No-Fly Zones for Drones: FAA Proposes New Rules Over Critical Infrastructure

Overview

On May 6, 2026, the Federal Aviation Administration (FAA) published a long-awaited Notice of Proposed Rulemaking (NPRM) that would create a formal process for designating drone-free zones — known as Unmanned Aircraft Flight Restrictions (UAFRs) — over critical infrastructure facilities. The proposed rule has significant implications for the entire drone ecosystem. Facility operators across a broad range of industries would gain a potential pathway to restrict unauthorized drone access to their airspace, while commercial drone operators and companies that rely on UAS services face new compliance obligations, operational constraints, and potential criminal liability in designated zones.

With the comment period closing on July 6, 2026, this rulemaking presents an important opportunity for all stakeholders — including both facility operators and UAS operators — to shape the final rule before it takes effect.

Background

Congress first directed the FAA to create this framework in 2016 through Section 2209 of the FAA Extension, Safety, and Security Act (FESSA). A decade later, the FAA has now proposed a process to implement this directive by creating UAFRs, designated volumes of airspace with defined lateral and vertical boundaries where drone operations are restricted. A UAFR is a regulatory designation, not a physical countermeasure: a UAFR does not authorize facility owners to detect, intercept, or disable drones. Such capabilities require separate legal authorities. The NPRM proposes two UAFR types:

• A Standard UAFR restricts unauthorized drone operations within defined airspace on a continuous or part-time basis.
• A Special UAFR imposes heightened restrictions at sites facing credible safety or security threats, requires federal agency endorsement, and may carry criminal penalties for violations tied to national or homeland security.

Key Takeaways and Practical Implications

• Compliance required even within restricted airspace. Operators are not categorically barred from UAFRs but must broadcast Remote Identification (Remote ID), transit in the shortest practicable time, and provide advance notice to the FAA and facility manager — with potential criminal penalties for violations in zones tied to national security or homeland security designations.
• Broad eligibility across 16 sectors. Eligibility is tied to the 16 critical infrastructure sectors identified in National Security Memorandum 22 (NSM-22), including Chemical, Energy, Communications, Financial Services, Healthcare and Public Health, Transportation Systems, and others. Facilities must be permanent, non-mobile structures that qualify as “critical infrastructure” under federal law, contain assets vulnerable to drone threats, and demonstrate that damage or disruption would have regional or national-level consequences. Many facilities may qualify under more than one sector, providing multiple pathways to eligibility. Criteria for two sectors — Food & Agriculture and Water & Wastewater Systems — are reserved pending public comment, meaning the pool of eligible facilities could grow further.
• Security prerequisites. Applicants must demonstrate existing protective security measures, including restricted access, designated security personnel, monitoring systems, and the ability to receive Remote ID broadcasts from nearby drones.
• Defined boundaries. A UAFR’s lateral boundary may not extend beyond the applicant’s property lines. The vertical ceiling is generally capped at 400 feet above ground level (AGL), with a limited exception for structures exceeding 300 feet AGL.
• Application and review process. Applicants must submit documentation through a web-based portal, including evidence of drone activity near the facility within the prior 24 months, vulnerability assessments, and an explanation of how the UAFR fits within existing security plans. Upon conditional approval, the FAA will publish the proposed UAFR in the Federal Register for a minimum 30-day public comment period before issuing a final determination. Denied applicants may petition for reconsideration within 30 days.
• Not an absolute ban on drones. Certain authorized drone operations — including those under FAA Parts 91, 107, 108, 135, and 137 — may still occur within a UAFR, provided the operator broadcasts Remote ID, transits in the shortest practicable time, and provides advance notice to the FAA and facility manager. Facility managers may not approve, disapprove, or otherwise restrict compliant operations.
• Duration and cost. Each UAFR has a term of up to five years, renewable for additional five-year periods. Material changes must be reported to the FAA within five business days, and annual reports on drone activity within the restricted airspace are required.

Action Items and Outlook

• Assess eligibility and impact. The 16-sector framework is broad. Facility operators should promptly review the sector-specific criteria in the NPRM to determine whether any sites may qualify — and under which sector(s). UAS operators should evaluate their current and planned flight paths against the categories of facilities likely to seek UAFRs, and assess the potential operational and compliance impact on their businesses.
• Submit comments by July 6, 2026. The comment period is a key opportunity to influence the final rule. Areas likely to generate significant stakeholder input include eligibility criteria, boundary limitations, notification and reporting obligations, and the treatment of permitted operations within a UAFR.
• Begin preparing documentation. The application process will require detailed supporting materials. Facilities anticipating a UAFR application should begin compiling drone activity data, vulnerability assessments, and security plans now. UAS operators who anticipate that their flight paths may be affected by potential UAFRs should begin documenting current operations, assessing alternative routes, and evaluating the costs and logistical implications of compliance with advance notice and transit requirements.
• Understand the limits. A UAFR is a regulatory tool — not a technological solution. Any active drone detection or mitigation capabilities must be pursued through separate legal authorities.

The Crowell Transportation team can assist clients in evaluating the impact of the proposed rule, preparing public comments, and developing compliance strategies. We will continue to monitor the Part 74 rulemaking process as it develops.