What is drone compliance? Drone compliance is the ongoing practice of meeting every regulation that applies to a commercial drone operation, from pilot certification and aircraft registration to flight records and risk assessments. In 2026, that means managing Part 107, the new Part 108 BVLOS framework, Remote ID, and the updated EASA SORA 2.5 methodology with documentation that can survive an audit.
Refreshed April 16, 2026 to cover the Part 108 final rule timeline, full Remote ID enforcement, and EASA's updated SORA 2.5 methodology that replaced SORA 2.0 on September 29, 2025.
Table of contents
- What drone compliance actually means in 2026
- The four pillars every operator has to cover
- US drone compliance: Part 107, Part 108, and Remote ID
- EU drone compliance: EASA categories and SORA 2.5
- Which framework applies to your operation
- What auditors actually check (the part competitors skip)
- Building a compliance program that scales
- The compliance maturity model for drone operations
- Common violations and what they cost
- Frequently asked questions
- Ready to make drone compliance an everyday habit?
What drone compliance actually means in 2026
Drone compliance is not a certificate you earn once. It is a continuous operational discipline: meeting every rule that touches your flights, proving it with records, and updating the program when the rules move. The rules move constantly. The FAA's Part 108 final rule is tracking toward publication in March or April 2026, EASA rolled out SORA 2.5 on September 29, 2025, and Remote ID enforcement has teeth in 2026 that it lacked two years ago.
Most enforcement actions do not start with a reckless flight. They start with missing paperwork. An operator flies legally, something minor triggers a review, the FAA asks for logs, the operator cannot produce them, and the violation is written against the recordkeeping gap rather than the flight itself. That pattern is why drone compliance software has become a required tool for commercial operators rather than a nice-to-have.
The practical definition of drone compliance rests on four operational pillars, each backed by records that prove the others. Pilot credentials. Aircraft airworthiness and identification. Operational authorization for the flight profile. Documentation that ties the first three to a specific mission. Insurance and airspace clearance fall inside these pillars rather than standing separately: insurance is a document, airspace clearance is an authorization. Miss any pillar, and the flight is out of compliance even if it was technically safe.
The four pillars every operator has to cover
Every regulator, regardless of country, examines the same four areas. Think of them as the foundation your compliance program has to rest on before you start layering in jurisdiction-specific rules.
Pilot credentials. Part 107 certificates in the US, EASA A1/A3 or A2 certificates in Europe, plus any recurrent training. Certificates expire. Part 107 pilots need to complete online recurrent training every 24 months. Letting a pilot fly on an expired certificate is a violation even if the flight profile is identical to last month's.
Aircraft and identification. Drones over 250 grams need FAA registration in the US, and every commercial drone needs Remote ID broadcast whether through a built-in module or an external attachment. Remote ID compliance is fully enforced in 2026, with penalties that can reach thousands of dollars per flight for unbroadcast operations.
Operational authorization. The authorization depends on the mission. LAANC requests for controlled airspace near airports. Part 107 waivers for flights that break standard rules (night, over people, BVLOS under the current system). Part 108 authorizations once that rule takes effect. In Europe, Specific category authorizations built from a SORA risk assessment.
Records and documentation. Flight logs, maintenance records, pilot training files, incident reports, risk assessments, and insurance certificates. The FAA does not mandate one specific logbook format, but it does mandate that you can produce the proof. The flight log automation guide walks through the record types that matter for audits.
Retention periods vary by record type. The table below reflects the practical standard most commercial operators work to, drawn from FAA guidance and common audit expectations. Specific authorizations may impose stricter retention terms, so always check the text of your waiver or Specific category authorization.
| Record type | Typical retention | Why it matters |
|---|---|---|
| Flight logs (per mission) | 24 months minimum | Proves legal operation during the audit lookback window |
| Maintenance and airworthiness records | Life of the aircraft | Establishes continued airworthiness and traceability |
| Pilot certificates and recurrent training | As long as pilot is active + 24 months after | Verifies credentials were current for every logged flight |
| Incident and accident reports | Indefinite | No statute of limitations on safety investigations |
| Airspace authorizations (LAANC, waivers) | 24 months after flight | Ties each flight to its approval trail |
| Risk assessments (SORA, Part 108) | Duration of the authorization + 24 months | Shows the safety case the authorization rested on |
| Insurance certificates | Policy term + 7 years | Matches typical commercial liability tail coverage |
These four pillars apply to a solo photographer flying real estate jobs and to an energy company running fleet-scale inspections. The difference is volume, not structure.
US drone compliance: Part 107, Part 108, and Remote ID
The US regulatory stack for commercial drone work has three layers in 2026.
Part 107 remains the default framework for commercial operations with drones under 55 pounds. Key requirements include a Remote Pilot Certificate, aircraft registration with the FAA, 400-foot altitude ceiling, visual line of sight, daylight operations (or anti-collision lighting for twilight), and restricted-airspace authorization where applicable. The eCFR text of Part 107 is the authoritative source, and every operator should bookmark it.
Part 108 is the shift every commercial operator should be watching. The FAA published the Part 108 NPRM on August 7, 2025 in the Federal Register, received over 3,000 comments, reopened the comment period in January 2026, and is tracking toward a final rule in spring 2026 with implementation six to twelve months after. Part 108 replaces the slow, case-by-case BVLOS waiver process with a standardized framework covering aircraft up to 1,320 pounds. It introduces two approval tracks: Permitted Operations, which are self-certified for lower-risk scenarios, and Certificated Operations, which require FAA review. The Part 108 vs Part 107 comparison explains which operations shift and which stay under Part 107.
The key operational changes in Part 108:
- Five risk categories based on population density and operational complexity
- Two new crew roles: Operations Supervisor and Flight Coordinator, replacing the lone Remote Pilot in Command
- Airworthiness acceptance rather than full type certification
- A defined path for permitted BVLOS operations without individual waivers
- The Part 108 compliance checklist breaks down the documentation an operator will need when the rule lands
Remote ID is the third layer and the one that trips up otherwise careful operators. Every drone used in commercial operations must broadcast identification data in real time. Operators flying drones without built-in Remote ID need a broadcast module attached. Some older aircraft are essentially grounded for commercial use unless retrofitted. The FAA UAS hub lists compliant modules and current enforcement guidance.
State and local rules add a fourth dimension. Federal airspace authority sits with the FAA, which means states cannot restrict altitudes or flight paths. But states and municipalities can restrict takeoffs, landings, and the use of public property. A downtown flight might be legal in federal airspace and illegal from a city park. The flight crew has to check both layers during planning.
EU drone compliance: EASA categories and SORA 2.5
European operators work inside the EASA framework, which splits drone operations into three categories by risk rather than by weight class alone.
Open category. Low-risk operations under 25 kg, below 120 meters, within visual line of sight. Subdivided into A1 (over uninvolved people with certain drones), A2 (close to uninvolved people), and A3 (far from people). Most recreational and light commercial work lives here.
Specific category. Operations that exceed Open category limits. The operator has to justify the flight through a risk assessment and obtain authorization from the national aviation authority. This is where SORA lives.
Certified category. High-risk operations approaching manned aviation: passenger transport, operations over crowds with heavy aircraft, high-altitude BVLOS. Full aircraft type certification required.
EASA's SORA 2.5 methodology became applicable on September 29, 2025, replacing SORA 2.0 as the standard risk assessment for Specific category operations. The big changes are a clearer 10-step structure, quantitative ground risk methodology using population density data, improved containment definitions, and reduced documentation burden for low-risk (SAIL II) operations. For most VLOS Specific category work, SORA 2.5 cuts the evidence you have to submit in half.
The risk assessment workflow that used to take days now takes hours for standard scenarios, particularly for operators who have a system that captures population density, mission parameters, and mitigation evidence in one place.
Which framework applies to your operation
Operators working across mission types often need to map each flight to the correct regulatory framework before planning. The matrix below cross-references the common commercial mission profiles with their US and EU requirements, so the framework decision becomes a lookup rather than a research project.
| Mission profile | US framework | EU framework | Documents required |
|---|---|---|---|
| VLOS, under 55 lb, daylight | Part 107 | Open A1/A2/A3 | Pilot cert, registration, pre-flight log |
| Night operations, VLOS | Part 107 (anti-collision lighting) | Open with national rules | Same as above, plus lighting declaration |
| Over uninvolved people | Part 107 with Category 1-4 compliance | Open A1 with C0/C1 class drone | Aircraft category declaration, operational plan |
| BVLOS infrastructure inspection | Part 107 waiver (now), Part 108 Permitted (after rule) | Specific (SORA 2.5) | Risk assessment, CONOPS, DAA documentation |
| Drone delivery | Part 108 Certificated Operations | Specific or Certified | Full operational authorization |
| Over 55 lb aircraft | Part 107 waiver now, Part 108 primary path after | Specific or Certified | Airworthiness acceptance, SAIL evidence |
| Controlled airspace operations | LAANC or ATC coordination | U-space authorization | Airspace clearance record |
When the mission crosses categories, always document to the stricter framework. An inspection flight that could run under Open but enters controlled airspace needs the airspace authorization paper trail even if the core operation is low-risk.
Other jurisdictions at a glance
Operators outside the US and EU still have frameworks to meet. Transport Canada authorizes BVLOS through the Remotely Piloted Aircraft System (RPAS) pathway, with medical delivery operations already active in Toronto. The UK Civil Aviation Authority handles Specific category approvals case by case and runs progressive BVLOS trials through the Future Flight Challenge. Australia's Civil Aviation Safety Authority (CASA) covers commercial work under Part 101, with standardized BVLOS approvals for agriculture and mining well-established. All three build on similar SORA-style risk methodologies, so the documentation habits that satisfy FAA or EASA auditors generally translate.
What auditors actually check (the part competitors skip)
Picture the scene. An FAA inspector emails on a Tuesday, visits on Friday, and asks for the flight records for serial number DJI-4A7C2 between October and December. The operator with a system opens a dashboard, filters by serial number and date range, and produces 47 flight logs cross-referenced to pilots and authorizations inside five minutes. The operator without a system spends the weekend digging through three apps, two spreadsheets, and a shared drive, and still cannot match every flight to its LAANC record. Same flights. Same safety. Very different audit outcome.
Most compliance articles explain the regulations. Few explain what happens when a regulator actually shows up. The gap is operational knowledge.
When an FAA inspector or an EASA national authority audit team opens a commercial drone program, they look for five specific things.
Pilot file completeness. Certificate on file, current medical if required by operation type, recurrent training completed, training records dated, and a signed operations manual acknowledgment. Missing any single one of these produces a finding.
Aircraft records by tail number. Every airframe in your fleet has its own record. Registration document, maintenance log with dates and signatures, Remote ID compliance proof, battery cycle history, and inspection history. An inspector will pick a drone serial number and ask to see all of it. Drone maintenance tracking should live in a system, not a spreadsheet.
Flight records linked to pilots and aircraft. For any audited flight, the inspector wants to see who flew, which airframe, where, when, under what authorization, with what pre-flight checks, and what happened afterward. The pre-flight checklist template needs to be completed and stored per flight, not as a generic team document.
Authorization trail. If the flight required LAANC, the authorization ID and timestamp. If it required a waiver, the waiver document. If Special Use Airspace was active, the NOTAM check and acknowledgment. Gaps here are the most common violations.
Incident and anomaly records. Any event that could have affected safety: a flyaway, a near-miss, a battery failure, an unplanned landing. Some of these trigger mandatory reporting (any injury, loss of consciousness, or $500+ in property damage needs to be reported within 10 days). Audits look for the operator's own awareness of these events, not just the reported ones.
Operators who pass audits cleanly are not the ones with perfect flights. They are the ones with findable, timestamped, cross-referenced records. That distinction changes how you design your program.
Building a compliance program that scales
A single-pilot operation can run on a spreadsheet. A ten-pilot, thirty-drone fleet cannot. The point where manual compliance breaks is predictable, and it usually arrives sooner than operators expect.
Start with a Safety Management System (SMS) even if you are not required to have one. Document your operational procedures, risk controls, training plan, and incident response in one place that every team member signs and acknowledges. This is the document the inspector asks for first.
Establish a recurring internal audit rhythm. Every quarter, pull ten random flight records and verify the chain: authorization, pre-flight, pilot log, aircraft log, post-flight. Internal findings are cheap. External findings are expensive. The audit scheduling workflow describes what this cadence looks like in practice.
Maintain a risk register that tracks known operational risks, their mitigations, and their residual risk ratings. When SORA 2.5 or Part 108 asks for your risk methodology, the register is the evidence. This is particularly important for utility and energy inspection operations where BVLOS and elevated terrain compound risk.
Tie your certification tracking to calendar alerts. Certificates lapse quietly. A pilot who flew last week on a valid certificate can be out of compliance this week without either of you noticing. Software-driven renewal tracking pays for itself the first time it catches a lapse.
For fleet-scale operations, add asset-level serial tracking. Every battery has a cycle count that affects safe operation. Every airframe has an inspection schedule that depends on flight hours. Every propeller set has a replacement interval. The operator who can produce these records on demand is the one who keeps the certificate.
The compliance maturity model for drone operations
Operators rarely jump from informal to audit-ready in one step. The progression runs through three predictable stages, and recognizing which stage you are in keeps the compliance investment proportional to the operation.
Stage 1: Crawl (1–2 pilots, under 5 aircraft). Spreadsheet-viable. The operator tracks certificates, aircraft registrations, and flight logs in shared documents. Pre-flight checklists are PDFs. Risk assessments are written ad hoc per mission. This stage works until volume or scope grows. The single biggest failure mode is a certificate or authorization expiring without anyone noticing because nothing alerts on the calendar.
Stage 2: Walk (3–10 pilots, 5–15 aircraft). Platform required. Manual tracking breaks because no single person sees the whole state. The operator adopts a compliance platform that captures flight logs automatically, alerts on expiring certificates, and links records by pilot and aircraft. Internal audits become quarterly. Risk assessments are built from templates rather than drafted from scratch. Operators that try to stay on spreadsheets in this stage usually fail their first external audit.
Stage 3: Run (10+ pilots, enterprise fleet). Full Safety Management System. The platform captures every flight, cert, authorization, and incident. Internal audit cadence runs monthly. A dedicated compliance role exists even if it is not a full-time position. Documented CONOPS exist for every recurring mission type. This is the stage where Part 108 Certificated Operations and EASA Specific category authorizations become available as a natural extension rather than a heavy lift.
The mistake most scaling operators make is staying at Stage 1 too long. By the time the platform is absolutely necessary, the backfill of historical records to populate it is painful. Moving to Stage 2 before it is forced by an audit finding saves roughly 30 to 50 hours of cleanup per pilot, based on typical operator-reported effort.
Compliance software and the case for a single system
Stitching compliance across three or four tools (a flight planner, a logbook app, a spreadsheet for certs, a folder of PDFs) creates the exact gaps auditors find. The core argument for a platform approach is that every record connects to every other record automatically.
Modern drone compliance software does five things that manual processes cannot:
- Pulls flight logs from the drone automatically after each mission, including DJI telemetry processing
- Generates risk assessments by combining flight plan data, airspace data, weather data, and population density
- Maintains audit-ready records cross-referenced by pilot, aircraft, project, and date
- Alerts on certificate expirations, maintenance intervals, and training due dates before they lapse
- Produces compliance reports on demand without manual collation
The DroneBundle vs Dronedesk comparison walks through feature differences for operators evaluating platforms. Most established commercial operators end up on some form of integrated platform because the alternative is hiring a compliance officer whose full-time job is reconciling spreadsheets.
The features page covers how our platform wires these capabilities together. For mapping and survey companies in particular, the FlybyGuys case study shows how a Finnish aerial mapping operation manages EASA compliance and client documentation through a single system.
Common violations and what they cost
Civil penalties from the FAA reach up to $27,500 per violation for individuals and $275,000 for organizations. Criminal charges are possible for violations involving national security areas or reckless operations. The violations that actually get written against small and mid-size operators tend to be mundane.
| Violation | Typical fine range | Root cause |
|---|---|---|
| Flying without valid Remote ID | $1,000 to $3,000 per flight | Older aircraft not retrofitted |
| Operating in controlled airspace without LAANC | $1,500 to $5,000 | Authorization never requested |
| No current Part 107 certificate | $1,000 to $5,000 | Missed recurrent training |
| Incomplete flight records during audit | $500 to $2,500 | Records never captured |
| Failure to report reportable incident | $1,000 to $10,000 | Operator unaware of reporting threshold |
Ranges above reflect typical civil penalty bands based on published FAA enforcement actions as of April 2026. Actual penalties are set per case and can exceed these ranges for willful violations (statutory maximums are $27,500 per violation for individuals and $275,000 for organizations).
What matters more than the fines is the pattern. Regulators write violations against operators who cannot prove compliance, not against operators who are actually unsafe. The insurance implications are a separate layer: a compliance finding can trigger premium increases or policy non-renewal, which costs more than the fine itself.
For public safety and emergency response operations, a compliance lapse can also disqualify the agency from federal grants and from manned-aircraft integration authorizations. The non-fine consequences are often the bigger risk.
Frequently asked questions
Do small businesses need drone compliance software?
Yes, once the operation crosses two or three pilots or five aircraft. Below that threshold, a disciplined spreadsheet system works. Above it, the manual system starts producing the exact record gaps that auditors find. The tipping point is not scale, it is the point where no single person can hold the whole compliance state in their head.
How long do I need to keep drone flight records?
Keep flight logs for at least 24 months, maintenance records for the life of the aircraft, and pilot training records as long as the pilot is active. Incident reports should be retained indefinitely. The FAA has no single mandated retention period, but these are the practical standards most commercial operators work to. EASA Specific category authorizations often specify their own retention requirements in the authorization document, and those take precedence.
Does Part 108 replace Part 107?
No. Part 108 supplements Part 107 rather than replacing it. Part 107 remains the baseline for commercial flights under 55 pounds within visual line of sight. Part 108 adds a framework for BVLOS and larger aircraft operations. Most operators will continue operating primarily under Part 107 and move specific mission types to Part 108 as the rule becomes available. The Part 108 final rule is expected in spring 2026 with implementation six to twelve months after.
What is the single biggest drone compliance mistake operators make?
Failing to cross-reference flight records with the specific pilot and aircraft that executed each flight. Each record gets captured somewhere, but the links between them are missing. An inspector asks "who flew serial number DJI-ABC123 on March 8" and the operator has to search through three systems. That search time is often the thing that turns a friendly audit into a formal finding.
Ready to make drone compliance an everyday habit?
Compliance stops being a burden when the records create themselves. Every flight logged automatically against the right pilot and aircraft. Every certificate tracked with renewal alerts before it lapses. Every risk assessment built from current airspace, weather, and population data instead of last year's template. Every audit request answered in minutes instead of weeks.
DroneBundle brings Part 107, Part 108 prep, Remote ID tracking, SORA-compatible risk assessments, and complete flight documentation under one platform. With the Part 108 final rule tracking toward publication within the next 60 days, operators who stand up a compliance system now are the ones ready to file Permitted Operations applications on day one. Operators waiting for the rule to land will spend the first quarter of implementation catching up.
Start your free trial today, no credit card required.
Or book a live demo to see how compliance tracking works for your fleet size and mission type.
