Drone Law | UK SORA | CAA Regulation | AI Governance

Summary: CAA Decision No. 60 marks a significant development in the regulation of Specific category drone operations in the UK. Coming into force on 1 October 2026, it updates the UK SORA framework and introduces clearer expectations around compliance evidence, ground-risk mitigation, containment, kinetic energy analysis and evidence retention. For operators, the message is clear: compliance is no longer just a narrative safety case. It must be evidenced, retained and auditable.

1. Why Decision No. 60 Matters

The UK’s lower airspace is becoming increasingly complex. Beyond Visual Line of Sight operations, drone delivery, infrastructure inspection, emergency services use, autonomous routing and higher-risk commercial UAS activity all require a more mature regulatory framework.

CAA Decision No. 60 updates the Acceptable Means of Compliance and Guidance Material for UK Regulation (EU) 2019/947. In practical terms, it strengthens the UK Specific Operation Risk Assessment, or UK SORA, for operators seeking authorisation in the Specific category.

The legal significance is that UK SORA is becoming a structured assurance methodology. Operators must not merely state that an operation is safe. They must demonstrate that the aircraft, procedures, people, operational volume, ground environment, airspace risks, mitigations and emergency arrangements meet the required level of safety.

2. UK SORA Is Not a Box-Ticking Exercise

UK SORA exists to support the operational risk assessment required for Specific category operations. It considers both ground risk and air risk, then applies mitigations and operational safety objectives according to the Specific Assurance and Integrity Level, or SAIL.

The updated framework is particularly important because it clarifies how operators must gather, present and retain compliance evidence. This is a move away from generalised operational assertions and towards aviation-grade documentation.

3. The Three Compliance Pathways

Decision No. 60 identifies three broad routes for demonstrating compliance.

Operators must also retain compliance evidence for the duration of the operational authorisation and for three years after operations under that authorisation cease. That evidence may become critical in a CAA audit, incident investigation, insurance dispute or civil claim.

4. Ground Risk: What Happens If the Drone Falls?

Ground risk is central to UK SORA. The law is concerned not only with whether the drone can fly, but with what happens if it fails. Decision No. 60 provides more detailed guidance on how operators may reduce ground risk.

5. Kinetic Energy and Penetration Risk

Decision No. 60 gives particular importance to kinetic energy. This matters because it converts safety claims into measurable injury-risk analysis.

Operators should not rely on generic manufacturer statements. They need platform-specific evidence: mass, velocity, terminal impact behaviour, parachute performance, battery fire risk and representative structural analysis.

6. Containment and Fly-Away Risk

Containment is a central pillar of the updated UK SORA framework. It asks whether the unmanned aircraft can be kept within its operational volume and ground risk buffer, even after failure or loss of control.

For lower-risk operations, containment may be assessed qualitatively through design appraisal and procedural evidence. For higher-risk operations, the CAA may expect quantitative probability targets, such as demonstrating that the probability of exiting the relevant volume or buffer is below specified thresholds per flight hour.

Containment evidence may include geo-caging, tethering, independent flight termination systems, lost-link logic, command-and-control resilience, navigation integrity, power-system independence and emergency procedures.

7. EU AI Act and UK AI Standards

Decision No. 60 is not an AI regulation. However, many modern drone operations increasingly rely on AI-enabled functions, including detect-and-avoid, automated route planning, computer vision, landing assistance, ground-person detection, predictive maintenance and autonomous contingency management.

The EU AI Act is relevant as a benchmark for risk management, technical documentation, record-keeping, transparency, human oversight, robustness and cybersecurity. The UK does not currently have a single equivalent UK AI Act. Instead, it follows a sector-led, principles-based model based on safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.

8. Data Protection and Surveillance Risk

Many Specific category operations involve cameras, thermal imaging, mapping payloads or AI-enabled object recognition. UK SORA primarily addresses safety, but operators must also consider privacy, data protection and surveillance risk.

If cameras or AI systems detect uninvolved persons, personal data may be captured, stored or analysed. Operators may need a data protection impact assessment, retention limits, access controls, privacy notices and clear rules on secondary use.

9. What Operators Should Do Before 1 October 2026

Operators should review their safety cases and evidence packs now. In particular, they should check:

• Aircraft mass, speed, kinetic energy and terminal velocity;
• Ground-risk assumptions and population-density evidence;
• Sheltering, operational restriction and observation claims;
• Parachute, flight termination and impact mitigation evidence;
• Containment evidence, including geo-caging and lost-link logic;
• AI-enabled functions, including detect-and-avoid and automated decision-support tools;
• Evidence retention systems;
• Supplier contracts for access to technical data.

10. Bottom Line

CAA Decision No. 60 marks a shift from descriptive drone safety cases to structured assurance. Operators must now be able to prove their safety claims through coherent, retained and auditable evidence.

The most important development is the convergence between aviation safety and AI governance. UK SORA asks whether the drone operation is safe. The EU AI Act and UK AI principles ask whether automated systems are risk-managed, documented, robust, explainable, secure and subject to human oversight. For modern drone operations, those are increasingly the same question.

Compliance is not what the operator says it does. Compliance is what the operator can prove.

About the Author

Richard Ryan is a barrister, Chartered Arbitrator and specialist in drone law, aviation regulation and artificial intelligence. He advises operators, manufacturers and public bodies on UK CAA regulation, UK SORA, BVLOS operations, AI governance and commercial drone operations. He is currently undertaking a PhD at Cranfield University researching the legal framework for autonomous aviation and future airspace integration.

This article is general legal commentary and does not constitute legal advice.

The post Navigating UK SORA: A Drone Lawyer’s Guide to CAA Decision No. 60 appeared first on Blakistons.