Drone Ops Consultants

Drone safety management systems

Building an SMS that works

A safety management system (SMS) is the way an organization finds hazards, decides how to control the risks, checks that those controls work and keeps its people trained and reporting. For a drone operator it sits alongside the operations manual. The manual sets out how you fly, and the SMS shows how you keep that safe as aircraft, sites, crews and clients change.

This guide covers the usual structure of an SMS, where the UK CAA, EASA and the FAA require one for drone operations, how to size it for a small team, and how to keep it working after it has been written. It reflects the position as of October 2026.

Vetted consultants

2 results

Pegasus Vectoring

London, GB

Pegasus Vectoring provides specialist consultancy for organisations developing and operating unmanned aircraft systems (UAS) in the Specific Category. They guide clients from initial operational concept through SORA development, regulatory authorisation, and ongoing compliance assurance, ensuring safe, practical and regulator‑defensible capabilities. Services include operational design, airspace and ground environment assessment, SORA and operational authorisation support, competence development

Pegasus Vectoring Limited is an independent specialist consultancy helping organisations develop safe, practical and regulator-ready unmanned aviation capabilities. We start with the client’s operational need—not a predetermined regulatory solution. Working collaboratively, we define the objective, characterise the operating environment and develop a proportionate operational and regulatory strategy. Our support extends from early feasibility and concept development through risk assessment, OSC and SORA applications, operational documentation, findings resolution and ongoing assurance. Our experience includes BVLOS operations within Atypical Air Environments, critical infrastructure and heavy-lift UAS. Led by a former airline captain with 23 years of aviation experience and UK CAA and UAE GCAA Airline Transport Pilot Licences, Pegasus combines operational judgement with structured regulatory analysis. Our aim is not simply to secure an approval, but to help clients establish a safe, sustainable and scalable operational capability.

CAA

Vaspba Remote Piloted Systems Ltd

Winfrith, GB

CAA Regulatory Consultancy | Agriculture | Heavy Lift | BVLOS | Drone Forensics & Expert Witness Support

Vaspba Remote Piloted Systems Ltd is a UK specialist in uncrewed aircraft systems, regulatory consultancy and operational support. We assist organisations with CAA Operational Authorisations, PDRA and SORA applications, ConOps, Operations Manuals, risk assessments, compliance evidence and BVLOS projects. Our services also include independent drone accident investigation, flight-log analysis, technical reporting and expert-witness support for legal, insurance and commercial disputes. With practical experience in UAS design, integration, testing, servicing and operations, we provide evidence-based advice grounded in real-world aviation and engineering experience.

CAA

What an SMS is made of

An SMS is a set of processes and records, usually written up in a safety manual or a section of the operations manual. One named person at the top answers for it. The LUC rules call this person the accountable manager, and the FAA's rule calls them the accountable executive.

At the higher risk levels the UK CAA asks for an SMS in line with ICAO Annex 19 principles. The FAA's Part 5 rule sets out the four components most SMS frameworks use, one per subpart:

  • Safety policy: a written commitment from the top, named responsibilities and the safety objectives you are working towards
  • Safety risk management: finding hazards, assessing the risk each one poses and putting controls in place
  • Safety assurance: checking that the controls work, through monitoring, audits, investigations and reviews
  • Safety promotion: training and communication so the whole team knows how the system works and what has been learned

When regulators require an SMS for drone operations

UK: an SMS is a stated requirement for a Light UAS Operator Certificate (LUC). UAS.LUC.030 says it must suit the size of the organization and the nature and complexity of its work. It lists what the system must include, from an accountable manager and a safety policy to safety risk management, documented safety reporting and management of change, and an independent function that monitors compliance. The CAA opened a 12-month LUC trial in 2026 for a small number of organizations and says there is no routine LUC application service until further notice.

UK SORA: for operational authorizations assessed under UK SORA, the operational safety objective on operator competence (OSO 1) asks for more as the SAIL rises. At SAIL 2 it expects basic procedures such as checklists, technical logbooks and training records. At SAIL 3 it adds a way to check you are working within your authorization, plus occurrence analysis. At SAIL 4 to 6 the operator must have an SMS in line with ICAO Annex 19 principles. The CAA updates this guidance from time to time. In July 2026 it published Decision No. 60, changing the UK SORA guidance from 1 October 2026, then revoked it in September 2026 with Decision No. 61, so the versions in force before 3 July 2026 still apply. Check the current text in its regulatory library.

EU: the LUC is an optional certificate issued by the national aviation authority where the operator is registered. EASA lists a safety management system among the general requirements, along with competent staff, a records system and an LUC safety manual. Depending on the privileges granted, a holder may fly standard scenarios without a declaration or authorize some or all of its own operations.

US: 14 CFR Part 5 applies to anyone who holds or applies for a Part 119 certificate to conduct Part 135 operations, as well as airlines and some others. The FAA requires drone package delivery operators to use the Part 135 certification process, and it has issued Part 135 air carrier certificates to several drone companies. Operators with Part 135 authority before 28 May 2024 must have an SMS in place and submit a declaration of compliance no later than 28 May 2027. Later applicants must meet Part 5 as part of certification. Part 107 is not among the operations Part 5 lists.

Sizing an SMS for a small operator

The rules expect the system to match the operation. UAS.LUC.030 ties the SMS to the size of the organization and the hazards of its activities. The FAA excuses an organization with a single pilot who performs all the safety functions from some Part 5 requirements, such as the confidential employee reporting system.

In a small team, one person often holds several roles. The LUC rules still ask for compliance monitoring that is independent and reports findings to the accountable manager, so a small operator may need someone outside the day-to-day flying to do it. Ask the regulator what arrangement it will accept before you commit to one.

A workable small-operator SMS is often a short safety policy, a hazard log tied to your main operation types, one risk method that everyone uses, a simple reporting form, a regular safety review and an annual internal audit. Each part should produce a record you can show an inspector or a client.

Safety reporting, indicators and reviews

For internal reporting, Part 5 requires a confidential reporting system in which employees can report hazards, incidents and concerns, and suggest improvements, without fear of reprisal. The CAA makes a similar point about occurrence reporting, saying its purpose is to learn from occurrences and stop them happening again, and that it is not there to attribute blame.

External occurrence reporting is a separate duty. The CAA says that in the specific category, accidents and serious incidents must be reported to the AAIB and to the CAA under your organization's occurrence reporting procedures, and other occurrences to the CAA. Reports go through the ECCAIRS 2 portal and should include your operator ID and whether you hold an operational authorization. Your SMS should say who files these reports and how the findings come back into the hazard log.

Safety performance indicators turn the SMS into something you can measure. Part 5 lists the monitoring an SMS must include, such as watching operational processes, spotting changes in the operating environment, audits, evaluations of the SMS itself and investigations. Useful indicators for a drone operator might be safety reports per 100 flight hours, flights cut short by link or GPS problems, overdue maintenance items or crew currency lapses. Pick a few, set a target for each and review them at a fixed interval.

Reviews and audits keep the system current. Revisit the hazard log whenever you add an aircraft type, site type or operating method, and treat that as a management of change step. EASA notes that an LUC stays valid only while the organization keeps meeting its requirements, so the SMS has to keep working long after approval.

What a consultant does, and what to ask before hiring

A consultant can help you scope the SMS to your operation, draft the policy, hazard log and procedures, design indicators, train the team and run an internal audit. They cannot approve your SMS or promise an outcome: the regulator decides. The accountable manager still owns the system and your team still has to run it. Operators can compare vetted consultants on DOC, where regulator experience is shown as verified only where it has been evidenced.

  • Which regulators have you prepared SMS material for, and for what kind of approval?
  • How will you size the system for a team of our size?
  • Will you train our staff to run it, or only write the documents?
  • Can you carry out our compliance monitoring or internal audits, and how would that stay independent?
  • What records will we need to keep, and how often should we review them?

Common mistakes

A safety manual can cover every required topic and still go unused by the team. Check your SMS for these faults:

  • Copying a large organization's SMS manual that a small team cannot follow
  • Writing the hazard log once and leaving it unchanged after new aircraft, sites or crew
  • Treating safety reports as a disciplinary matter, so people stop making them
  • Mixing up internal safety reports with the occurrence reports the regulator requires
  • Choosing indicators that nobody reviews, or that only count accidents
  • Asking someone to monitor compliance on work they also run day to day

Common questions

Do small drone operators need a safety management system?

It depends on the operation and the regulator. In the UK an SMS is required for an LUC and, under UK SORA, for operations at SAIL 4 to 6. In the EU it is a requirement for an LUC. In the US, Part 5 applies to Part 135 certificate holders and does not cover operations flown only under Part 107. Operators outside these cases can still run a simpler SMS to manage risk and answer client questions.

What are the main parts of an SMS?

Most frameworks use four components. Safety policy sets the commitment, responsibilities and objectives. Safety risk management finds hazards and puts controls in place. Safety assurance checks that the controls work through monitoring, audits and investigations. Safety promotion covers training and communication. The FAA's Part 5 rule uses these four as its subparts, and the UK CAA refers to ICAO Annex 19 principles for higher-risk drone operations.

When must Part 135 drone operators have an SMS?

Under 14 CFR 5.9, an operator authorized under Part 135 before 28 May 2024 must develop and implement an SMS and submit a declaration of compliance to the FAA no later than 28 May 2027. Anyone applying for Part 135 authority, or with an application pending on or after 28 May 2024, must have an SMS that meets Part 5 as part of certification.

How is internal safety reporting different from occurrence reporting?

Internal reporting is your own system for staff to raise hazards, near misses and concerns so the SMS can act on them. Occurrence reporting is a legal duty to tell the authorities about certain events. In the UK specific category, the CAA says accidents and serious incidents go to the AAIB and the CAA, and other occurrences to the CAA, through the ECCAIRS 2 portal. A good SMS links the two.

Can a consultant write our SMS for us?

A consultant can draft the documents, set up the hazard log and reporting process, and train your team. The system still belongs to your organization, and the accountable manager answers for it. Regulators look at whether the SMS works in practice, so your staff need to understand and use it. Only the regulator can decide whether it meets the requirements.