What are EASA drone regulations?
EASA drone regulations are a harmonised framework under EU Regulation 2019/947 governing unmanned aircraft across European member states. Operations are sorted into Open, Specific and Certified categories by risk level, each setting its own rules for pilot competency, operator registration, aircraft class marking and remote identification.
Flying drones commercially in European airspace means working inside a framework that is genuinely harmonised, which is both the good news and the part operators most often get wrong. The European Union Aviation Safety Agency (EASA) sets rules that apply across member states, so the same registration, insurance and remote identification requirements follow you from Helsinki to Lisbon.
Two things changed the practical picture and still catch operators out. Class identification labels became applicable on 1 January 2024, which quietly reclassified a large share of existing fleets. And SORA 2.5 replaced 2.0 as the risk assessment methodology for Specific Category work. This guide covers both, alongside the category structure, compliance requirements and record keeping.
Table of contents
- Understanding EASA drone categories
- Open category operations
- Class marking and legacy drones
- Specific category operations
- Certified category operations
- Remote pilot competency requirements
- Registration and marking requirements
- Remote identification
- Operational limitations and restrictions
- Insurance requirements
- Risk assessment procedures
- Documentation and record keeping
- Cross-border operations
- Frequently asked questions
Understanding EASA drone categories
EASA structures European drone regulations around three operational categories under EU Regulation 2019/947. Each defines compliance requirements by the risk the operation presents.
The Open Category covers most commercial work: aerial photography, basic inspections, mapping. It applies to drones under 25 kilograms flown within visual line of sight, with no operational authorisation required.
The Specific Category applies to operations that exceed Open Category limits. Flights over crowds, beyond visual line of sight operations, or heavier aircraft all land here, and each needs an authorisation from a national aviation authority.
The Certified Category covers the highest risk work, requiring type certification for the aircraft and certification of the operator. Passenger transport and dangerous goods over populated areas sit here, and almost no commercial inspection or survey business needs it.
Open category operations
Open Category operations split into three subcategories. Each sets its own aircraft requirements, distance limits and pilot competency standard, which shapes flight planning before anything else.
A1 subcategory
A1 permits flight over uninvolved people using drones under 250 grams or C0 and C1 class aircraft. Flying over assemblies of people is never permitted in the Open Category regardless of subcategory.
Pilots need the A1/A3 competency certificate, obtained through online training and an examination.
A2 subcategory
A2 permits flight near but not over uninvolved people, using C2 class aircraft under 4 kilograms. The standard horizontal separation is 30 metres, reducible to 5 metres when the drone's low-speed mode is active.
Pilots need the A2 certificate, which adds a theoretical examination and a self-practical training declaration on top of A1/A3.
A3 subcategory
A3 covers operations in areas where uninvolved people are not expected, using drones under 25 kilograms. Flights must stay at least 150 metres from residential, commercial, industrial and recreational areas.
The A1/A3 certificate is sufficient, which makes A3 the accessible entry point for pilots with basic theoretical training.
Class marking and legacy drones
This is the change that reclassified a lot of existing fleets, and it is the thing most operators check too late.
Class identification labels, C0 through C6, became applicable on 1 January 2024. The transition period that ran from 31 December 2020 to that date is over. A drone placed on the market before 1 January 2024 without a class mark, and not privately built, is what EASA calls a legacy drone.
Legacy drones can still be flown, but only in two subcategories, decided by mass alone:
- A1, if maximum take-off mass is under 250 grams
- A3, if maximum take-off mass is under 25 kilograms
There is no expiry date attached to that allowance. It is the permanent position, not another transition waiting to end.
The consequence is worth spelling out. A 900 gram legacy drone that could be flown close to people during the transition period is now an A3 aircraft, meaning 150 metres from any residential, commercial, industrial or recreational area. Nothing about the aircraft changed. The rule around it did, and a fleet bought before 2024 may be sitting in a more restrictive subcategory than the operator assumes.
EASA also notes a practical trap: unclassified drones do not publish a maximum take-off mass the way class-marked ones do. Weigh the aircraft with its payload rather than trusting a specification sheet.
Class marking matters in the Specific Category too. Standard Scenarios require class-marked aircraft, so a legacy fleet cannot be flown under STS-01 or STS-02 no matter how the operation is documented. Keeping class marks and mass figures in your equipment records alongside serial numbers is what makes this checkable rather than assumed.
Specific category operations
Specific Category operations need a risk assessment and an authorisation from the national aviation authority. The application demonstrates how operational risk is brought to an acceptable level.
SORA 2.5
The Specific Operations Risk Assessment methodology moved to version 2.5 through EASA ED Decision 2025/018/R, published on 29 September 2025 and applicable across the EU from that date. EASA folded it into the June 2026 edition of the Easy Access Rules for Unmanned Aircraft Systems.
Version 2.5 shifts the methodology towards quantitative, data-backed argument rather than narrative justification, and reworks how ground risk and air risk classes are derived. Member states may run their own transition period during which applications prepared under SORA 2.0 are still accepted, so the practical question for an operator mid-application is what your own authority currently takes. Ask before you rewrite anything.
Standard scenarios
Standard Scenarios provide pre-declared operational parameters for common Specific Category work, letting an operator submit a declaration rather than a full authorisation application:
- STS-01: visual line of sight over a controlled ground area
- STS-02: beyond visual line of sight with airspace observers, over a controlled ground area
Both require class-marked aircraft, C5 for STS-01 and C6 for STS-02.
Light UAS Operator Certificate
Operators running frequent or complex Specific Category work can apply for a Light UAS Operator Certificate. An LUC allows the holder to self-authorise operations within the privileges granted, removing the per-operation application cycle.
The certificate also demonstrates organisational competency to clients and authorities, which supports scaling fleet operations across borders.
Certified category operations
Certified Category operations require aircraft type certification, a certified operator and a licensed pilot, on the model of crewed aviation. These are passenger transport, dangerous goods and comparable operations.
Certification is expensive and slow, and almost no inspection, survey or media operation needs it.
Remote pilot competency requirements
Commercial operations require demonstrated pilot competency, and the requirement depends on the subcategory rather than on whether money changes hands. The structure differs from obtaining an FAA drone license in the United States, where one certificate covers most commercial work.
A1/A3 competency certificate
The A1/A3 certificate covers theoretical knowledge across air safety, airspace restrictions, aviation regulation, human performance limits, operational procedures, general knowledge of UAS, privacy and data protection, insurance and security.
The examination is 40 multiple-choice questions with a 75% pass mark, taken online through a national aviation authority or an approved entity.
A2 competency certificate
The A2 certificate requires the A1/A3 certificate first, then self-practical training, then an additional theoretical examination covering meteorology, UAS flight performance and technical and operational mitigation of ground risk.
The practical element is a declared self-training exercise rather than an examined flight test, which is a common point of confusion.
Keeping competency current
Competency certificates carry validity periods, and renewal requirements are set nationally. Building certificate expiry into the same system that holds pilot flight hours means renewals surface before they ground a crew rather than after.
Registration and marking requirements
Registration in the EU is of the operator, not of each aircraft, and it happens once regardless of fleet size.
Who has to register
You must register as a UAS operator with the authority of the country where you reside or have your principal place of business if either applies:
- The drone has a maximum take-off mass of 250 grams or more
- The drone carries a sensor capable of capturing personal data, at any weight, unless it qualifies as a toy under Directive 2009/48/EC
In the Specific Category, registration is required regardless of the aircraft's mass.
That camera clause is the one operators miss. A sub-250 gram drone with a camera still triggers registration unless it is a certified toy, which commercial aircraft are not.
What registration produces
Registration issues an operator registration number. That number must be displayed on every aircraft you operate, and it must also be uploaded into the drone's remote identification system. A sticker alone is not sufficient on a class-marked aircraft.
Aircraft registration, as distinct from operator registration, applies in the Certified Category and to unmanned aircraft subject to certification.
Remote identification
Direct remote identification has been required across the EU since 1 January 2024. It arrived alongside class marking and applies uniformly across member states, not as a national rollout.
What is required
Direct remote ID, also called broadcast remote ID, is a one-way transmission over Wi-Fi or Bluetooth that any receiver nearby can pick up without internet connectivity. The broadcast carries the operator registration number, the aircraft serial number, position and altitude, timestamp, the take-off or remote pilot position, and emergency status.
The requirement travels with the class mark. C1, C2 and C3 aircraft in the Open Category must have it, as must C5 and C6. In the Specific Category, direct remote ID is required regardless of class. Legacy drones flown in A1 or A3 under the rules above do not carry the requirement, which is a narrow consolation given how restricted those subcategories are.
Network remote ID
Network remote ID, which transmits over an internet connection to a central service, is a component of the U-space framework rather than a general Open Category requirement. It becomes relevant inside designated U-space airspace, which member states establish individually. Do not plan an Open Category fleet around it. Read the requirement for your remote ID obligations as the direct broadcast one.
Operational limitations and restrictions
European operations sit inside airspace restrictions, geographical zones and environmental limits that member states define within the EASA framework.
Geographical zones
Member states designate UAS geographical zones where flight is prohibited, restricted, or subject to conditions. These are published nationally, and they are the mechanism through which a country protects airports, military sites, nature reserves and urban areas. Zones vary by country even though the underlying regulation does not, and checking them is per-flight work, not per-country work done once. Temporary restrictions are published through the same channels as NOTAMs.
Environmental and operational limits
The Open Category caps height at 120 metres above the closest point of the surface, with a limited allowance for flying above obstacles taller than that. Weather, visibility, wind and temperature all bear on whether a flight proceeds, and those judgements belong in a documented risk assessment rather than in a pilot's head.
Privacy
Drones carrying cameras fall under GDPR when they capture personal data. Operators need a lawful basis for processing, and the registration requirement for camera-equipped drones exists precisely because of this overlap.
Insurance requirements
Third-party liability insurance for drone operators in the EU derives from Regulation (EC) 785/2004, which sets minimum cover for aircraft operators and applies to unmanned aircraft within its scope.
The floor is set by maximum take-off mass. For aircraft under 500 kilograms, which covers essentially all commercial drone work, the minimum third-party liability cover is 750,000 SDR. SDR is the IMF's Special Drawing Rights unit, and its value against the euro floats, so the euro equivalent moves. Ask a broker for the current figure rather than working from a number quoted in an article.
Member states may impose requirements above that floor, and some do, particularly for Specific Category authorisations. National variation here is real, unlike registration and remote ID, so verify your own authority's position and any client contract terms, which often demand more cover than the regulation does. Our guide to drone insurance covers what policies actually contain.
Risk assessment procedures
Risk assessment is a regulatory requirement in the Specific Category and good practice everywhere else. Operators identify hazards, evaluate risk, and document the mitigations that bring residual risk to an acceptable level.
Hazard identification
A usable assessment covers aircraft technical failure, pilot error and human factors, weather and environmental conditions, airspace conflict, ground risk from population density, and data security.
Mitigation and review
Mitigations work through procedure, technology, training and operational limitation. Documentation has to show the reasoning, not just the conclusion, because an authority reviewing a Specific Category application is assessing the argument.
Assessment is not a one-off. Incident reports and flight records feed back into it, and an assessment that has not changed in two years of operations is usually one nobody is reading.
Documentation and record keeping
Record keeping is written into the operator's responsibilities under 2019/947 rather than left to convention, which is the main structural difference from the US approach in drone operations.
What to keep
- Remote pilot competency certificates and training records
- Operator registration and aircraft class marking evidence
- Maintenance records per aircraft
- Insurance certificates
- Risk assessments and operational authorisations
- Flight logs
- Occurrence and incident reports
Retention
Operators in the Specific Category are expected to keep records of operations, maintenance and remote pilot training for three years. The harder requirement is not storage but retrieval: producing the certificate, the authorisation, the checklist and the log covering one specific flight from eighteen months ago, while somebody waits.
Occurrence reporting
Occurrences affecting safety must be reported to the national authority under the EU occurrence reporting regulation. Knowing your national reporting route before you need it is worth the twenty minutes it takes to find.
Cross-border operations
Registration, class marking, remote identification and the insurance floor are harmonised across the EU. An operator registered in one member state does not re-register to fly in another, and a C2 drone is a C2 drone everywhere.
What genuinely varies is narrower than most comparison articles suggest:
- Geographical zones. Each member state defines its own, published through its own portal. This is the real per-country homework.
- Insurance above the floor. Member states and clients may require more than 785/2004 sets.
- Specific Category authorisations. Held with the authority that issued them. Cross-border operation uses the mutual recognition process rather than an automatic transfer.
- Competency certificate renewal. Validity and renewal conditions are set nationally.
Before flying in a new country, check that country's geographical zones and confirm whether your authorisation travels. Skip the rest, because it does not change.
Frequently asked questions
What license do I need to fly a drone commercially in Europe?
Commercial operations in Europe require an EASA remote pilot competency certificate matched to your subcategory. A1/A3 covers flights over 250 gram aircraft and A3 operations and is an online examination. A2 adds self-practical training and a further theoretical examination. Specific Category work needs an operational authorisation on top. Our guide on how to get an EU drone license walks the process, and what drone license do I need helps identify which applies.
Can I still fly a drone without a class marking in Europe?
Yes, but only in two subcategories. A drone placed on the market before 1 January 2024 without a class identification label can be flown in A1 if its take-off mass is under 250 grams, or in A3 if it is under 25 kilograms. There is no end date on this. It also cannot be used under Standard Scenarios in the Specific Category, which require class-marked aircraft.
Do US FAA Part 107 certificates work in Europe?
No. Part 107 certificates carry no validity in European airspace, and you need EASA competency certificates regardless of what you hold elsewhere. Existing aviation credentials do not shortcut the process, though some authorities recognise prior knowledge in their training pathways.
How much drone insurance do I need in Europe?
Regulation (EC) 785/2004 sets the floor at 750,000 SDR of third-party liability for aircraft under 500 kilograms, which covers commercial drone work. Because SDR floats against the euro, ask a broker for the current equivalent. Individual member states and client contracts frequently require more.
Ready to keep European compliance in one place?
Class marks, competency certificate expiry dates, operator registration, insurance renewals and three years of flight records tend to live in five different places until an authority asks for all of them at once.
DroneBundle keeps aircraft records with their class marking and mass, pilot certificates with their expiry dates, flight logs attached to the jobs they belong to, and risk assessments and incident reports against the same projects, so a records request is a search rather than an afternoon.
Start your free trial today, no credit card required.
Or book a demo and we will walk your own fleet and certificate structure through the platform.
