European drone regulation is not the obstacle course founders fear — it's a designed framework with three doors, and knowing which door your product walks through changes your engineering priorities, your timeline and your pitch. This is the map, in engineering language.
The two regulations that matter
- Regulation (EU) 2019/947 — the operations rulebook: categories, operator obligations, pilot competency, authorisations. If it's about flying, it's here.
- Regulation (EU) 2019/945 — the product rulebook: class marks (C0–C6), manufacturer obligations, CE-style conformity. If it's about the aircraft as a product, it's here — see our class marking guide.
Both apply directly across EASA member states (EU plus Norway, Iceland, Switzerland-adjacent arrangements), which is the good news: one framework, ~30 markets. National authorities (NAAs) still run registration, geo-zones and the actual processing of your applications — where practice varies more than founders expect.
The three categories, honestly summarised
| Open | Specific | Certified | |
|---|---|---|---|
| Risk logic | Low risk by built-in limits | Risk assessed per operation | Aviation-grade certification |
| Key limits | <25 kg, VLOS, ≤120 m, no dangerous goods, no dropping | Whatever your authorisation says | Type-certified aircraft, licensed pilots |
| Paperwork | Registration + online training | Operational authorisation (SORA/PDRA/STS) or LUC | Type certificate, air operator-style approvals |
| Timeline to operate | Days | Months (2–12+, SAIL-dependent) | Years |
| Typical users | Photography, inspection VLOS, testing | BVLOS, delivery, near/over people, >25 kg | Passenger/large cargo eVTOL |
Open category: your sandbox, with subcategories
Open splits by proximity to people: A1 (overfly of uninvolved people essentially only for the lightest classes), A2 (close to people with a C2 aircraft and extra pilot exam), A3 (far from people — 150 m from residential/commercial areas — where most sub-25 kg prototypes live). For a startup, A3 is the free flight-test regime: register as an operator, pass the online exam, respect geo-zones, and iterate. Its ceiling arrives the day your business model needs BVLOS, urban proximity or dropping anything.
Specific category: where drone businesses actually live
Beyond Open limits, you need an operational authorisation from your NAA, obtained via one of three routes, in increasing order of effort:
- Standard Scenarios (STS-01/02) — pre-packaged operations (VLOS over controlled ground area urban; BVLOS with airspace observers over sparsely populated areas) using C5/C6-marked aircraft: declaration instead of full assessment. Narrow but fast, where your mission fits.
- PDRA (Pre-Defined Risk Assessments) — EASA-published templates covering common operation shapes; you fill in specifics rather than arguing methodology.
- Full SORA — the general-purpose risk assessment: ground risk, air risk, mitigations, and a rigour level (SAIL) that scales the evidence demanded of your organisation and aircraft.
Add the LUC (Light UAS operator Certificate): an organisational approval that lets mature operators self-authorise within privileges — the "we do this weekly, stop asking per-mission" endgame.
Certified category
Type-certified aircraft, certified operators, licensed pilots — the regime for carrying people and for the heaviest risk operations. If your roadmap says "urban air mobility", budget aviation-industry timescales and capital; for nearly all UAS startups, the strategic question is instead how far the Specific category can carry the business (answer: further than most assume — high-SAIL Specific covers a lot of ambitious territory).
What this means for your engineering roadmap
- Design to thresholds: the 25 kg and class-mark mass cliffs are product requirements. So are containment features (geofencing, failsafe behaviour, remote ID) that SORA mitigations will lean on.
- Evidence is a deliverable: design documentation, test reports, reliability data and manuals aren't bureaucracy retrofitted — they're artefacts your authorisation is literally made of. Cheap to produce as you go, brutal to reconstruct.
- Pick launch markets by NAA practice: processing speed and BVLOS friendliness differ across member states; operators genuinely sequence market entry around it. Cross-border extension of an authorisation is a real mechanism once the first one exists.
Regulation in Europe rewards exactly what good engineering produces anyway: documented design, tested failure behaviour, honest reliability data. Startups that internalise this early turn compliance from a tax into a moat — the authorisation your competitor hasn't started is 6–12 months of head start. Deeper dives: SORA, BVLOS approvals, U-space.
Frequently asked questions
What are the three EASA drone categories?
Open (low risk: under 25 kg, visual line of sight, no dangerous goods, operational limits by subcategory A1/A2/A3), Specific (medium risk: anything beyond Open limits, requiring an operational authorisation based on risk assessment such as SORA), and Certified (high risk: certified aircraft and licensed remote pilots, e.g. passenger transport).
Do EASA drone rules apply in every EU country the same way?
The core regulations (2019/947, 2019/945) apply directly in all EASA member states, and an operational authorisation can be extended to other member states. But national authorities still control geographical zones, registration portals, language requirements and processing practice — implementation varies noticeably.
Which EASA category does a drone startup usually need?
Most commercial use cases beyond simple photography — BVLOS, operations near people, heavier aircraft, delivery — live in the Specific category. Plan for a SORA-based operational authorisation or a Standard Scenario; treat the Open category as a testing and early-revenue sandbox.
This is independent educational content — not legal, spectrum, conformity-assessment or flight-safety advice. Rules change and differ by country. Verify current requirements with EASA, your national aviation authority, your national spectrum regulator (in Belgium, BIPT) and qualified counsel before you operate or rely on any figure here.