ISO 21384-3:2026

• Abstract:

  This document specifies the requirements for safe commercial operations of uncrewed aircraft system (UAS), including the external safety-critical service providing command and control (C2) Link. This document applies to all commercial UAS regardless of size, application or location and represents the international best practice for the safe commercial operation of any UAS.

• Status: Published
• Publication Date: 06-Aug-2026
• ICS: 49.020 - Aircraft and space vehicles in general
• Technical Committee: ISO/TC 20/SC 16 - Unmanned aircraft systems
• Drafting Committee: ISO/TC 20/SC 16/WG 3 - Operations and procedures
• Current Stage: 6060 - International Standard published
• Start Date: 07-Aug-2026
• Due Date: 27-Nov-2026
• Completion Date: 07-Aug-2026

• Revises: ISO 21384-3:2023 - Unmanned aircraft systems — Part 3: Operational procedures
• Effective Date: 16-Dec-2023

Overview

ISO 21384-3 - Uncrewed Aircraft Systems – Part 3: Operational Procedures is an international standard established by ISO/TC 20/SC 16. This standard outlines comprehensive requirements for the safe operation of commercial uncrewed aircraft systems (UAS), with specific attention to operational procedures and the management of critical external services such as the command and control (C2) link. Applicable to all commercial UAS regardless of size, application, or operating environment, ISO 21384-3 provides globally recognized best practices for managing risk, ensuring safety, and supporting compliance within the rapidly evolving drone industry.

Key Topics

• Operational Safety Management
  The standard requires UAS operators to implement robust safety management systems (SMS), tailored to the specific risk category of their UAS operations (open, specific, or certified). These systems should address risk assessment, safety policies, monitoring, and continuous improvement.

• Security and Data Protection
  Procedures for data protection must be established, ensuring compliance with information security management systems (ISMS) as described in ISO/IEC 27001. Security protocols address the protection of personnel, data, and operational integrity.

• Command and Control Link (C2 Link)
  ISO 21384-3 highlights the need for a reliable, safety-critical C2 link provided by an external communications service provider, establishing performance expectations and service level agreements (SLAs) for safe UAS command and control.

• Personnel Roles and Qualifications
  Clear responsibilities are defined for key personnel such as Compliance Monitoring Officers (COMO), Safety Officers (SAFO), remote pilots, fleet managers, and visual observers. The standard emphasizes competence, training, and documented procedures.

• Airspace Compliance and Operations
  Operators must comply with airspace regulations, registration, remote identification, and ensure operational compatibility. This includes special considerations for operations above certain altitudes and within regulated zones.

• Risk-Based Operational Categories
  Operational procedures are harmonized across the "open," "specific," and "certified" risk categories, reflecting international practices from ICAO and JARUS, and taking into account factors such as MTOM (maximum take-off mass), flight type (VLOS, BVLOS), and risk to third parties.

• Maintenance and Conflict Management
  Maintenance requirements for hardware and software, configuration management, and established protocols for conflict management and collision avoidance are included, ensuring both proactive and reactive safety measures.

Applications

ISO 21384-3 is essential for organizations involved in:

• Commercial UAS Operations
  From aerial photography and inspection services to logistics and infrastructure monitoring, operators must align with these requirements to ensure safe and compliant operations.

• UAS Service Providers
  Entities providing command and control, maintenance, and other operational support services play a critical role in the ecosystem and are required to meet specified safety and quality standards.

• Aviation and Airspace Authorities
  Policy makers and regulators can reference ISO 21384-3 to harmonize UAS operational procedures with manned aviation and maintain public safety.

• UAS Personnel Training
  Training programs for remote pilots, fleet managers, and support staff rely on these guidelines for up-to-date competence requirements and best practices.

Related Standards

For comprehensive compliance and integration, ISO 21384-3 should be used alongside related standards, including:

• ISO 21384-4: Uncrewed Aircraft Systems - Part 4: Vocabulary
  Standardizes terminology for consistent communication.

• ISO 23629-12: UAS Traffic Management (UTM) - Part 12: Requirements for UTM Service Providers
  Defines requirements for UTM systems, which manage and integrate low-altitude UAS operations.

• ISO 23665: Uncrewed Aircraft Systems - Training for Personnel Involved in UAS Operations
  Establishes training and qualification criteria for UAS personnel.

• ISO/IEC 27001: Information Security Management Systems
  Provides frameworks for protecting sensitive operational and personal data.

In summary: ISO 21384-3 establishes the global benchmark for risk-aware, safe, and efficient commercial UAS operations, supporting regulatory compliance, operational reliability, and the sustained growth of drone applications worldwide.

International
Standard
ISO 21384-3
Third edition
Uncrewed aircraft systems —
2026-08
Part 3:
Operational procedures
Reference number
© ISO 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 4
5 Safety and security . 6
5.1 General .6
5.2 Safety.6
5.2.1 Safety policy .6
5.2.2 Requirements for operators conducting UAS operations in open category .6
5.2.3 Additional requirements for operators conducting UAS operations in specific
category .7
5.2.4 Additional requirements for operators conducting UAS operations in certified
category and for C2CSP .8
5.2.5 Tasks of the COMO .8
5.2.6 Tasks of the SAFO .9
5.3 Security .10
5.3.1 Requirements for operators conducting UAS operations in open category .10
5.3.2 Additional requirements for operators conducting UAS operations in the
specific category .10
5.3.3 Additional requirements for operators conducting UAS operations in the
certified category or equivalent and for C2CSP .11
5.3.4 Tasks of the SECO . 12
6 Data protection — Operator requirements .12
7 UAS operator .13
7.1 Documentation . 13
7.1.1 Documents held by the UAS operator . 13
7.1.2 Documents to be available at the point of operations .14
7.2 Insurance .14
8 Airspace . 14
8.1 Compliance with airspace regulations .14
8.2 Airspace information .14
8.3 Operations above 500 ft (150 m) . 15
8.4 Special zones at very high flight levels (FL) 600 . 15
8.5 Registration . 15
8.6 UA identification . 15
8.7 Compatibility . 15
9 Operations .15
9.1 Flight operations . . 15
9.2 Operational plan — Flight planning .16
9.3 Flight preparation . .16
9.3.1 Pre-flight inspections .16
9.3.2 Communication planning .17
9.4 In flight operations .18
9.4.1 Responsibilities of the remote pilot in command (RPIC) .18
9.4.2 Operational limitations .18
9.4.3 Transfer of functions and responsibilities .18
9.4.4 Multiple UA operation .19
9.4.5 Autonomous operations .19
9.4.6 Communication and airborne functions for UTM . 20

iii
9.4.7 Operations at night . 20
9.4.8 Surface or ground operations .21
9.4.9 Journey log .21
9.4.10 Contingency and emergency procedures . 22
9.5 External services . 22
9.5.1 UAS functions interacting with UTM . 22
9.5.2 Oversight of contracted service providers . . 22
9.5.3 C2 communication service provider (C2CSP) . 23
9.6 Personnel qualification and management . 26
9.6.1 General . 26
9.6.2 Fleet manager (FM) and flight operations officer (FOO) — Tasks .27
9.6.3 Visual observers (VO) — Tasks . 29
9.6.4 Competence . 30
9.6.5 Currency .32
9.6.6 Qualification and training .32
10 Maintenance .33
10.1 General . 33
10.2 Hardware updates . 33
10.3 Software updates . 34
10.4 Service release . 34
10.5 Configuration management . 34
11 Conflict management .34
11.1 General . 34
11.2 Separation provision and collision avoidance . 34
11.3 Operational procedure . 35
Annex A (normative) Privacy etiquette .40
Annex B (informative) External services . 41
Annex C (informative) Levels of automation.42
Bibliography .45

iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO document should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a)
patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent
rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a)
patent(s) which may be required to implement this document. However, implementers are cautioned that
this may not represent the latest information, which may be obtained from the patent database available at
www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 20, Aircraft and space vehicles, Subcommittee
SC 16, Uncrewed aircraft systems.
This third edition cancels and replaces the second edition (ISO 21384-3:2023), which has been technically
revised.
The main changes are as follows:
— harmonization with the three risk-based categories of UAS operations described in Reference [24];
— introduction of new personnel tasks in 9.6 in relation to fleet manager (FM) and visual observers (VO).
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.

v
Introduction
This document outlines requirements for uncrewed aircraft (UA) operational procedures which, when
applied together with any other current and future standard on uncrewed aircraft systems (UAS), form a
robust UA safety and quality standard.
This document refers to the three risk-based categories of UAS operations introduced by the Joint Authorities
[21]
for Rulemaking on Unmanned Systems (JARUS) enshrined by ICAO in Reference [24]. Assigning a UAS
operation to a category (or subcategory in jurisdictions where they exist) typically considers the maximum
take-off mass (MTOM), the maximum dimensions of the airframe, the type of operations (i.e. VLOS, EVLOS
or BVLOS), the risk for third parties on the ground normally driven by the density of population and the risk
for third parties in the air, which is also influenced by the airspace classes defined in Reference [25].
The principles of these three risk-based categories are summarized in Table 1 and can be applied also in
jurisdictions where the three risk-based categories are not implemented, but the taxonomy is based, for
example, on aircraft MTOM and type of operations.
Table 1 — Main features of the three risk-based categories of UAS operations
Category Open Specific Certified
MTOM In most jurisdictions 25 kg Unlimited Unlimited
High risk (i.e. comparable to
Risk for third parties on the Medium risk or regulated
Low risk commercial aircraft opera-
ground and in the air lower risk
tions with pilot on board)
Governmental non-military
Governmental non-military
Professional non-commer-
Professional non-commer-
Recreational
cial
cial
Governmental non-military
Commercial including
Commercial including
Professional non-commer-
aerial work, transport of
aerial work, transport of
Purpose
cial
freight, spraying, releasing
freight, spraying, releasing
substances or objects, but
Commercial including
substances or objects, one
also transporting people
aerial work or transport of
pilot to several aircraft,
on-board for commercial or
freight
autonomous operations
non-commercial air trans-
without pilot
port
VLOS
VLOS
EVLOS
Type of operations VLOS EVLOS
BVLOS
BVLOS
International IFR
Required with possible
minor exceptions Depend-
ing on the jurisdiction, reg-
Required
Always required, but de-
istration can be required
Registration pending on jurisdiction as
In most jurisdictions only
for the UA or for the UAS
in the open category
for the UA
operator or for both
In no jurisdiction registra-
tion of the RPS is required
Required possibly using
Remote (electronic) identi- Required with possible
Required conventional aviation equip-
fication minor exceptions
ment (e.g. ADS-B)
Required as proactive,
Risk assessment by UAS predictive and inter-organi-
Not required Required
operator zational safety management
by operator
NOTE The registration process is different from the operational authorization process; and the latter is a regulatory safety
approval, different from the administrative approval by the geozone manager, if applicable and from the airspace authorization
issued by traffic management services.

vi
TTabablele 1 1 ((ccoonnttiinnueuedd))
Category Open Specific Certified
Required and including
Means of evidence of ap-
Not required Required certificates by aviation
plied mitigations
authorities
Established case-by-case Established case-by-case
Conditions and limitations Established by regulations based on the risk assess- based on the risk assess-
ment ment
Demonstrated through
Declaration of Conformity
Demonstrated through signed by UAS manufac-
Declaration of Conformity turer or, for higher risk, by
Airworthiness of UA TC and individual CofA
signed by UAS manufac- design verification (DV) or
turer type certificate (TC) and
individual certificate of
airworthiness (CofA)
Required.
It may have different de-
nominations, different from
UPL and depending on the
Required but issuance often Required but issuance often
type of operation in the cer-
UAS pilot licence (UPL) delegated to a recognized delegated to a recognized
tified category [e.g. remote
entity entity
pilot licence (RPL) for inter-
national RPAS operations
under IFR in conformance
with ICAO standards].
Operational authorization
for one or a series of UA Not applicable Possible Not applicable
flights
Mandatory in several juris-
UAS operator certificate Not applicable Voluntary
dictions
Authorization by geozone
manager to enter specific Possible Possible Possible
areas
The process for airspace
authorization is normally
not applicable, but in some
Airspace authorization to jurisdictions geozones Possible under specified
Required
enter controlled airspace are established to permit conditions
access to some portions of
controlled airspace also to
the open category
International (i.e. entering Not applicable, unless Not applicable, unless ena-
the sovereign airspace of enabled by agreements bled by agreements among Possible on the basis of the
State(s) different from the among States by regionally States by regionally applica- Chicago Convention
take-off State) applicable legislation ble legislation
Flights above high seas
without entering sovereign Possible Possible Possible
airspace of a second State
NOTE The registration process is different from the operational authorization process; and the latter is a regulatory safety
approval, different from the administrative approval by the geozone manager, if applicable and from the airspace authorization
issued by traffic management services.
This document is structured in a way to provide a logical pathway from core principles to specific
requirements, applicable in jurisdictions where the three risk-based categories are implemented or
elsewhere.
vii
International Standard ISO 21384-3:2026(en)
Uncrewed aircraft systems —
Part 3:
Operational procedures
1 Scope
This document specifies the requirements for safe commercial operations of uncrewed aircraft system
(UAS), including the external safety-critical service providing command and control (C2) Link.
This document applies to all commercial UAS regardless of size, application or location and represents the
international best practice for the safe commercial operation of any UAS.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO 21384-4, Uncrewed aircraft systems — Part 4: Vocabulary
ISO 23629-12:2022, UAS traffic management (UTM) — Part 12: Requirements for UTM service providers
ISO 23665, Uncrewed aircraft systems — Training for personnel involved in UAS operations
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 21384-4 and the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
C2 Link communications service provider
C2CSP
entity which provides a portion of or all of the C2 Link (3.4) service for operation of an UAS
Note 1 to entry: The definition is adapted from Reference [16].
3.2
designated operational coverage
DOC
volume where the C2 Link QoSD (3.10) meets the C2 Link (3.4) specified performances and supports the
corresponding intended UAS operations
Note 1 to entry: The definition is adapted from Reference [16].

3.3
collision avoidance
third layer of conflict management which activates when the separation mode has been compromised
Note 1 to entry: The definition is adapted from Reference [17].
3.4
C2 Link
command and control link service
telecommunication service provided for the purpose of supporting command and control of the aircraft
Note 1 to entry: The definition is adapted from Reference [16].
Note 2 to entry: The C2 Link is not a tangible product, therefore it cannot be subject to product verification procedures.
3.5
crew resource management
CRM
utilization of all resources available to the crew to manage human error
3.6
DAA system
detect and avoid system
system that supports the remote pilot to see, sense or detect conflicting traffic or other hazards and take the
appropriate action
3.7
external service
service and related provider, necessary for the safety of the UA flight or safety of UAS operations,
encompassing:
a) command and control link communication service provider (C2CSP) (3.1);
b) other operation support services, whose purpose is to support a single flight but not to manage traffic;
c) UTM services;
d) services at vertiports
Note 1 to entry: The definition is adapted from Reference [20].
Note 2 to entry: Additional information on external services is provided in Annex B.
Note 3 to entry: Only the safety critical C2CSP is covered in this document.
Note 4 to entry: UTM services and non-safety-critical operation support services are covered in ISO 23629-12.
3.8
fleet manager
person designated by the operator to execute specific functions associated with the operational control
system of the UAS operator
Note 1 to entry: The terms UAS operator or operator are equivalent in this document and they refer to the organization
employing the remote pilots and other personnel, as defined in ISO 21384-4.
3.9
quality of service
QoS
totality of the characteristics of an entity that bear on its ability to satisfy stated and implied needs
Note 1 to entry: The definition is adapted from Reference [16].

3.10
quality of service delivered
QoSD
statement of the QoS (3.9) achieved or delivered to the UAS operator by the C2 Link communications service
provider (C2CSP) (3.1)
Note 1 to entry: The definition is adapted from Reference [16].
3.11
quality of service experienced
QoSE
statement expressing the QoS (3.9) that remote pilots believe they have experienced
Note 1 to entry: The definition is adapted from Reference [16].
3.12
quality of service required
QoSR
statement of the QoS (3.9) requirements of the UAS operator to the C2 Link communications service provider
(C2CSP) (3.1)
Note 1 to entry: The definition is adapted from Reference [16].
3.13
remain-well-clear
ability to detect, analyse and manoeuvre in order to ensure that a UA is not being operated in such proximity
to other aircraft as to create a collision hazard
3.14
remote pilot in command
RPIC
pilot designated by the operator as being in command and charged with the safe conduct of a flight
3.15
safety assurance
set of activities providing for system monitoring, measuring, assessment, and corrective action to assure
the effectiveness of risk controls
3.16
safety management system
SMS
systematic approach to managing safety, including the necessary organizational structures, accountabilities,
policies and procedures
Note 1 to entry: The definition is adapted from Reference [12].
3.17
safety promotion
set of activities providing guidance for training and communication to promote safety as a core value in the
organization
3.18
safety risk management
SRM
set of activities using task analysis, hazard identification, risk analysis, and risk assessment to develop risk
controls
3.19
separation provision
second layer of conflict management and tactical process of keeping aircraft away from hazards by at
least the appropriate separation minima which is only used when strategic conflict management (3.21) (i.e.
airspace organization and management, demand and capacity balancing and traffic synchronization) cannot
be used efficiently
Note 1 to entry: The definition is adapted from Reference [17].
3.20
service level agreement
SLA
enforceable agreement between the C2 Link communications service provider (C2CSP) (3.1) and the UAS
operator covering the safety, performance, coverage and security of the C2 Link (3.4) provision as required
for the RPAS operator’s intended operations
Note 1 to entry: The definition is adapted from Reference [16].
3.21
strategic conflict management
first layer of conflict management that is achieved through the airspace organization and management,
demand and capacity balancing and traffic synchronization components
Note 1 to entry: The definition is adapted from Reference [17].
3.22
uncrewed aircraft accident
occurrence associated with the operation of an uncrewed aircraft which takes place between the time the
aircraft is ready to move with the purpose of flight until it comes to rest at the end of the flight and the
primary propulsion system is shut down, in which:
a) a person is fatally or seriously injured as a result of direct contact with any part or exposure to any
emission of the UA or other component of the UAS, including parts which have become detached from
the aircraft; or
b) the aircraft sustains damage or structural failure which prevents safe operation
3.23
uncrewed aircraft incident
occurrence, other than an uncrewed aircraft accident (3.22), associated with the operation of an aircraft
which affects or can affect the safety of operation, including the loss of uncrewed aircraft
3.24
VLL
very low level
airspace below the minimum heights for VFR traffic as established by the competent authority
4 Abbreviated terms
ADS-B automatic dependant surveillance - broadcast
AIS aeronautical information service
ANSP air navigation service provider
ATC air traffic control
ATS air traffic service
BVLOS beyond visual line-of-sight

CofA certificate of airworthiness
COMO compliance monitoring officer
DAL design assurance level
DG dangerous goods
DV design verification
ERP emergency response plan
EVLOS extended visual line-of-sight
FD flight dispatcher
FM fleet manager
FOO flight operations officer
FW firmware
FOD foreign object debris
GNSS global navigation satellite system
HAIKU Human AI teaming Knowledge and Understanding
IFR instrument flight rules
ISMS information security management system
JARUS Joint Authorities for Rulemaking on Unmanned Systems
MCM maintenance control manual
MEL minimum equipment list
NOTAM notice to airmen
OEM original equipment manufacturer
PIC pilot in command
RF radio frequency
RPS remote pilot station
SAFO safety officer
SECO security officer
SW software
TC type certificate
UA uncrewed aircraft
UAS uncrewed aircraft system
UTM UAS traffic management
VLL very low level
VLOS visual line-of-sight
VO visual observer
5 Safety and security
5.1 General
UAS operators and providers of external services shall be aware of their responsibilities for safety and
security, including information security, regardless of the type or size of UAS operated or category of
operation.
Comprehensive SMS and ISMS, which are process-oriented approaches to managing safety and security
throughout an organization, can be required as specified in 5.2 and 5.3.
NOTE 1 Safety management systems for occupational health and safety of the personnel are defined in ISO 45001.
NOTE 2 Information security management systems are described in ISO/IEC 27001.
NOTE 3 Aviation safety management, as defined in Reference [12], has instead the purpose of protecting the safety
of third parties, in the air or on the ground, during UAS operations.
5.2 Safety
5.2.1 Safety policy
A safety policy shall be defined for UAS operators and providers of external services to accomplish their
goals. Human error in UA operation and supporting system management can be controlled by a safety policy.
The policy shall be complemented by procedures and organizational structures for safety risk management,
safety assurance and safety promotion.
5.2.2 Requirements for operators conducting UAS operations in open category
All operators conducting UAS operations in VLOS in the open category or equivalent shall:
a) appoint a person as COMO;
b) appoint a person as SAFO;
c) designate the COMO and the SAFO based on professional qualities and expert knowledge of laws,
regulations and practices on safety of uncrewed aviation and the ability to fulfil tasks respectively
referred to in 5.2.5 and 5.2.6;
d) train and qualify personnel on safety matters related to intended operations;
e) establish procedures for prescriptive safety including as a minimum:
1) monitor and assess changes to regulations which can affect operations;
2) establish evidence that all applicable regulations are complied with;
f) establish procedures to support reactive safety through:
1) maintain records of any operational activity for at least three months (can be longer if required
by regulations or because the State authority competent for the matter has opened an accident or
incident investigation);
2) provide in a timely manner any information required by the authority;
g) establish procedures for proactive safety including as a minimum:
1) the possibility for staff, customers, subcontractors or other partner SPs to report any relevant and
perceived safety occurrence;
2) mandatory reporting of safety occurrences to the competent authority, based on applicable
regulations;
3) voluntary reporting to the competent authority of any additional and relevant observed safety
occurrence, in a manner that would allow a further safety analysis by the authority, if deemed
appropriate by the latter;
4) collection of received or originated safety occurrence reports;
5) timely feedback to originators of the report;
6) storage of received or originated safety occurrence reports;
7) protection of related information, in particular identity of the author of the report, in accordance
with Annex A;
8) dissemination of safety information to involved personnel and affected stakeholders;
9) taking decisions, implementing and monitoring effect of corrective actions originated by received
reports;
NOTE 1 The COMO or SAFO can be or not be employees of the UAS operator.
NOTE 2 A single COMO or single SAFO can perform such a function on behalf of several organizations, providing
that no conflict of interest arises.
NOTE 3 A single physical person can perform both the function of COMO and of SAFO.
5.2.3 Additional requirements for operators conducting UAS operations in specific category
In addition to 5.2.1 and 5.2.2, all operators conducting UAS operations in the specific category or equivalent
shall:
a) address the structure, responsibilities, processes and procedures that promote and establish an
environment and culture of continuing improvement and enhancement of safety;
b) not change configuration of the systems used for respective operations or the procedures thereof,
without prior evaluation of the related hazards, considering safety, security and privacy, and emerging
risks, complemented by verified implementation of the mitigations stemming from the evaluation;
c) control system configuration and operational procedures and manage changes, demonstrate and
document their compliance with applicable regulations, monitor actual application of such procedures
and maintain related records for at least two years;
d) establish procedures for predictive safety including as a minimum, safety assessment of any change
affecting operations; such safety assessment should include:
1) identification of the scope of the change;
2) verification that the foreseen change is compliant with applicable regulations;
3) identification of related hazards;
4) determination of the safety criteria applicable to the change;
5) risk analysis in relation to the harmful effects or improvements in safety related to the change;

6) risk evaluation and, if required, risk mitigation for the change to meet the applicable safety criteria;
7) verification that the change is in accordance with the scope that was subject to safety assessment,
and meets the safety criteria, before the change is put into operation;
8) acquisition of prior approval to implement the change, from the competent authority, when required
by regulations;
9) specification of the monitoring requirements necessary to ensure that the operations will continue
to meet the safety criteria after the change has been implemented.
e) establish procedures for interorganizational safety management, allowing exchange of safety
information with affected stakeholders.
NOTE 1 Further guidance on risk assessment for UAS operations is given in Reference [20].
NOTE 2 Procedures for managing changes can include analysis, calculations, simulation, laboratory testing,
regression testing for software or testing in real environment, as well as distribution of necessary information to
stakeholders and additional training for staff.
5.2.4 Additional requirements for operators conducting UAS operations in certified category and
for C2CSP
In addition to 5.2.1, 5.2.2 and 5.2.3, all operators conducting UAS operations in certified category or
equivalent and all C2CSP shall:
a) establish a manual containing all safety management procedures and reporting lines;
b) in the context of prescriptive safety, establish a system of periodical internal audits to demonstrate and
document compliance with applicable regulations and organizational procedures;
c) in the context of reactive safety, establish procedures for internal safety investigations on significant
safety occurrences;
d) as part of the inter-organizational processes for safety management, establish arrangements with other
relevant organizations (e.g. other aircraft operators, vertiport operators, UTM service providers) to
ensure continuous improvement of the safety of operations.
The arrangements with other organizations may include inter-organizational teams for joint safety
investigation, safety analysis and development of joint corrective action plans.
NOTE The safety management manual cannot be combined with other manuals of the organization.
5.2.5 Tasks of the COMO
The UAS operator or C2CSP shall ensure that the COMO receives any instructions regarding the exercise of
the tasks in this subclause only from the SP top management or from the competent State authorities.
The COMO shall not be dismissed or penalized by the organization for performing her or his tasks.
The COMO shall directly report to the highest management level of the operator or C2CSP organization.
The COMO shall be bound by secrecy or confidentiality concerning the performance of his or her tasks,
taking into account applicable legislation.
The COMO may fulfil other tasks and duties in the integrated management system, providing that any such
tasks and duties do not result in a conflict of interests. Therefore, the COMO may be responsible, for example,
for data protection or safety management, but not for operations or service provision, maintenance or other
activities related to production.

The COMO shall have at least the following tasks:
a) inform and advise the organization's top management and the employees who carry out tasks with
regulatory compliance implications of their obligations pursuant to applicable regulatory provisions;
b) monitor compliance with applicable legislation, with this document and with the policies of the operator
or C2CSP in relation to regulatory provisions, in the context of prescriptive safety management and
including the assignment of responsibilities, awareness-raising and training of staff involved in relevant
operations;
c) manage the related internal audits, if applicable, report the findings to the highest management level in
the organization, advice on corrective action plans and monitor implementation of corrective actions;
d) support possible audits or inspections by competent authorities and prepare responses to respective
protocol questions;
e) provide advice to the organization's top management where requested as regards regulatory
compliance;
f) act as the contact point for the authorities on issues relating to regulatory compliance;
g) to systematize and analyse working information, keep the necessary documentation and draw up
reports.
5.2.6 Tasks of the SAFO
The UAS operator or C2CSP shall ensure that the SAFO receives any instructions regarding the exercise
of the tasks in this subclause only from the organization's top management or from the competent State
authorities.
The SAFO shall not be dismissed or penalized by the organization for performing her or his tasks.
The SAFO shall directly report to the highest
...