to established aerospace firms—navigate the complexities of regulation, risk management, and innovation.

The post Military Drones and AI Regulation: A UK Drone Lawyer’s Perspective appeared first on Blakistons.

By Richard Ryan, Drone Lawyer

Introduction

The integration of Artificial Intelligence (AI) into drones has revolutionised various industries, from agriculture and logistics to surveillance and defence. AI-powered drones offer advanced capabilities like autonomous navigation, obstacle avoidance, and sophisticated data analysis. However, the rapid advancement of AI technologies brings forth legal and ethical challenges that necessitate robust regulatory frameworks.

The European Union’s proposed Artificial Intelligence Act (AI Act) represents a pioneering effort to regulate AI technologies comprehensively. As a drone lawyer based in the UK, I aim to explore the potential impact of the AI Act on the drone industry and review the current state of its implementation across various EU countries.

The EU AI Act and Its Relevance to Drones

The AI Act is designed to mitigate risks associated with AI systems by categorizing them based on their potential impact on safety and fundamental rights. High-risk AI systems—those used in critical infrastructure, law enforcement, or that have significant implications for health and safety—are subject to stringent regulatory requirements.

Key Implications for the Drone Industry:

1. Classification as High-Risk AI Systems: Drones equipped with AI functionalities for surveillance, data collection, or autonomous operations may be classified as high-risk. This classification subjects them to rigorous compliance obligations.

2. Compliance Requirements: Manufacturers and operators must implement risk management systems, ensure high-quality data sets, maintain transparency, and provide detailed technical documentation.

3. Conformity Assessments: Before entering the EU market, AI-powered drones may need to undergo conformity assessments to verify compliance with the AI Act’s provisions.

4. Transparency and Human Oversight: The Act emphasises the need for human oversight over AI systems. Drone operators may be required to ensure that AI decisions can be audited and overridden by humans when necessary.

5. Data Governance: Strict rules on data quality and governance affect how drones collect, process, and store data, especially personal or sensitive information.

Current Implementation Status in EU Countries

While the AI Act is still under negotiation and has not been enacted as of October 2023, several EU Member States are proactively preparing for its implementation.

Spain

Spain has established the Spanish Artificial Intelligence Supervisory Agency (AESIA), demonstrating a proactive stance toward AI regulation. AESIA is set to act as the market surveillance authority under the Department of Digital Transformation, indicating Spain’s commitment to enforcing the AI Act’s provisions once they become law.

Finland

Finland proposes a decentralized model by appointing multiple existing authorities as market surveillance entities, including the Energy Authority and the Medicines Agency. This approach leverages existing regulatory bodies to oversee AI compliance across different sectors.

Italy

Italy is considering assigning its national digital and cybersecurity agencies to enforce the AI Act. Preparations include building internal capacities and fostering research partnerships, emphasizing the development of competencies and continuous dialogue with scientific communities.

Ireland

Ireland has published a list of nine national public authorities responsible for protecting fundamental rights under the AI Act. These authorities will gain additional powers to address high-risk AI systems, including access to mandatory documentation from developers and deployers.

Germany and France

Both countries are actively engaged in discussions and preparatory measures to align with the AI Act. Germany’s Federal Ministry for Economic Affairs and Climate Action and France’s Directorate General of Enterprises are leading these efforts, though detailed implementation plans are still forthcoming.

Implications for the UK Drone Industry

Although the UK has left the EU, the AI Act could significantly impact UK-based drone companies:

– Market Access: To operate within the EU, UK companies must ensure their AI-enabled drones comply with the AI Act’s requirements.
– Regulatory Alignment: The UK may consider aligning its AI regulations with the EU to facilitate trade and maintain high standards of AI governance.
– Competitive Edge: Understanding and adapting to the AI Act can provide UK companies with a competitive advantage in the European market.

Recommendations for Drone Stakeholders

1. Stay Informed: Keep abreast of developments regarding the AI Act and its implementation across EU Member States.

2. Assess AI Systems: Evaluate existing AI functionalities within drones to determine if they fall under the high-risk category.

3. Prepare for Compliance: Develop strategies to meet compliance obligations, including documentation, risk assessments, and implementing human oversight mechanisms.

4. Engage with Regulators: Participate in consultations and dialogues with regulatory bodies to influence policy and gain clarity on compliance requirements.

Conclusion

The EU AI Act represents a significant step toward comprehensive AI regulation, with profound implications for the drone industry. Companies involved in the development and operation of AI-powered drones must proactively address potential compliance challenges. By understanding the regulatory landscape and preparing accordingly, drone manufacturers and operators can ensure continued innovation while adhering to legal and ethical standards.

—

About the Author

Richard Ryan is a drone lawyer based in the UK, specialising in aviation law, AI regulation, and data protection. With extensive experience advising drone manufacturers, operators, and users, Richard Ryan has presented to leading defence companies on the impact of AI regulation on drone technology. Committed to guiding clients through the complex legal landscape of emerging technologies, Richard Ryan offers insights and expertise to navigate the evolving world of AI and drones. Richard Ryan is a PhD student at Cranfield University researching the regulatory framework of UTM system for unmanned aviation.

The post The Impact of the EU AI Act on Drones: A Comprehensive Overview appeared first on Blakistons.