Drone Law | UK SORA | CAA Regulation | AI Governance
Summary: CAA Decision No. 60 marks a significant development in the regulation of Specific category drone operations in the UK. Coming into force on 1 October 2026, it updates the UK SORA framework and introduces clearer expectations around compliance evidence, ground-risk mitigation, containment, kinetic energy analysis and evidence retention. For operators, the message is clear: compliance is no longer just a narrative safety case. It must be evidenced, retained and auditable.
The UK’s lower airspace is becoming increasingly complex. Beyond Visual Line of Sight operations, drone delivery, infrastructure inspection, emergency services use, autonomous routing and higher-risk commercial UAS activity all require a more mature regulatory framework.
CAA Decision No. 60 updates the Acceptable Means of Compliance and Guidance Material for UK Regulation (EU) 2019/947. In practical terms, it strengthens the UK Specific Operation Risk Assessment, or UK SORA, for operators seeking authorisation in the Specific category.
The legal significance is that UK SORA is becoming a structured assurance methodology. Operators must not merely state that an operation is safe. They must demonstrate that the aircraft, procedures, people, operational volume, ground environment, airspace risks, mitigations and emergency arrangements meet the required level of safety.
UK SORA exists to support the operational risk assessment required for Specific category operations. It considers both ground risk and air risk, then applies mitigations and operational safety objectives according to the Specific Assurance and Integrity Level, or SAIL.
The updated framework is particularly important because it clarifies how operators must gather, present and retain compliance evidence. This is a move away from generalised operational assertions and towards aviation-grade documentation.
Decision No. 60 identifies three broad routes for demonstrating compliance.
| Pathway | What It Means | Legal Significance |
|---|---|---|
| Declarative approach | The operator declares that it meets the relevant acceptable means of compliance. | Suitable for lower-risk requirements, but the declaration must still be accurate and supportable. |
| Agreed compliance basis | The operator and CAA agree in advance how compliance will be demonstrated. | Useful for novel or complex operations where evidence may include testing, analysis or design appraisal. |
| Compliance evidence approach | The operator submits both the compliance basis and the underlying evidence to the CAA. | The most rigorous route, likely to be required for higher-risk or technically complex operations. |
Operators must also retain compliance evidence for the duration of the operational authorisation and for three years after operations under that authorisation cease. That evidence may become critical in a CAA audit, incident investigation, insurance dispute or civil claim.
Ground risk is central to UK SORA. The law is concerned not only with whether the drone can fly, but with what happens if it fails. Decision No. 60 provides more detailed guidance on how operators may reduce ground risk.
| Mitigation | Description | Key Legal Risk |
|---|---|---|
| M1A: Sheltering | Relying on people being inside structures. | The aircraft must not be capable of penetrating the relevant structures. |
| M1B: Operational restrictions | Operating at times or in areas where fewer uninvolved people are present. | Population assumptions must be evidenced and realistic. |
| M1C: Ground observation | Using observers or technical systems to detect uninvolved people. | Detection capability, observer competence and response procedures must be credible. |
| M2: Impact mitigation | Reducing impact energy through parachutes, flight termination or design features. | Deployment reliability, minimum altitude, failure modes and secondary hazards must be addressed. |
Decision No. 60 gives particular importance to kinetic energy. This matters because it converts safety claims into measurable injury-risk analysis.
| Kinetic Energy | Risk Category | Operator Requirement |
|---|---|---|
| Up to 175 joules | Lower hazard | Generally less demanding penetration analysis, subject to the operational context. |
| 175 to 7,000 joules | Medium hazard | Penetration analysis should be conducted against representative structures. |
| Over 7,000 joules | High hazard | More rigorous evidence is required, potentially including crashworthiness analysis and structural modelling. |
Operators should not rely on generic manufacturer statements. They need platform-specific evidence: mass, velocity, terminal impact behaviour, parachute performance, battery fire risk and representative structural analysis.
Containment is a central pillar of the updated UK SORA framework. It asks whether the unmanned aircraft can be kept within its operational volume and ground risk buffer, even after failure or loss of control.
For lower-risk operations, containment may be assessed qualitatively through design appraisal and procedural evidence. For higher-risk operations, the CAA may expect quantitative probability targets, such as demonstrating that the probability of exiting the relevant volume or buffer is below specified thresholds per flight hour.
Containment evidence may include geo-caging, tethering, independent flight termination systems, lost-link logic, command-and-control resilience, navigation integrity, power-system independence and emergency procedures.
Decision No. 60 is not an AI regulation. However, many modern drone operations increasingly rely on AI-enabled functions, including detect-and-avoid, automated route planning, computer vision, landing assistance, ground-person detection, predictive maintenance and autonomous contingency management.
The EU AI Act is relevant as a benchmark for risk management, technical documentation, record-keeping, transparency, human oversight, robustness and cybersecurity. The UK does not currently have a single equivalent UK AI Act. Instead, it follows a sector-led, principles-based model based on safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.
| UK SORA Issue | AI Governance Standard | Practical Evidence |
|---|---|---|
| Operational risk assessment | Lifecycle risk management | Hazard log, AI failure-mode analysis, operating design domain and residual-risk register. |
| Compliance evidence | Technical documentation | Version-controlled technical file, test reports, software release notes and design appraisals. |
| Ground observation | Accuracy and human oversight | Detection metrics, false-negative analysis, lighting limits and observer escalation procedures. |
| Containment | Robustness and cybersecurity | Geo-cage testing, lost-link logic, GNSS spoofing assessment and command-link resilience. |
| Evidence retention | Record-keeping and auditability | Flight logs, telemetry, AI outputs, incident reviews and corrective actions. |
Many Specific category operations involve cameras, thermal imaging, mapping payloads or AI-enabled object recognition. UK SORA primarily addresses safety, but operators must also consider privacy, data protection and surveillance risk.
If cameras or AI systems detect uninvolved persons, personal data may be captured, stored or analysed. Operators may need a data protection impact assessment, retention limits, access controls, privacy notices and clear rules on secondary use.
Operators should review their safety cases and evidence packs now. In particular, they should check:
CAA Decision No. 60 marks a shift from descriptive drone safety cases to structured assurance. Operators must now be able to prove their safety claims through coherent, retained and auditable evidence.
The most important development is the convergence between aviation safety and AI governance. UK SORA asks whether the drone operation is safe. The EU AI Act and UK AI principles ask whether automated systems are risk-managed, documented, robust, explainable, secure and subject to human oversight. For modern drone operations, those are increasingly the same question.
Compliance is not what the operator says it does. Compliance is what the operator can prove.
Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, aviation regulation and artificial intelligence. He advises operators, manufacturers and public bodies on UK CAA regulation, UK SORA, BVLOS operations, AI governance and commercial drone operations. He is currently undertaking a PhD at Cranfield University researching the legal framework for autonomous aviation and future airspace integration.
This article is general legal commentary and does not constitute legal advice.