EASA Operational Authorization

When you need one, and the three ways to get it

Article 4 of the regulation sets the limits of the Open category. The drone must have a maximum take-off mass under 25 kg, stay in visual line of sight (VLOS) and within 120 m of the ground, keep a safe distance from people and not fly over assemblies of people, and must carry no dangerous goods and drop no material. If your operation falls outside any of these, it is in the Specific category, and Article 5 requires an operational authorization from the competent authority of the member state where you are registered as an operator.

There are two exceptions. If the operation fits a standard scenario (STS), you submit a declaration instead and may start once the NAA confirms receipt and completeness. If you hold a light UAS operator certificate (LUC) with the right privileges, you may need neither. Separately, some geographical zones require a flight authorization from the zone's authority, which EASA says should not be confused with an operational authorization.

Where an authorization is needed, there are three routes. The first two support an application to the NAA, and the third can remove the need to apply each time:

• A full risk assessment: you carry out a Specific Operations Risk Assessment (SORA), the acceptable means of compliance to Article 11, and submit it with your evidence. EASA moved to SORA 2.5 in September 2025. Another method can be used if you show it meets Article 11.
• A predefined risk assessment (PDRA): if your operation fits one of EASA's published PDRAs, you complete its table of conditions in place of a full SORA. You still apply for the authorization.
• An LUC: an optional certificate for legal entities that requires a safety management system and an LUC manual. Within the privileges the NAA grants, the holder can authorize some or all of its own operations without applying each time.

What the application to your NAA contains

The application is built on your Article 11 risk assessment, which starts with a description of the operation, usually called the concept of operations (ConOps). Article 11 says it must cover the nature of the activity, the operating area (including the population overflown, the terrain and the airspace), how the operation is planned and crewed, the technical features of the drone, and the competence of the personnel. EASA's application form (Form 208) also asks for planned start and end dates, VLOS or BVLOS, whether you will carry dangerous goods or drop material, and details of each aircraft, including its remote identification and other conspicuity equipment.

You must also confirm that the operation complies with Union and national rules on privacy, data protection, liability, insurance, security and environmental protection. EASA's guidance says to develop an operations manual for every Specific category operation, structured as the SORA annex sets out, and to submit it for operations at SAIL III and above. For VLOS operations up to SAIL II, the NAA may validate only your compliance matrix and authorize without seeing the manual, but you must still hold the evidence and keep it up to date.

Keep the application and its documents for at least 2 years after the authorization expires, or, if it is refused, 2 years after you applied. Under UAS.SPEC.030, the application must include:

• Your UAS operator registration number
• The name of the accountable manager, or your own name if you apply as an individual
• The operational risk assessment
• A list of the mitigation measures you propose, with enough detail for the authority to judge whether they are adequate
• An operations manual, where the risk and complexity of the operation require one
• Confirmation that suitable insurance will be in place when operations start, where Union or national law requires it

How the NAA assesses it, and what the authorization specifies

The NAA evaluates your risk assessment and the strength of the mitigations you propose. Under Article 12 it grants the authorization when it concludes that your operational safety objectives take account of the risks, and that the combination of operating conditions, crew competence and aircraft features is adequate to keep the operation safe. Drones that are, or will be, subject to certification also need a valid certificate of airworthiness (or restricted certificate) or approved flight conditions. If any of the flying is in controlled airspace, a procedure must be in place to coordinate with the airspace service provider. If the NAA refuses, it must give its reasons.

Forms, fees, online portals and processing times are set nationally. EASA says processing times depend on the complexity of the operation and the NAA's workload, and advises applying well in advance.

The authorization sets out its scope and the conditions you must fly to. EASA's template (Form 209) records, among other things:

• The authorized locations and the height limits of the operational volume, either 'generic' (any location meeting stated conditions) or 'precise' (set coordinates)
• The risk assessment used (SORA edition or PDRA number) and the resulting SAIL
• The ground and air risk classes, the mitigations you must apply and the level of containment
• The competency required of remote pilots and other key staff, and how many aircraft one pilot may fly at once
• Events you must report to the NAA beyond those required by Regulation (EU) No 376/2014
• The authorized aircraft, and the dates the authorization is valid from and to

Validity, changes and ongoing obligations

The EU rules leave the duration to the NAA, which states it in the authorization. In practice, authorizations are usually issued for a fixed period, typically one or two years depending on the type, and you reapply before they expire. Lead times vary by NAA, often from 28 days to three months, so check yours and diary the date. In every case an authorization stays valid only while you comply with the regulation and its conditions. Remote pilot certificates (A1/A3, A2 and STS) are separate and valid for five years: revalidate before expiry, usually through refresher training or a short exam, or repeat the training and exam once they lapse. Operator registration is separate again and must be renewed at intervals each country sets. An authorization cannot be transferred to another operator, and if it is revoked or surrendered you must send the NAA a digital acknowledgment without delay.

If the operation or the listed mitigations change significantly, you must apply for an updated authorization. EASA's guidance treats any non-editorial change that affects the authorization or its supporting documents as significant, for example a change to the risk assessment's assumptions, key personnel, ownership, principal place of business, procedures or operations manual. Flying in another member state needs an application to that state's authority under Article 13.

Your ongoing duties under UAS.SPEC.010 to UAS.SPEC.090 include:

• Reviewing regularly whether your mitigations are still adequate, and updating them
• Flying every operation within the authorization's limits, conditions and mitigations
• Training remote pilots to the competency the authorization defines, in cooperation with an entity designated by the competent authority
• Keeping records of training and qualifications (for 3 years after a person leaves or changes role), maintenance (3 years) and operations, including unusual occurrences (3 years)
• Keeping up-to-date lists of designated remote pilots and maintenance staff
• Fitting each aircraft with at least one green flashing light and an active, up-to-date remote identification system
• Giving the NAA's authorized staff access to your facilities, aircraft, documents and records

What a consultant does, and what to ask before hiring

A consultant can help you work out whether you need an authorization at all, choose between a full SORA, a PDRA and an LUC, write the ConOps and operations manual, assemble the compliance evidence, and deal with the NAA's questions and later amendments. They cannot grant an authorization or promise an outcome: the NAA decides. Operators can compare vetted consultants on DOC, where experience with a particular regulator shows as verified only where it has been evidenced.

• Which NAAs have you prepared operational authorization applications for, and under which SORA edition or PDRA?
• Will you write the risk assessment and operations manual, or review drafts we write?
• How will you check whether a standard scenario or PDRA would cover our operation more simply?
• What records, training and reporting will the authorization require of us once it is issued?
• How do you handle amendments when our aircraft, crew or sites change?

Common mistakes

An authorization keeps applying to every flight after it is issued, and several of these mistakes only show up later, during oversight. Mistakes to avoid include:

• Applying to the NAA of the country where you plan to fly, when the application goes to your state of registration
• Treating a geographical zone flight authorization as if it were an operational authorization, or the other way round
• Listing mitigations in the application that the operations manual and crew procedures do not carry out
• Changing aircraft, key personnel or procedures without checking whether the change needs an updated authorization
• Relying on a generic authorization without a documented check that each site meets its conditions
• Letting training, maintenance and flight records lapse, when the NAA's staff are entitled to see them