FAA Finally Proposes Drone No-Fly Rules for Critical Infrastructure Sites
· TexaHub · Drones, Regulation & Ethics, Defence & Security
A decade after Congress ordered it, the FAA's Section 2209 proposal would let refineries, prisons, dams and other critical sites apply for drone flight restrictions.
A decade-old mandate
The Federal Aviation Administration published a notice of proposed rulemaking in the Federal Register on 6 May that would create a process for operators of certain fixed site facilities to request restrictions on unmanned aircraft flying near them [1]. The proposal implements section 2209 of the FAA Extension, Safety and Security Act of 2016 and would add a new Part 74 to the agency's rules [1]. Comments are due by 6 July 2026 under docket FAA-2026-4558 [1].
Congress first named energy facilities, oil refineries, chemical plants and amusement parks as candidates, then added railroad facilities in 2018 and state prisons in 2024 [1]. Inside Unmanned Systems noted that the 2018 reauthorisation had set a deadline of 31 March 2019 for the proposal, and that the 181-page document follows Executive Order 14305, "Restoring American Airspace Sovereignty", signed on 6 June 2025 [2]. DroneXL reported that the rule went on public inspection on 5 May, a day before formal publication [4].
Transportation Secretary Sean Duffy said that "restoring airspace sovereignty in America means protecting sensitive locations from aerial threats while providing clear guidance to drone pilots so they can operate with confidence" [9].
Two kinds of restriction
The proposal defines two designations [1]. A standard unmanned aircraft flight restriction, or UAFR, would be a block of airspace with defined horizontal and vertical limits in which drones are barred except for a few narrow exceptions [1]. Its lateral boundary must lie within the applicant's property lines, and its ceiling is set at 400 feet above ground level, with room to go higher for structures taller than 300 feet [1]. A UAFR can be continuous or part-time, the latter active for up to 290 consecutive days a year to suit seasonal sites [1].
A special UAFR is a stricter tier for facilities owned or operated by federal security or intelligence agencies or the Department of War, and for sites those bodies endorse, when a security assessment shows credible risks [1]. The FAA says it would mirror today's special security instructions under 14 CFR 99.7 but last five years, and it proposes to fold appropriate existing instructions into the new framework [1]. Where a special UAFR is issued for national or homeland security, the airspace may be designated national defense airspace, which can carry criminal penalties [1]. Hogan Lovells noted that both types carry a maximum five-year term and must be renewed at least 120 days before expiry [7].
The rule is explicit about what it does not do. A UAFR would not create a physical boundary or authorise a facility to use technology to detect, take control of or destroy a drone; it is a legal designation that tells compliant pilots to stay out and lets regulators and police enforce it [1]. Entities that already hold counter-drone authority under other laws keep it [2].
Who can apply
Eligibility is limited to permanent, non-mobile facilities that meet the federal definition of critical infrastructure and sit in one of 16 sectors, from chemicals and communications to dams, energy, transportation and water [1]. Within each sector the FAA proposes thresholds. According to sUAS News, these include power plants of at least 500 megawatts, refineries able to process 100,000 barrels a day, prisons housing 500 or more inmates, Level I trauma centres with helipads, and outdoor attractions with at least 2.5 million annual visitors [3].
Meeting a threshold would not be enough on its own. Applicants would have to document existing drone activity near the site, the vulnerabilities of their assets and the consequences of an incident, and explain how the restriction fits their wider security plan [1]. sUAS News reported that the facility must also maintain baseline security, including the ability to receive and log broadcast Remote ID messages [3]. Each approved application would then go through its own Federal Register notice with at least 30 days for public comment [1].
The regulatory impact analysis says Sector Risk Management Agencies identified about 125,000 facilities that may be high priority for a UAFR under the proposed thresholds [1]. Its cost estimate rests on a scenario of more than 9,000 facilities obtaining restrictions, with annualised costs of $21 million to $31 million [1]. DroneXL stressed that the 9,000 figure is the agency's modelling input, not a cap [4].
What commercial operators keep
For drone businesses the key provision is proposed section 74.250, which would let operations under Parts 91, 107, 108, 135 and 137 pass through a standard UAFR if they broadcast Remote ID, transit in the shortest practicable time and notify the facility [1]. That list spans public safety flights, routine commercial work, the forthcoming beyond-visual-line-of-sight rules, package delivery and agricultural spraying [3]. DroneXL pointed out that recreational flyers are not on it [4]. Special UAFRs would require permission from both the responsible agency and the FAA Administrator [1].
The FAA asks for comment on whether other operations should be allowed, on the economic impact if commercial operators cannot transit, and on what information operators should provide to show they are not a threat [1].
Early reactions
Industry groups broadly welcomed the proposal while signalling where they will push. Michael Robbins, chief executive of AUVSI, said "it is good to see the FAA finally move forward" after nearly a decade of delay, and the association said it would seek meaningful access for certificated operators and notification requirements that scale with commercial traffic [5]. AUVSI also framed the rule as a chance to pre-empt state and local drone restrictions [5]. Lisa Ellman, chief executive of the Commercial Drone Alliance, called it "an important milestone" [8].
Facility owners were supportive. The American Fuel & Petrochemical Manufacturers said the proposal's recognition that refineries and chemical plants need airspace security is "an important step forward" [6]. FLYING reported that the National Press Photographers Association has raised concerns about possible effects on First Amendment rights and aerial newsgathering [9].
In our view the proposal is narrower than its headline suggests: restrictions are confined to property lines and a 400-foot ceiling, and vetted commercial traffic is allowed through. The open questions are how many of the eligible facilities apply, how burdensome site notification proves in practice, and how much latitude the FAA keeps for special restrictions. DroneXL argued that the Administrator's discretion to endorse special UAFRs is the part that deserves the most scrutiny [4]. The docket is open until July.
Sources
[1] Designation-Restrict the Operation of Unmanned Aircraft in Close Proximity to a Fixed Site Facility — Federal Register, 6 May 2026
[2] FAA Releases Section 2209 NPRM, Two-Tier Framework for Drone Restrictions Around Critical Infrastructure — Inside Unmanned Systems, 7 May 2026
[3] New rules will keep unmanned aircraft away from prisons and power plants — sUAS News, 8 May 2026
[4] FAA Drops Section 2209 NPRM After Decade-Long Wait, Industry Has 60 Days To Shape The Rule — DroneXL, 5 May 2026
[5] AUVSI Statement on FAA's Proposed Section 2209 Rule — AUVSI, 6 May 2026
[6] AFPM supports FAA proposal to secure critical infrastructure from unauthorized drones — American Fuel & Petrochemical Manufacturers, 5 May 2026
[7] At long last, FAA proposes rule restricting drone operations over critical infrastructure — Hogan Lovells, 8 May 2026
[8] FAA Advances Long-Delayed Rule to Restrict Drones Over Sensitive Sites — DRONELIFE, 5 May 2026
[9] FAA Addresses Drone Threats at 'Critical Infrastructure' Sites — FLYING Magazine, 6 May 2026