CAA UAV Regulations Explained for UK Operators

UK drone rules are designed around one main question: how much risk does the flight create for people, property and other airspace users? That is why CAA UAV regulations no longer revolve around whether a flight is “commercial” or “recreational”. A paid roof survey can sometimes be flown in the Open category, while an unpaid flight near crowds, airports or complex infrastructure may need formal authorisation.

For UK operators, this risk-based approach is helpful, but it also means compliance depends on the details of each job. Aircraft weight, pilot competence, proximity to uninvolved people, airspace restrictions, site control, insurance and record keeping all matter.

This guide explains the essentials as at mid-2026. It is written for operators planning real-world work in surveying, utilities, emergency services, media, inspection and other professional settings. Always check the CAA’s official drone guidance before relying on a rule for a live operation, as policy, forms and transitional arrangements can change.

The basic structure of CAA UAV regulations

The Civil Aviation Authority regulates drones, often referred to in official guidance as unmanned aircraft systems, or UAS. In everyday use, UAV, UAS and drone are often used interchangeably, although UAS is the broader term because it includes the aircraft, controller, command link and supporting systems.

UK drone operations are grouped into three categories.

Category	Typical risk level	What it means for operators
Open	Low	No CAA operational authorisation is needed if the flight stays within strict limits.
Specific	Medium	You need a CAA Operational Authorisation unless the operation fits another recognised permission route.
Certified	High	Reserved for the highest-risk operations, such as some passenger-carrying or complex operations.

Most UK commercial drone operators work in either the Open or Specific category. The Certified category is not relevant to the majority of routine surveying, inspection, mapping, photography or emergency service support flights.

The key point is that you classify the operation first, then work out the competence, permission, procedures and documentation needed.

Open category: low-risk flights without operational authorisation

The Open category is the simplest route, but only if you can stay inside its limits. It is intended for lower-risk flights where the aircraft is relatively small, the remote pilot maintains visual line of sight, and the operation avoids risky proximity to uninvolved people.

The Open category normally requires:

• A drone below 25 kg maximum take-off mass.
• Visual line of sight throughout the flight.
• A maximum height of 120 metres, or 400 feet, above the surface.
• No flight over assemblies of people.
• Compliance with the relevant Open subcategory rules.
• A valid Operator ID and Flyer ID where required.
• Airspace checks before flight.

The Open category is split into A1, A2 and A3. These are not quality levels. They describe how close you may operate to uninvolved people, based on aircraft eligibility and pilot competence.

A1 is for the lowest-risk operations, generally involving very small aircraft. A2 allows closer operations to people where the aircraft and pilot competence meet the applicable requirements. A3 is for flights kept well away from uninvolved people and built-up, recreational, commercial or industrial areas.

A common mistake is assuming that a small drone can be flown anywhere. It cannot. A sub-250 g drone may be treated more favourably in some situations, but the pilot still needs to respect airspace restrictions, privacy, safety, visual line of sight and the Drone Code.

Because the UK’s drone class-marking and transitional arrangements have evolved separately from EASA rules, do not assume that an EU label, online article or overseas certificate automatically applies in the UK. If your operation depends on A1 or A2 eligibility, verify the current UK CAA position before the job.

Operator ID, Flyer ID and pilot competence

UK drone registration separates the person or organisation responsible for the drone from the person flying it.

The operator is responsible for managing the drone and ensuring it is used safely. The flyer is the person at the controls. In a sole-trader operation, these may be the same person. In a utility, police, survey or inspection team, the operator may be the organisation and the flyers may be staff pilots.

Requirement	Who or what it applies to	Why it matters
Operator ID	The person or organisation responsible for the drone	Must usually be displayed on the drone where required.
Flyer ID	The person flying the drone where required	Shows the flyer has passed the basic CAA theory test.
A2 CofC	Remote pilots operating in A2 where applicable	Supports closer operations to people under the A2 rules.
GVC	Common route for Specific category pilots	Often used to support applications for CAA Operational Authorisation.

The CAA drone registration service is the official place to register, renew and take the basic test. Operator IDs and Flyer IDs have different validity periods, so organisations should track renewal dates rather than relying on pilots to remember them individually.

The General Visual Line of Sight Certificate, or GVC, is widely used by professional operators in the Specific category. It is not, by itself, permission to fly. It is evidence of remote pilot competence that can support an Operational Authorisation application.

Specific category: when you need CAA authorisation

If the operation cannot be completed inside the Open category, it will usually fall into the Specific category. This is where many professional drone businesses, public-sector teams and infrastructure operators spend much of their time.

You may need a CAA Operational Authorisation if the job involves factors such as:

• Flying closer to uninvolved people than the Open category permits.
• Operating heavier drones in urban or congested environments.
• Flying beyond visual line of sight.
• Operating above the normal 120 metre height limit.
• Working in complex or sensitive airspace.
• Dropping articles or carrying specialist payloads.
• Running repeatable operations across multiple sites with defined procedures.

An Operational Authorisation is granted to the operator, not just to an individual pilot. It is based on the CAA’s assessment of your operating procedures, pilot competence, aircraft, maintenance arrangements and risk controls.

For many standard professional operations, operators use a predefined route such as a UK PDRA where the flight profile fits the published conditions. More complex operations may require a fuller safety case or structured risk assessment approach. The CAA’s Specific category policy has developed over time, so it is important to use the current application guidance rather than copying an old operations manual.

A strong Specific category application is not just a paperwork exercise. It should show that your organisation can plan, brief, fly, respond to emergencies, maintain aircraft and learn from incidents in a repeatable way. If you are building or improving that process, Dronedesk’s guide to creating a drone flight risk assessment that works is a useful companion to the regulatory overview here.

Airspace rules: do not rely on the category alone

Even if your flight fits the Open category or your Operational Authorisation, you still need to check airspace. CAA UAV regulations sit alongside airspace restrictions, temporary restrictions, aerodrome procedures and local site controls.

The most common airspace issue for UK operators is the Flight Restriction Zone, or FRZ, around protected aerodromes. You must not fly in an FRZ without the required permission from the relevant air traffic control unit, flight information service unit or aerodrome operator, depending on the site.

You should also check for:

• Restricted areas, prohibited areas and danger areas.
• Temporary restricted areas and emergency restrictions.
• NOTAMs that affect your operating area.
• Military air traffic zones and other sensitive airspace.
• Local restrictions around prisons, royal parks, major events or critical sites.

Airspace checks should happen before the job is accepted, again during planning, and again shortly before flight. For repeat clients, such as survey companies inspecting housing stock or utilities inspecting linear assets, it is still risky to assume that yesterday’s airspace picture applies today.

The CAA’s Drone and Model Aircraft Code is a useful baseline for safe flying behaviours, but professional operators should also maintain evidence of their site-specific checks and permissions.

Insurance, privacy and non-aviation permissions

CAA permission is not the only requirement. A legally safe flight can still create problems if the operator ignores insurance, land access, data protection or client-site rules.

If you fly for work, reward or commercial purposes, you should have suitable aviation insurance that meets the applicable UK requirements. Many clients, especially utilities, public bodies and large contractors, will also specify minimum liability cover in procurement documents.

Landowner permission is separate from CAA permission. The CAA may allow you to fly in a given category, but that does not give you the right to take off from private land, close a footpath, access a substation or control a construction site. Site access, cordons and public management should be agreed with the landowner, principal contractor or responsible authority.

Privacy and data protection are equally important. If your drone captures identifiable people, vehicle registrations, homes or workplaces, UK GDPR and the Data Protection Act may apply. The Information Commissioner’s Office provides public guidance on drones and privacy, and professional operators should be able to explain what they record, why they record it, how it is stored and how long it is retained.

What the rules mean for common UK operator scenarios

The category you use depends on the operational facts, not the industry label. The same drone and pilot may be in the Open category on one job and the Specific category on the next.

Scenario	Likely regulatory considerations	Practical planning focus
Rural land survey with a small drone	Often possible in Open if separation and airspace rules are met	Land access, VLOS, livestock, footpaths, weather and battery planning.
Roof inspection in a town centre	Often needs careful A2 eligibility or Specific category authorisation	Uninvolved people, take-off control, cordons, traffic and emergency procedures.
Utility asset inspection	May be Open or Specific depending on location, aircraft and proximity	Linear routes, critical infrastructure access, client permits and electromagnetic hazards.
Emergency service deployment	May involve dynamic risk and airspace coordination	Command structure, evidence logging, scene safety, deconfliction and rapid briefings.
BVLOS inspection or patrol	Usually Specific and often more complex	Detect-and-avoid, communications, contingency planning and CAA approval route.

For operators managing multiple aircraft, pilots and maintenance obligations, regulatory compliance quickly becomes a fleet management issue as well as a flight-planning issue. Dronedesk’s drone fleet management guide explores how records, assets, pilot assignments and maintenance schedules fit into a professional operation.

A practical compliance workflow for UK drone operators

A repeatable workflow is one of the best ways to stay compliant. It also helps when clients, insurers or auditors ask how you make go or no-go decisions.

Start by defining the task clearly. What is the purpose of the flight, what data is needed, where will the aircraft fly, and what would make the operation unsafe or non-compliant?

Next, classify the operation. Decide whether it fits Open, Specific or Certified. If it is Open, identify the relevant subcategory. If it is Specific, confirm that your Operational Authorisation covers the aircraft, pilot, location type and method of operation.

Then check people, property and airspace. This includes uninvolved persons, assemblies of people, nearby roads, schools, railways, construction activity, livestock, emergency activity, FRZs, NOTAMs and any temporary restrictions.

After that, prepare the flight documents. Depending on the operation, this may include a risk assessment, method statement, site survey, client permission, landowner permission, airspace approval, pilot competence evidence, insurance certificate and emergency response plan.

Before take-off, brief the team. Everyone involved should understand the flight area, roles, communications, abort criteria, emergency landing options and what to do if members of the public enter the operating area.

Finally, log the outcome. Record the flight, aircraft used, pilot, batteries where relevant, defects, incidents, maintenance issues and lessons learned. Good logs are not just for compliance. They improve future planning and help identify patterns before they become safety issues.

Common misconceptions about CAA UAV regulations

“Commercial drone flights always need CAA permission.” Not necessarily. The UK moved away from the old commercial-permission model. Some paid work can be done in the Open category if every Open category condition is met.

“A sub-250 g drone can fly anywhere.” No. Small drones still need to comply with airspace restrictions, privacy law, safe separation, visual line of sight and the Drone Code. If it has a camera, Operator ID requirements may also apply unless an exemption applies.

“My GVC lets me fly in the Specific category.” A GVC is evidence of pilot competence. The operator still needs an Operational Authorisation, or another valid permission route, for Specific category operations.

“Airspace apps replace permission.” Apps and maps are planning tools. They do not grant permission to enter an FRZ, restricted area or temporary restricted area. You need approval from the correct authority where required.

“Landowner permission is the same as CAA permission.” They are separate. You may need both, and you may also need client, site, police, highways, rail, event or infrastructure approvals depending on the job.

Keeping compliant as your drone operation grows

The hardest part of CAA compliance is rarely learning a single rule. It is applying the right rule consistently across changing locations, pilots, aircraft, clients and weather conditions.

That is why professional operators should treat compliance as an operating system, not a one-off document. Your processes should make it easy to answer questions such as:

• Which pilots are competent and current for this operation?
• Which aircraft are serviceable and suitable for the task?
• Does this site fall inside controlled or restricted airspace?
• Are we operating under Open category limits or an Operational Authorisation?
• What risk controls are required for uninvolved people?
• Where are the flight logs, permissions and maintenance records stored?

Dronedesk is built for drone operations management and includes features such as client management, fleet management, team management, airspace intelligence, proximity intelligence, flight planning, flight logging, data reporting, configurable checklists and risk assessments. You can review the platform’s current capabilities on the Dronedesk features page.

Frequently asked questions

What are the main CAA UAV regulations UK operators need to understand? UK operators should understand the Open, Specific and Certified categories, Operator ID and Flyer ID requirements, the 120 metre height limit, visual line of sight, airspace restrictions, separation from uninvolved people, insurance obligations and when an Operational Authorisation is needed.

Do I need CAA permission for commercial drone work in the UK? Not automatically. Commercial work can be flown in the Open category if it meets all Open category requirements. If the operation exceeds those limits, such as flying too close to uninvolved people or operating BVLOS, you will usually need Specific category authorisation.

What replaced the old PfCO? The old Permission for Commercial Operations model was replaced by the current risk-based framework. Many professional operators now use a GVC and apply for a CAA Operational Authorisation for Specific category work.

Can I fly a drone at night in the UK? Night flying is not automatically prohibited, but you must still maintain safe control, visual line of sight and orientation, comply with the applicable category rules, and manage the additional risks caused by darkness. Your Operational Authorisation may include specific night procedures if you operate in the Specific category.

What is the maximum legal drone height in the UK? The normal maximum height is 120 metres, or 400 feet, above the surface. Operations above this limit generally need specific CAA approval or must fit an applicable exception confirmed in current CAA guidance.

Do emergency services have different drone rules? Emergency services still need robust governance, competent pilots, airspace coordination and suitable authorisations. Some emergency scenarios may involve special procedures or coordination routes, but they should not be treated as a blanket exemption from safe operating requirements.

Plan compliant flights with less admin

Understanding CAA UAV regulations is the foundation. Applying them consistently on every job is the real operational challenge.

If your team needs a clearer way to manage clients, aircraft, pilots, airspace checks, risk assessments, checklists and flight logs, Dronedesk brings those workflows into one drone operations management platform. It helps operators keep planning, safety and compliance evidence organised from the first enquiry through to the completed flight record.