Anyone who has tried to keep pace with drone law this year has probably experienced closing one browser tab on a new FAA proposal and having three more open in its place. At Commercial UAV Expo, the panel “Cutting Through the Legal Ease: What Drone Operators Need to Know About NDAA Compliance and Beyond” tackled that overload head-on. It delivered something rare in this industry right now: clarity, delivered with humor, from people who actually interpret these rules for a living.
Moderator Dawn Zoldi, CEO of P3 Tech Consulting and publisher at Autonomy Global, opened by admitting what most operators already feel. “Head spinning amount of change I feel like in the last couple of months,” she told the packed room. “Very hard to keep up.” Joining her were Courtney Freeman of Adams & Reese, a former FAA regulations attorney who managed the agency’s operations law branch, and Tyler Hazen of Angulo McGhee, whose practice represents drone manufacturers and service providers across product liability and contract disputes. Together they walked the audience through the regulatory maze that now touches everything from critical infrastructure overflights to battery sourcing.
Section 2209 Finally Has a Shape
For a full decade, Section 2209 of the 2016 FAA Extension, Safety and Security Act sat as an unfulfilled congressional directive to protect critical infrastructure from errant drone flights. That changed in May 2026, when the FAA published its long-awaited proposed rule establishing a new Unmanned Aircraft Flight Restriction, or UAFR, framework under a forthcoming 14 CFR Part 74. The public comment period closed after a short extension, and the panel dug into what the rule actually does and does not do.
Freeman offered a reframe that many operators have not considered. “I personally see it sort of the opposite,” she said, pushing back on the idea that 2209 is a “doomsday scenario” for operators. Rather than restricting more airspace, she argued the rule could finally replace a patchwork of inconsistent state and local overflight bans with one federal standard, provided the FAA includes an explicit preemption clause in the final version. Federal preemption, the legal concept that certain Federal laws can trump state or local laws, has been a particular issue in the drone space over the past several years with the FAA issuing an updated Fact Sheet regarding its stance on the issue.
Hazen backed that up with the scope of the current mess. Roughly 10 to 15 states already have their own critical-infrastructure overflight laws, each defining things differently. “In one state, don’t come within one statute mile of critical infrastructure. In another state, oil refineries count as critical infrastructure, but maybe a dam doesn’t,” he said. That inconsistency, panelists agreed, is a bigger operational headache than a single federal rule would be.
Operators should also understand that 2209 protection is not automatic. Facility owners must actively petition the FAA, demonstrate a documented safety or security need, and meet baseline security requirements including Remote ID detection capability. Even then, some facility owners may be frustrated to learn that holding a Standard UAFR doesn’t necessarily stop overflight of unmanned aircraft. Standard UAFRs will still allow compliant operators to transit the restricted airspace in the shortest practicable time, provided they broadcast Remote ID and notify the facility in advance.
The takeaway: Section 2209 will not restrict the entire airspace overnight, and it may ultimately simplify a chaotic state-by-state patchwork. Expect the final rule sometime after mid-2027 at the earliest; Freeman noted FAA rulemakings of this complexity typically take a year or more to finalize, and this one drew approximately 900,000 public comments that must be adjudicated first. For more information on 2209, check out our coverage on Autonomy Global.
Safer Skies Gives Local Authorities New Power, and New Questions
The panel then turned to the SAFER Skies Act, which passed in December 2025 and extended counter-UAS mitigation authority, previously reserved for select federal agencies, to qualified state, local, tribal, and territorial (SLTT) law enforcement. An interim final rule implementing the law took effect July 1, 2026, with its own comment period closing just as the panel took place.
Zoldi explained why this authority required its own act of Congress in the first place. Federal statutes like the Aircraft Sabotage Act already criminalize interference with aircraft, and because drones qualify as aircraft, local agencies needed explicit legislative cover to act against drone threats without running afoul of those laws. “Congress needed to give explicit authority,” she said, tracing the same logic that first extended mitigation power to the Department of Defense and later the FBI and DHS. The panel noted that state law enforcement can enforce federal law where they have been explicitly granted that authority by Congress.
Freeman flagged the practical gap that still worries her. “The IFR did not include, in my opinion, sufficient guardrails from an operator protection perspective,” she said, pointing to the risk that a lawfully operating delivery or infrastructure-inspection drone could be mistaken for a threat by a newly empowered local agency. As of the panel date, only a handful of organizations nationwide had completed the required FBI training, a bottleneck that Zoldi has separately reported on for Autonomy Global, arguing that federal officials declaring the policy “done” understates how much operational friction remains.”Washington has declared victory,” she noted, adding that the training is currently being delivered in-person.
The takeaway: Compliant operators flying near events or facilities should proactively coordinate with local law enforcement before missions launch. Hazen’s advice is to treat regulators and first responders as partners, not adversaries, and brief them on what your operation looks like before anyone has to guess.
NDAA, FCC and the Supply Chain Squeeze
No topic generated more energy in the room than supply chain compliance. Hazen traced the lineage from early NDAA provisions restricting federal procurement of certain foreign telecommunications equipment through today’s much broader FCC order banning foreign-made drones and critical components, including motors and batteries, from four specifically named countries under NDAA-linked restrictions: China, Russia, Iran, and North Korea.
He was careful to correct a common misconception. “It is not a China ban,” Hazen said of the FCC’s foreign-made drone order. “We’re talking about drones that are made in France. We’re talking about drones that are made in Texas by a French-owned company.” That distinction matters enormously for manufacturers assembling components across multiple countries, since the rule reaches far beyond the four NDAA-named adversary nations.
On the specific question of batteries, Hazen offered practical guidance for manufacturers and procurement teams: if a battery component did not previously require FCC approval, it still does not require it now, though he cautioned that this could change as the agency signals intent to tighten control over sourcing. He also flagged two current exceptions, the Buy American Act and the Blue UAS list, both of which carry expiration dates of roughly one year and should not be treated as permanent shelter.
Freeman added that a related FCC proceeding covering additional components had its own comment period closing the same week as the panel, with the compliance timeline still very much in flux. That FCC proposal targeted foreign “military-grade” drones and would prohibit importation and sale of certain UAS and UAS Critical components. These restrictions would strongly impact various drone industries particularly agricultural spraying and thermal imaging. The proposal received strong opposition in public comments. Both panelists agreed the interagency coordination behind these rules leaves something to be desired. As Zoldi put it, tracking the overlapping bans, exemptions, and effective dates practically requires its own flowchart.
The takeaway: Manufacturers and procurement teams should audit every component, not just the airframe, against current FCC and NDAA restrictions, verify whether Buy American or Blue UAS exemptions actually apply to their supply chain, and revisit that analysis regularly since the rules are still moving.
Part 108 and the Road to Scaled Autonomy
The session closed on the hot topic of the moment: Part 108, the long-anticipated beyond visual line of sight (BVLOS) framework that would finally increase the availability of BVLOS operations and normalize a large variety of applications. Freeman confirmed the rule remains under review at the Office of Information and Regulatory Affairs, with real prospects of further delay despite an executive order pushing for its release.
Hazen described Part 108 as the natural evolution of Part 107, shifting the regulatory model from individual pilot certification toward a corporate responsibility structure involving flight coordinators and operations supervisors overseeing autonomous, pre-programmed missions. He connected it directly to the emerging Part 146 framework for automated data service providers, which would supply operators with real-time information on temporary flight restrictions, weather, and other aircraft. Freeman noted that because the two rules were proposed together, she would be surprised if the FAA finalizes one without the other.
The takeaway: Operators planning beyond visual line of sight business models should watch Part 108 and Part 146 as a linked pair, and should not assume a beyond-line-of-sight future arrives on any fixed calendar. Freeman suggested a same-year release is possible but the rule could face further delays..
Staying Ahead of the Curve
The panel’s closing advice doubled as a broader industry mindset. Freeman urged operators to keep local stakeholders informed of mission intent well before flights occur, both as a legal safeguard and a trust-building measure. Hazen emphasized risk-shifting tools like insurance and indemnification agreements, reminding the room that perfect regulatory compliance does not eliminate exposure to state-level negligence or privacy claims. And both agreed the industry has drifted away from the public-acceptance conversations that dominated its early years, a gap Hazen warned will resurface the moment an autonomous delivery mishap makes headlines.
For operators willing to stay engaged, attend the legal tracks at industry events, and treat regulators as collaborators rather than obstacles, the current wave of rulemaking is navigable. The rules are catching up to the technology. That is, ultimately, good news for an industry ready to scale.