The Future of Unmanned Flight: An Introduction to Drone Regulations in the EU

  • April 23, 2021

by Zlatko Grigorov, Kambourov & Partners

This is the first article in the “Future of Unmanned Flight” series, which presents the current regulatory framework of drones in the EU, examines open issues regarding privacy, data protection, liability, insurance, and any other developments in the growing industry of unmanned flight.


Unmanned aircraft systems (UAS), referring to the unmanned aircraft (UA) itself as well as the equipment used to control it remotely, colloquially known as drones, have become relatively ubiquitous in recent years primarily as hobbyist gadgets, however their possible commercial uses are many and ever-growing. Currently, different types of UAS are developed, tested and used for aerial imaging, construction site assistance, crop dusting, aerial topdressing, surveillance and policing, parcel delivery, and even human transportation. Despite those numerous commercial applications one thing is still standing in the way of having a world where the small and not so small unmanned flying vehicles are omnipresent: in comparison to manned aviation which has a fully developed air traffic management (ATM) with some of the strictest and universally applied rules on safety and protocol, the ATM for UAS, called U-space in Europe and UTM in the United States, is still in its infancy. An exponentially developing technology, which presents many concerns regarding safety, liability, privacy, etc. must be contained through careful and targeted regulatory effort in order to ensure a sustainable and safe development of a new industry.

This is why this series of articles will carefully examine the legislative environment of commercial drone use, presenting a comprehensive introduction to the sphere and serving as a jumping off point for businesses and persons interested in deploying UA. The present article will present an overview of the currently applicable regulations in the EU, while the following publications will deal with the open issues of privacy and data protection, liability and insurance, and the future plans for the development of a complete European U-space.

Framework Regulation

Despite their seeming recency, drones have been regulated practically since their inception yet their increasing popularity as well as posed dangers have significantly sped up the process of lawmaking. Regulation (EC) 2008/216 gave EU competence only regarding drones with maximum takeoff capacity of more than 150 kg, leaving the legislative competence for lighter UA (which are most currently used non-military drones) to the Member States. However, this all changed in 2018, when the new Basic European Aviation Safety Agency (EASA) Regulation (No. 2018/1139) entered into force and moved all regulatory power regarding UAS, regardless of size and type, to the hands of the EU. The reasoning behind this choice has been put down to ensuring “safety within a common European airspace, the necessity of common rules for the identification and registration of unmanned aircraft and operators, [and the setting of] uniform standards in design”1.

Although the new Basic Regulation has firmly established the goal of the Commission and EASA to create a harmonized regulatory framework for UAS, the regulation itself gives few precise rules on the operation of drones. Rather the articles and annexes relevant to unmanned aviation serve to sanction the number of secondary legislative acts which are required for any comprehensive governing mechanism. Article 57 of the Basic Regulation authorizes the Commission to adopt implementing acts specifying the rules for operation of unmanned aircraft including for relevant personnel, and for all rules regarding certification concerning both actual in-flight rules but also pre-flight licenses for pilots, drone-based businesses, etc. Additionally, Article 58 of the Basic Regulation delegates powers to the Commission for creating specific rules on the manufacturing, design and maintenance of UAS, including all relevant for those activities certifications. On the basis of those articles two regulations, one implementing and one delegated, were adopted in 2019, which have been further amended since. As the aim of this article series is to introduce potential commercial users of UAS to the regulatory environment, the implementing regulation is discussed in more detail in the subsequent section, because it focuses on the actual rules for the utilization of drones. The delegated regulation, which sets rules for design and manufacturing would not be discussed at length in the present series.

Despite the move of regulatory power from Member States to the EU, flexibility provisions have been provided in Article 71 of the Basic Regulation, which lists the occasions in which Member States may diverge from the prescribed rules in either the Basic Regulation itself or the secondary acts pursuant to it. One such possible exemption to requirements of EU UAS legislation is, in fact, crucial to the future development of U-space and refers to the possibility of Member States to create national rules which make subject to certain conditions the operation of UAS for reasons of public security and protection of privacy and personal data. This allows of the creation of so-called drone no-fly zones in sensitive areas such as around airports or over nuclear plants, as well as to require flights in residential housing areas to be conducted only if the drone in question is not equipped with video cameras or other sensors deemed to be able to interfere with the right to privacy. The current and future developments of UAS-based operations in line with adequate personal data and privacy protection are going to be discussed in more detail in the following articles of this series.

At the present moment National Authorities have published interactive maps on their websites which include no-fly zones around the country’s airports, restricted areas around the no-fly zones of the international airports and security zones around the country’s external borders. Currently, the interactive maps also include the possibility for creating environment protection zones, temporarily restricted to UA areas, and coordination zones, however such have not been created to date.

Secondary Legislation

1 Bassi, E. (2019). European Drones Regulation: Today’s Legal Challenges. In 2019 International Conference on Unmanned Aircraft Systems (ICUAS) (pp. 443-450). IEEE.

The first implementing regulation, adopted by the Commission in regard to the powers conferred to it by Article 57 of the Basic Regulation as described above, was Commission Implementing Regulation (EU) 2019/947 on the rules and procedures for the operation of unmanned aircraft. The Implementing Regulation introduced the three categories of UAS operations which will serve as the guide for delineating all UAS operations in the EU. The categories are based on the risk the operation poses to people and property and consist of low risk – open category; medium risk – specific category; and risk as manned aviation – certified category.

The EU rules for registration, authorization and operation of UA according to the Implementing Regulation were supposed to supersede all prior national legislation and become directly applicable in July 2021, however due to the ongoing COVID-19 pandemic, the date has been pushed to January 2022.

Open category.

UAS operations in this category are considered to be the simplest and least risk-creating. Article 4 of the Implementing Regulation requires that in order for operations to fall in this category the drone must have a maximum take-off mass of less than 25kg and not fly at altitudes over 120m above the ground. It also importantly requires that all operations in this category are conducted within visual line of sight (VLOS), defined as continuous unaided visual contact with the UA, allowing the remote pilot to control the flight path of the UA in relation to other aircraft, people and obstacles for the purpose of avoiding collisions. In order for operations to be conducted in the lowest risk category the unmanned aircraft must keep a safe distance from people and not be flown over gatherings. Such flights do not require prior authorization, however if the drone weighs more than 250g, it must be registered with the national registration system for UA and this unique registration number must be included both within the drone identification add-on system and be attached physically onto the aircraft.

Due to the requirement for conducting flights VLOS, the open category would most likely be used primarily by hobbyist or for limited commercial operations, for example aiding a remote bridge inspection or construction site supervision.

Specific category.

Flights would fall into this category if one or some of the requirements for an open category flight are not met (Art. 5, Implementing Regulation). This means in practice that flights in the specific category would mostly concern situations where the flights are conducted beyond the visual line of sight (BVLOS), defined as the absence of VLOS. In order for a flight to be conducted in this category the operator must cover one of three requirements – either they have received authorization for the activities intended by the responsible national aviation authority (‘NAA”) or the operation is included in one of the standard scenarios; or the pilot must hold a light drone operator certificate with privileges.

In the first case, the operator should declare the planned activities and the NAA must evaluate them following the conditions set out in Article 12 and allow them to occur only if the safety of the operation has been insured and the necessary mitigation steps have been taken. This takes into account both the technical specifications of the aircraft, including its current condition and maintenance, and the competence of the pilot. In the second case, certain standard scenarios are to be added to the implementing regulation, which include detailed specifications of typical operation parameters and the required technical knowledge of the operator to perform them, and if the declared activity falls under them no further authorization by the NAA is needed.

Because this is the category where most commercial operations are likely to be taking place, the legislator is developing a number of standard scenarios which would greatly improve the efficiency of flight authorization procedures. Already in 2020, the Commission Implementing Regulation (EU) 2020/639 was adopted, which added new standard scenarios for BVLOS UAS operations.

Certified category.

Flights fall into this category if they are conducted over assemblies, aim to transport people or to carry dangerous goods (Art. 6, Implementing Regulation) or if the drone’s dimensions are over 3 meters (Art. 40, Delegated Regulation (EU) 2019/945). Additionally, this category includes flights that would normally fall under the specific category but in the course of the assessment by the NAA described above have been deemed too risky without the mitigation of a licensed pilot or certified UAS. Precise rules on how operations in this category would be conducted are still in development.

Despite the fact that the new EU regulations are directly applicable, important steps must be taken by the national authorities to ensure their successful application – this is especially true regarding the effective enforcement of uniform registration and authorization procedures.