The comment window on the FAA’s Section 2209 rule closed August 5th. It’s still not a final rule, That may still be six to twelve months out, at best. But the fact that comments are closed changes what critical infrastructure operators should be doing right now…and most haven’t started.
What 2209 Actually Creates
Section 2209 has been ten years in the making. Congress ordered the FAA to build this process back in 2016, gave the agency 180 days to do it and it finally moved a decade later. This movement was forced via an executive order last June (2025) directing the FAA to publish the proposal “promptly.” It landed in May (2026, almost a year later), which opened a 60-day public comment period. At period closure, FAA is looking at a heavy comment record from many individuals and organizations including over fourteen trade associations across energy, chemical, transportation, and other sectors, all pushing in roughly the same direction.
So what does it purport to do, as proposed? The rule would establish two new classes of airspace designations, Unmanned Aircraft Flight Restriction (UAFR) and Special Unmanned Aircraft Flight Restriction (SUAFR), under a new Part 74. It’s not a Temporary Flight Restriction (TFR). It’s not a physical barrier. And it is explicitly not counter-UAS authority. What it is: a legal chunk of airspace drawn around a facility’s property that would turn an intrusion from a nuisance into an enforceable violation with civil and, in some cases, criminal penalties behind it.
That distinction matters more than the “just airspace” framing suggests. Before this rule, a private facility had no standing mechanism to ask for a no-fly designation. The only precedent was the FAA’s ad hoc use of special security instructions (SSIs), granted case by case to a small number of federally connected sites. Section 2209 turns that exception into a real process. The FAA expects somewhere between 120,000 and 150,000 facilities across 16 sectors to be eligible. This isn’t a niche rule for nuclear plants and airports. It will touch nearly every asset owner classified as critical infrastructure.
What It Allows, What It Doesn’t and Why That Still Matters
As mentioned, the draft rule provides for two types of UFRs. The standard UAFR (just called UAFR), which most applicants will receive, will run for five years. It requires asset owners to have Remote ID receiving capability and basic physical security. It would still allow vetted commercial operators to transit the airspace, but with prior notice.
The Special UAFR (SUAFR), the higher bar, would be reserved for facilities with a credible federal security sponsor. It would restrict flyovers more tightly and carry the threat of criminal liability under 49 U.S.C. 46307 for violations, not just FAA civil penalties.
Here’s the part most coverage glosses over. Neither UAFRs nor SUAFRs grant mitigation authority to the infrastructure operator. Nothing in Part 74 lets a facility jam, spoof, net or shoot down a drone that violates its restriction.
Special authority for state and local law enforcement as well as correctional facilities sits in a separate piece of federal policy, the SAFER Skies Act. That took effect July 6 as part of the 2026 NDAA and builds a two-tier detection-and-mitigation framework for just those entities. It does not cover critical infrastructure owners or operators either.
So why bother with the airspace designation if the authority-holder cannot stop anything on their own? Because the people closest to this rulemaking suggest that in the future UAFRs/SUAFRs may become a practical prerequisite for a facility that later wants mitigation authority, once that authority exists. Get the 2209 legal designation in place now or get in line behind everyone else once that door opens.
There’s also one unresolved wrinkle worth knowing about if you operate across state lines. The NPRM never addresses whether it would preempt some of the state-level critical infrastructure drone laws that have already proliferated in the absence of a federal rule. For a multi-state operator, that’s a live risk remaining to be mitigated, not a technicality.
What the Final Rule Will Almost Certainly Require
In my assessment, a few pieces of Part 74 are close to locked, whatever else changes in the final version:
1. Remote Identification (RID). Every UAFR/SUAFR applicant will need the ability to detect RID broadcasts from compliant operators transiting nearby airspace. What’s still genuinely open is the technology question. Does a phone app that reads RID satisfy the requirement, or does the FAA expect a commercial sensor system? Nobody knows yet. No vendor performance standard exists to guide a purchase. Treat the requirement as fixed but the implementation as unsettled.
2. UAS Response Plan. The security plan fight seems to be the sharpest live dispute on record. The FAA’s draft language calls for a “drone security plan.” Industry has been pushing back toward a narrower “drone response plan,” arguing that handing a full physical security posture over to the FAA creates its own exposure. Comments suggest offering an executive-level certification as an alternative to submitting the whole document. How that gets resolved will set the tone for how much operational detail every applicant has to disclose.
3. Eligibility. Every sector’s comments land on the same concern about unhelpful thresholds. The FAA’s proposed thresholds of 100,000 barrels a day for refineries and 500 million cubic feet a day for natural gas processing are chemical categories borrowed from a CFATS program that’s been legally dead since 2023. These arbitrary cutoffs would exclude facilities carrying real risk. The consistent request of the FAA across sectors is that the agency replace hard numeric gates with a risk-based or case-by-case pathway instead.
Why Operators Should Move Before the Final Rule, Not After
Two things are worth starting now, independent of when the FAA actually finalizes the rule.
Start building the eligibility file. This would include throughput numbers, chemical inventories, and any documented drone activity near the site. The NPRM asks for up to 24 months of activity data “where available.” facilities without that record risk waiting years even after the rule takes effect, since the review timeline stacks on top of the data-collection window rather than running alongside it.
Get ahead of Remote ID. If a site doesn’t have receiving capability deployed yet, this is the moment to understand the technology landscape and vet solutions on your own terms. Do this before a finalized rule creates a rush and vendors start marketing aggressively into a captive market with no performance standard to hold them to.
Neither of these depends on knowing exactly what the final rule says. They depend on knowing what it will almost certainly require, and getting there before every other eligible facility in the country is trying to do the same thing at once.
The real payoff of 2209 isn’t the airspace restriction itself. It’s what a UAFR sets a facility up for next. If mitigation authority for critical infrastructure does eventually get delegated the way SAFER Skies and the broader policy direction suggest it might, a facility that already holds a UAFR walks into that conversation with standing. A facility that waited for the final rule to force its hand won’t.