Drone Law | UK SORA | CAA Regulation | AI Governance

Summary: CAA Decision No. 60 marks a significant development in the regulation of Specific category drone operations in the UK. Coming into force on 1 October 2026, it updates the UK SORA framework and introduces clearer expectations around compliance evidence, ground-risk mitigation, containment, kinetic energy analysis and evidence retention. For operators, the message is clear: compliance is no longer just a narrative safety case. It must be evidenced, retained and auditable.

1. Why Decision No. 60 Matters

The UK’s lower airspace is becoming increasingly complex. Beyond Visual Line of Sight operations, drone delivery, infrastructure inspection, emergency services use, autonomous routing and higher-risk commercial UAS activity all require a more mature regulatory framework.

CAA Decision No. 60 updates the Acceptable Means of Compliance and Guidance Material for UK Regulation (EU) 2019/947. In practical terms, it strengthens the UK Specific Operation Risk Assessment, or UK SORA, for operators seeking authorisation in the Specific category.

The legal significance is that UK SORA is becoming a structured assurance methodology. Operators must not merely state that an operation is safe. They must demonstrate that the aircraft, procedures, people, operational volume, ground environment, airspace risks, mitigations and emergency arrangements meet the required level of safety.

2. UK SORA Is Not a Box-Ticking Exercise

UK SORA exists to support the operational risk assessment required for Specific category operations. It considers both ground risk and air risk, then applies mitigations and operational safety objectives according to the Specific Assurance and Integrity Level, or SAIL.

The updated framework is particularly important because it clarifies how operators must gather, present and retain compliance evidence. This is a move away from generalised operational assertions and towards aviation-grade documentation.

3. The Three Compliance Pathways

Decision No. 60 identifies three broad routes for demonstrating compliance.

Operators must also retain compliance evidence for the duration of the operational authorisation and for three years after operations under that authorisation cease. That evidence may become critical in a CAA audit, incident investigation, insurance dispute or civil claim.

4. Ground Risk: What Happens If the Drone Falls?

Ground risk is central to UK SORA. The law is concerned not only with whether the drone can fly, but with what happens if it fails. Decision No. 60 provides more detailed guidance on how operators may reduce ground risk.

5. Kinetic Energy and Penetration Risk

Decision No. 60 gives particular importance to kinetic energy. This matters because it converts safety claims into measurable injury-risk analysis.

Operators should not rely on generic manufacturer statements. They need platform-specific evidence: mass, velocity, terminal impact behaviour, parachute performance, battery fire risk and representative structural analysis.

6. Containment and Fly-Away Risk

Containment is a central pillar of the updated UK SORA framework. It asks whether the unmanned aircraft can be kept within its operational volume and ground risk buffer, even after failure or loss of control.

For lower-risk operations, containment may be assessed qualitatively through design appraisal and procedural evidence. For higher-risk operations, the CAA may expect quantitative probability targets, such as demonstrating that the probability of exiting the relevant volume or buffer is below specified thresholds per flight hour.

Containment evidence may include geo-caging, tethering, independent flight termination systems, lost-link logic, command-and-control resilience, navigation integrity, power-system independence and emergency procedures.

7. EU AI Act and UK AI Standards

Decision No. 60 is not an AI regulation. However, many modern drone operations increasingly rely on AI-enabled functions, including detect-and-avoid, automated route planning, computer vision, landing assistance, ground-person detection, predictive maintenance and autonomous contingency management.

The EU AI Act is relevant as a benchmark for risk management, technical documentation, record-keeping, transparency, human oversight, robustness and cybersecurity. The UK does not currently have a single equivalent UK AI Act. Instead, it follows a sector-led, principles-based model based on safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.

8. Data Protection and Surveillance Risk

Many Specific category operations involve cameras, thermal imaging, mapping payloads or AI-enabled object recognition. UK SORA primarily addresses safety, but operators must also consider privacy, data protection and surveillance risk.

If cameras or AI systems detect uninvolved persons, personal data may be captured, stored or analysed. Operators may need a data protection impact assessment, retention limits, access controls, privacy notices and clear rules on secondary use.

9. What Operators Should Do Before 1 October 2026

Operators should review their safety cases and evidence packs now. In particular, they should check:

• Aircraft mass, speed, kinetic energy and terminal velocity;
• Ground-risk assumptions and population-density evidence;
• Sheltering, operational restriction and observation claims;
• Parachute, flight termination and impact mitigation evidence;
• Containment evidence, including geo-caging and lost-link logic;
• AI-enabled functions, including detect-and-avoid and automated decision-support tools;
• Evidence retention systems;
• Supplier contracts for access to technical data.

10. Bottom Line

CAA Decision No. 60 marks a shift from descriptive drone safety cases to structured assurance. Operators must now be able to prove their safety claims through coherent, retained and auditable evidence.

The most important development is the convergence between aviation safety and AI governance. UK SORA asks whether the drone operation is safe. The EU AI Act and UK AI principles ask whether automated systems are risk-managed, documented, robust, explainable, secure and subject to human oversight. For modern drone operations, those are increasingly the same question.

Compliance is not what the operator says it does. Compliance is what the operator can prove.

About the Author

Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, aviation regulation and artificial intelligence. He advises operators, manufacturers and public bodies on UK CAA regulation, UK SORA, BVLOS operations, AI governance and commercial drone operations. He is currently undertaking a PhD at Cranfield University researching the legal framework for autonomous aviation and future airspace integration.

This article is general legal commentary and does not constitute legal advice.

The post Navigating UK SORA: A Drone Lawyer’s Guide to CAA Decision No. 60 appeared first on Blakistons.

White Paper

Beyond 2019

A New Counter Uncrewed Systems and Air Threat Resilience Strategy for the United Kingdom, After Ukraine and Iran

By Mr Richard Ryan, Barrister, Blakiston’s Chambers · June 2026

The United Kingdom’s published national counter drone policy; the UK Counter-Unmanned Aircraft Strategy, presented to Parliament as Command Paper 187 on 21 October 2019^[1]; is materially out of date as a strategic document. It remains the only published national strategy in the field for the whole of government, yet it is now approximately six years and seven months old, and roughly three and a half years beyond its own planning horizon.

The strategy was sound for its time. It identified the highest harm illegal uses of small drones; terrorism, smuggling into prisons, disruption of critical national infrastructure; and prescribed layered intervention, industry standards, responder powers and public education.^[2] But it was expressly confined to malicious and illegal use of small aerial drones, in a domestic policing and protective security frame. That frame has been overtaken by operational reality in Ukraine and the Iranian theatre: massed one way attack drones, combined drone and missile salvos, container and special forces launch, dense electronic warfare, fibre optic command links and AI assisted guidance now define the threat.

Subsequent UK documents do not update the 2019 strategy; they work around it. The Defence Drone Strategy (2024),^[3] the Strategic Defence Review 2025,^[4] NPSA’s site specific guidance,^[5] and the Ministry of Defence’s 2026 pursuit of new defeat powers at military sites^[6] together form a patchwork of sectoral adaptations laid over an unrevised core. This paper argues that the 2019 strategy should be retired as a standalone statement and replaced by an integrated Counter Uncrewed Systems and Air Threat Resilience Strategy, supported by a consolidated legal code for detection, disruption and defeat, and by an annual ministerial statement to Parliament.

1.  The threat has become a strategic mass system

The central lesson of 2024–2026 is not that drones have become more common but that they have become a strategic mass system — a consumable class of munition and sensor used for saturation, decoying, attrition of intelligence assets, target acquisition and the deliberate erosion of a defender’s cost exchange ratio. On the night of 2 June 2026, Ukraine’s air force reported that Russia had launched 656 drones and 73 missiles in a single overnight barrage, of which 602 drones and 40 missiles were downed or suppressed.^[7][8] Single salvos now routinely exceed several hundred drones.

Critical infrastructure has been directly affected. In February 2025 a Russian Geran-2 (Shahed type) drone struck the New Safe Confinement over Chornobyl’s reactor four;^[9] by December 2025 the International Atomic Energy Agency assessed that the structure had lost its primary safety functions, including confinement.^[10] In May 2026 a drone strike caused a fire at an electrical generator on the perimeter of the United Arab Emirates’ Barakah nuclear plant; a civilian reactor site; leaving one unit running on emergency diesel generators.^[11][12]

The homeland and deployed force dimension is now concrete for the United Kingdom. In early March 2026 a Shahed type drone struck a runway at RAF Akrotiri in Cyprus; a British Sovereign Base Area; causing limited damage,^[13] and the UK flew defensive sorties and, where requested, acted in the collective self defence of regional allies.^[14] Ukraine’s Operation Spider’s Web (June 2025) had already shown that 117 first person view drones launched from concealed truck borne containers could strike strategic bomber bases far from any front line, damaging more than 40 aircraft, with some guidance reportedly AI assisted.^[15]

A necessary qualification

Not every battlefield lesson maps to the British mainland. The most credible open analysis holds that long range Shahed type strikes on Great Britain would face high attrition because of geography and warning time, while shorter range drones launched from containers or by hostile special forces remain a credible risk to high value assets at home. The policy implication is to discriminate between vectors; not to import foreign assumptions wholesale, and not to dismiss the threat. A refreshed strategy should say so candidly.

2.  Why the 2019 strategy can no longer stand alone

The clearest institutional signal came in February 2026, when the Ministry of Defence reported 266 drone incidents near UK military sites during 2025 (up from 126 in 2024) and sought fresh statutory powers through the Armed Forces Bill; extending beyond aerial drones to land and maritime systems; to allow Defence personnel to defeat drones at their own sites without waiting for police intervention.^[6] When the armed forces must legislate around a framework built for policing to protect their own bases, that framework has expired.

3.  The legal framework: developed, but fragmented

Domestic powers have expanded since 2019 but remain complex. The Air Traffic Management and Unmanned Aircraft Act 2021 created bespoke constabulary powers to ground, stop, search, inspect and seize unmanned aircraft, and amended section 93 of the Police Act 1997 to facilitate authorisations for certain counter drone measures.^[17][18] In the civil regime, the Civil Aviation Authority’s Direct Remote ID requirements came into force on 1 January 2026 for UK1, UK2, UK3, UK5 and UK6 class drones, with extension to most drones carrying a camera from 1 January 2028.^[19]

Yet lawful defeat is markedly harder than detection. Operational use of a jammer is generally an offence under section 68 of the Wireless Telegraphy Act 2006, and Ofcom has no power to authorise operational use; only narrow trial and research licences in shielded conditions.^[20] Government is separately examining the enforcement framework around jammers.^[21] Kinetic or electronic interference may amount to unlawful property or wireless interference absent proper authorisation; the Act’s own explanatory notes acknowledge as much. Techniques that take over a drone by software may engage the Computer Misuse Act 1990 and the Investigatory Powers Act 2016, and sensing engages the Data Protection Act 2018, the UK GDPR and the Human Rights Act 1998, which requires the state both to protect life from foreseeable threats and to keep its sensing and defeat measures necessary and proportionate. A lawful defeat chain is a designed legal artefact, not an improvisation.

Overseas action sits within international law. The Government’s March 2026 legal position on Iranian regional attacks invoked the collective self defence of allies under Article 51 of the UN Charter, subject to necessity and proportionality and Security Council notification.^[14] Once in armed conflict, drones attract no special category: they are governed by the ordinary rules of distinction, proportionality and precaution applicable to all weapons.^[22]

4.  Recommendations

The Government should replace the 2019 strategy with a new instrument covering the whole of government. Five propositions should anchor it:

1. Integrate, do not append. A single Counter Uncrewed Systems and Air Threat Resilience Strategy spanning the Home Office, MoD, Cabinet Office resilience, CAA, Ofcom, NPSA, the intelligence community, prisons and CNI operators, aligned to NATO’s integrated air and missile defence framework.^[16]
2. Consolidate the law. A statutory code (or, at minimum, statutory guidance) defining who may detect, disrupt and defeat uncrewed systems, where, against which threat category, under what authorisation, with what recording and what review after an incident — differentiating urban areas, prisons, airports, defence sites and overseas operations.
3. Adopt a layered baseline that is alert to cost. Use NPSA’s site specific, threat informed model as the national spine,^[23] plugging into a wider air and missile defence architecture for higher end threats, and prioritising defeat options that are low in collateral, deep in magazine and economically rational. A missile fired at every cheap drone is not a strategy; it is a budgetary confession.
4. Treat industry and export control as readiness. Link procurement, export licensing, sanctions intelligence and sovereign industrial strategy, with secure by design and open architecture requirements across C-UAS procurement. A state that cannot source the components of its own counter drone systems is not strategically autonomous.
5. Compliance and oversight by design. Require a written legal basis, data minimisation, retention limits and human oversight for every C-UAS deployment by a public authority; subject identification by AI to documented necessity and a review of error rates; and provide Parliament an annual ministerial statement on C-UAS powers, deployments, tests, safety incidents, rights compliance and lessons learned, with NPSA and the ICO involved where domestic surveillance is concerned.

5.  Conclusion

None of this discards the 2019 strategy’s best inheritance; its insistence on layered intervention over an optimism founded on gadgets, an instinct NPSA’s later guidance has only reinforced.^[5] The task is not to repudiate 2019 but to lift its sound protective security spine into an architecture wide enough for the threat that now exists: a spectrum of low cost, autonomous and electronically contested uncrewed systems, ranging from nuisance to war. The 2019 strategy answered the question of its decade. It is time to ask the question of this one.

The post appeared first on Blakistons.

“`

The post Rapid Briefing: “UK Drone Regulations and Net Risk” (PwC, Sept 2025) — Issues, Gaps, Opportunities appeared first on Blakistons.

The post When “Just a Minute” Becomes BVLOS: Legal Lessons for Drone Operators from CHIRP’s September 2025 Reports appeared first on Blakistons.

The post What the UK Drone Industry Can Learn from EASA’s Adoption of SORA 2.5 appeared first on Blakistons.

UTM Operational Concept

The legal framework for UTM (Unmanned aircraft system Traffic Management) will need to develop as regulators grapple with issues that relate to legal responsibility and accountability as the proliferation of drones increases.

Unmanned Aircraft System (UAS) Traffic Management (UTM) Enabling Civilian Low-altitude Airspace and Unmanned Aircraft System Operations.

What is the problem?

Many beneficial civilian applications of the UAS have been proposed, that include goods delivery, medical deliveries, infrastructure surveillance, search and rescue and agricultural monitoring. Currently, there is no established UTM infrastructure to enable and safely manage the widespread use of BVLOS low-altitude airspace and UAS operations, regardless of the type of UAS.

To read the full article click here.

The post Legal Framework of UTM for UAS – 2020 Digital Avionics Systems Conference appeared first on Blakistons.

Policy has become law in many jurisdictions, but policy needs to be developed further to keep pace with demand because safety is paramount. This paper investigates and highlights legal aspects that a regulator and UTM stakeholders have to consider in developing good drone law. It is essential that a properly considered legal framework is developed for many reasons including, but not limited to, increased positive public perception, proliferation of innovation of use cases for Unmanned Aerial Systems, improved environmental impact and improved safety.

This paper describes the fundamentals that a well designed and considered legal framework for a UTM system should address, in order to provide much needed certainty that can guide all stakeholders to a regulatory path that leads to safe maximized utility of drones in shared airspace.

Click here to read the full article.

The post The Legal Framework of UTM for UAS appeared first on Blakistons.