Europe’s next drone rule update starts with a simple question: when a drone appears near an airport, power station, border, port or crowded public space, can authorities quickly tell whether it belongs there?
On 18 September 2026, the European Union Aviation Safety Agency published Opinion No 06/2026. The proposal would require Member States to verify a UAS operator’s identity before registration, lower the mass trigger for mandatory operator registration and direct remote identification from 250 g to 100 g, and tighten the framework for UAS geographical zones. The 100 g trigger is a 60% reduction in the current mass threshold.
Those changes are still proposals. EASA Opinions are submitted to the European Commission and are not binding rules until the EU legislative process produces adopted regulations. EASA’s own rulemaking guidance makes that status explicit.
Even so, the direction is difficult to miss. European drone regulation is moving beyond the earlier emphasis on keeping aircraft separated from people and manned aviation. Identity, accountability, data quality and the ability to sort cooperative traffic from unidentified traffic are taking a larger role.
What EASA Put On The Table
The September Opinion targets Implementing Regulation (EU) 2019/947 and Delegated Regulation (EU) 2019/945, the two central pieces of the EU civil UAS framework. EASA says the amendments respond to the European Commission’s February 2026 Action Plan on Drone and Counter Drone Security.
Identity Verification Changes The Registration System
Under the current framework, national registration systems already collect a natural person’s full name, date of birth, address, email address and telephone number. Legal persons provide their name and identification number, along with other required information. The September proposal adds a different layer: Member States would need to verify identity before registration is completed.
EASA has not, on the public summary page, prescribed one universal verification method. That detail matters for implementation. A national authority could need changes to its registration portal, digital identity workflow and checks for legal entities. Operators should therefore watch the final text rather than assuming a particular passport, eID or company-verification process.
From a security perspective, a verified registration record gives authorities a firmer link between the registration number transmitted by a cooperative aircraft and the person or organisation behind that registration.
The 100 g Threshold Reaches Further Into Small Drones
Current EU rules require an operator to register for open-category operations when the aircraft has a maximum take-off mass of 250 g or more, or can transfer more than 80 joules of kinetic energy in an impact. Registration is also required for a drone fitted with a sensor capable of capturing personal data unless it qualifies as a toy.
That sensor rule is an important detail. Plenty of popular camera drones below 250 g already bring their operators into the registration system. So the proposed 100 g threshold should not be read as if every 100-to-249 g camera drone is currently anonymous. The bigger regulatory expansion is that mass alone would pull more small aircraft into scope, while direct remote identification would reach further down the weight range.
For manufacturers, the design question becomes more demanding. A light aircraft that has traditionally sat in the C0 space may need identification functionality once the final rules and product requirements are settled. For operators with older aircraft, transition dates and retrofit provisions will be crucial. EASA already notes that stand-alone direct remote identification modules are available, though you should not assume a module will resolve every future compliance case until the adopted rules are published.
Europe Wants A Cleaner Picture Of Legitimate Drone Traffic
The security logic behind the proposal becomes clearer when you read the Commission’s February Action Plan. By the end of 2024, the EU drone ecosystem had passed two million registered operators, about 20% more than a year earlier. The Commission also forecasts the European commercial airborne drone segment at roughly €14.5 billion by 2030 and potentially more than €50 billion by 2033.
More legitimate operations create a practical screening problem for security teams. A sensor may detect a small aircraft near critical infrastructure, yet detection alone does not tell you whether it is an authorised inspection flight, a media crew, a contractor, a hobby pilot who has entered a restricted area, or a deliberately non-cooperative aircraft.
The Commission describes detection, tracking and identification as central to separating authorised operations from potentially malicious activity. Its plan calls for stronger registration and identification, better information sharing, and systems that combine several data feeds into a common operational view.
Remote ID Is A Cooperative Signal
Direct remote identification gives nearby receivers a digital broadcast from the aircraft. Under the existing EU product rules for classes that carry the function, the broadcast can include the UAS operator registration number, the aircraft’s unique serial number, a timestamp, the aircraft’s position and height, its course and ground speed, the remote pilot’s position or take-off point, and an emergency-status indication. The data is designed to be receivable by existing mobile devices within broadcast range.
EASA has also explained that members of the public can receive direct remote identification data, while the link from the operator registration number to a named person is reserved for enforcement authorities through the registration system. That separation is important for traceability without publishing the operator’s identity in the radio broadcast itself.
For a security team, compliant remote ID can act as a cooperative identification layer. It helps remove known traffic from the list that needs immediate investigation. An unidentified aircraft can then receive more attention from radar, radio-frequency sensors, optical cameras, acoustic sensors or other counter-UAS equipment.
Remote ID does not identify every hostile drone. A malicious operator may use modified hardware, disable compliant functions, spoof data or fly an aircraft built outside the normal regulatory chain. The Commission’s plan explicitly says detection of illegitimate drones requires a multi-sensor approach because small size, low altitude, terrain clutter and swarms can limit traditional radar.
The Security Context Has Become Harder To Ignore
The regulatory work started before the latest incidents, so no single event explains the September Opinion. Still, Europe’s security environment gives the proposal a very different tone from an ordinary technical update.
Germany, for example, said in September 2026 that an attempted attack at Leipzig/Halle Airport on 4 August involved an explosives-equipped drone and attributed the operation to Russian state-linked activity. Russia denied the accusation. Germany’s federal government described the incident as a serious security event and said the national threat assessment had been raised. The German government’s drone-security FAQ and Reuters’ report on the attribution provide the detail.
The Commission’s Action Plan takes a broader view. It cites hostile overflights, airspace violations, airport disruption, threats to critical infrastructure, external borders and public spaces. It has also put money behind counter-drone capability: a €150 million equipment call has supported uncrewed aerial and maritime surveillance, while a separate €250 million call published in December 2025 targeted stronger protection of the EU’s external borders, including drones and counter-drone systems.
There is a useful contrast in the aviation safety data. EASA’s Annual Safety Review 2025, covering 2024, reported no fatal accidents involving UAS, although occurrence reporting continued to rise. The new identification push therefore cannot be understood only through accident statistics. The policy concern now includes deliberate misuse, attribution and response.
Geographical Zones Are Becoming Part Of The Identification System
UAS geographical zones are already a core part of European operations. Member States can create areas where flights are prohibited, restricted or facilitated for safety, security, privacy or environmental reasons. Airports, military installations, hospitals, prisons, power facilities and protected areas are typical examples. EASA’s geo-zone guidance explains the current structure.
The problem is consistency. A cross-border operator may deal with different national portals, map formats, local conditions and update practices. The September Opinion proposes a national-conditions framework intended to improve the accessibility and consistency of geographical-zone information across the EU, while keeping Member States’ ability to establish zones.
The Commission has already set a timeline around this work. Its February plan called for improved availability of UAS geographical-zone information by the fourth quarter of 2026 and technical requirements for geofencing functionality by 2027.
Geo-awareness and geofencing are related, though they are not identical. Current EU class requirements can provide pilots with alerts about geographical restrictions. A future geofencing function could go further by technically preventing a compliant aircraft from entering a protected area under defined conditions. Better zone data is a prerequisite for either approach to work reliably across borders.
What The Proposal Could Mean For Operators
Your immediate obligations have not changed simply because EASA published an Opinion. The existing regulations remain the rules to follow until new EU acts are adopted and become applicable.
Still, operators can prepare for the direction of travel. If you fly aircraft between 100 g and 249 g, check the exact model, whether it has a camera or other personal-data sensor, its class marking and its current remote-ID capability. Keep your operator registration details accurate. Commercial operators with multiple fleets should also know which aircraft can accept a registration number in their direct remote identification system and which would depend on external modules or future manufacturer support.
Non-EU operators should watch this closely as well. Under current EASA guidance, a visitor who plans to operate in Europe registers in the first EASA Member State where they intend to fly, and that operator registration is then recognised across the EASA system. The registration number is displayed on relevant aircraft and uploaded to the remote identification system where required. EASA’s guidance for non-EU visitors sets out the current process.
Model aircraft clubs and associations are a special case. EASA says the September material allows alleviations for UAS operated within recognised model-aircraft clubs and associations, reflecting their established operating structures and lower-risk settings.
What Manufacturers And Service Providers Should Watch
For manufacturers, the lower threshold can affect product architecture, software and conformity work. Direct remote identification needs a secure way to accept the operator registration number, broadcast the required data and resist tampering. Smaller aircraft also have tight constraints on weight, power use, cost and internal space, so a rule that reaches down to 100 g is not a trivial hardware change.
Registration-platform providers and national authorities face a different workload: identity verification, interoperable data, operator support and dependable links between registration records and remote-ID broadcasts. Geographical-zone publishers will also need cleaner, more consistent digital information if future geo-awareness and geofencing functions are expected to use it.
There is an interesting policy balance here. EASA’s earlier May 2026 NPA 2026-103 combined security measures with broader simplification and estimated about 39% overall cost savings compared with the current framework for authorities, operators, manufacturers and training entities. The September Opinion focuses on security measures, yet the wider rulemaking programme is not simply adding paperwork across every part of drone regulation.
The Bigger Shift Is From Permission To Attribution
Europe’s first generation of harmonised drone rules answered operational questions: how heavy is the aircraft, where can it fly, how close can it get to people, what training does the pilot need, and which category applies?
The next layer asks who is operating the aircraft, whether that identity has been verified, what the aircraft is broadcasting, whether the flight matches the conditions attached to that place, and how quickly authorities can connect those pieces of information.
That is a change in regulatory emphasis. A compliant drone becomes easier to recognise as legitimate traffic. An aircraft that refuses to identify itself becomes more conspicuous in environments where authorities have access to better registration, zone and sensor data.
The practical payoff is not the identification rule in isolation. It comes from combining registration, verified identity, direct remote identification, geographical-zone information, U-space services and counter-UAS sensing. Each layer answers a different question. Together they give authorities a better basis for deciding which flight belongs in the airspace and which one needs investigation.
What Happens Next
EASA has sent the Opinion into the EU rulemaking process. The European Commission now considers the proposed amendments to the implementing and delegated regulations. The wording can still change before adoption, and application dates or transitional arrangements will determine how quickly operators and manufacturers must act.
For now, treat 18 September 2026 as a clear regulatory signal rather than a new compliance date. Keep following the rules already in force, track the Commission’s adoption process, and review any sub-250 g aircraft in your fleet that could be affected by a 100 g identification threshold.
Europe is building a system in which legitimate drone operations are expected to become easier to identify at the same time that non-cooperative operations attract more scrutiny. For anyone planning fleets, products or services for the European market, traceability is moving closer to the centre of the rulebook.
FAQs
Are The New 100 g Rules Already In Force?
No. EASA’s 18 September 2026 publication is an Opinion, so the existing EU rules remain in force until the European Commission adopts amendments and the relevant application dates arrive. Operators should follow current national and EU requirements in the meantime.
Will Every Drone Above 100 g Need Operator Registration?
The EASA proposal would lower the mass trigger for mandatory registration from 250 g to 100 g. The final legal text will define the exact scope, exceptions and transition arrangements, so operators should check the adopted regulation before making fleet decisions.
Do Sub-250 g Camera Drones Currently Avoid Registration?
No. Under current EU rules, a drone below 250 g can still require operator registration when it carries a sensor capable of capturing personal data and is not a toy. That is why many small camera-drone operators are already registered today.
What Does Direct Remote Identification Broadcast?
It broadcasts identification and flight data that can help nearby receivers recognise a cooperative drone. Existing EU class requirements can include the operator registration number, aircraft serial number, timestamp, position, height, course, ground speed, the remote pilot’s position or take-off point, and emergency status.
Can Remote ID Stop A Hostile Drone?
No. Direct remote identification is an identification mechanism for cooperative aircraft, not a complete counter-drone system. European security planning also relies on radar, radio-frequency sensing, optical and thermal systems, acoustic sensing, data fusion and other tools for non-cooperative aircraft.
What Should A European Drone Operator Do Now?
Keep following the rules already in force and review which aircraft in your fleet fall between 100 g and 249 g. Check registration status, class markings, remote-ID capability, national geographical zones and future manufacturer guidance as the Commission moves the proposal toward possible adoption.
