Drone Operation Laws Explained for Commercial Use

Commercial drone work is no longer a niche activity. Surveyors use drones to inspect roofs and map land. Utilities use them to check lines, towers and assets. Emergency services use them for situational awareness. But as soon as a drone is being used for a paid job or professional purpose, the legal questions become sharper: Who is responsible, what permission is needed, where can it fly and what records must be kept?

In the UK, the biggest misconception is that drone operation laws are triggered purely by whether the flight is commercial. That used to be a more important dividing line. Today, the UK Civil Aviation Authority (CAA) regulates most drone flights by the level of operational risk, not simply by whether money changes hands.

That does not mean commercial operators can treat the rules casually. Commercial use brings additional expectations around insurance, contracts, data protection, health and safety, audit trails and client evidence. This guide explains the core legal framework for commercial drone use, with a UK focus and practical notes for operators working internationally.

The core principle: commercial drone laws are risk-based

The CAA’s framework for unmanned aircraft systems is built around three operating categories: Open, Specific and Certified. These categories determine what you can do, what training or authorisation may be required and how much evidence you need to hold before flying.

The CAA drone guidance should always be your primary source for UK requirements, especially because aircraft class rules, authorisation routes and operational guidance can change. At the time of writing in August 2026, however, the category model remains the foundation of UK drone operation laws.

Category	Typical commercial relevance	What it means in practice
Open	Lower-risk work such as simple photography, basic surveys or site progress shots within strict limits	No CAA operational authorisation is normally needed, but you must follow the category rules, registration duties and operating limits
Specific	Higher-risk work such as closer operations near people, complex sites, heavier drones or some specialist infrastructure work	Requires a CAA Operational Authorisation or another recognised route, supported by risk assessment and procedures
Certified	Very high-risk operations, potentially including carrying people or dangerous goods	Subject to aviation-style certification, licensing and oversight, and not typical for most commercial drone service providers

The practical takeaway is simple: a commercial flight can be legal in the Open category if it stays within the Open category limits. A non-commercial flight can still require authorisation if it creates higher risk.

For professional operators, that means every job should start with an operational question, not a sales question: what are we flying, where are we flying, who could be affected and what level of control is needed?

Legal duties every commercial drone operator should check

A compliant commercial operation is not just a pilot with a drone. It is a chain of responsibilities covering the operator, the remote pilot, the aircraft, the site, the client brief and the surrounding airspace.

Registration and operator responsibility

Most commercial drone businesses in the UK will need an Operator ID from the CAA. The operator is the person or organisation responsible for managing the drone and ensuring it is used safely and legally. The Operator ID must usually be displayed on the aircraft.

The remote pilot may also need a Flyer ID, depending on the aircraft and operation. Even where a Flyer ID is not required, the pilot must still be competent for the flight being carried out. For many commercial operators, additional training such as an A2 Certificate of Competency (A2 CofC) or General VLOS Certificate (GVC) may be relevant depending on the operation and authorisation route.

The UK Drone and Model Aircraft Code is a useful baseline for remote pilots, but commercial operators should treat it as the starting point rather than the whole compliance system.

Insurance for commercial drone use

Commercial drone operators in the UK are generally required to hold aviation insurance that meets the relevant legal standard. In practice, this usually means cover compliant with retained Regulation (EC) No 785/2004.

Do not assume a general business policy, public liability policy or manufacturer care plan is enough. Commercial drone insurance should match the type of aircraft, the nature of the work, the operating environment and any client or contract requirements.

Airspace checks and permission

Before every commercial flight, you need to understand the airspace. This includes Flight Restriction Zones (FRZs) around aerodromes, restricted areas, danger areas, prohibited areas, temporary restrictions, NOTAMs and local site hazards.

A common error is assuming that a green-looking map means a flight is automatically legal. Airspace intelligence is only one part of the decision. You still need to consider landowner permission for take-off and landing, nearby people, emergency access, obstacles, weather, privacy and any site-specific rules.

Operating limits: height, visibility and people

For most routine drone work, 400 ft or 120 m above the surface is the key height limit unless a specific permission or authorisation allows otherwise. Visual line of sight is also a core requirement for most operations, meaning the remote pilot must be able to see the aircraft well enough to control it and avoid collisions.

Rules around flying near or over people depend on the aircraft, category, subcategory and authorisation. As a commercial operator, you should be especially cautious around uninvolved people, congested areas, events and assemblies of people. If the job requires closer work than the Open category allows, you may be moving into the Specific category.

Records and accountability

Commercial clients often ask for evidence: risk assessments, pilot qualifications, insurance, flight logs, maintenance records, site surveys and operational procedures. Regulators may also expect a clear audit trail if something goes wrong.

This is where professional operators need more than a memory and a folder of old PDFs. They need a repeatable process that shows how each flight was planned, approved, flown and recorded.

When the Open category is enough for commercial work

The Open category is designed for lower-risk drone operations. Many simple commercial jobs can fall within it, provided the aircraft and site conditions fit the rules.

Examples might include a small drone capturing marketing images over private land, a roof inspection with good separation from uninvolved people or a basic survey in a controlled, low-risk environment. The commercial purpose does not automatically push the flight into the Specific category.

However, the Open category is not a shortcut. It comes with strict limits around aircraft type, proximity to people, maximum height, visual line of sight and overflight of assemblies. If you cannot meet those limits, you should stop and reassess the operation.

Open category issue	Why it matters for commercial operators
Aircraft weight and class	Determines where and how close to people the drone may be flown
Distance from uninvolved people	Often the deciding factor on busy sites, streets, events and industrial premises
Visual line of sight	Limits how far the pilot can safely operate without additional authorisation
400 ft / 120 m height limit	Affects inspection, mapping and infrastructure work where assets are tall or terrain varies
No overflight of assemblies of people	Important for media, events, public realm and emergency response support

The Open category can work well for straightforward commercial tasks, but it is not always suitable for infrastructure, urban survey or emergency work. If you are regularly designing workarounds to squeeze a job into the Open category, it may be time to consider whether a Specific category authorisation is more appropriate.

When you need the Specific category

The Specific category applies when the operation creates more risk than the Open category allows. In the UK, this usually means you need an Operational Authorisation from the CAA unless another recognised route applies.

Typical reasons a commercial job may fall into the Specific category include flying closer to uninvolved people, using heavier aircraft, operating in complex industrial environments, conducting extended infrastructure inspections or planning work that needs a more formal safety case.

The authorisation process is not just a formality. It requires the operator to explain how the risks will be controlled. That means documented procedures, competent personnel, aircraft management, emergency planning and evidence that the operator can do what it says it will do.

Many operators use a GVC as part of the route toward an Operational Authorisation, although the precise evidence required depends on the operation. For more complex work, the CAA may require a fuller operating safety case or a methodology aligned with recognised risk assessment approaches.

If you are building this capability, your risk assessment process needs to be practical, job-specific and usable by the team on site. Dronedesk has a separate guide on how to build a drone flight risk assessment that works, which is a useful next step if your operations are becoming more complex.

The paperwork that keeps commercial flights defensible

Drone operation laws are not only about what happens in the air. For a commercial operator, compliance is often proven through records. If there is an incident, a client dispute or a regulator query, your paperwork shows whether the flight was planned and managed responsibly.

A good commercial job pack normally includes the essentials before the aircraft leaves the ground. This does not need to be bureaucratic, but it does need to be consistent.

Record or check	Why it matters
Client and site brief	Confirms the purpose of the work, boundaries, deliverables and site constraints
Airspace and proximity review	Identifies FRZs, restrictions, nearby aerodromes, roads, railways, schools, prisons, crowds and other hazards
Risk assessment and method statement	Shows how foreseeable hazards were identified and controlled
Pilot competency evidence	Confirms the remote pilot is suitable for the flight and authorisation route
Insurance evidence	Demonstrates that the commercial operation has appropriate cover
Aircraft and battery records	Supports airworthiness, maintenance control and battery safety
Checklists	Reduces missed steps before, during and after the flight
Flight logs	Creates a record of what happened, where, when and by whom
Incident or occurrence notes	Helps meet reporting duties and improves future safety planning

This is also where software can support a more professional operating model. The published Dronedesk features include client, fleet and team management, airspace and proximity intelligence, flight planning, flight logging, data reporting, configurable checklists and risk assessments, all of which map directly to the records commercial operators need to manage.

Privacy, data protection and filming laws

A legally safe flight is not automatically a privacy-compliant flight. If your drone captures identifiable people, vehicle number plates, homes, gardens or sensitive sites, UK GDPR and the Data Protection Act 2018 may apply.

The Information Commissioner’s Office provides public guidance on drones and privacy, and commercial operators should take privacy seriously from the planning stage. This is especially important for survey companies, utilities and emergency services because they may operate near homes, workplaces or public spaces.

Good practice includes telling people where appropriate, limiting what you capture, avoiding unnecessary recording, securing the data, setting retention periods and sharing footage only with authorised parties. For systematic monitoring or higher-risk data processing, a Data Protection Impact Assessment may be appropriate.

Privacy is also a reputational issue. A technically legal flight can still damage trust if members of the public feel they were filmed without care or explanation.

Sector-specific issues for commercial operators

Different industries face different legal and operational pressure points. The core drone operation laws are the same, but the way risk appears on site can vary significantly.

Survey companies often need repeatable workflows for maps, measurements, roof inspections and progress images. Their biggest challenges are usually site control, separation from uninvolved people, data handling and consistency across multiple pilots or locations.

Utility companies may face more complex airspace and safety environments. Power lines, substations, pipelines, rail corridors, roads, telecoms assets and remote terrain all create hazards that should be reflected in the risk assessment. Utilities may also need strong asset records and clear evidence for internal safety teams.

Emergency services may operate under different operational pressures, especially when life safety is involved. Even then, drone use should be governed by training, command structure, airspace coordination, data protection and post-flight logging. Emergency context does not remove the need for disciplined procedures.

Media, events and marketing teams should be especially cautious around crowds. Flying over assemblies of people is heavily restricted and often incompatible with routine Open category operations. For public events, the safest legal answer is often early planning, formal permissions and a realistic decision about whether the flight can be done at all.

Operating outside the UK: do not assume the rules travel with you

Commercial drone operators increasingly work across borders, especially in surveying, energy, construction and emergency support. The UK framework is a useful reference point, but it does not authorise you abroad.

Region	Commercial compliance points to check
United States	FAA Part 107 remote pilot certification, drone registration, Remote ID rules, airspace authorisations and waivers for operations outside standard limits
European Union	EASA Open, Specific and Certified categories, operator registration, remote pilot competency, local authority requirements and privacy laws
Other jurisdictions	Local aviation authority rules, import rules, spectrum rules, insurance, permissions for sensitive sites and data protection requirements

For US operations, the FAA commercial drone operator guidance is the starting point. For EU operations, the EASA civil drones guidance explains the European framework, although member states may still have national procedures and local restrictions.

If you are tendering for international work, confirm legal requirements before pricing the job. Training, insurance, permissions and local representation can all affect cost and lead time.

Common compliance mistakes in commercial drone work

Most compliance failures are not caused by operators ignoring every rule. They often come from small assumptions made under time pressure.

Common mistakes include:

• Treating commercial intent as the only legal test, instead of assessing operational risk
• Assuming an app-based airspace check is the same as permission to fly
• Forgetting that insurance requirements are different for commercial work
• Using a generic risk assessment that does not reflect the real site
• Failing to manage batteries, maintenance and aircraft records across a growing fleet
• Capturing personal data without a clear privacy plan
• Letting client pressure override weather, people separation or airspace constraints
• Keeping flight logs in inconsistent spreadsheets, email threads or pilot notebooks

As operations grow, these weaknesses become harder to manage manually. If you are adding aircraft, pilots, subcontractors or multiple client sites, it is worth reviewing your operating model. Dronedesk’s guide to drone fleet management explains when simple spreadsheets start to struggle and what to consider as your fleet becomes more complex.

A practical compliance workflow for commercial drone jobs

The most reliable way to stay compliant is to build the law into your workflow. That means every job follows a predictable path from enquiry to post-flight record.

Start by defining the task clearly. What does the client need, what data will be captured and what would make the flight unsafe or unlawful? Then check the aircraft, pilot, category and airspace. If the flight sits comfortably inside the Open category, document why. If it does not, identify the authorisation or permission route before agreeing dates with the client.

Next, prepare the site risk assessment and method statement. Include people, property, obstacles, roads, railways, livestock, electromagnetic interference, emergency landing areas, weather limits and site control measures. Make sure the pilot and any observers understand their roles.

Before flying, run the pre-flight checklist and confirm that conditions still match the plan. After flying, complete the log, record any deviations, store relevant data securely and update maintenance or battery records if needed.

This approach is not about creating paperwork for its own sake. It is about being able to show that a professional operator made informed, lawful and safety-led decisions at every stage of the job.

Frequently Asked Questions

Do I need CAA permission for every commercial drone flight in the UK? No. A commercial drone flight can be carried out in the Open category if it meets all Open category rules. You need CAA Operational Authorisation when the operation falls into the Specific category or otherwise requires permission.

Is the old PfCO still required for commercial drone work? No. The old Permission for Commercial Operations is no longer the current UK framework. Commercial operators now work within the Open, Specific or Certified categories, with Operational Authorisation used for many Specific category operations.

What is the maximum legal height for commercial drone flights? For most routine UK drone flights, the limit is 400 ft or 120 m above the surface unless a valid authorisation or permission allows otherwise. Always check the rules for your category and operation.

Can I fly a drone over people for a commercial job? It depends on the aircraft, category, distance, people involved and whether the people are part of an assembly. Overflying uninvolved people is tightly restricted, and overflying assemblies of people is generally not allowed without specific authorisation.

Do commercial drone operators need insurance? Yes, commercial drone operators in the UK generally need aviation insurance that meets the relevant legal requirements. Check that the policy covers the aircraft, operation type, location and client requirements.

Can emergency services use drones without following normal rules? Emergency services may have specific procedures, permissions or exemptions for certain situations, but drone use still needs competent pilots, safe operating procedures, airspace awareness, privacy controls and proper records.

Make commercial drone compliance easier to manage

Drone operation laws can be complex, but your workflow does not have to be chaotic. The key is to turn legal duties into repeatable checks, records and decisions that your whole team can follow.

Dronedesk helps commercial drone operators manage the operational admin around clients, teams, aircraft, planning, risk assessments, checklists, flight logs and reporting in one place. If your drone work is growing beyond ad hoc files and spreadsheets, it is a practical way to bring structure to compliance-focused operations.