SORA for Drone Operators: A Practical Guide (2026)

SORA — Specific Operations Risk Assessment — is the risk methodology behind specific-category drone authorisations in Europe. In short: SORA is a structured assessment of ground and air risk that determines which requirements your operation must meet. If you fly beyond the limits of the open category and no standard scenario fits, this document is your route to approval.

This guide walks through the methodology step by step, covers what changed when SORA 2.5 entered the EASA framework, and explains how the application process works in practice.

What is SORA — and when do you need one?

The open category has hard limits: maximum 25 kg, visual line of sight (VLOS), below 120 metres, and never over assemblies of people. Cross any of those lines and your operation belongs in the specific category — which means documenting the risk before you fly.

Typical operations that require a specific-category authorisation:

• BVLOS — beyond visual line of sight, such as powerline inspection or wide-area mapping
• Flying above 120 metres, common for mast and wind-turbine inspection
• Operations near or over people beyond what A1/A2 allows
• Dropping payloads or other operations the regulation does not permit in the open category

The SORA methodology comes from JARUS and is EASA's acceptable means of compliance (AMC) to Article 11 of Regulation (EU) 2019/947. It is common to the whole EU/EEA, so an assessment built on the methodology is recognised by every European authority — with national additions where they exist.

Check the shortcuts first: STS and PDRA

Before starting a full SORA, check whether your operation fits a standard scenario (STS) or a pre-defined risk assessment (PDRA). STS-01 covers VLOS over a controlled ground area in a populated environment; STS-02 covers BVLOS with airspace observers over sparsely populated areas — both with C5/C6 class-marked aircraft. If your operation fits an STS, an operator declaration is enough and the entire SORA exercise disappears.

The PDRAs cover several common operation types with a ready-made frame where much of the analysis is already done. A full SORA is for operations that fit none of the boxes — and those are what the rest of this guide is about.

Step 1: Describe the operation (ConOps)

Everything starts with the concept of operations — ConOps. It defines what you fly, where, how high, with which aircraft, and with what crew competence. The ConOps is not paperwork for a drawer: every later judgement in the analysis points back to it, and if the operation changes, the assessment must be updated.

A good ConOps also describes the organisation — roles, responsibilities, maintenance routines, and training. If you already keep an operations manual and structured pilot and equipment records, much of the groundwork is done.

Step 2: Ground risk (GRC) and mitigations

The Ground Risk Class (GRC) expresses the danger to people on the ground. The starting point is set by the aircraft's size and energy combined with the scenario — VLOS or BVLOS, and whether the area is controlled, sparsely populated, or populated.

Risk can then be reduced with mitigations:

• M1 — strategic measures that reduce the number of people exposed, such as a controlled ground area
• M2 — measures that reduce the effect of an impact, typically a parachute
• M3 — an emergency response plan (ERP) that is rehearsed and documented

The result is a final GRC. The lower you get, the lighter the requirements in the rest of the assessment — which is why planning the operational area carefully pays off before any writing starts.

Step 3: Air risk (ARC)

The Air Risk Class (ARC) describes the likelihood of encountering manned aviation, from ARC-a (segregated airspace) to ARC-d (dense traffic). The starting point follows from where you fly: altitude, proximity to aerodromes, and airspace classification.

Strategic measures — timing, geographic limits, or agreements with local air traffic services — can lower the class. Whatever risk remains sets the TMPR, the tactical mitigation performance requirement: how you detect and avoid other traffic in flight. A map tool with zone and airspace layers makes this part of the job far easier to document.

Step 4: SAIL and the OSOs

Final GRC and residual ARC combine into a SAIL — Specific Assurance and Integrity Level, from I to VI. The SAIL determines how robust your organisation, equipment, and procedures must be, expressed through OSOs (Operational Safety Objectives).

The OSOs cover operator competence and procedures, maintenance, equipment reliability, and crew training, among other things. For each objective you demonstrate a level of robustness — low, medium, or high — and the higher the SAIL, the more evidence is required. This is where your flight logs, certificate register, and maintenance history become audit evidence: a SAIL II operation with tidy records is a manageable job, while gaps in the history make even simple applications heavy.

Step 5: Adjacent areas and containment

The assessment ends with what happens if the aircraft leaves the planned operational volume — containment. The adjacent area and airspace are assessed, and you must show that the probability of ending up there is low enough, if necessary with technical barriers such as geofencing and independent flight termination.

Everything is then collected into a comprehensive safety portfolio: the ConOps, the risk assessments, the mitigations, and the evidence for every OSO. That package is what the authority evaluates.

How the application works

You apply to your national aviation authority. EASA maintains the central SORA reference page; in Norway, the Civil Aviation Authority publishes English-language drone guidance and a detailed SORA 2.5 guide (in Norwegian). Expect processing times of several weeks, apply well before your planned start date, and budget for a fee.

A granted operational authorisation is valid for two years. Renewal comes around faster than you think: the documentation behind the application has to be maintained continuously, not reconstructed in a panic every second year.

What changed in SORA 2.5?

SORA 2.5 entered EASA's AMC material in the autumn of 2025 and now sits in the consolidated June 2026 edition of the Easy Access Rules for unmanned aircraft systems. The changes are good news for most operators:

• Less evidence for low-risk VLOS operations (SAIL II) — documentation requirements were reduced where the risk is genuinely low
• Softer containment requirements — keeping the aircraft inside the operational volume is now judged at a more proportionate level
• Clearer text — less room for interpretation means more consistent treatment from authority to authority

If you hold an older authorisation built on SORA 2.0, it remains valid for its period — but expect to submit against the 2.5 methodology at renewal. Check your authority's current guidance.

The documentation has to outlive the authorisation

A SORA is not finished when the authorisation is granted. The OSO evidence is a commitment: flight logs must be kept, certificates renewed before expiry, maintenance documented, and the emergency response plan rehearsed. At an inspection, what decides the outcome is whether your records still match what the application promised.

That is exactly what UAV-Planner is built for: SORA-aligned checklists and forms, flight logs with complete history, alerts before certificates expire, and CSV export when the authority asks for documentation. See pricing, or read the EASA compliance checklist and the drone fleet management guide for the rest of the compliance picture.