Resources

At the end of June 2026, EASA released a new revision of the Easy Access Rules for Unmanned Aircraft Systems (the EAR for UAS). For anyone who works with the specific category on a daily basis, this is the edition worth reading, because it is the point at which SORA 2.5 finally sits inside the single, consolidated reference document alongside Regulation (EU) 2019/947 and its acceptable means of compliance (AMC) and guidance material (GM).

If you have been following the file, none of the underlying content is a surprise. The legal change happened in September 2025, when EASA published Executive Director Decision 2025/018/R and introduced SORA 2.5, the latest version of the Specific Operations Risk Assessment developed by JARUS, into the AMC and GM to Regulation (EU) 2019/947. We looked at that moment when SORA 2.5 first landed. What the June 2026 EAR does is bring that decision, catalogued as Issue 1, Amendment 4 to the AMC and GM, into the one document that most operators and competent authorities actually open when they need an answer. The Easy Access Rules are a consolidation, so no new legal obligation arrives with them. What arrives is readability: three separate publications you used to cross-reference now sit in one coherent, colour-coded, navigable whole.

This post is written for the operators we work with most closely, meaning those flying in and around critical infrastructure, those running security operations, and public safety teams who often sit under their own national regime. Below is what changed, and what it means for each of you.

What actually changed

SORA 2.5 keeps the same fundamental logic as SORA 2.0: you describe your operation, assess the ground risk and the air risk, mitigate what you can, and arrive at a Specific Assurance and Integrity Level (SAIL) that tells you how much evidence you have to produce. What SORA 2.5 adds is a tidier method, sharper definitions, and less friction than operators and authorities met over the first years of practical use.

The methodology is now expressed as ten systematic steps. In outline, you document the proposed operation, determine the intrinsic ground risk class, optionally reduce it to a final ground risk class through mitigations, determine the initial air risk class and then the residual air risk class after strategic mitigations, apply tactical mitigation performance requirements, determine the SAIL, determine the containment requirements, identify the operational safety objectives, and finally compile the comprehensive safety portfolio.

A few points stand out for professional operators:

• The intrinsic ground risk is now more quantitative. The intrinsic ground risk class is scaled from 1 to 10 and is driven by the unmanned aircraft characteristics, meaning maximum characteristic dimension and maximum speed, together with the population density at risk in the operational volume and the ground risk buffer. This is a more explicit, data-led starting point than many operators were used to.

• The SAIL still runs from I to VI, and it remains the pivot of the whole assessment. A final ground risk class above 7 falls outside SORA and belongs in the certified category. SAIL V and VI operations require a type certificate issued by EASA under Part 21.

• The operational safety objectives are consolidated to seventeen. For the assigned SAIL, you show compliance with each of the seventeen OSOs at the required level of robustness, low, medium or high. This is a leaner set than the previous version, and the robustness logic is clearer.

• Containment is treated as its own function. Step 8 sets containment requirements at one of three robustness levels, low, medium or high, calculated from the unmanned aircraft characteristics, the SAIL, the average population density in the defined adjacent ground area, and the presence of any outdoor assembly of people within one kilometre of the outer limit of the operational volume.

• The comprehensive safety portfolio replaces the older documentation set. SORA 2.5 also ships with official templates, which is a welcome step towards harmonisation across Member States.

One practical warning on timing. SORA 2.5 became applicable across the European Union on the date ED Decision 2025/018/R was published, 29 September 2025. Individual Member States were permitted to set their own transition windows during which applications prepared under SORA 2.0 would still be accepted, and to define the maximum validity of authorisations granted in that window. Those windows differ by country and several have already closed. If you operate across borders, do not assume a single deadline. Check the position of each national aviation authority you deal with.

What SORA 2.5 means for critical infrastructure operators

This is where the detail rewards close reading, because SORA treats critical infrastructure in a very specific way.

SORA is a safety methodology. Its categories of harm are the potential for fatal injuries to third parties on the ground and fatal injuries to third parties in the air. Damage to critical infrastructure is acknowledged as a genuine and more complex condition, and it is explicitly left out of the quantified part of SORA itself. The reasoning is that different countries have differing sensitivities to this harm, so it is treated as a national specificity and is expected to be assessed in cooperation with the organisation responsible for the infrastructure, which is the party that best understands the threat to its own assets.

There are two consequences for those of you protecting or inspecting energy assets, ports, airports, rail, water, and comparable sites.

First, if your operation could affect critical infrastructure, you complete the SORA risk picture with an additional assessment of the critical infrastructure risk, run in cooperation with the infrastructure owner and folded into your concept of operations. In practice this means an earlier and more structured conversation with the asset owner, and it means your emergency response plan must explicitly account for the possibility of harming critical infrastructure, which the AMC now lists among the emergency situations an operator should plan for. The definition to keep in mind is broad: critical infrastructure means systems and assets vital to national defence, national security, economic security, and public health or safety, at both regional and national level.

Second, when you fly close to sensitive sites, the containment and adjacent-area logic in Step 8 moves to the centre of your assessment. Beyond-visual-line-of-sight inspection routes over or beside a live facility, and drone-in-a-box deployments that hold a fixed operational volume against a fixed asset, are exactly the operations where average population density in the adjacent ground area and the presence of nearby assemblies of people drive the robustness level you have to demonstrate. SORA 2.5 makes those inputs more explicit, which helps, and it also means you need to work the assessment through properly.

What SORA 2.5 means for security operators

For security operations, the same specific-category machinery applies, and there are two things worth separating clearly.

The operation you fly, whether that is perimeter surveillance, a rapid-response deployment, or persistent overwatch of a site, is assessed through SORA in the ordinary way. The site you are protecting may itself meet the definition of critical infrastructure, which brings the cooperation and adjacent-area considerations above directly into your own planning.

It is worth being precise about scope, because it is a common source of confusion. Regulation (EU) 2019/947 and SORA govern how you operate your own unmanned aircraft safely. They do not, on their own, regulate the detection of, or defence against, third-party drones. Counter-UAS sits under a different set of legal instruments, and the security threat posed by an uncooperative third-party aircraft is outside what SORA is designed to quantify. SORA does note that competent authorities may, where appropriate, consider additional categories of harm such as cybersecurity and privacy under Article 12 of the Regulation, and these sit outside the core safety calculation. For those of us building integrated detection, assessment and response capability, the takeaway is that safety compliance for your own platforms and security assurance for the wider site are two distinct workstreams that must be run in parallel and joined up deliberately.

Public safety and the state-operator question

Public safety teams frequently ask whether any of this applies to them at all, and the honest answer is: it depends on how your country has organised itself.

Under the EASA Basic Regulation, Regulation (EU) 2018/1139, aircraft used in military, customs, police, search and rescue, firefighting, border control, coastguard and similar services are treated as state aircraft and fall outside the scope of the EASA framework. Many police and emergency services therefore do not operate under Regulation (EU) 2019/947 directly.

In practice, though, very few Member States have built their state-operator frameworks from a blank sheet. It is far more common for a national authority to construct a regime for state drone operations that borrows heavily from the civil rules, taking large parts of Regulation (EU) 2019/947 and, importantly, its AMC and GM, including the SORA methodology, and adapting them to the operational reality of a state service. Where that is the case, and it is the norm, SORA 2.5 becomes the de facto benchmark even for public safety operators who are formally outside EASA scope. If your national framework references SORA, it will over time reference the current version of SORA, and the ten-step method, the seventeen OSOs, and the containment logic described above will shape how your operations are assessed regardless of the state-aircraft carve-out.

The pragmatic conclusion for public safety operators is to look at how closely your national regime tracks the civil AMC and GM, and to assume that the SORA 2.5 vocabulary is the one your authority and your partners will increasingly speak. Prepare for that language now, whatever your formal status.

What operators should do now

If you take one action from this blog, make it a re-baselining exercise. Concretely:

• Re-map your existing concepts of operations against the ten SORA 2.5 steps, and identify where the more quantitative intrinsic ground risk and the revised containment inputs change your SAIL or your evidence burden.

• Confirm the transition position with each national aviation authority you work with. The SORA 2.0 acceptance windows were set nationally and are not uniform. Do not let a live authorisation lapse on an assumption.

• Adopt the official SORA 2.5 templates and update your internal operations manual, compliance matrix and comprehensive safety portfolio to match.

• For critical-infrastructure-proximate work, open the conversation with the asset owner early, and build the separate critical infrastructure risk assessment into your concept of operations and your emergency response plan from the start.

• For security operations, keep the safety case and the security case as distinct but coordinated workstreams, and be clear internally about where the specific-category rules stop and the counter-UAS and site-security regimes begin.

• For public safety teams, check how your national state-operator framework references the civil AMC and GM, and prepare for SORA 2.5 to become the working language even if you are formally outside EASA scope.

The June 2026 Easy Access Rules confirm the direction of travel and make it official and readable in one place. SORA 2.5 is a genuine step towards a more harmonised, predictable and practical framework for the specific category, and for those of us operating in and around critical infrastructure it brings the risk conversation closer to where it always should have been, which is a shared conversation between the operator and the owner of the asset at stake.

At AirHub we build the software that carries this compliance work through the whole operational lifecycle, from concept of operations and risk assessment to live mission coordination and evidence capture.

If you would like to talk through what SORA 2.5 means for your specific operations, we are always happy to have that conversation. Book a demo and we will walk you through it.

This article is a general overview and does not constitute legal advice. For binding requirements, always refer to the official EASA publications and to the guidance issued by your national aviation authority.

June was a busy month for drone regulation. Every region moved on something that affects how operators plan, register aircraft or prove compliance, from a Danish hearing on mandatory Remote ID to a groundbreaking at the FAA's new research range in Oklahoma. If you run a fleet, a control room or a compliance function, this drone regulation update pulls together what changed and why it matters.

Europe: identification, zoning and data access move forward

Norway's Luftfartstilsynet published its 2025 flight statistics for Specific-category operators on 5 June. Operators with an operational authorisation logged 23,469 flight hours, slightly down from 25,000 the year before. The regulator points to operators shifting into the Open category after C-marking rollout, plus a few large contracts ending. Of the total, 11,502 hours came from the Specific category itself, with a clear split towards VLOS over BVLOS.

Denmark's Trafikstyrelsen opened a hearing on 29 June for a draft amended drone order. The headline change is mandatory Remote ID, or another form of remote identification, for every drone above 250 g, and for lighter drones fitted with sensors when flying in safety- or security-critical zones. The draft also adds new distance requirements around commercial ports, airfields, prisons and two royal residences, and gives police direct access to operator logbooks. If adopted, the rules take effect on 1 January 2027. The consultation closes on 21 August 2026, so there is still time for operators to respond.

Germany's LBA released a filling aid for drone application forms this month, aimed at cutting the errors that slow down authorisation processing. It sits alongside the LBA's broader effort to modernise how it handles drone applications.

In Italy, ENAC opened consultation on 24 June on a draft regulation for UAS Geographic Zones. The draft sets out how Italy will define, manage and communicate the geographic zones required under EU 2019/947, a step that matters for any operator planning missions near restricted or regulated airspace.

Oman's Civil Aviation Authority published an update moving its Advanced Air Mobility programme from strategic vision into phased implementation, with the next set of milestones for integrating AAM and UAS into Omani airspace.

Americas: infrastructure and faster access for operators

On 25 June, the US Department of Transportation and the FAA broke ground on the Vertical Take-Off and Landing Procedures and Analysis Range, known as V-PAR, at the Mike Monroney Aeronautical Center in Oklahoma City. The roughly $8.3 million facility includes a vertiport, a covered hangar and a small control centre, and will support research into wake separation, downwash and outwash, radiofrequency interference and vertiport operations for electric and hybrid VTOL aircraft.

ANAC presented Brazil's new drone regulation at DroneShow Latin America, the region's largest drone fair, walking the industry through what changes for operators under the updated framework.

Peru's Ministry of Transport and Communications launched a virtual accreditation system that cuts drone pilot accreditation from days to minutes. It is a practical example of a regulator removing friction for the operators it oversees, rather than adding it.

Asia-Pacific: roadmaps and personnel governance

Japan's MLIT and METI published an updated roadmap and version 2 of the Operational Concept for flying cars, setting out the path for AAM services beyond the Osaka-Kansai Expo.

CASA Australia released new Key Personnel guides to help RPAS operator's certificate holders identify, appoint and manage the key roles their operations require, tightening up personnel governance across the sector.

Standards bodies: building the technical foundation

Standards work rarely makes headlines, but it decides what operators will be required to prove in a few years. ASTM's Digital Information in the Supply Chain Committee proposed a new guide (WK99450) on 25 June, setting out a framework for purchasing, authenticating and tracing the materials and components used in drones. The aim is to give public safety, infrastructure, agriculture, defence and commercial operators more confidence in the supply chain behind their aircraft, an area closely linked to the kind of data security and sovereignty guarantees we detail on our trust centre.

EUROCAE published ED-341 on 5 June, giving practical guidance for showing compliance with SAIL III and IV Operational Safety Objectives under SORA. EASA recognises the document as an Acceptable Means of Compliance for the non-design-related OSOs in SORA Annex E, which makes it directly relevant to any operator working through their own SORA 2.5 compliance process.

EUROCAE also opened consultation on two further standards in June. ED-347, out for consultation from 19 June, defines the interface between the UAS operator and the Network Identification Service required under EU U-space Regulation 2021/664. ED-355, out for consultation from 26 June, sets minimum performance standards for cooperative surveillance systems supporting detect-and-avoid operations. Both consultations run into August, giving operators and manufacturers a window to feed in comments.

The Global UTM Association marked its tenth anniversary on 27 June with a look back at how the UTM ecosystem has developed since 2016, from early concept work to live U-space services and certified providers.

What this means for your operations

Taken together, June's updates point in one direction: identification, zoning and traceability are becoming standard requirements rather than optional extras. Denmark's Remote ID hearing, Italy's geographic zoning consultation and EUROCAE's network identification standard all deal with the same underlying question, which is how regulators and operators know what is flying where. At the same time, several regulators spent June removing friction rather than adding it, whether that is Peru's faster accreditation, Germany's filling aid or the FAA's investment in AAM research infrastructure.

For teams running drone programmes across public safety, infrastructure or security operations, the practical takeaway is to keep an eye on the consultation deadlines that affect your market and build for identification and traceability now, rather than treating them as a future compliance project.

AirHub tracks these developments every month so operators do not have to. If you want a platform built with the same principles of transparency and accountability that regulators are pushing towards, book a demo.

Stephan van Vuren recently joined a podcast on autonomy in the air, on land and at water. This article draws on that conversation.

Ask our co-CEO and co-Founder Stephan van Vuren what a drone actually is, and the answer tends to surprise people. It is a tool that happens to fly. The flying draws the attention, along with the aviation rules that come with it, yet the value sits in what the drone collects: video, thermal imagery, sensor readings and position. In practical terms, a drone is a flying data platform.

That reframing moves the hard question. Getting a drone airborne is largely solved. What matters now is who controls the data once it exists, where that data is stored, and which route it travels. For operators in public safety, security and critical infrastructure, data sovereignty has become the decision that shapes everything else.

The drone is a tool that happens to fly

Most of the operational value of a drone is generated in the air. A visual or thermal camera over an incident scene produces a continuous stream, and that stream is only useful if it reaches the people who need it: a control room, a commander on the ground, a partner agency.

The scale of that data is about to change sharply. Today, many drones are still carried to a site, flown for a single task and packed away again. The next step is the drone in a box: docking stations placed at fixed points that fly around the clock rather than once a day. When deployments move from occasional to continuous, the volume of footage and telemetry grows enormously. How quickly you can process it, and how cleanly you can route it to the right party, becomes the core of the operation.

Data sovereignty means keeping control of your own data

Sovereignty often gets framed as a national flag on a server. In daily operations it comes down to something more concrete: keeping grip on your own data. Who can open it, where it is stored, which route it travels, and which partners you choose to share it with.

For a public safety or critical infrastructure operator, that question has an edge to it. Most civil drone hardware still comes from a small number of manufacturers, and a buyer needs to know that the footage a drone captures stays where it belongs. AirHub is vendor-agnostic, so the platform sits between the hardware and the data and gives the operator the controls: which feeds are stored, where they live, and who is allowed to reach them. This is the purpose of secure data mode, and it is the reason so many buyers now ask where the software itself is built before they ask what it costs. We covered that question in more detail in where AirHub's software is actually built.

Why a European cloud is becoming a baseline requirement

A growing number of organisations want their operational data to stay inside Europe. For police forces, ministries and infrastructure operators, sitting under a non-European cloud is increasingly difficult to justify, both for compliance and for trust.

The practical case is just as strong. Keeping the cloud close shortens the route the data travels, reduces the number of hops along the way, and makes it far easier to see and control where information goes. A reliable European partner running on national infrastructure turns that from a principle into a working setup. AirHub supports private and European cloud deployment so the data comes to rest where the operator wants it, close to where it was captured.

Filter at the edge so only the right data travels

A lot of what a drone records is never needed. If the task is to read a number plate or confirm a single detection, the useful output is small. Filtering on the edge, on the drone itself, means only the relevant event and its metadata cross the network, which keeps bandwidth, storage and exposure low.

Some missions do call for keeping everything, and those cases raise the stakes on a stable connection and a nearby cloud. The principle holds either way: decide what is worth keeping, send what matters, and store the rest under your own terms. The same logic already applies well beyond drones. A camera in a shop or a sensor on a network does not need to record everything forever to stay useful.

Sharing footage between agencies without losing control

Sovereignty is tested the moment two organisations need to work from the same picture. Belgium is a useful example. Policing there is organised into zones, each set up slightly differently, and an operation often needs one zone to work alongside another. Footage generated by one team has to reach another team in a way both can trust.

In practice the technology is rarely the obstacle. A drone feed from one service can be shared with a fire brigade watching on a tablet, as long as there is a browser and an internet connection. The harder part is governance: deciding which data a police unit shares with the fire service, which stays internal, and how that holds up at scale. The Belgian Police run exactly this kind of shared, real-time picture across teams, and the control over what is shared with whom is part of what makes it work.

What data sovereignty looks like inside AirHub

AirHub is built so the operator stays at the controls of their own data. Storage location, access rights and sharing stay decisions the customer makes. For organisations with the strictest requirements, on-premise and air-gapped deployment keeps everything inside their own walls, and the trust center sets out how the platform handles security and compliance.

Control also has to survive a bad day. Connections drop, signals get jammed, batteries run low. In regions like the Baltic states, jamming near the border is a daily reality, and any drone flying there needs to cope with it. That calls for redundancy built into the aircraft: a safe landing routine when the link is lost, and increasingly AI that lets the drone hold its position from its own cameras when the network is unavailable. Sovereignty over your data is only as good as your ability to keep operating when conditions turn against you.

The thread through all of this is straightforward. A drone is a flying data platform, and the organisation that controls the data controls the operation.

Want to see how AirHub keeps your operational data under your control, built around your own requirements? Book a demo and we will walk you through it.