Part 146 FAA Rule: Automated Data Service Providers

Part 146 is the FAA's proposed rule for certifying automated data service providers (ADSPs), the companies that would supply strategic deconfliction and conformance monitoring to BVLOS drone operators. It was published with Part 108 in August 2025 and is not yet law.

Part 146 FAA rulemaking gets a fraction of the attention Part 108 does, yet a large share of Part 108 flights could not legally take off without it. Under the proposal, any Part 108 flight in Class B, C, D or Class E surface area airspace, or in a Category 3 or higher operating category, would have to use a service from a Part 146 certificated provider (§108.190(e)).

This guide works from the proposed regulatory text and the FAA's own preamble. It covers the parts operators actually need: which flights would require a provider, what the three service levels mean, what a certificated provider owes its customers, and what it costs to become one.

Part 146 FAA status: proposed, not final

Part 146 is a proposed rule. It appears in the same notice of proposed rulemaking as Part 108, Federal Register document 2025-14992 (90 FR 38212, published August 7, 2025, Docket FAA-2025-1908, RIN 2120-AL82). There is no 14 CFR Part 146 in the Code of Federal Regulations today, and nobody can apply for a Part 146 certificate yet.

The combined final rule has been under review at the White House Office of Information and Regulatory Affairs since July 10, 2026, and OIRA's list of rules under review, dated October 13, 2026, still showed it as pending review. Our Part 108 NPRM tracker covers the review process and what happens after publication.

Every section number in this article is a proposal and could change in the final rule. The FAA itself said, in its small-business (regulatory flexibility) analysis, that "no entities are currently operating as an automated data service provider, as the rules defining an automated data service provider do not currently exist" (90 FR 38354).

The proposal places Part 146 in subchapter H of 14 CFR, beside Part 145 repair stations and Part 147 maintenance schools. That location is deliberate. The FAA would regulate data providers as a new kind of "air agency" under 49 U.S.C. 44702, the same statutory authority it uses for repair stations.

What Part 146 would regulate

Part 146 would regulate any person "using a distributed computational system to provide automated data services that support aircraft operations" when those services are used to show compliance with an FAA rule (§§146.1, 146.5). In plain terms: software running on servers that a drone operator relies on to meet a regulatory requirement.

The FAA's preamble is blunt about why the agency wants this model. It concluded that its radar and surveillance systems do not reliably detect small drones, particularly at 400 feet and below where terrain and structures interfere, and that running drone traffic management from its 520 towers and 147 TRACONs would need an exponential increase in controllers it does not have (90 FR 38322). So instead of the FAA separating drones, operators would deconflict themselves using information exchanged between certificated providers. The FAA even wrote that the term "unmanned traffic management" "may be a misnomer," because the system provides information for operators to manage their own flights.

Familiar industry labels all fold into the new term. UAS service supplier (USS), supplemental data service provider (SDSP) and "third-party service provider" would all be automated data service providers under Part 146.

Approval would come in two layers, modeled on Part 145 repair stations and their ratings (90 FR 38324):

1. A certificate for the organization, issued at a service level.
2. A service authorization for each individual service the organization wants to offer.

A first-time applicant must apply for at least one service authorization alongside the certificate. The FAA will not certify a company that has nothing ready to provide (§146.115(d)).

What is in scope and what is not

Being in scope means a service could be certificated. It does not mean it must be. Only services that a rule requires to come from a certificated provider must hold Part 146 approval.

The examples in the left column come from the FAA's own list in the preamble (90 FR 38325). The proposal deliberately does not lock providers into fixed categories. The BVLOS ARC had recommended seven named service types; the FAA rejected that approach so new services would not need a rule change. A service would instead have to be "designed in accordance with an industry consensus standard" (§146.205(a)(5)). The 2024 reauthorization act names ASTM F3548-21, the USS interoperability standard, as an example of what should be acceptable.

The LAANC carve-out matters to every Part 107 pilot. LAANC providers already operate under agreements with the FAA, so the FAA left them out to avoid duplicate oversight (90 FR 38325). Nothing in Part 146 changes how you request a controlled airspace authorization today.

Which flights would need a Part 146 provider

A Part 108 operator would need a Part 146 service in two situations: flights in Class B, C, D or Class E surface area airspace, and flights in operating Category 3, 4 or 5 (§108.190). Everything else would be optional, unless the FAA authorizes otherwise.

Proposed §108.190 splits the requirement in a way that is easy to misread. Strategic deconfliction and conformance monitoring are not always required together.

Section 108.190(e) says both requirements "must be achieved through operational use of an authorized service provided by an appropriately certificated automated data service provider under part 146," unless the FAA authorizes otherwise. The Part 108 permitted operations guide explains how the five population categories are drawn.

What the services must actually do is also defined:

• Strategic deconfliction must detect and resolve conflicts with other discoverable drone operations before takeoff, and maintain a target average conformance to all activated operational intents (§108.190(c)).
• Conformance monitoring must alert operations personnel immediately when the aircraft leaves its operational intent, and pass that alert to other airspace users and the FAA (§108.190(d)).

Detect and avoid is a separate requirement. Flights in Class B or C airspace would also need the ability to avoid aircraft that are not broadcasting (§108.180(b)), and the right-of-way debate behind that is covered in our electronic conspicuity guide. A Part 146 provider could supply DAA data, but §108.190 does not require it to.

The FAA expects some sectors to rarely touch Part 146 at all. Its cost analysis says agricultural operators "are not likely to require use of these services" because of where they fly (90 FR 38351). Rural inspection in Class G over sparse populations would look similar. Delivery networks working near towns and airports, and drone dock operations inside controlled airspace, are the opposite case.

The three service levels

Part 146 would sort providers into three service levels by the operations they support, not by how sophisticated the service is (§146.110). The level decides how much evidence the FAA wants before issuing a certificate or authorization.

The FAA summed it up this way: a Level 1 applicant declares it complies, a Level 2 applicant declares and explains how, and a Level 3 applicant declares and proves it (90 FR 38329). The agency expects most applicants to seek Level 1, a modest number Level 2, and "few, if any" Level 3 (90 FR 38328).

Here is the operational catch. The service level tracks your operation, not the provider's marketing. If your Part 108 operation depends on relief from any Part 108 requirement, a Level 1 provider would not cover you. You would need a provider certificated at Level 2 or higher. Level 3 is the route for services supporting flights outside Part 108 entirely. The FAA's example is "BVLOS operations conducted outside 14 CFR part 108" (90 FR 38328), which would include BVLOS flown under a Section 44807 exemption.

What a certificated provider would owe its users

A certificated provider would have to run a quality management system, a cybersecurity program, change management, annual training, incident reporting and long record retention, and meet strict rules for software updates (subparts D and E). Several of these protect the operator directly.

Organization requirements

• Quality management system meeting 14 CFR Part 5 safety management system rules, minus a list of exceptions (§146.310(b)).
• Cybersecurity policy covering access limits, attack response and measurement (§146.305).
• Service difficulty reports. The provider must offer users a way to report failures that endangered or may endanger safe operation, and tell users it exists (§146.310(f)).
• Reportable occurrences. Any unscheduled outage, and any security breach that gives someone unauthorized access to the provider's networks, devices or data, must be reported to the FAA, even if the breach did not affect service integrity (§146.325).
• Training for staff and contractors, with recurrent training at least once per calendar year (§146.320).
• Impartiality. Service must be offered "in a reasonable and non-discriminatory manner" (§§146.300(e), 146.400(e)).

Data exchange and software updates

Services must exchange data with users and with other certificated providers "irrespective of the user's or other provider's digital platform," using authentication and non-repudiation so data integrity and origin can be proven (§146.400). That interoperability rule is what makes a federated network of competing providers possible.

The update rules are unusually specific for an FAA regulation:

The FAA's preamble spells out why major updates matter: an operator that does not adapt "would lose functionality of the service after the update" (90 FR 38326). The 60-day overlap is the operator's integration window, though it would not apply when several providers must update in a coordinated way to stay interoperable; the 7-day notice still would (§146.405(h)). The provider must also hand testing documentation to the FAA within 24 hours of a written request (§146.405(c)(2)).

Record retention

The six-month figure deserves attention. The data your flights exchanged with a provider, such as operational intents and conformance alerts, would only have to be kept for six months. If an incident review, an insurance claim or a client dispute arrives later, the provider may no longer hold it. Keep your own copies of what matters, alongside the flight records Part 108 would require of you.

Being your own ADSP

An operator can supply its own strategic deconfliction, but it would then have to hold a Part 146 certificate itself. The FAA's BVLOS fact sheet says a BVLOS operator "could be its own data service provider or contract with another company."

The preamble closes the obvious loophole. Self-provided services would go through "the part 146 certification and service authorization process" exactly like a third-party service (90 FR 38321, footnote 146). A delivery company with an in-house engineering team building its own deconfliction stack would carry two regulatory roles: Part 108 operator and Part 146 provider.

That double role is realistic mainly for large, vertically integrated fleets, the kind run by the drone delivery companies that already built UTM software under waivers. For a service company with ten pilots, buying from a certificated provider is the only sensible path.

Two more rules matter for build-or-buy decisions:

• A provider may lean on outside vendors, such as cloud hosting, only for functions that are not aviation-safety specific, unless the vendor is itself Part 146 certificated (§146.300(d)).
• A certificate cannot be transferred without FAA approval, and a change to the ownership structure disclosed in the application, which lists every holder of 5% or more of voting stock, counts as a transfer (§§146.105(b), 146.130(c)).

What it would cost to become an ADSP

The FAA's own estimates put the paperwork to obtain a certificate and first authorization at about $365 for Level 1, $800 for Level 2 and $1,824 for Level 3 (90 FR 38356). The real costs sit elsewhere.

In the FAA's own example, a provider with 99 employees would spend about $138,600 a year on training alone (90 FR 38351). The FAA was candid that its SMS and training figures borrow from other industries because it "does not have data specific to potential automated data service providers."

For operators, the more important number is missing. The FAA said the cost of buying these services "cannot be determined until a market for such services develops" (90 FR 38354). Budget for it as an unknown line in any Part 108 business case, and remember that a Category 1 or 2 operation outside Class B, C, D and Class E surface areas would avoid it entirely.

How to vet a provider once Part 146 is final

When certificated providers exist, the questions below would separate a compliant contract from an expensive surprise. Each one maps to a proposed requirement.

1. Is the certificate at the right level? Match it to your operation. Any Part 108 waiver or exemption pushes you to Level 2 (§146.110).
2. Is the specific service authorized? A certificate alone is not enough. Ask for the service authorization covering strategic deconfliction or conformance monitoring, and any limits or conditions the FAA attached (§146.210(b)).
3. What is the outage plan? Outages are reportable to the FAA (§146.325), but your contingency procedures still have to handle one mid-operation. Put it in your risk assessment.
4. How will you hear about updates? Get the user notice channel in writing and plan integration testing inside the 60-day major update window (§146.405).
5. Where do you file a service difficulty report? The provider must tell you (§146.310(f)).
6. What data do they keep, and for how long? The floor is six months (§146.330(d)). Negotiate longer if your clients or insurers need it.
7. Who owns the provider? An acquisition triggers FAA approval of the certificate transfer (§146.130(c)), which could interrupt service.

Foreign providers could qualify too. Under §146.115(e), a provider authorized in a country that has a bilateral aviation safety agreement covering comparable services "may be deemed to meet the application requirements." The preamble points to the EU's U-space service providers, certified under rules in effect since 2023, as the model (90 FR 38329).

Store the certificate, authorization letter, contract and every update notice in one place per operation, ideally with the document management you already use for waivers and insurance. When an auditor asks how a flight in Class D was deconflicted, you will want that file next to the project, not in someone's inbox.

What operators can do now

Nothing in Part 146 applies to a flight you fly today. BVLOS still runs through a Part 107 BVLOS waiver, a Section 44807 exemption, or a Section 927 waiver.

The useful preparation is an inventory. Check each current and planned site's airspace class and rough population density against the §108.190 triggers, and note which would need a Part 146 service. The DroneBundle airspace map shows FAA controlled airspace and LAANC grid ceilings on the same map as your project sites, and gives each site a plain airspace read. Drone regulations news tracks when the rule lands.

Frequently asked questions

Is FAA Part 146 in effect?

No. Part 146 is a proposed rule published August 7, 2025 in the Part 108 BVLOS NPRM. OIRA's list of rules under review still showed the final rule as pending on October 13, 2026. There is no 14 CFR Part 146 in the eCFR, no application portal and no certificated provider. The FAA said it would open an electronic application platform once the rule is finalized.

What is an automated data service provider?

An automated data service provider (ADSP) is a person or company using "a distributed computational system to provide automated data services that support aircraft operations" (proposed §146.5). In practice that means providers of strategic deconfliction, conformance monitoring, detect and avoid data and similar services that drone operators would use to comply with Part 108.

Does Part 146 affect Part 107 pilots?

Not directly. Part 146 would only matter when a regulation requires a certificated service, and Part 107 visual line of sight flights have no such requirement. LAANC is specifically excluded from Part 146 (§146.1(b)(3)), so controlled airspace authorizations under Part 107 would work as they do today.

Can a drone operator be its own ADSP?

Yes, but it would need its own Part 146 certificate and service authorization. The FAA's preamble says self-provided services go through the same certification process as third-party ones. For most service companies, contracting with a certificated provider would be far simpler.

Get your operation ready for Part 108 and Part 146

Part 146 shifts part of your compliance onto a vendor, and that makes your own records more important. You will need to show which flights required a certificated service, which provider supplied it, and what your crew did when an alert fired.

DroneBundle keeps the operator side of that record in one place: pilot certificates with expiry reminders, DJI flight logs and replay after landing, risk assessments per project, and stored documents for provider contracts, waivers and authorizations. Utilities and energy teams and dock programs can keep that compliance evidence next to the work itself.

Start your free trial and build your Part 108 site inventory before the rule lands.

Or book a live demo to see how projects, airspace and documents fit together for BVLOS planning.