After almost 10 years of waiting, the FAA finally dropped its proposed rule for Section 2209. So if you fly drones, whether recreationally or commercially, this one kind of matters for you. The window to do anything about it closes on August 5th after it was extended from the original deadline of July 6th. Stick around, because at the end I’ll show you exactly how to file a comment that is going to get read.
What Is Section 2209?
Back in 2016, Congress told the FAA to build a process that would let certain critical infrastructure sites across the country ask for drone flights to be restricted over their facilities. Now, 10 years later, two more congressional reauthorizations and an executive order later, the FAA has finally issued a proposed rule. These are going to be called UAFRs — Unmanned Aircraft Flight Restrictions. DroneXL first covered the filing in its breakdown of the Section 2209 NPRM, and you can read the full proposal on the Federal Register.
Important framing here before we go any further. This is a proposed rule. This is not law just yet. No UAFRs exist today. The rule is set up with an application process. Nobody’s airspace is actually being restricted the moment that this passes. Sites are going to have to apply one at a time and prove their cases.
Two Tiers: Standard and Special UAFRs
There are going to be two tiers. A standard UAFR is going to be the default, and that standard UAFR is going to have a horizontal boundary that’s going to be inside of the applicant’s property line and default to a ceiling of 400 feet AGL, which kind of makes sense. The restriction is kept at the property line, 400 feet, not just a giant bubble over the entire neighborhood.
Here’s the catch, though. It’s not a full restriction like a temporary flight restriction or a restricted area that you might be familiar with. You likely will qualify to fly through one of these — more on that in a second.
The other type of restriction is a special UAFR, and that’s the heavier tier. Eligibility here is going to be limited to facilities that are owned, operated, or sponsored by federal security or intelligence agencies or by military departments. These are going to carry a 5-year designation. Operations within a special UAFR are going to require both permission from the using agency and approval from the FAA administrator, or whoever they decide to delegate that to. And here’s the teeth: when issued for national security or homeland security purposes, they would be designated as national defense airspace and carry criminal penalties if they are violated. This is a special one, not the traditional one we talked about earlier.
Who Can Apply?
The good news is that it’s not just anyone. A site has to fall within one of 16 critical infrastructure sectors: energy, chemical, water, nuclear, transportation, defense, healthcare, and so on. There are a few more after that.
Applicants bear the burden of proving that a restriction is necessary. This is a big “if,” and it’s very important. They have to show real drone traffic, a specific vulnerability, and existing security measures that are already in place — restricted access, security personnel, and monitoring. They also need the capability to receive and log broadcast Remote ID information from drones that are going to be operating nearby.
The scale here is kind of the headline number. The FAA identified approximately 125,000 fixed-site facilities that could be considered as a potential UAFR site. But based on the criteria proposed in the NPRM — the notice of proposed rulemaking — the FAA estimates they are going to receive about 9,000 UAFR applications over the next 5 years. So not 125,000.
What Does This Actually Mean for You?
Here’s the big one. If you’re a recreational flyer flying under 49 U.S.C. 44809, no flying in a UAFR, period. If you’re flying under Part 91, 107, upcoming 108, Part 135, or Part 137, then there’s going to be a transit pathway. Operations conducted under 91, 107, 108, 135, and 137 that I just mentioned are permitted, provided you meet some requirements.
The first one is that you comply with Remote ID requirements as they are under 14 CFR Part 89. Chances are you’re already doing that. Also, provided that you give advance notice to the fixed-site facility.
Here’s the part that is worth understanding: notification is not approval. I did specifically say that you provide advance notice. You tell the site that you’re going to be transiting through the airspace and the site really cannot deny you. You’re just providing them information. As far as advance notice, you might ask, “How far is advance notice?” There’s no actual word in the FAA document that tells us how far advance notice is. And the FAA is going to keep control here of the airspace, not the actual facility. Again, this is very important.
How the Process Works for the Facility
Let’s take a look at how the process is going to work for a facility to get a UAFR put in place. First, each site is going to need to have authorization, meaning a single company cannot make their entire property a UAFR. In the application to the FAA, each site must show that there is a vulnerability, the consequences of a UAS-related event, incident, or occurrence, their UAS response plan, their security measures, and other data as required by the FAA in that application.
If the FAA conditionally approves it, then there’s going to be an NPRM published on the site for 30 days where you will be able to see it and say, “Well, no, I don’t agree with this being a UAFR, and here’s the reason why.” Just like you have a chance here to leave a comment on this NPRM. With that being said, there is also another pathway where the FAA says it may put a UAFR in place if it has good cause to forego comments and notices, bypassing the NPRM process. If approved, that UAFR is going to be good for a maximum of 5 years.
The Good and the Bad
Let’s talk about the good and maybe the bad from our perspective here. The good: sites have to prove that they have a need, and I think that’s really a good thing. Restrictions are kept as small as practical. Certificated operators get to have a transit pathway inside of the airspace, and the FAA — not the actual facility — still controls the airspace.
The gap we’re thinking about is that there’s no real counter-drone authority for any of these facilities. In fact, the rule explicitly says it does not authorize geofencing, jamming, drone capture, or any form of mitigation technology. You might be wondering, then what’s the whole point of this? A site can know who’s flying, but they cannot stop a bad actor. And the notify-and-fly model assumes that the people notifying are the honest ones who are actually going to be flying, which raises the question of whether bad actors are going to be deterred at all.
Another area where this could be very beneficial is that it would provide a clear rule on what is and what is not critical infrastructure. We’ve seen states doing their own thing over and over again over the last 10 years. That said, the proposed rule does not really preempt state or local regulation regarding operating near critical infrastructure. So the states would still be able to do their own thing.
One more point here on the good cause to forego comment and notice for a UAFR: we believe that if this happens, if the FAA decides to bypass the NPRM process, transparency needs to be very, very clear. The FAA should be required to share the cause and the rationale for an immediate implementation of a UAFR without letting the public comment. And this is exactly why the comment period actually exists.
What the FAA Is Asking For
The FAA is asking for input on this NPRM. Specifically, it’s asking for input on the scope of the 16-sector framework — should there be more, should there be less? What additional operations should be allowed through a UAFR? Maybe we want to think about the folks who are flying recreationally here. What credibility information should operators provide? And also the economic impact on commercial operators if transit is restricted — I think that’s a very important one to talk about.
Regarding recreational operators, unfortunately they’re not included in here. Our thought is that it’s possibly because Part 107 operators have to go through a TSA check, and a recreational user would not. So that’s more than likely the reason behind it. But if you want to comment on that and think a recreational operator should be allowed, then you should be making that comment.
How to File a Comment That Gets Read
Here’s how you can actually comment. It takes about 5 minutes. Go to regulations.gov and search the docket number. This is FAA-2026-4558. Comments, like I said, have been pushed from July 6th to August 5th.
One note here: comments are public, so don’t put anything in there that you wouldn’t want to see attached to your name. A good comment is specific. Don’t just say, “I don’t like this.” Tell them how it is going to affect your operation, your business, your routes, your cost. The FAA literally has to read and respond to substantive comments. So a concrete, real-world example is going to carry a lot more weight than a form letter. Now the ball is in your court.
This article is based on a video from our YouTube partner Greg Reverdiau at Pilot Institute. Watch the full breakdown on the Pilot Institute YouTube channel, and find more of Greg’s coverage on his DroneXL author page.
