This NPRM follows the Administration’s June 5, 2025, executive order, Unleashing American Drone Dominance (summarized in a previous Pillsbury alert), directing the FAA to publish a final BVLOS rule within 240 days. Accordingly, we could see a final BVLOS rule in the first quarter of 2026.
The proposed rule adopts a performance and risk-based position, which is viewed as more flexible and forward-thinking than typical FAA prescriptive rules. The FAA’s approach recognizes the diversity of types of drones and drone operations. Rather than propose a one-size-fits-all regulatory framework, the proposed rule scales the regulatory requirements and permissions to the type of the drone operation (e.g., high-risk operations due to aircraft size, weight, speed, the area of overflight, and operational parameters will require an operating certificate versus an FAA permit for lower-risk operations). Further, the proposed rule is comprehensive and holistic, balancing the need for innovation and scale while prioritizing safety and security measures.
With more than 700 pages of preamble language and proposed rule text, the NPRM has an extensive potential impact. Here are some key highlights of the proposed rule:
- Key Operations Enabled: The proposed rule outlines operations that the BVLOS rule would enable, including package delivery, agriculture, aerial surveying, civic interest such as public safety, recreation, and flight testing. Operations would occur at or below 400 feet above ground level, launching from pre-designated, access-controlled locations. Operators must secure FAA approval for their intended flight areas, specifying boundaries, daily operation estimates, and zones for takeoff, landing, and loading. They would also need to ensure reliable communications and have procedures for lost links. Additionally, all drone operators would be responsible for understanding airspace and flight restrictions, reviewing Notices to Airmen (NOTAMs), and identifying hazards. The FAA would evaluate proposals to fly multiple drones on a case-by-case basis.
- Operational Authorizations, Permits and Certificates: The proposed rule recognizes that drone operations vary in complexity and risk. Therefore, the FAA is proposing two operational authorization pathways: either an Operating Permit or an Operating Certificate.
-Operating Permit: These permits are designed for smaller-scale, low-risk operations that require less FAA oversight. Permits will be available in eight categories: unmanned aircraft training; flight testing; demonstrations; package delivery; agricultural use; aerial surveying; civic interest; and recreation. An entity will apply for a permit in the category that applies to them and will be limited to operations in that category. Under a permit, operations will be limited to areas with less-dense populations on the ground and a company will be limited to using a certain number of aircraft (e.g., 100 drones for package delivery, 25 drones for agriculture, surveying, and civic interest).
-Operating Certificate: These certificates are designed for operators that wish to operate larger aircraft in size or number, operating over areas with larger concentrations of people, and/or conducting higher risk and more complex operations. Certificated operations would include four categories: package delivery; agriculture; aerial surveying; and civic interest. To issue a certificate, the FAA would conduct reviews of the proposed operations, provide oversight of the operator and operations, and require operators to develop a safety management system and training program. The certificate would be more akin to operating certificates in traditional aviation and would entail a higher level of interaction with the FAA for issuance and oversight of the certificate.
- Aircraft: The proposed rule would allow aircraft to weigh up to 1,320 lbs. including everything they are carrying. This is a significant departure from Part 107, which has a 55-pound weight limit. With this said, the proposed rule suggests three weight limits for the various categories of permitted and certificated operations (55 pounds, 110 pounds and 1,320 pounds). For example, aerial surveying operations and civic interest operations could not utilize drones that exceed 110 pounds, including anything attached or carried.
Under the proposed rule, the FAA would not require traditional FAA airworthiness certificates. Rather, the FAA would establish a process for accepting the airworthiness of an aircraft based on industry consensus standards. Manufacturers would develop and test aircraft to meet the consensus standards and develop operational limitations. This means manufacturers would develop the limits of their drones, including speed and weather limits, as well as how long and far they operate, rather than the FAA imposing these limits. Operators would be required to stay within the manufacturer’s limits to be compliant.
- Operations Over People: The proposed rule would allow operations over people but not over large, open-air gatherings such as concerts, sporting events, or crowded parks. The FAA proposes five categories of operations over people based on population density (Category 1 being the most sparsely populated areas and Category 5 being the most densely populated areas). Each density category would have operational restrictions. The restrictions, as well as technological and operational mitigations, would increase with population density. Operators with an Operating Permit could only operate in areas up to Category 3. Operations over a Category 4 or 5 area would require an Operating Certificate.
- Operator Responsibility for Personnel: Under the proposed rule there is no individual pilot certification. Rather the onus to comply with Part 108 is on the operating entity (i.e., the company) to ensure staff are properly trained, similar to a corporate responsibility model. This is a key difference from Part 107, where the operational responsibility falls on the individual operator.
- Safe Separation Requirements: The proposed rule would require drones to have technologies that enable them to automatically detect and avoid other aircraft. Drones would yield to all manned aircraft broadcasting their position using ADS-B. Drones could not interfere with operations and traffic patterns at airports, heliports, seaplane bases, space launch and reentry sites, or facilities where electric Vertical Takeoff and Landing aircraft take off or land. The rule would also require drones operated under Part 108 to have lighting and to broadcast Remote ID.
- Automated Data Service Providers: The NPRM proposes the establishment of a new regulated entity, Automated Data Service Providers (ADSPs). These entities would be certified by the FAA, under a new Part 146. ADSPs would provide real-time data to drone operators to deconflict and manage the efficiency of their operations. The proposed rule would permit operators to be their own ADSPs or contract externally. Thus, instead of the FAA playing a centralized role in separation and efficiency of unmanned aircraft such as drones, the ADSPs would serve this role.
- Security: To address cyber threats, the proposed rule would require operators to develop and implement cybersecurity policies to prevent unauthorized access, data breaches, or manipulation of command-and-control systems—adopting best practices for digital security. The proposed rule would require operators to develop security policies to physically protect their facilities. It also includes TSA background check provisions for anyone operating drones to include a check of criminal history, immigration status, and intelligence-related databases and watchlists. In addition, TSA would require permitted and certificated package delivery operators to obtain a limited security program from TSA.
- Reporting: Operators would be required to report information to the FAA including: (1) flight data including the total number of flight hours for each drone, and make, model and registration number; (2) unplanned or precautionary landings; (3) loss of control or communication; (4) malfunctions that lead to flights into unauthorized areas; (5) failure of an automated data service; (6) security breaches that incur loss of control; (7) unauthorized access to an operator’s facilities, networks or data; and (8) any operation that results in more than $500 in damage to property.
- Record Keeping: Operators would also be required to maintain records of each flight with the relevant flight information, as well as records of any mechanical issues, maintenance and alteration inspections, and personnel training. For manufacturers, they would maintain records of compliance information and testing data, configuration control documentation, and continued operational safety data. ADSPs would maintain records or compliance and test data and software revisions.
The FAA is seeking comments on each of the above topics, in addition to other areas. It is an exciting time in the commercial drone industry, with the FAA seeking meaningful, industry feedback to the proposed rule. Pillsbury will continue to monitor developments and provide actionable guidance.