Operational Authorisation Explained for UK Drone Operators

An Operational Authorisation is the single document that turns a Specific Category flight plan into a legal flight. It is the permission slip the UK Civil Aviation Authority hands to a drone operator once that operator has proved, on paper, that the proposed operation can be run safely and within the UK regulatory framework.

The phrase gets thrown around loosely, and a lot of drone pilots end up thinking it is a qualification they earn, or a blanket ticket to go commercial. It is neither. It is an operator-level document, tightly scoped, and it is the one thing the CAA looks for when an audit lands on your desk.

An Operational Authorisation is the CAA's permission to run a Specific Category operation, and it is issued to the operator rather than the pilot

UK drone law splits every flight into one of three categories: Open, Specific, or Certified. The Open Category is the low-risk lane with no paperwork — the drone weight, the sub-category, and the distance rules do the work for you. The moment your proposed operation leaves that lane, you are in the Specific Category, and the Specific Category does not open without a CAA Operational Authorisation.

The authorisation itself is a PDF, issued to the UAS Operator, setting out the scope, conditions and limits of what that operator is allowed to do. It names the operator, it references the Operations Manual they submitted, and it spells out the activities that now sit inside their envelope — weight limits, altitude ceilings, distances, airspace constraints, Remote Pilot qualification requirements, insurance requirements, and so on.

This is the detail most people miss. An Operational Authorisation is not a pilot qualification. It belongs to the operator — the business or individual taking legal responsibility for the flight — and it is the operator who is audited, fined, or has the document revoked if things go wrong. The Remote Pilot sitting behind the sticks is a different role entirely, governed by a different article of the regulation, with a different set of duties.

Operator-level and pilot-level sit at different layers of UK drone law and it matters which one you are asking about

The cleanest way to read UK drone regulation is to separate the two roles and look at them in turn. The operator is the legal entity responsible for the operation — the sole trader, the limited company, the public body — registered with the CAA under an Operator ID. The operator holds the Operational Authorisation, holds the insurance policy, and holds the Operations Manual. The operator is named in the paperwork and is the party the CAA will take action against if the operation breaches the conditions in that paperwork.

The Remote Pilot is the individual flying the drone on a given day. That person needs a personal qualification appropriate to the operation — usually the General Visual Line of Sight Certificate, or an RPC-L1 for PDRA01 work, and one of the higher RPC levels for BVLOS operations. Those qualifications are owned by the individual and they travel with the person from one job to the next.

So the question "do I have an Operational Authorisation?" is really two questions. The operator side asks whether the business holds the CAA document. The pilot side asks whether the individual holds the qualification the document demands. Both have to be true on the day of the flight, and holding the pilot qualification without the operator authorisation gets you nowhere in the Specific Category.

There are two routes into an Operational Authorisation — PDRA01 off the shelf, or UK SORA for anything that does not fit

The CAA offers two application paths. The first is the Pre-Defined Risk Assessment route, and there is only one PDRA currently published in the UK. PDRA01 covers drones between 250 grams and 25 kilograms flown within Visual Line of Sight, anywhere in the UK subject to airspace restrictions, including residential, commercial, industrial and recreational areas. It is the authorisation almost every commercial drone operator applies for first, because the risk assessment has already been done for you and the application is effectively a box-ticking exercise against pre-agreed limits.

The second route is UK SORA, the Specific Operations Risk Assessment. UK SORA replaced the old Operating Safety Case method on 23 April 2025 and is the path you take when your proposed operation is outside the PDRA01 envelope. That includes BVLOS flight, operations above 120 metres, dropping items, swarm operations, flying close to crowds, or flying close to people with a drone that weighs 500 grams or more. A SORA application is a full risk assessment — you calculate the SAIL (Specific Assurance and Integrity Level) for the operation, set out the operational volume, ground risk buffer and adjacent area, and prove to the CAA that the mitigations match the risk.

A third document, the CAP 722 guidance, sits underneath both routes. It is the CAA's operating manual for the Specific Category and the document your ops manual leans on for occurrence reporting, accident reporting, maintenance, and every other area the authorisation references by pointer rather than by full text.

How the two routes compare

The authorisation only permits the specific operations written into your Operations Manual — and not a step beyond that

This is the bit that catches people out. An Operational Authorisation is not open-ended. Read a PDRA01 front to back and you will see that every single activity is either permitted inside a named limit or prohibited outright. The altitude cap is written in. The separation from uninvolved people is written in. The 500-metre range from the Remote Pilot is written in. If the operation you are about to fly is not inside those limits, the authorisation does not cover it, and the insurance policy attached to the authorisation will not cover it either.

Take the classic examples from inside PDRA01. You can fly within 150 metres of residential and commercial areas, which the Open A3 sub-category would not allow. You can operate day or night under the procedures in your Operations Manual. You can keep a 50-metre buffer from uninvolved people, reducing to 30 metres during take-off and landing. And you get the 1-to-1 rule applied to assemblies of people — horizontal separation from the assembly must not be less than the height of the drone.

What PDRA01 explicitly does not give you is permission to drop articles, permission to fly BVLOS, permission to carry dangerous goods, or permission to overfly assemblies of people. Those activities sit in UK SORA territory or are forbidden outright. The authorisation is narrow by design, and the CAA is clear that the scope is defined by the Operations Manual the operator has declared.

An Operational Authorisation is not a blanket commercial drone licence and it never has been

The myth worth killing here is the idea that a PDRA01 is a "commercial drone licence". It is not. Under the current UK regime, the same framework governs recreational and commercial flying — your Operational Authorisation is about the risk profile of the operation, not about whether money changes hands. A hobbyist flying a 25-kilogram drone close to houses needs the same authorisation as a business doing the same flight for a paying client.

The old Permission for Commercial Operations, or PfCO, was withdrawn at the end of 2020. That document was framed around commercial use and it does not exist any more. Anyone still describing themselves as "PfCO certified" is quoting a regime that has been closed for more than five years.

The other thing an Operational Authorisation does not give you is an exemption from everything else in UK drone law. You still need an Operator ID on every drone. Your Remote Pilot still needs a valid Flyer ID and the qualification the authorisation demands. You still need insurance that meets UK Regulation (EU) 785/2004. You still need airspace permissions for flight restriction zones and any other restricted airspace. And UK GDPR, trespass law, and local byelaws sit on top of all of it, with no drone-specific exemption.

The Operations Manual is the companion document and the Operational Authorisation is unreadable without it

A PDRA01 on its own is a short document. The weight it carries comes from the Operations Manual that sits alongside it. The CAA's recommended PDRA01 Operations Manual template is CAP 2606, and it is the document the CAA expects to see when an audit lands.

Your Operations Manual spells out every procedure the authorisation assumes you have in place — the safety policy, the insurance details, the named personnel, Remote Pilot competency and currency, pre-flight and in-flight procedures, the emergency response plan, maintenance schedules, occurrence and airprox reporting, and the logs and records you are required to keep. It is the document that turns "the operator declares they will operate within the conditions" into something a regulator can actually check.

Since the CAA streamlined the PDRA01 application, you no longer upload the Operations Manual at the point of applying. Instead, you self-declare that a valid manual exists and will be maintained. But the expectation that the manual is current, specific to your operation, and ready on request has not changed. If the CAA asks to see it and you cannot produce it, or it references procedures you are not actually following, your authorisation can be suspended or revoked.

An Operational Authorisation runs for 12 months and renewal is a deliberate step rather than an automatic one

PDRA01 is valid for 12 months from the date it is issued, and UK SORA authorisations run for a period set on the individual document. Neither renews itself. You can reapply for a PDRA01 from 28 days before the expiry date, and reapplying before the anniversary preserves the continuity of the authorisation with no break in cover.

The renewal fee mirrors the new application fee — 524 pounds a year for PDRA01, no VAT. The CAA typically issues a PDRA01 within 24 hours of application, though that is a service target rather than a guarantee, and UK SORA applications take longer because the assessment is bespoke. If your PDRA01 has already expired, you use the same reapplication service, but you must not fly under an expired authorisation — a lapsed PDRA01 is the same as no PDRA01, and any work you do in the gap falls outside the legal framework.

A couple of practical points that catch people at renewal time. PDRA01 authorisations cannot be transferred between Operator IDs — individual to organisation is a new application, not a change. Sole traders who want the authorisation issued in a trading name need an organisation Operator ID from the start. And at renewal, the CAA pre-fills the last year's answers; it is on you to update anything that has changed — the drones you operate, the accountable manager, the named personnel.

So that is the shape of an Operational Authorisation. It is an operator-level document, narrow in scope, defined by its companion Operations Manual, renewable once a year, and issued through one of two routes depending on whether your operation fits the pre-defined PDRA01 envelope or needs a full UK SORA risk assessment. It is the backbone of every UK commercial drone survey, drone roof inspection, and close-to-buildings shoot that you see filed as legal under UK law.

If you are weighing up whether PDRA01 will cover the kind of work you want to fly, the UK drone laws explainer is the next place to start, and the drone pilot qualifications overview unpacks how the pilot-level qualifications map onto each authorisation type.

Got a specific scenario you want covered — a borderline PDRA01 question, a UK SORA application problem, a commercial shoot you cannot work out how to legalise? Drop a note to peter@hiredronepilot.uk and I will come back to you directly. If you prefer the video version of this explainer, the comments are open on YouTube.