When the European Union adopted its comprehensive unmanned aircraft regulatory framework in 2019, one of the central architectural decisions was to structure the regulation around risk rather than aircraft size or technology. The result is a three-category system — Open, Specific, and Certified — that applies across all EU member states and determines what authorisation an operator needs before flying. Understanding how this framework works is foundational to understanding the regulatory environment for drone delivery in Europe.

The framework’s legal basis

The three-category framework is established in two primary regulations: Commission Delegated Regulation (EU) 2019/945, which covers the aircraft themselves (design standards, marking, registration requirements), and Commission Implementing Regulation (EU) 2019/947, which covers the operational rules. Both were adopted in 2019 and have been amended and supplemented by subsequent regulations as the framework has been implemented and refined.

The regulations apply directly in all EU member states without needing to be transposed into national law — a characteristic of EU implementing regulations that ensures consistency across the single aviation market. EASA publishes extensive supporting materials, including acceptable means of compliance and guidance material, that clarify how the regulations should be applied in practice.

Open category

The Open category covers low-risk operations that can be conducted without prior authorisation from a national aviation authority. Operations fall into the Open category if the unmanned aircraft is below 25 kilograms, flies below 120 metres above ground level, remains within visual line of sight, and does not fly over assemblies of people. Within the Open category, three subcategories — A1, A2, and A3 — apply depending on the aircraft’s maximum take-off mass and where it is operated relative to uninvolved people.

For drone delivery operators, the Open category is of limited relevance. Commercial delivery operations to residential addresses involve flying over people and properties in ways that take the operation out of the Open category’s scope, and the payload requirements of delivery typically involve aircraft above the smaller mass thresholds. The Open category is primarily relevant for recreational operators, inspectors, photographers, and others conducting operations away from people.

Specific category

The Specific category is where most commercial drone delivery operations sit. It covers operations that present higher risk than Open category — specifically, operations beyond visual line of sight, over people, in controlled airspace, or with larger aircraft — and requires prior authorisation from the relevant national aviation authority.

The authorisation process under the Specific category follows a risk assessment methodology defined by EASA. The primary methodology for commercial operations is the Specific Operations Risk Assessment, or SORA, which requires operators to assess the risk of their proposed operation against a defined set of ground risk and air risk factors, identify mitigating measures, and demonstrate that the residual risk is acceptable. The SORA process produces an authorisation that is specific to the operator, the aircraft, the operational area, and the operating conditions described in the application.

EASA has also published a set of Predefined Risk Assessments, or PDRAs, which are pre-completed risk assessments for common operation types. An operator whose proposed operations match a PDRA can use it to support their authorisation application without completing a full SORA from scratch — a significant simplification for operations that fit within the predefined parameters.

For drone delivery operators, the Specific category is the regulatory home for BVLOS operations, operations over populated areas, and operations that otherwise exceed the Open category limits. The authorisation process is more demanding than Open category but less demanding than the full aviation certification required for the Certified category.

Certified category

The Certified category covers the highest-risk operations — those in which the consequences of a failure could be equivalent to the consequences of a manned aviation accident. Operations that carry people, operations above densely populated areas with large aircraft, and operations in high-risk airspace environments may fall into the Certified category.

Certified category operations require certification of the unmanned aircraft itself (equivalent to the type certification process for manned aircraft), certification of the operator (equivalent to an air operator’s certificate), and in some cases licensing of the remote pilot. The certification process follows EASA’s established aviation certification procedures, adapted for unmanned systems.

Few commercial drone delivery operators currently operate in the Certified category. Most operations, including large-scale commercial delivery, are conducted under the Specific category framework. As aircraft grow larger and operations become more complex, the boundary between Specific and Certified will become more significant — but for current-generation delivery aircraft and operations, the Specific category is the operative framework.

How the categories interact with U-space

The three-category framework defines what authorisation an operator needs. The U-space framework defines how airspace is managed for those operations. An operator conducting a Specific category BVLOS delivery operation within designated U-space airspace must both hold a Specific category authorisation and use the services of a certified U-space service provider to access that airspace. The two frameworks are complementary rather than alternative — the category determines the authorisation; U-space determines the airspace management.