Nearly a decade after Congress mandated action, the Federal Aviation Administration has finally published its Notice of Proposed Rulemaking implementing Section 2209 of the FAA Extension, Safety, and Security Act of 2016. Published in the Federal Register on May 6, 2026, the proposed rule would create a formal process for critical infrastructure operators to petition for drone flight restrictions over their facilities.
This isn't a minor regulatory adjustment. It's a structural change that would establish permanent, legally enforceable no-fly zones around sensitive facilities across sixteen critical infrastructure sectors — and the implications stretch from recreational hobbyists to commercial operators conducting inspection, mapping, and delivery missions.
What Section 2209 Actually Does
The proposed rule creates a new regulatory framework under 14 C.F.R. Part 74, establishing what the FAA calls "Unmanned Aircraft Flight Restrictions" (UAFRs). Unlike the current system, which relies heavily on temporary flight restrictions and case-by-case waivers, this would create a standardized petition process for permanent airspace protections.
Key elements of the proposal include:
Petition-Based System Facilities don't automatically receive protected status. Instead, operators must apply through a new FAA portal and demonstrate that restrictions are necessary based on aviation safety, protection of people and property, national security, or homeland security concerns. The proposal repeatedly emphasizes that restrictions apply only to "fixed-site facilities," not broad geographic areas or temporary events.
Two-Tier Restriction Framework The FAA proposes two levels of restricted airspace. A Standard UAFR would prohibit most drone operations within a defined boundary unless operators meet FAA safety and security requirements. A Special UAFR would impose stricter controls at sensitive federal sites, requiring advance approval from both the FAA and sponsoring federal agency. Special UAFRs could remain in place for up to five years.
Sixteen Eligible Infrastructure Sectors The proposal identifies a comprehensive list of eligible sectors: chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors, transportation systems, and water and wastewater.
The Commercial Operator Angle
For commercial drone operators, this rule creates both challenges and clarity. The proposal includes important provisions for legitimate commercial operations:
Transit Rights for Commercial Operators Drones operating under Parts 91, 107, 108, 135, and 137 can transit Standard UAFRs if they broadcast Remote ID under Part 89, transit in the shortest practicable time, and notify the facility. This means commercial operators conducting real estate photography, BVLOS delivery operations, agricultural spray operations, and cargo flights retain the ability to transit restricted airspace subject to notification requirements.
Recreational Operators Face Tighter Constraints Notably, recreational flyers operating under 49 U.S.C. 44809 are excluded from the transit provision. This creates a meaningful distinction between commercial and recreational operations near critical infrastructure.
Remote ID as Enforcement Tool The proposal outlines how violations could be enforced using existing authorities. Site operators can contact law enforcement if a drone enters restricted airspace, and authorities can use Remote ID data to identify the operator or locate the control station. The restrictions help law enforcement distinguish between lawful and unauthorized operations by establishing clear legal boundaries.
Why the Decade-Long Delay?
Section 2209 was enacted in July 2016 with an original deadline of January 2017. The nearly ten-year gap between mandate and action reflects the complexity of balancing competing interests:
Security vs. Innovation Tension The FAA has struggled to craft rules that protect sensitive facilities without stifling the commercial drone industry. The proposal attempts this balance by allowing transit rights for commercial operators while creating clear restrictions for unauthorized activity.
Executive Order Pressure President Trump's June 6, 2025 executive order "Restoring American Airspace Sovereignty" directed the FAA Administrator to promptly submit the NPRM and promulgate a final rule as soon as practicable. This White House pressure clearly accelerated the timeline.
Documented Security Incidents The rulemaking comes amid a documented rise in security incidents involving rogue drones at critical infrastructure sites, including attempts to disrupt electrical grid infrastructure, unauthorized surveillance of chemical and energy facilities, and use of drones to deliver contraband to correctional facilities.
Industry Reaction: Divided but Engaged
Early responses from stakeholders reveal the predictable divisions:
Infrastructure Operators Supportive Groups representing critical infrastructure operators have generally welcomed the proposal. The ability to directly petition for airspace restrictions — rather than working through government sponsors — represents a significant procedural improvement.
Commercial Drone Industry Cautious The Commercial Drone Alliance and AUVSI have expressed measured responses. While acknowledging legitimate security concerns, both organizations have raised questions about the waiver process timeline and potential for overly broad facility designations. CDA has actively urged members to participate in the comment period.
Counter-UAS Community Watching Closely The proposal deliberately does not create new counter-UAS authority or authorize jamming, spoofing, or interdiction technologies. That separation between airspace designation and counter-drone authority remains legally distinct, leaving counter-UAS advocates pushing for parallel regulatory action.
State-Level Parallel Developments
The federal rulemaking isn't happening in a vacuum. Florida provides a notable example of state-level action: its recently enacted Unmanned Aircraft Systems Act prohibits knowing or willful drone operation over critical infrastructure facilities, with violations potentially prosecuted as third-degree felonies. This creates a layered regulatory environment where operators must navigate both federal and state restrictions.
The Comment Period: A Critical Window
The FAA is accepting public comments through July 6, 2026 — a 60-day window that industry observers consider relatively short given the rule's scope. The FAA has specifically requested input on several key questions:
- Whether the 16-sector categorization model is appropriate
- What additional facility types should qualify
- What additional UAS operations should be allowed through UAFRs
- The economic impact on commercial operators if transit rights are restricted
Stakeholders across aviation, infrastructure, public safety, and UAS sectors should strongly consider participating while the framework is still being shaped.
Timeline and Next Steps
After the comment period closes July 6, the FAA will review submissions and potentially revise the proposal before issuing a final rule. Given the significance and divided stakeholder reactions, the process will likely take 12-18 months minimum. The June 2025 executive order directed the agency to move "as soon as practicable," but regulatory due diligence takes time.
For operators, the key actions now are:
- Review the NPRM — The full 181-page document and supporting materials are available through the Federal Register
- Assess operational impact — Identify whether your regular flight areas include facilities that might petition for UAFRs
- Consider commenting — The comment period is the opportunity to shape the final rule
- Monitor B4UFLY updates — Approved restrictions will eventually appear in FAA airspace information systems
Bottom Line
The Section 2209 NPRM represents a meaningful expansion of drone flight restrictions, but it's not the operational catastrophe some operators fear. The petition-based system provides flexibility, transit rights preserve commercial operations, and the timeline allows for adaptation.
The bigger picture is that drone regulation is maturing. The industry is moving from Wild West permissiveness toward structured frameworks that balance innovation with security. Smart operators will engage with this process rather than resist it — because the direction of travel is clear, and early engagement produces better outcomes than late opposition.
