By: Jennifer Ambrose, Autonomy Global Ambassador – Aviation Regulations
Today, May 6, 2026, the FAA released the long-awaited proposed rule on fixed-site restrictions for UAS in proximity to critical infrastructure for public inspection. Section 2209 of the FAA Extension, Safety and Security Act of 2016 required the FAA to do rulemaking to restrict UAS use around critical infrastructure, amusement parks and other locations. Ten years, two more Congressional reauthorizations and an Executive Order later, the FAA has finally issued the rule. And it’s a doozy! The proposed rule, titled “Designation: Restrict the Operation of Unmanned Aircraft in Close Proximity to a Fixed Site Facility,” is available here for comment for 60 days starting today.
What is an Unmanned Aircraft Flight Restriction (UAFR)
Under the proposed rule, an Unmanned Aircraft Flight Restriction UAFR is an area designated under a new Part 74 in which drones would be restricted from operating unless the operation falls under an exception. A UAFR can be continuous (year-round) or part-time (e.g. effective for up to 290 consecutive days a year). The FAA plans to list the UAFRs in FAA Order JO 7400.12. The proposed rule outlines two kinds of UAFRs, Special UAFRs and Standard UAFRs. They have very different levels of restriction.
Special UAFRs – Special Security Instructions with a Different Name?
Special UAFRs mirror the federal security restrictions currently set under 14 CFR § 99.7 Special Security Instructions (SSIs) and follow a similar process (Current §99.7 restrictions for fixed sites would get integrated into these new Special UAFRs). Special UAFRs would have longer term 5 year designations, and when issued for national security or “homeland security” purposes would be designated as national defense airspace under 49 USC § 40103(b)(3) and carry criminal penalties if violated. Special UAFRs will get released for notice and comment prior to being enacted. Only operators from the government agency responsible for the Special UAFR, or who have permission from that agency and approval from the FAA, will be able to operate within a Special UAFR.
Standard UAFRs… Don’t Restrict Most UAS Operations
Standard UAFRs would supposedly restrict UAS operations over other facilities BUT they don’t actually keep UAS from flying in that airspace. Operators flying under Parts 91, 107, 108, 135, or 137 (in other words, nearly all commercial UAS operations) would have to notify the UAFR holder and “transit the airspace in the shortest practicable time.” What does that mean? We’re not entirely sure.
Also, notification is not the same as “ask and receive permission.” It just requires that the operator inform the UAFR facility. In contrast, all recreational drone operations would be entirely restricted, regardless of weight or size.
Who Can Request a UAFR?
Only Federal departments or Agencies can request a UAFR. although they can request it for any specific location. The UAFR must meet specific criteria, demonstrate a need for the UAFR and go through environmental analysis as part of the application process.
Special UAFRs can only be requested by a Federal security or intelligence agency, the Department of Defense or the Department of Energy and have to be supported by a “credible safety or security threat” (undefined). So basically, a relevant federal government sponsor essentially has to ask for a UAFR on behalf of a private critical infrastructure owner.
And even then, not every location would qualify for a UAFR, even if the right type of agency asked. The site has to be critical infrastructure that meets the requirements of one of these categories:
- Chemical sector (e.g. Hazmat storage)
- Commercial facilities (e.g. amusement parks)
- Communications (e.g. Broadcast networks, cell towers, etc)
- Critical Manufacturing (specifically Primary Metal, Machinery, Electrical Equipment, Appliance, Component, and Transportation Equipment manufacturing)
- Dams
- Defense Industrial Base (both DOD contractor and subcontractor facilities)
- Emergency Services (Correctional facilities and jails)
- Energy (e.g. electrical substations, oil refineries, etc)
- Financial Services (e.g. Trading floors or financial exchange, locations with high-volume cash throughput)
- Food and Agriculture***
- Government Facilities (matches 99.7 requirements)
- Healthcare and Public Health (Level 1 trauma centers with helipads)
- Information Technology (e.g. Big data centers, exposed fiber-optics)
- Nuclear Reactors, materials, and waste
- Transportation systems (e.g. pipelines, bridges, intermodal hubs, etc)
- Water and Waste Water systems ***
***A note about the Food and Agriculture and Water and Wastewater Systems sectors. Unlike the rest of the possible types of critical infrastructure, the FAA didn’t actually provide the regulatory requirements. Perhaps they either ran out of time or couldn’t come to a consensus on what the requirements would be. Instead, the FAA asked a number of questions asking comments to suggest what they should do for those sectors, possibly in the hope they’ll be able to get enough feedback to develop criteria for the final rule. If they want to add criteria for either of those, we should see a supplemental notice come out. Everyone should keep an eye on these categories, as they could cover substantial geographic areas depending on how the criteria is developed.
In addition to falling into one of the above sectors the site must meet the following –
- Must be a fixed site, have geographic boundaries. Can’t be temporary or mobile.
- Site must have protective security (includes restricted access, security personnel, and security monitoring)
- Critical assets or components of the facility must be vulnerable to UAS
- Damage/ Disruption/ Destruction of the facility would have a regional or national-level debilitating impact.
The first criteria is a radically different position than with the Roving TFR NOTAM policy. (See prior AG coverage of the Roving NOTAMs). The last two criteria may cause some consternation with would-be applicants for a UAFR because they have to detail to the FAA what vulnerabilities they have and how those could be exploited by drones and why that damage would be debilitating to the region or the country. That’s both risky and a high bar to set, for obvious reasons.
Does a UAFR Give the UAFR Holder the Right to C-UAS?
The short answer is that a UAFR does not equate to granting the UAFR holder counter-UAS (C-UAS) authority. You still need to have separate C-UAS authority before you can mitigate a rogue drone. That said, if an agency has C-UAS authority to mitigate drone activity, they will certainly be able to take appropriate action against a drone inappropriately flying within their UAFR, if not otherwise approved to fly there. It seems C-UAS mitigation would be much more likely within a Special UAFR.
What Does This All Mean for Drone Operators?
If the rule finalizes as written, it will mean that anyone conducting operations in a Standard UAFR will have to notify the facility that “owns” the UAFR and fly “as quickly as practicable” through it while broadcasting Remote ID. Aside from the notification requirement, this probably doesn’t mean much will change in practical terms for commercial operators.
Recreational folks won’t be able to fly in a standard UAFR, though, for any reason because they don’t meet the exceptions (UAS that are too small to register and which won’t be equipped with Remote ID). That means if you live in a UAFR, your kid won’t be able to fly their little drone near your home.
Anyone conducting unauthorized operations in a Special UAFR runs the risk of both civil and criminal enforcement as well as potential C-UAS mitigation action in any form. The FAA has also signaled a much harder line lately on enforcement actions with its changes to the enforcement order (FAA Order 2150.3C) and the release of the new DETER policy which tries to fast track civil enforcement actions. (See concurrent AG coverage of DETER).
Now is the time for everyone to comment! Comments open TODAY for sixty days. This is your chance to have your say before the rule goes final.