The FAA's Section 2209 NPRM: a long-awaited step toward clearer airspace rules

Section 2209 has been one of the most anticipated pieces of drone rulemaking on the FAA's docket. Industry groups have pushed for it for years. The case is straightforward: a clear federal framework is better than the patchwork of state laws that grew up in its absence. More than a dozen states wrote their own critical-infrastructure drone laws while the federal rule sat undone, with examples ranging from felony charges in Arizona for flights over substations and refineries to surveillance restrictions in Arkansas, Louisiana, and Texas.

That federal framework is now on the table. It will likely shift before it lands.

A UAFR is a designation, not a default

This is one of the most important – and potentially misunderstood – features of the proposed rule: flight restrictions do not exist over a critical infrastructure site simply because of the rule passes; the owner has to apply, on a site-by-site basis. The application has to demonstrate that the facility is fixed, that it meets the critical infrastructure definition, that layered security is already in place (including the capability to receive Remote ID broadcasts), and that there is a documented safety or security need.

If the FAA finds those conditions met, it would publish the proposed restriction for at least 30 days of public comment before issuing it. Each individual UAFR gets its own public comment window.

The FAA's own analysis estimates roughly 9,000 facilities will go through this process over five years, out of approximately 125,000 that could theoretically qualify. The bar is meant to be high.

The two designation types

The proposal sets up two categories.

Standard UAFRs are the default. They apply to permanent, fixed facilities in 16 critical infrastructure sectors covering energy, chemical, water, transportation, communications, defense industrial base, healthcare, nuclear, and others. The categories Congress originally named (oil refineries, chemical plants, amusement parks, railroad facilities, state prisons) all sit within these sectors. A Standard UAFR has a horizontal boundary inside the applicant's property lines and a default ceiling of 400 feet AGL. It can be continuous or seasonal. 

Importantly, drone operations under Parts 91, 107, 108, 135, and 137 can access the airspace if they broadcast Remote ID, transit in the shortest practicable time, and notify the facility. Recreational operators cannot.

Special UAFRs are reserved for federal security and intelligence agencies, military departments, and certain non-federal facilities they sponsor. They carry a five-year term and flights require permission from both the sponsoring agency and the FAA Administrator. Expect more friction at sites like nuclear plants, military installations, and other sensitive federal facilities.

The rule does not authorize geofencing, jamming, or counter-drone interdiction. Those remain under separate federal law.

What this means for working drone operations

For owners who hold a UAFR over their own site, work continues. The owner controls who flies in the airspace they applied to restrict, which would include authorizing contractor operations at the site.

The “transit” provision covers a different case: operators passing through someone else's UAFR airspace. The "shortest practicable time" language has been flagged by industry observers as a point worth clarifying during the comment period, since it isn't obvious how it applies to flights that aren't simple point-to-point transit.

‍DroneDeploy is tracking the rule closely and will make sure customers have the flight-planning tools they need to remain compliant as the framework takes shape.

Where the comment window matters

While there are many positive aspects of the proposal, there are areas worth engaging on:

Weight isn't a factor in the access rules. A small mapping drone is treated the same as a heavier aircraft. Risk profiles differ. The comment period is the place to make the case for weight, energy, or operational context as factors in notification thresholds or access criteria.

The notification mechanism has to work in practice. Whether transit operates more like LAANC (fast, automated, predictable) or more like DroneZone (slow, paperwork-heavy) will determine how usable the rule is in daily operations.

State law overlap. The NPRM doesn't squarely address whether it preempts the state-level critical-infrastructure drone laws already on the books. The outcome will affect any program working across state lines.

A note for drone programs inside larger organizations

If your organization owns sites in the 16 sectors, someone in your legal or security team may eventually consider applying for a UAFR. It is worth you being in the conversation early. The application asks for current drone activity and existing security measures, and your drone program is the source of truth for most of that.

How to comment

Comments are due July 6, 2026, through regulations.gov under Docket No. FAA-2026-4558. Comments are public.

The FAA is specifically asking for input on the scope of the 16-sector framework, what additional operations should be allowed through a UAFR, what credibility information operators should provide, and the economic impact on commercial operators if transit is restricted.

If your program has concrete examples of work that would be affected, the docket is the place to put them.

Contact a DroneDeploy product expert

This post is provided for general information purposes and should not be taken as legal advice. Compliance teams should review the proposed rule and their own situation directly.

‍