Drone Law | UK SORA | CAA Regulation | AI Governance

Summary: CAA Decision No. 60 marks a significant development in the regulation of Specific category drone operations in the UK. Coming into force on 1 October 2026, it updates the UK SORA framework and introduces clearer expectations around compliance evidence, ground-risk mitigation, containment, kinetic energy analysis and evidence retention. For operators, the message is clear: compliance is no longer just a narrative safety case. It must be evidenced, retained and auditable.

1. Why Decision No. 60 Matters

The UK’s lower airspace is becoming increasingly complex. Beyond Visual Line of Sight operations, drone delivery, infrastructure inspection, emergency services use, autonomous routing and higher-risk commercial UAS activity all require a more mature regulatory framework.

CAA Decision No. 60 updates the Acceptable Means of Compliance and Guidance Material for UK Regulation (EU) 2019/947. In practical terms, it strengthens the UK Specific Operation Risk Assessment, or UK SORA, for operators seeking authorisation in the Specific category.

The legal significance is that UK SORA is becoming a structured assurance methodology. Operators must not merely state that an operation is safe. They must demonstrate that the aircraft, procedures, people, operational volume, ground environment, airspace risks, mitigations and emergency arrangements meet the required level of safety.

2. UK SORA Is Not a Box-Ticking Exercise

UK SORA exists to support the operational risk assessment required for Specific category operations. It considers both ground risk and air risk, then applies mitigations and operational safety objectives according to the Specific Assurance and Integrity Level, or SAIL.

The updated framework is particularly important because it clarifies how operators must gather, present and retain compliance evidence. This is a move away from generalised operational assertions and towards aviation-grade documentation.

3. The Three Compliance Pathways

Decision No. 60 identifies three broad routes for demonstrating compliance.

Operators must also retain compliance evidence for the duration of the operational authorisation and for three years after operations under that authorisation cease. That evidence may become critical in a CAA audit, incident investigation, insurance dispute or civil claim.

4. Ground Risk: What Happens If the Drone Falls?

Ground risk is central to UK SORA. The law is concerned not only with whether the drone can fly, but with what happens if it fails. Decision No. 60 provides more detailed guidance on how operators may reduce ground risk.

5. Kinetic Energy and Penetration Risk

Decision No. 60 gives particular importance to kinetic energy. This matters because it converts safety claims into measurable injury-risk analysis.

Operators should not rely on generic manufacturer statements. They need platform-specific evidence: mass, velocity, terminal impact behaviour, parachute performance, battery fire risk and representative structural analysis.

6. Containment and Fly-Away Risk

Containment is a central pillar of the updated UK SORA framework. It asks whether the unmanned aircraft can be kept within its operational volume and ground risk buffer, even after failure or loss of control.

For lower-risk operations, containment may be assessed qualitatively through design appraisal and procedural evidence. For higher-risk operations, the CAA may expect quantitative probability targets, such as demonstrating that the probability of exiting the relevant volume or buffer is below specified thresholds per flight hour.

Containment evidence may include geo-caging, tethering, independent flight termination systems, lost-link logic, command-and-control resilience, navigation integrity, power-system independence and emergency procedures.

7. EU AI Act and UK AI Standards

Decision No. 60 is not an AI regulation. However, many modern drone operations increasingly rely on AI-enabled functions, including detect-and-avoid, automated route planning, computer vision, landing assistance, ground-person detection, predictive maintenance and autonomous contingency management.

The EU AI Act is relevant as a benchmark for risk management, technical documentation, record-keeping, transparency, human oversight, robustness and cybersecurity. The UK does not currently have a single equivalent UK AI Act. Instead, it follows a sector-led, principles-based model based on safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.

8. Data Protection and Surveillance Risk

Many Specific category operations involve cameras, thermal imaging, mapping payloads or AI-enabled object recognition. UK SORA primarily addresses safety, but operators must also consider privacy, data protection and surveillance risk.

If cameras or AI systems detect uninvolved persons, personal data may be captured, stored or analysed. Operators may need a data protection impact assessment, retention limits, access controls, privacy notices and clear rules on secondary use.

9. What Operators Should Do Before 1 October 2026

Operators should review their safety cases and evidence packs now. In particular, they should check:

• Aircraft mass, speed, kinetic energy and terminal velocity;
• Ground-risk assumptions and population-density evidence;
• Sheltering, operational restriction and observation claims;
• Parachute, flight termination and impact mitigation evidence;
• Containment evidence, including geo-caging and lost-link logic;
• AI-enabled functions, including detect-and-avoid and automated decision-support tools;
• Evidence retention systems;
• Supplier contracts for access to technical data.

10. Bottom Line

CAA Decision No. 60 marks a shift from descriptive drone safety cases to structured assurance. Operators must now be able to prove their safety claims through coherent, retained and auditable evidence.

The most important development is the convergence between aviation safety and AI governance. UK SORA asks whether the drone operation is safe. The EU AI Act and UK AI principles ask whether automated systems are risk-managed, documented, robust, explainable, secure and subject to human oversight. For modern drone operations, those are increasingly the same question.

Compliance is not what the operator says it does. Compliance is what the operator can prove.

About the Author

Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, aviation regulation and artificial intelligence. He advises operators, manufacturers and public bodies on UK CAA regulation, UK SORA, BVLOS operations, AI governance and commercial drone operations. He is currently undertaking a PhD at Cranfield University researching the legal framework for autonomous aviation and future airspace integration.

This article is general legal commentary and does not constitute legal advice.

The post Navigating UK SORA: A Drone Lawyer’s Guide to CAA Decision No. 60 appeared first on Blakistons.

Drone Law | Counter-UAS | Defence AI | One-Way Effectors

Summary: The Royal Navy’s launch of the British-built Nyan One-Way Effector from XV Patrick Blackett is more than a drone trial. It is a legal and operational marker in the UK’s transition towards a Hybrid Navy, raising issues of targeting law, weapons review, military airworthiness, counter-UAS defence, export controls and AI governance.

1. Why the Nyan Trial Matters

The Royal Navy and British Army have tested the Nyan One-Way Effector, designed and built by BAE Systems’ Callen-Lenz, for both maritime and land operations. The system has a 2.9-metre wingspan and is designed to provide a precision strike capability. It has now been launched from the Royal Navy’s experimentation ship XV Patrick Blackett as part of Project Vantage, the programme focused on accelerating maritime one-way effector capability.

Legally, the phrase “one-way effector” should not distract from the underlying classification problem. Nyan may simultaneously be an aircraft, a military UAS, a weapon system, a munition, a software-enabled targeting platform and an export-controlled defence article. Each classification carries its own compliance burden.

2. From Drone Novelty to Combat Mass

The trial reflects the UK’s move towards crewed-uncrewed teaming and the Royal Navy’s Hybrid Navy concept. One-way effectors are intended to provide affordable combat mass, allowing crewed platforms to extend reach, increase tempo and complicate an adversary’s defensive picture.

However, affordability does not dilute legal responsibility. The cheaper and more numerous the weapon, the more frequently it may be used. The more frequently it is used, the more important lawful targeting architecture becomes.

3. Autonomy: The Legal Question Is What the Machine Decides

The key legal question is not whether Nyan is a drone, but what functions are automated or autonomous. Autonomy in navigation is not the same as autonomy in target selection. A system may fly itself to a pre-programmed target without being authorised to decide who or what is attacked.

Commanders and lawyers should ask:

• Does the system merely navigate to a human-selected target?
• Does it detect, classify, prioritise or select targets?
• Can it be retasked, recalled, aborted or terminated after launch?
• What happens if GPS is jammed, spoofed or degraded?
• What mission data and operator decisions are recorded?

Those questions determine whether the system can be used consistently with distinction, proportionality, precautions in attack and applicable rules of engagement.

4. Article 36 Weapons Review

A one-way effector requires a disciplined weapons review. That review should not be limited to the airframe or warhead. It should include the launcher, mission-planning software, navigation system, datalinks, communications architecture, abort logic, cyber resilience, payload effects and integration with intelligence or targeting systems.

The review must also examine foreseeable use cases. Launching from land against a fixed target is materially different from launching from a moving naval platform against a maritime or coastal target. The latter introduces neutral shipping, civilian infrastructure, allied aircraft, electromagnetic interference, airspace deconfliction and more complex proportionality assessments.

5. EU AI Act and UK AI Standards

The EU AI Act generally excludes AI systems used exclusively for military, defence or national-security purposes. However, its high-risk AI standards remain useful benchmarks for dual-use suppliers, defence contractors, procurement assurance and civilian spin-outs.

The UK does not currently have a single equivalent “UK AI Act”. Instead, the UK uses a sector-led, principles-based model. In defence, this is supplemented by Ministry of Defence AI principles, including human-centricity, responsibility, understanding, bias and harm mitigation, and reliability.

6. Maritime Launch Changes the Legal Burden

Launching from a ship is materially different from launching from a land range. The platform is moving. Weather and sea state affect launch reliability. The electromagnetic environment may be contested. The operating area may include neutral vessels, civil aircraft, allied aircraft, helicopters, missiles and other uncrewed systems.

The legal architecture must therefore include target validation, positive identification, proportionality analysis, precautions in attack, air and maritime deconfliction, and auditability. The question is not simply whether Nyan can be launched from a ship. The question is whether the Navy can generate a repeatable, auditable and legally defensible kill chain from a ship.

7. The Counter-UAS Mirror

Every one-way effector creates a corresponding defence problem. If the UK can launch low-cost precision effectors from ships, adversaries and proxies can attempt similar effects. Counter-UAS law is therefore inseparable from OWE deployment.

Defending ships, ports, airbases and critical infrastructure requires layered capabilities: detection, identification, tracking, electronic warfare, cyber effects, kinetic interceptors, directed energy, decoys, hardening, dispersal and forensic recovery.

In armed conflict, commanders will operate under the law of armed conflict and rules of engagement. In peacetime or grey-zone conditions, counter-drone operations may engage aviation law, communications law, property rights, criminal law, public safety, port security and military aid to civil authorities.

8. Export Controls and Procurement Risk

Sovereign manufacture does not remove export-control obligations. Airframes, propulsion systems, launchers, datalinks, payloads, source code, mission-planning tools, technical assistance and software updates may all require careful classification and licensing analysis.

Rapid procurement also creates legal debt if safety cases, software changes, data rights, AI assurance, cyber resilience and operator training are not properly documented. The solution is not to slow innovation, but to embed lawyers, engineers, safety specialists, AI assurance teams and operators into the experimentation cycle from the start.

9. Bottom Line

The Nyan sea launch is a significant step towards a British Hybrid Navy. Its real importance lies in the legal system-of-systems problem it exposes. A one-way effector is not merely a drone with a warhead. It moves through air law, weapons law, targeting law, AI governance, export-control law, safety regulation, procurement governance and counter-UAS doctrine.

The future fleet will not be judged only by how many drones it can launch. It will be judged by whether it can launch them lawfully, safely, proportionately, responsibly and at scale.

About the Author

Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, counter-UAS, defence procurement and AI governance. He advises government, defence and technology organisations on autonomous systems, military aviation, export controls, commercial contracts and regulatory compliance. Richard is also undertaking a PhD at Cranfield University researching the future legal framework for BVLOS operations, autonomous aviation and Unmanned Traffic Management.

This article is general legal commentary and does not constitute legal advice.

The post Nyan at Sea: One-Way Effectors, Counter-UAS Law and Defence AI Governance appeared first on Blakistons.

From 1 January 2026, the UK drone regulatory framework enters a new phase. While the underlying legal structure remains based on the Air Navigation Order 2016 and UK UAS Regulations, several operational changes are being introduced. Understanding the distinction between legislation, Civil Aviation Authority guidance, and industry practice is now essential.

This article provides a practical legal overview of the key changes affecting recreational and commercial drone operators flying within the Open Category in the United Kingdom.

Law and Guidance Are Not the Same Thing

One of the most common misunderstandings among drone operators is the assumption that everything in the Drone Code or CAA guidance is itself law.

The legal framework consists primarily of legislation, including the Air Navigation Order 2016 and UK UAS Regulations. These are the provisions under which enforcement action and prosecutions may occur.

The CAA also publishes guidance, including CAP 722, Acceptable Means of Compliance and the Drone Code. These materials are highly important, but they are generally guidance rather than legislation. Compliance with them will usually be persuasive evidence of safe and responsible operation.

A useful way to think about compliance is:

• Green: operating within CAA guidance and published best practice.
• Amber: operating within the law but outside guidance.
• Red: operating outside the legal framework.

Flying outside guidance may sometimes remain lawful, but operators must be ready to justify their decisions if challenged by the police, the CAA or a court.

Registration Requirements

Most drones with a camera and weighing more than 100 grams require registration under the Drone and Model Aircraft Registration and Education Scheme.

Operators will generally need both an Operator ID and a Flyer ID.

The Operator ID identifies the person responsible for the aircraft and must be displayed on the drone. The Flyer ID confirms that the pilot has passed the required competency test and remains valid for five years.

Importantly, it is the operator who is registered rather than the drone itself.

Universal Rules for All Drone Flights

Maximum Altitude

The maximum operating height remains 120 metres, or 400 feet, above the closest point of the earth’s surface. This matters particularly when flying near cliffs, hills, mountains or other changing terrain.

Visual Line of Sight

Visual Line of Sight remains a central requirement of UK drone regulation.

The pilot must be able to see the aircraft sufficiently to avoid collisions in the air and manage risks on the ground. Seeing only a small dot or relying solely on navigation lights is unlikely to be defensible if an incident occurs.

First Person View Flying

Where FPV goggles are used, a competent observer or spotter is generally required. The spotter should remain beside the pilot and maintain awareness of air and ground hazards while the pilot is focused on the video feed.

Airspace Restrictions

Many drone prosecutions arise from breaches of airspace restrictions rather than from technical flying errors.

Airspace should be checked before every flight using a reliable and current source of aeronautical information. The information should be refreshed immediately before launch.

Key restriction types include:

• Flight Restriction Zones: permanent restricted areas around airports, prisons and protected sites.
• Temporary Restrictions: restrictions created for events, security operations and public safety purposes.
• NOTAMs: aviation notices which may affect drone operations.

Operators should use modern airspace mapping tools and should not assume that yesterday’s airspace position remains correct today.

A1, A2 and A3 Operational Categories

A1: Flying Over People

The A1 category provides the greatest flexibility. Certain drones under 250 grams may be flown over uninvolved persons, although flight over crowds remains prohibited.

This category generally includes legacy drones under 250g, UK0 and UK1 aircraft, C0 aircraft and C1 aircraft subject to transitional provisions.

A2: Flying Close to People

A2 operations allow flight near uninvolved persons but generally prohibit flight directly over them. Operators normally require an A2 Certificate of Competency.

Certain UK2 and C2 aircraft may operate with reduced separation distances where the applicable requirements are met.

A3: Flying Far from People

A3 operations are intended for open areas away from uninvolved persons and built-up environments.

Operators must generally maintain 50 metres from uninvolved persons and 150 metres from residential, commercial, industrial and recreational areas.

Article 16 Authorisations

Members of recognised model aircraft and drone associations may benefit from Article 16 Authorisations. These permissions can provide greater operational flexibility, including reduced separation distances and access to some locations that would otherwise be more restricted under the Open Category framework.

Ground Hazards and Article 241

Even where all technical drone requirements are satisfied, operators remain subject to wider safety duties.

Article 241 of the Air Navigation Order provides that a person must not recklessly or negligently cause or permit an aircraft to endanger any person or property.

Ground hazards may include members of the public, vehicles, buildings, infrastructure, wildlife and protected environmental sites.

Particular care should be taken when operating near Sites of Special Scientific Interest and other environmentally protected areas.

Remote ID Arrives in 2026

One of the most significant developments is the introduction of Remote ID.

Remote ID creates an electronic identification system allowing drone operations to be identified through information transmitted by the aircraft.

Implementation is being phased in. New UK1, UK2 and UK3 drones released from 2026 will require Remote ID functionality. Existing aircraft will transition over a longer implementation period extending towards 2028.

Operators should monitor CAA updates closely as implementation progresses.

Night Flying Requirements

Night flying remains permissible within the Open Category.

From 2026, operators will generally require a green flashing light attached to the aircraft.

The purpose of the light is to assist people on the ground in recognising the aircraft as a drone. It should not be treated as a substitute for maintaining Visual Line of Sight.

Insurance and Operational Responsibility

Recreational operators are generally not legally required to carry insurance, although doing so is strongly recommended.

Commercial operators typically require specialist aviation insurance compliant with applicable regulatory requirements.

Pilots should also ensure they are fit to fly, avoid operating under the influence of alcohol or drugs, and remain alert to low-flying manned aircraft at all times.

Conclusion

The 2026 changes represent an evolution rather than a revolution in UK drone regulation.

The key principles remain unchanged: understand the law, check airspace before every flight, maintain Visual Line of Sight, operate safely and proportionately, and keep abreast of developments concerning Remote ID and future airspace integration.

For most operators, compliance remains straightforward. Those who understand the distinction between legislation and guidance, conduct appropriate pre-flight planning and adopt a risk-based approach should continue to fly safely and lawfully throughout 2026 and beyond.

Disclaimer: This article is provided for general information only and does not constitute legal advice. Specific advice should be sought in relation to individual circumstances.

Richard Ryan is a practising barrister, Arbitrator , drone lawyer, and regulatory specialist with more than 20 years’ experience in litigation, arbitration, aviation, defence, technology, construction, and commercial law. He advises drone operators, aerospace companies, government bodies, and technology businesses on complex regulatory, operational, and compliance issues relating to unmanned aircraft systems (UAS), counter-UAS technologies, urban air mobility, and emerging aviation regulation.

Richard is currently undertaking PhD research at Cranfield University examining the future regulatory framework for Beyond Visual Line of Sight (BVLOS) operations, Unmanned Traffic Management (UTM), and the integration of drones into shared airspace. He regularly writes on developments in drone law, aviation regulation, privacy, safety, and the future of autonomous flight.

The views expressed in this article are for general information purposes only and do not constitute legal advice.

The post UK Drone Rules from 1 January 2026: A Lawyer’s Practical Guide for Pilots appeared first on Blakistons.

White Paper

Beyond 2019

A New Counter Uncrewed Systems and Air Threat Resilience Strategy for the United Kingdom, After Ukraine and Iran

By Mr Richard Ryan, Barrister, Blakiston’s Chambers · June 2026

The United Kingdom’s published national counter drone policy; the UK Counter-Unmanned Aircraft Strategy, presented to Parliament as Command Paper 187 on 21 October 2019^[1]; is materially out of date as a strategic document. It remains the only published national strategy in the field for the whole of government, yet it is now approximately six years and seven months old, and roughly three and a half years beyond its own planning horizon.

The strategy was sound for its time. It identified the highest harm illegal uses of small drones; terrorism, smuggling into prisons, disruption of critical national infrastructure; and prescribed layered intervention, industry standards, responder powers and public education.^[2] But it was expressly confined to malicious and illegal use of small aerial drones, in a domestic policing and protective security frame. That frame has been overtaken by operational reality in Ukraine and the Iranian theatre: massed one way attack drones, combined drone and missile salvos, container and special forces launch, dense electronic warfare, fibre optic command links and AI assisted guidance now define the threat.

Subsequent UK documents do not update the 2019 strategy; they work around it. The Defence Drone Strategy (2024),^[3] the Strategic Defence Review 2025,^[4] NPSA’s site specific guidance,^[5] and the Ministry of Defence’s 2026 pursuit of new defeat powers at military sites^[6] together form a patchwork of sectoral adaptations laid over an unrevised core. This paper argues that the 2019 strategy should be retired as a standalone statement and replaced by an integrated Counter Uncrewed Systems and Air Threat Resilience Strategy, supported by a consolidated legal code for detection, disruption and defeat, and by an annual ministerial statement to Parliament.

1.  The threat has become a strategic mass system

The central lesson of 2024–2026 is not that drones have become more common but that they have become a strategic mass system — a consumable class of munition and sensor used for saturation, decoying, attrition of intelligence assets, target acquisition and the deliberate erosion of a defender’s cost exchange ratio. On the night of 2 June 2026, Ukraine’s air force reported that Russia had launched 656 drones and 73 missiles in a single overnight barrage, of which 602 drones and 40 missiles were downed or suppressed.^[7][8] Single salvos now routinely exceed several hundred drones.

Critical infrastructure has been directly affected. In February 2025 a Russian Geran-2 (Shahed type) drone struck the New Safe Confinement over Chornobyl’s reactor four;^[9] by December 2025 the International Atomic Energy Agency assessed that the structure had lost its primary safety functions, including confinement.^[10] In May 2026 a drone strike caused a fire at an electrical generator on the perimeter of the United Arab Emirates’ Barakah nuclear plant; a civilian reactor site; leaving one unit running on emergency diesel generators.^[11][12]

The homeland and deployed force dimension is now concrete for the United Kingdom. In early March 2026 a Shahed type drone struck a runway at RAF Akrotiri in Cyprus; a British Sovereign Base Area; causing limited damage,^[13] and the UK flew defensive sorties and, where requested, acted in the collective self defence of regional allies.^[14] Ukraine’s Operation Spider’s Web (June 2025) had already shown that 117 first person view drones launched from concealed truck borne containers could strike strategic bomber bases far from any front line, damaging more than 40 aircraft, with some guidance reportedly AI assisted.^[15]

A necessary qualification

Not every battlefield lesson maps to the British mainland. The most credible open analysis holds that long range Shahed type strikes on Great Britain would face high attrition because of geography and warning time, while shorter range drones launched from containers or by hostile special forces remain a credible risk to high value assets at home. The policy implication is to discriminate between vectors; not to import foreign assumptions wholesale, and not to dismiss the threat. A refreshed strategy should say so candidly.

2.  Why the 2019 strategy can no longer stand alone

The clearest institutional signal came in February 2026, when the Ministry of Defence reported 266 drone incidents near UK military sites during 2025 (up from 126 in 2024) and sought fresh statutory powers through the Armed Forces Bill; extending beyond aerial drones to land and maritime systems; to allow Defence personnel to defeat drones at their own sites without waiting for police intervention.^[6] When the armed forces must legislate around a framework built for policing to protect their own bases, that framework has expired.

3.  The legal framework: developed, but fragmented

Domestic powers have expanded since 2019 but remain complex. The Air Traffic Management and Unmanned Aircraft Act 2021 created bespoke constabulary powers to ground, stop, search, inspect and seize unmanned aircraft, and amended section 93 of the Police Act 1997 to facilitate authorisations for certain counter drone measures.^[17][18] In the civil regime, the Civil Aviation Authority’s Direct Remote ID requirements came into force on 1 January 2026 for UK1, UK2, UK3, UK5 and UK6 class drones, with extension to most drones carrying a camera from 1 January 2028.^[19]

Yet lawful defeat is markedly harder than detection. Operational use of a jammer is generally an offence under section 68 of the Wireless Telegraphy Act 2006, and Ofcom has no power to authorise operational use; only narrow trial and research licences in shielded conditions.^[20] Government is separately examining the enforcement framework around jammers.^[21] Kinetic or electronic interference may amount to unlawful property or wireless interference absent proper authorisation; the Act’s own explanatory notes acknowledge as much. Techniques that take over a drone by software may engage the Computer Misuse Act 1990 and the Investigatory Powers Act 2016, and sensing engages the Data Protection Act 2018, the UK GDPR and the Human Rights Act 1998, which requires the state both to protect life from foreseeable threats and to keep its sensing and defeat measures necessary and proportionate. A lawful defeat chain is a designed legal artefact, not an improvisation.

Overseas action sits within international law. The Government’s March 2026 legal position on Iranian regional attacks invoked the collective self defence of allies under Article 51 of the UN Charter, subject to necessity and proportionality and Security Council notification.^[14] Once in armed conflict, drones attract no special category: they are governed by the ordinary rules of distinction, proportionality and precaution applicable to all weapons.^[22]

4.  Recommendations

The Government should replace the 2019 strategy with a new instrument covering the whole of government. Five propositions should anchor it:

1. Integrate, do not append. A single Counter Uncrewed Systems and Air Threat Resilience Strategy spanning the Home Office, MoD, Cabinet Office resilience, CAA, Ofcom, NPSA, the intelligence community, prisons and CNI operators, aligned to NATO’s integrated air and missile defence framework.^[16]
2. Consolidate the law. A statutory code (or, at minimum, statutory guidance) defining who may detect, disrupt and defeat uncrewed systems, where, against which threat category, under what authorisation, with what recording and what review after an incident — differentiating urban areas, prisons, airports, defence sites and overseas operations.
3. Adopt a layered baseline that is alert to cost. Use NPSA’s site specific, threat informed model as the national spine,^[23] plugging into a wider air and missile defence architecture for higher end threats, and prioritising defeat options that are low in collateral, deep in magazine and economically rational. A missile fired at every cheap drone is not a strategy; it is a budgetary confession.
4. Treat industry and export control as readiness. Link procurement, export licensing, sanctions intelligence and sovereign industrial strategy, with secure by design and open architecture requirements across C-UAS procurement. A state that cannot source the components of its own counter drone systems is not strategically autonomous.
5. Compliance and oversight by design. Require a written legal basis, data minimisation, retention limits and human oversight for every C-UAS deployment by a public authority; subject identification by AI to documented necessity and a review of error rates; and provide Parliament an annual ministerial statement on C-UAS powers, deployments, tests, safety incidents, rights compliance and lessons learned, with NPSA and the ICO involved where domestic surveillance is concerned.

5.  Conclusion

None of this discards the 2019 strategy’s best inheritance; its insistence on layered intervention over an optimism founded on gadgets, an instinct NPSA’s later guidance has only reinforced.^[5] The task is not to repudiate 2019 but to lift its sound protective security spine into an architecture wide enough for the threat that now exists: a spectrum of low cost, autonomous and electronically contested uncrewed systems, ranging from nuisance to war. The 2019 strategy answered the question of its decade. It is time to ask the question of this one.

The post appeared first on Blakistons.

The newsletters keep landing in my inbox with their countdowns. The latest one fixes on 2 August; the date the AI Office acquires real teeth over general-purpose AI models. I read these updates the way a coastal town reads tide tables: not because every wave matters to me, but because I need to know which ones will reach the door. So let me work through what this particular tide actually touches, from the perspective of someone who spends their days arguing about machines that fly.

The autonomy problem nobody wants to define

Start with the thing that makes drones legally interesting in the first place: autonomy is a spectrum, and the law hates spectrums.

A consumer quadcopter holding position in a breeze is running control loops that would have been called “artificial intelligence” in a 1980s research paper. A military loitering munition selecting between candidate targets is doing something most people would unhesitatingly call AI, and find alarming. Between those two poles sits an enormous, messy middle; obstacle avoidance, automated return-to-home, “follow me” tracking, swarm coordination, automated target recognition that merely flags rather than decides. Where on that spectrum does a drone become an “AI system” in the meaning of Article 3?

This matters enormously and almost nobody asks it cleanly. The Act’s definition turns on a system that infers, from inputs, how to generate outputs that influence environments. Plenty of drone autonomy stacks meet that bar comfortably. Plenty of others; deterministic flight controllers executing fixed logic; arguably don’t. I have sat across the table from engineers who insist their navigation system is “just maths,” and they’re not entirely wrong, but “just maths” is also a fair description of every neural network ever trained. The line is not where intuition puts it.

Why the military carve-out is a trap, not a shield

Here is where I watch clients relax too early.

The AI Act contains an exclusion for systems used exclusively for military, defence or national security purposes. Counter-drone work, in particular, loves to shelter under this. The reasoning goes: we detect and defeat hostile UAS, this is inherently a security function, therefore the Act doesn’t reach us. Lovely. Except “exclusively” is doing ruthless work in that sentence, and the dual-use reality of this entire sector makes the exclusion far narrower than people want it to be.

The same RF-detection and optical-tracking stack that protects an airbase gets sold, with a different sticker, to protect a stadium, a prison, a private estate. The moment that system has a civilian commercial life; the moment it is placed on the EU market for protecting critical infrastructure rather than fighting a war; the exclusion frays. And critical infrastructure protection is precisely the kind of use the high-risk classification regime is built to capture. A counter-UAS platform that automatically classifies an incursion and cues a response near an airport is not obviously outside the high-risk net just because its cousin wears camouflage.

The targeted consultation on the high-risk classification guidelines, open until late June, is therefore not abstract bureaucracy to me. Those guidelines are where the boundary between “this is a security tool, leave it alone” and “this is a high-risk system, document everything” will actually get drawn through worked examples. Anyone in this sector who isn’t reading those drafts is choosing to be surprised later.

Article 50 and the drone you can’t see

Now the part that genuinely changes behaviour on the ground.

Article 50’s transparency obligations don’t care about risk tiers. They bite on situations; and one of those situations is biometric categorisation, another is emotion recognition, and another is content that interacts with or affects people. Picture the increasingly common deployment: a drone with a camera doing crowd monitoring, perimeter patrol, or event security. The instant that payload starts categorising people by biometric attributes, the deployer owes the exposed individuals notice. You cannot quietly run biometric categorisation from 120 metres up and treat the altitude as a privacy shield. The obligation attaches to what the system does, not to how far away the lens sits.

I find this is the provision that catches operators off guard, because it cuts against the entire instinct of aerial surveillance, which is to be unobtrusive. The law is, in effect, telling a category of drone operator that unobtrusiveness is now sometimes unlawful. That is a genuinely interesting collision between the technology’s reason for existing and the regulation’s reason for existing, and it is going to generate litigation.

The sandbox that slipped a year

There was a small piece of news in the recent updates that I suspect most readers skimmed: the establishment deadline for regulatory sandboxes has been pushed from August 2026 to August 2027.

For most industries that’s a footnote. For drones it’s meaningful, because the sandbox model is arguably better suited to unmanned aviation than to almost any other AI domain. We already have a mature culture of supervised, geographically-bounded testing; segregated airspace, specific operational risk assessments, temporary danger areas. A regulatory sandbox is conceptually just that culture extended from airworthiness into algorithmic compliance. The delay means the one mechanism that could let a counter-UAS startup test automated-response logic on real incursions, under supervision, with some shelter from fines, won’t materialise on the original timetable. The companies most in need of a structured way to prove their systems are safe will spend another year improvising compliance instead. Whether that protects the public or merely protects incumbents is the kind of question I find genuinely unresolved.

What I’m telling clients

The honest summary I give, stripped of comfort, runs roughly like this. The August date isn’t your date; it’s aimed at the makers of large general-purpose models, and most drone autonomy doesn’t live there. But the regime those powers belong to is the same regime whose high-risk rules and Article 50 duties absolutely will reach you, and the classification guidelines being drafted right now are where your fate gets decided. Don’t wait for enforcement to tell you which side of the line you’re on. The structured dialogue the AI Office favours means the first contact is likely to be a request for documentation, not a fine; which means the clients who survive comfortably are simply the ones who wrote the documentation before anyone asked.

Drones made autonomy visible; something you can point at in the sky. That visibility is exactly why this sector will be among the first places the AI Act’s abstractions get tested against physical reality. I’d rather my clients be the test case that wins than the cautionary one. The tide tables are right there in my inbox. The only real choice is whether to read them.

This is not legal advice; if you’re making compliance decisions about a specific system, get advice tailored to it.

About the author
Richard Ryan is a Direct Access Barrister at Blakiston’s Chambers, and a chartered arbitrator and accredited mediator, specialising in drone and counter-drone law. He advises operators, manufacturers, UTM providers, insurers and public bodies across the full UAS spectrum — regulatory permissions and BVLOS approvals, C-UAS deployment at airports, prisons and critical infrastructure, data and privacy, liability and high-value disputes. Instruct him directly or through solicitors.

The post The Drone in the Room: What the AI Act’s August Deadline Actually Means for Unmanned Aircraft appeared first on Blakistons.

By Richard Ryan, barrister and drone lawyer

Constructive outcome, practical lessons. A technical proximity breach was confirmed, a more serious allegation was dismissed, and there are clear takeaways that raise standards on evidence, cooperation and public safety.

This post is for general information only and is not legal advice.

The post A Constructive Outcome for Safer Skies: What the Client’s Case Means for UK Drone Pilots appeared first on Blakistons.

By Richard Ryan barrister and drone lawyer – practical takeaways, not legal advice.

The short version

The Civil Aviation Authority’s CAP3182 – Future of Flight: BVLOS Roadmap sets a clear direction:
routine BVLOS operations by 2027 across priority use cases (NHS, emergency services, infrastructure, commercial delivery) and
initial commercial AAM passenger flights by the end of 2028. The CAA intends to get there iteratively, using live operations to harden policy across three BVLOS operational pathways:
Atypical Air Environment (AAE), Low-Level over Urban Areas, and Fully Integrated BVLOS.
Expect a steady shift from temporary segregation to true integration with Electronic Conspicuity (EC), Detect-and-Avoid (DAA), and UTM-ATM interaction.

Why this matters

Two features distinguish this roadmap. First, it is outcome-focused, linking policy development to concrete operations (for example, linear infrastructure inspection and hospital-to-hospital logistics).
Secondly, it is explicitly sequenced: segregation is a stepping stone to integration. Policies will develop iteratively, with the CAA learning from live operations rather than waiting for a single “big-bang” rule change.
The roadmap is also tied to the UK’s Airspace Modernisation Strategy, with proposals due in 2026 that matter if you are planning national networks.

The three BVLOS pathways (and typical use cases)

• Atypical Air Environment (AAE) – BVLOS close to fixed ground infrastructure. Examples: linear inspection of power lines, railways, wind turbines; security and surveillance; agriculture.
• Low-Level over Urban Areas (below 500 ft AGL) – Integrated operations over populated areas. Examples: last-mile deliveries (NHS samples, consumer goods); urban inspection.
• Fully Integrated BVLOS (all classes of airspace) – Integrated operations without special airspace. Examples: emergency air services; offshore asset inspection; middle-mile logistics.

Note: Two other BVLOS pathways sit in the wider portfolio: Non-military State aircraft and Test and Evaluation (enabled today in segregated airspace).

What becomes “routine” when? (Roadmap at a glance)

Atypical (AAE)

• Now (A0): Single-operator missions (for example, railway inspection, perimeter patrols).
• By ~2027 (A1): Multiple operators in the same AAE segment (for example, consecutive missions along the same railway).

Heads-up: The definition and extent of AAE may be reviewed and expanded over time, unlocking more locations and volumes.

Low-Level over Urban

• LL0 (now): Single operator, bespoke entry conditions, often within a TRA/TMZ.
• LL1: Multiple operators in controlled airspace without temporary structures.
• LL2: Multiple operators in uncontrolled airspace – the most scalable for last-mile services.

Fully Integrated

• FI0: Segregated operations (for example, offshore monitoring in a temporary danger area).
• FI1: Specific volumes with bespoke entry conditions (for example, maritime TRAs/TMZs).
• FI2: Operations in controlled airspace without temporary structures.
• FI3: Operations across controlled and uncontrolled airspace – enabling nationwide networks.

Tech and policy enablers

Electronic Conspicuity (EC) and surveillance

• UAS equipage: ADS-B In/Out (978 MHz and/or 1090 MHz), progressively moving from trials to approvals with AMC/GM support at higher integration levels.
• Crewed equipage: Aligns with airspace requirements, with potential EC-mandate policy developments to watch.
• Ground infrastructure: Situational awareness feeds (for example, TIS-B) and information displays become more important for urban and fully integrated stages.

Detect-and-Avoid (DAA)

DAA starts as testing only within segregated airspace and progresses to approvals at higher assurance levels as reliance moves from bespoke procedures to technology-based mitigations (DAA and UTM).

UTM and ATM integration

• Early stages: UTM for flight planning and strategic UAS-to-UAS deconfliction.
• Maturing stages: Tactical deconfliction and procedures for UTM-ATM interaction, culminating in CISP-enabled information exchange.

C2 link robustness and SAIL

Command-and-control performance is tied to SAIL levels: SAIL 1-3 is acceptable early on, with SAIL 4+ moving from testing to approval as operations integrate further.

Air risk and ATC procedures

Residual Air Risk Class (ARC) rises as integration increases (from ARC-a towards ARC-c), and ATC interaction shifts from bespoke arrangements to standardised procedures.

Pathway-specific notes you can use in planning

Atypical Air Environment (AAE)

The AAE Policy Concept enables single-operator BVLOS near defined infrastructure, with guidance on operating at multiple sites and evidencing that missions qualify as AAE.
Expect UTM-based strategic deconfliction to unlock multi-operator AAEs (A0 -> A1).

So what? If you inspect rail, power, or wind, AAE is the lowest-friction BVLOS route today. Invest in ADS-B In/Out and UTM-connected operations to be ready for A1.

Low-Level over Urban

Partially integrated urban BVLOS has been demonstrated using TRA/TMZ access and bespoke procedures to mitigate mid-air collision risk while technology matures.
Over time, reliance shifts from temporary airspace to technology (DAA, UTM, EC), first in controlled and then uncontrolled airspace.

So what? For last-mile delivery pilots and NHS suppliers, plan for standardised ATC procedures, DAA approvals to higher assurance, ADS-B equipage, and access to ground infrastructure (for example, TIS-B) as operations scale from corridors to multi-operator networks.

Fully Integrated BVLOS (all airspace)

This pathway starts with segregated offshore work and progresses to routine operations in controlled and uncontrolled airspace without TRAs/TMZs.
The same EC/DAA/UTM/C2 themes apply, but at higher performance and assurance levels.

So what? If you are building middle-mile logistics or national inspection services, design now for scalable EC, tactical deconfliction, resilient C2 (SAIL 4+), and a concept of operations that works without special airspace.

Regulatory framing (how it fits with what you know today)

• Category and authorisations: BVLOS sits in the Specific or Certified category, typically via a SORA-based safety case with mitigations aligned to SAIL. CAP3182 signals the mitigations expected at each stage (EC, DAA, C2, UTM).
• Policy development: The CAA plans to publish interim Concepts of Operation and use live-ops data to refine policy – so early movers who share data help shape the scalable rules.
• Airspace modernisation: All of this is tied to the AMS; the 2026 airspace architecture proposals will underpin integrated UAS operations.

Practical actions for pilots and operators (2025-2027)

1. Map your operation to a pathway and scenario. Decide whether you are AAE (A0 -> A1), Urban (LL0 -> LL2), or Fully Integrated (FI0 -> FI3); plan the evidence needed for the next step.
2. Plan your EC roadmap. Budget for ADS-B In/Out (978/1090 MHz), integration, and participation in ground-based situational awareness where relevant.
3. Design for DAA maturity. For urban and fully integrated pathways, assume DAA approvals to higher assurance; capture testing data now.
4. Harden your C2 links. Align architecture to the SAIL you need (for example, moving from SAIL 1-3 to SAIL 4+).
5. Adopt UTM early. Use UTM for planning and strategic deconfliction; prepare for tactical deconfliction and UTM-ATM data exchange via CISP/SWIM.
6. Write to the signalled ConOps. Prefer standardised mitigations over bespoke procedures, and reflect this in your operations manual, training, and safety assurance.
7. Mind the non-aviation risks. Data protection, cybersecurity for C2/UTM interfaces, community engagement (noise, privacy), and appropriate insurance matter more as you scale.

Risks, dependencies, and what to watch

• Funding, industry progress, legislation: Dates depend on these; the CAA plans to update the roadmap annually.
• AAE scope may expand: Over time the height/extent could increase, enabling more sites with efficient authorisation and deconfliction checks.
• Shift from bespoke to standard: Expect standardised ATC interfaces and technology-based mid-air collision mitigations across all pathways as policy matures.

Jargon buster (as used in the roadmap)

• AAE – Atypical Air Environment: defined volumes near specific infrastructure.
• TRA/TMZ – Temporary Reserved Area / Transponder Mandatory Zone: temporary segregation while technology is proven.
• DAA – Detect-and-Avoid: onboard/ground systems to mitigate mid-air collision risk.
• EC – Electronic Conspicuity: making aircraft electronically visible; references ADS-B In/Out.
• UTM/ATM – UAS Traffic Management / Air Traffic Management: digital services for planning, deconfliction, and ATC interaction.
• SWIM – System-Wide Information Management; CISP – Common Information Services Provider: information exchange between UTM and ATM.
• SORA/SAIL – Risk assessment method (SORA) and levels of safety assurance (SAIL) in the Specific category.
• ARC-a/-b/-c – Residual Air Risk Class: increasing exposure as operations integrate into busier airspace.

Final thought

CAP3182 does not just set ambition; it points to the levers operators should pull to progress BVLOS:
EC equipage, DAA maturity, UTM participation, resilient C2, and standard interfaces with ATC.
Align your safety case and investment roadmap now to benefit as the CAA reduces reliance on temporary segregation and opens up routine BVLOS at scale by 2027.

Source: UK Civil Aviation Authority, CAP3182 – Future of Flight: BVLOS Roadmap (October 2025).

Disclaimer: General information from a UK drone law perspective; not legal advice.

About the Author
Richard Ryan is a Barrister (Direct Access), Mediator and Chartered Arbitrator based in the UK, specialising in drone and counter-drone law, aviation regulation, and complex commercial disputes. He advises operators, insurers and public bodies on SORA/AAE approvals, BVLOS programmes, privacy/data governance, and risk allocation across the drone ecosystem

The post BVLOS is coming of age: what the CAA’s new roadmap means for UK drone pilots and companies appeared first on Blakistons.

“`

The post Rapid Briefing: “UK Drone Regulations and Net Risk” (PwC, Sept 2025) — Issues, Gaps, Opportunities appeared first on Blakistons.

The post What the UK Drone Industry Can Learn from EASA’s Adoption of SORA 2.5 appeared first on Blakistons.