Drone Regulations Checklist for Commercial Flights

Commercial drone work is only profitable when it is repeatable, safe and defensible. A good drone regulations checklist helps you prove that every job, from a single roof inspection to a multi-site utility survey, has been planned against the rules that apply on the day.

This guide is written for UK commercial drone operators, survey teams, utility companies and emergency services. It focuses on practical compliance under the UK Civil Aviation Authority framework, but it is not legal advice. Always check the latest guidance from the CAA drones portal and the Drone and Model Aircraft Code before flying, especially if your operation is unusual, close to people, near controlled airspace or outside visual line of sight.

Start with the key point: commercial is not a category

In the UK, a paid drone job does not automatically mean you need the same permission for every flight. Since the move to risk-based drone regulation, the deciding factor is the nature of the operation, not whether money changes hands.

A commercial flight may be possible in the Open category if it meets all Open category limits. If it does not, it normally moves into the Specific category and requires an appropriate CAA Operational Authorisation. The Certified category exists for the highest-risk operations, but most routine commercial flights do not fall there.

Regulatory category	What it generally covers	Typical commercial examples	Core compliance question
Open	Lower-risk flights within strict operating limits	Simple site photography, low-risk inspections, basic mapping away from uninvolved people	Can the flight stay within Open category limits for aircraft, location, people, height and VLOS?
Specific	Operations that exceed Open category limits or introduce higher risk	Complex urban inspections, operations closer to uninvolved people, EVLOS or BVLOS work, higher-risk industrial sites	Do you have the right CAA authorisation, procedures and pilot competence?
Certified	Highest-risk operations closer to traditional aviation certification	Carrying people, certain high-risk cargo operations or very complex use cases	Are aircraft, operator and crew certified under the relevant framework?

The CAA’s CAP 722 guidance is the main reference for unmanned aircraft system operations in UK airspace. Treat it as your authoritative source when building or reviewing internal procedures.

The commercial drone regulations checklist

Use this checklist before quoting, during planning, on the day of flight and after the job. For larger teams, the real value comes from making it a standard operating workflow rather than a one-off document.

Checklist area	What to confirm	Evidence to keep
Operating category	Open, Specific or Certified category has been correctly identified	Planning notes, category decision, operational limits used
CAA registration	Operator ID and Flyer ID requirements are met	Operator ID record, pilot Flyer ID record, aircraft marking where required
Pilot competence	Pilot holds the right competency for the operation	Flyer ID, A2 CofC, GVC, internal training or currency records as applicable
Operational Authorisation	Required authorisation is in place if the flight is outside Open category limits	CAA Operational Authorisation, operations manual reference, permission conditions
Insurance	Commercial aviation liability insurance is valid for the work	Insurance certificate, policy scope, expiry date
Aircraft suitability	Drone, payload, batteries and firmware are suitable and serviceable	Maintenance records, battery logs, defect reports, pre-flight checks
Airspace	Controlled, restricted, prohibited, danger and temporary restrictions have been checked	Airspace screenshots or report, permission records, NOTAM review
Site permission	Take-off, landing and access permissions are agreed	Landowner or site manager approval, induction records, permits to work
Ground risk	People, roads, property, animals and sensitive sites are assessed	Site-specific risk assessment and mitigation plan
Weather	Conditions are within aircraft, pilot and authorisation limits	Weather forecast, wind limits, visibility assessment
Privacy	Data protection and surveillance risks are addressed	Privacy notice, client instructions, DPIA if appropriate, data handling plan
Emergency procedures	Lost link, flyaway, incursion, crash and battery emergency actions are briefed	Crew briefing record, emergency contact list, incident process
Flight logging	Actual flight details are recorded after the mission	Flight log, aircraft hours, pilot hours, battery cycles, defects

1. Confirm the operating category before you accept the job

Before you quote or commit resources, decide whether the flight can be conducted within the Open category. This is not just an admin step. It affects pricing, lead time, crew requirements, permissions and whether the job is realistic.

For Open category operations, confirm that the aircraft, location, separation distances, height, visual line of sight and proximity to uninvolved people all fit the relevant subcategory. Remember that the maximum height rule is generally 120 metres, or 400 feet, above the surface unless a specific rule or permission allows otherwise.

If any part of the task falls outside Open category limits, stop and assess whether it needs Specific category approval. Common triggers include operating closer to uninvolved people than Open category rules allow, flying in a congested or complex environment, using heavier aircraft, operating beyond visual line of sight, or working under conditions not covered by the Drone Code.

A GVC is not, by itself, permission to fly anywhere. It is a recognised competency route that supports applications for certain authorisations. The permission comes from the CAA Operational Authorisation and its conditions.

2. Check registration, pilot competence and crew roles

For commercial drone work, you should be able to show who the operator is, who the remote pilot is and who has responsibility for the aircraft and mission. In the UK, the operator is the person or organisation responsible for managing the drone, while the remote pilot is the person flying it.

Check that the Operator ID is current and displayed where required. Check that the pilot holds a valid Flyer ID where required. If the operation relies on an A2 CofC, GVC, internal emergency services training pathway or other competency evidence, make sure it is current and relevant to the job.

For team operations, record the role of each person involved. That may include remote pilot, observer, payload operator, spotter, incident commander, site contact or client representative. Role clarity matters when something changes quickly on site.

3. Verify insurance before mobilisation

Commercial drone operators in the UK generally need appropriate aviation liability insurance. Do not assume that a general business, professional indemnity or public liability policy covers drone operations.

Your insurance check should confirm the insured operator, aircraft types, geographical area, type of work, cover period and any exclusions. If you are flying for utilities, emergency services, government bodies or major contractors, expect the client to ask for evidence before you arrive on site.

Insurance is also a useful reality check. If your insurer would not recognise the type of operation you are proposing, your compliance review probably needs another look.

4. Complete airspace and site permission checks separately

Airspace permission and land permission are different. You may have permission from a landowner to take off, but still be unable to fly because of airspace restrictions. Equally, you may have airspace permission but no lawful access to the take-off area.

Your airspace check should consider Flight Restriction Zones around protected aerodromes, controlled airspace, restricted areas, prohibited areas, danger areas, temporary restrictions, NOTAMs and local hazards such as prisons, military sites, heliports or emergency activity.

Your site check should cover take-off and landing areas, emergency landing options, public access, traffic, livestock, overhead cables, cranes, masts, water, railways and any site-specific induction requirements. Utility and industrial environments often add further controls, such as permits to work, exclusion zones and radio procedures.

If you use software to manage planning, make sure it supports documented decision-making rather than just map viewing. Dronedesk’s listed features include airspace intelligence, proximity intelligence, flight planning, configurable checklists and risk assessments, which can help operators build a more consistent planning workflow in one place. You can review the platform’s published capabilities on the Dronedesk features page.

5. Build a site-specific risk assessment

A generic risk assessment is rarely enough for commercial drone work. The same aircraft and pilot can face very different risks depending on the location, client, weather, ground activity and airspace.

At a minimum, your risk assessment should identify:

• Air risks, including controlled airspace, low-flying aircraft, helicopters, gliders, military activity and nearby aerodromes.
• Ground risks, including uninvolved people, roads, buildings, railways, animals, hazardous sites and public access.
• Operational risks, including weather, battery endurance, GNSS reliability, radio interference, crew fatigue and emergency response.
• Data risks, including filming people, capturing private property, storing client data and sharing imagery.

For a deeper process, Dronedesk has a practical guide on building a drone flight risk assessment that works, which is especially useful if your current assessments are too generic or difficult to audit.

6. Plan for privacy and data protection

Commercial drone flights often collect more data than clients realise. A roof survey may capture neighbouring gardens. A utility inspection may record vehicle registrations. An emergency services deployment may involve vulnerable people or sensitive incident footage.

The UK GDPR and Data Protection Act can apply where images or data identify individuals. The Information Commissioner’s Office guidance on drones is a useful starting point for understanding privacy expectations.

Good practice includes minimising what you capture, avoiding unnecessary filming of people, using signage or notices where practical, briefing the client on lawful use, controlling access to imagery and deleting data when it is no longer needed. For higher-risk deployments, consider a documented Data Protection Impact Assessment.

7. Run an on-the-day compliance check

Even a well-planned flight can become non-compliant if conditions change. Treat the day-of-flight check as a fresh decision, not a formality.

On-the-day check	What to look for	Go or no-go trigger
Weather	Wind, gusts, visibility, precipitation, temperature and cloud base	Conditions exceed aircraft, pilot or authorisation limits
Airspace	New NOTAMs, emergency activity, temporary restrictions, nearby aircraft	Permission missing or air risk cannot be mitigated
Ground area	Public access, vehicles, site workers, animals, changing hazards	Separation or exclusion zone cannot be maintained
Crew briefing	Roles, communication, emergency actions and abort criteria understood	Any critical role or procedure is unclear
Aircraft status	Propellers, batteries, firmware, sensors, payload, compass and GNSS	Defect, warning or battery issue affects safe flight
Client scope	Flight matches agreed task, location, height and data capture	Client requests a change that alters category or risk

Be particularly careful with last-minute client requests. “Can you just fly over there as well?” may sound harmless, but it can introduce a new airspace issue, privacy concern, ground risk or authorisation breach. If the scope changes, reassess before flying.

8. Keep compliant post-flight records

Compliance does not end when the aircraft lands. Post-flight records help prove what happened, support maintenance, improve future planning and protect your organisation if a client, regulator or insurer asks questions later.

A commercial flight log should normally capture the date, location, aircraft, pilot, crew, client, flight times, batteries used, purpose of flight, weather, any deviations, defects and incidents. Maintenance and battery records should be updated promptly, especially if the flight involved harsh weather, heavy payload use or abnormal behaviour.

If there is an accident, serious incident, flyaway, airspace infringement or other reportable event, follow the relevant CAA, AAIB and internal reporting processes. Do not rely on memory days later. Record the facts while they are fresh.

For growing teams, record keeping becomes harder as aircraft, pilots and sites multiply. A structured approach to drone fleet management can make it easier to track assets, maintenance, pilot currency and operational history without relying on scattered spreadsheets.

Extra checks for different commercial sectors

The core drone regulations checklist stays the same, but different sectors add different operational pressures.

Sector	Common added risks	Extra checks to include
Surveying and mapping	Repeated flight lines, large areas, data accuracy requirements, public boundaries	Ground control access, privacy screening, battery planning, client deliverable limits
Utilities	Critical infrastructure, live electricity, remote sites, emergency repairs	Site induction, asset owner permits, exclusion zones, radio contact, emergency landing areas
Emergency services	Dynamic incidents, public presence, helicopters, sensitive imagery	Command approval, air asset coordination, evidence handling, scene safety, rapid dynamic risk assessment
Construction and industrial sites	Cranes, vehicles, temporary structures, contractors, dust and radio interference	Permit to work, site traffic plan, take-off control, PPE, changing hazard review
Environmental and rural work	Livestock, wildlife, uneven ground, poor connectivity, weather exposure	Landowner permission, animal disturbance controls, offline procedures, retrieval plan

Emergency services should be especially cautious about airspace coordination. A drone can be valuable at an incident, but it must not create risk for helicopters, air ambulances or other responding aircraft. Clear command procedures and rapid deconfliction are essential.

How to make the checklist operational, not decorative

Many organisations have a checklist. Fewer can prove it was followed consistently across every job. The difference is usually workflow discipline.

Assign ownership for each stage. A planner may complete airspace and site checks, the remote pilot may confirm day-of-flight conditions, and an operations manager may review authorisation compliance. For small operators, one person may do everything, but the responsibilities should still be explicit.

Version control also matters. If your operations manual, risk assessment template or emergency procedure changes, remove old versions from circulation. Audits often expose not a lack of documentation, but multiple versions of the same document being used by different pilots.

Finally, review your checklist after near misses, client changes, new aircraft, updated CAA guidance or unusual missions. Regulations and operational risks evolve. Your checklist should evolve with them.

Frequently Asked Questions

Do I need CAA Operational Authorisation for every commercial drone flight? No. A commercial flight can be conducted in the Open category if it meets all Open category limits. If the operation falls outside those limits, you will normally need the appropriate Specific category authorisation.

Is drone insurance mandatory for commercial flights in the UK? Commercial drone operators generally need appropriate aviation liability insurance. Check that your policy specifically covers the aircraft, work type, location and operating model you intend to use.

Can I fly inside an airport Flight Restriction Zone if I have a paid job there? Only if you have the required permission from the relevant aerodrome or air traffic authority and can meet all other regulatory and safety requirements. A client request does not override FRZ restrictions.

Does a GVC let me fly anywhere commercially? No. A GVC is evidence of remote pilot competency. It does not replace the need to comply with Open category rules or hold an Operational Authorisation where one is required.

What records should I keep after a commercial drone flight? Keep flight logs, pilot and aircraft details, battery use, maintenance notes, weather, permissions, risk assessments, client scope, defects, deviations and any incident reports. Your records should show what was planned, what changed and what actually happened.

How often should a drone regulations checklist be reviewed? Review it whenever CAA guidance changes, your aircraft or payloads change, you add new pilots, you enter a new sector, or an incident or near miss reveals a gap in your process.

Turn the checklist into a repeatable workflow

A drone regulations checklist is most useful when it becomes part of everyday operations. If you are managing clients, aircraft, pilots, risk assessments, checklists, flight plans and logs across multiple jobs, spreadsheets can become difficult to control.

Dronedesk brings core drone operations management tasks into one platform, including client management, fleet management, team management, flight planning, flight logging, configurable checklists, risk assessments, airspace intelligence and reporting. For commercial operators who need consistent evidence of planning and compliance, that structure can make the difference between a checklist that sits in a folder and a process your whole team actually follows.