The long-awaited (and desperately needed) Notice of Proposed Rulemaking (NPRM) was finally published in the Federal Register on May 6th. The NPRM creates a new 14 CFR §74, establishes the process by which designated critical infrastructure facilities can apply for protected status, and defines who can fly over these sites and how those flights can be approved.
“2209” refers to Section 2209 of the FAA Extension, Safety, and Security Act of 2016. That section gave the FAA 180 days from enactment to establish a process allowing applicants to petition the FAA to prohibit or restrict unmanned aircraft operations near fixed-site facilities. And since the 2016 Act was enacted on July 15th, 2016, that makes this NPRM almost 3600 days late.
And one of the biggest consequences of that indefensible delay is that states started filling that void with their own critical infrastructure airspace laws. We all know states love stepping in when the federal government leaves a vacuum in UAS regulation. And so far, 25 states have done exactly that.
So what can we do as an industry?
Like all NPRMs, the public gets an opportunity to comment on the proposed rule and explain how it will affect their lives and businesses. More importantly, those of us actually operating in the field, the boots on the ground if you will, can provide the FAA with real-world insight about what works, what doesn’t, and what unintended consequences can be prevented in the Final Rule. We are the people best positioned to do exactly that.
Let’s break this NPRM down.
At the highest level, this actually isn’t a bad NPRM. It lays out the categories of critical infrastructure sites that can apply for designation, explains the application process, and defines two categories of secure sites called Unmanned Aircraft Flight Restrictions (UAFRs). The first category is the “Standard UAFR,” intended for facilities requiring a lower level of security protection. The second is the “Special UAFR,” which would apply to highly sensitive federal or supported sites and likely include DOD and national security facilities.
The NPRM also outlines who can operate over these sites and the process by which those operations can be approved.
And it limits what actions UAFR sites can take when it comes to controlling UAS in or near their sites.
UAFR Designations
Let’s start with the “Standard UAFR.” This is the category most facilities would likely fall under, and it would restrict drone operations near or above qualifying facilities, allow certain operational and transit exceptions, and be administered through an approval/notification process.
Most critical infrastructure application approvals would likely land in this category. Which is generally good news for the commercial UAS industry. That list could include:

- Electrical substations
- Power grids
- Railroad facilities
- Refineries
- Amusement parks
- Zoos
And this is exactly why industry comments matter. If every power line crossing or railroad corridor required individual approval or notification, that becomes a massive operational burden. But a practical “notify-and-fly” system for Standard UAFRs could work well here.
Next is the “Special UAFR.” This category is much more restrictive and would apply to especially sensitive federal or endorsed facilities. It would potentially involve national defense airspace and require explicit FAA and/or agency approval before entry. And it could very likely carry criminal penalties for violations,
This category will likely mirror existing security-sensitive airspace restrictions around facilities like:

- Nuclear power plants
- DOD facilities
- Prisons
- Other national security sites
As currently written, flying over a Special UAFR would require approval from both the FAA Administrator and the agency responsible for that site.
_____________________________________________________________________
What Should Our Comments Focus On?
~First: Who Can Fly Over These Sites?
The FAA identifies five categories of UAS operations that would be allowed to operate over UAFR-designated sites:
- Part 107
- Part 135
- Part 137
- Part 91
- Future Part 108 operations
Noticeably absent is recreational operations under §44809. Obviously there are certainly facilities recreational flyers likely don’t need access to (refineries and wastewater treatment plants come to mind) but a blanket prohibition across all UAFR sites would be incredibly restrictive.
The most common UAFRs will likely be electrical substations. They’re everywhere. I can think of two near my own house, and one is adjacent to a park where drones are commonly flown. The same goes for telecommunications infrastructure. How many cell towers are near places people already fly recreationally?
And what about railroads? How would those be designated? I see no reason train buffs flying recreationally shouldn’t be allowed to film tracks or yards in many situations. If someone is chasing Union Pacific’s “Big Boy” around the country and can’t legally cross over railroad property with a drone, that defeats the whole purpose. And if they want to get a nice shot of Big Boy on static display in a rail yard, that UAFR designation may prevent that. According to the the 2209 Preamble, “… the Association of American Railroads (AAR) requested FAA consider allowing UAFRs over approximately 140,000 miles of track to include right-of-way property extending laterally fifty feet from the tracks” (Page 24671 of the Preamble), but luckily the FAA already said they do “not believe that issuing UAFRs over potentially 140,000 miles of track is consistent with Congress’s direction”. This is an example of what some CI entities have been asking. And why recreational operators need to comment too.

There should be a clear and compelling justification before any site receives a UAFR designation. Comment on the approval criteria. Explain why not every facility warrants restricted airspace. Maybe even propose allowing compliant §44809 operations with Remote ID over certain Standard UAFR sites. That would likely require subcategories within the Standard UAFR structure, so maybe it’s not feasible. But if you don’t ask, the answer is always no.
~Second: Who Can Apply?
Subpart B establishes the criteria for facilities applying for UAFR designation. And those applicants must demonstrate that they qualify as an eligible fixed-site facility, have standing as the owner or operator, and that the restriction is actually necessary. That the request must also be narrowly tailored.
And that last point is critical. The NPRM makes it clear the FAA does not want uncontrolled proliferation of restricted airspace. Read Subpart B carefully, beginning on page 24686 of the Federal Register, and think about what must be addressed there. The application process needs to be tightly defined, and applicants must be thoroughly vetted.
Because if the approval criteria aren’t strictly enforced, the entire UAFR process collapses. And if that happens, it creates an operational nightmare for the commercial UAS industry in the United States. The facility application process is the cornerstone of the entire 2209 rulemaking process. If that fails, all of §74 fails.
~Third: What Is the Flight Approval or Notification Process?
This is where remote pilots can make the biggest difference.
We already have real-world experience dealing with airspace authorizations through LAANC and DroneZone. We collectively represent millions of authorization requests and operational decisions. That experience matters. You comments should ask:
- Could a LAANC-style system work for Standard UAFRs?
- Could operators simply be notified automatically?
- Would an SGI style approvals make sense for Special UAFRs?
- Is there an entirely different system that would work better?
But whatever system is ultimately adopted must be transparent, efficient, easily accessible. If it’s opaque and difficult to notify or get permissions, then it won’t be used. And that puts us back at square one.
The same applies to any map or application displaying UAFR-designated areas. Think along the lines of the FAA UAS Data Map or current LAANC applications.
~Fourth: 14CFR §74 Must Not Permit UAS Mitigation.
The 2209 NPRM preamble discusses the practicality of allowing those sites designated under §74 to utilize counter UAS measures. The NPRM repeatedly describes Section 2209 as an airspace restriction mechanism, not a mitigation authority. The proposal establishes “unmanned aircraft flight restrictions” (UAFRs), i.e., rules about where drones may operate.
It’s imperative that any modification to Counter UAS authority remain separate from the §74 Final Rule. With the progress of the SAFER SKIES Act at the federal level, it needs to be made clear that §74 does not authorize any designated UAFR to use or implement UAS Mitigation methods. That authority must exclusively remain under the SAFER SKIES Act.
~Fifth: Federal Preemption.
In my opinion, reiterating federal preemption is the single most important near-term issue that must be addressed in 14 CFR §74. As mentioned earlier, 25 states have already passed some form of critical infrastructure airspace law or restriction. 14 CFR §74 must explicitly invalidate those existing state-level airspace restrictions and prohibit states from creating new ones in the future.
I’d suggest adding a new section under Subpart F, call it §74.240, and clearly establishes federal exclusivity over UAS airspace regulation.
Maybe something along these lines of:
“§ 74.240 Federal Exclusivity and Preemption.
(a) Exclusive Federal Authority.
The regulation of unmanned aircraft operations and airspace restrictions established under this part is an exclusive Federal function.
(b) Preemption.
This part preempts any State, Tribal, territorial, or local law, regulation, ordinance, or other requirement that restricts, prohibits, conditions, or penalizes unmanned aircraft operations within the National Airspace System based on proximity to critical infrastructure or fixed-site facilities.
No State or local government may establish or enforce an unmanned aircraft exclusion zone, stand-off distance, or operational restriction except as authorized by Federal law or regulation.
Any existing or future conflicting State or local requirement shall have no force or effect.
(c) Preservation of Traditional State Authority.
Nothing in this section affects State or local authority over trespass, privacy, land use, nuisance, reckless endangerment, or other ground-based conduct not involving regulation of airspace or flight operations.”
_____________________________________________________________________
We only have until July 6th to submit comments.
And commenting on this NPRM is every bit as important as the BVLOS NPRM because it directly affects how all of us operate. Write your comments. Run them through something like ChatGPT or Claude if you want help organizing your thoughts or strengthening the language. Then go back through it and make sure either is put into your own voice.
Tell a story. Be professional. Be specific. That’s how we help the FAA understand just how important it is to get the 2209 Final Rule right the first time. And we are exactly the right people who can help them do it. So keep this article in mind when you write your comment. And look for other articles and videos. I know that Pilot Institute will be putting out a video soon. I’ll post a link once they post it on their YouTube channel.
It’s simple to comment. Once you have your comment ready, simply go to the 2209 NPRM page in the Federal Register, click “SUBMIT A PUBLIC COMMENT”, and fill in the submittal. You can either copy and paste your comment into the box, or attach a PDF to the form. Then simply submit.

Why This NPRM Matters
This is probably the most significant security-related drone rulemaking since Remote ID. It fundamentally changes the relationship between:
- Critical infrastructure
- Airspace access
- Commercial drone scalability
- Recreational drone freedom
- Future BVLOS corridors
For the drone industry, the key question is, “Can the FAA protect sensitive infrastructure without creating a patchwork of restricted low-altitude airspace?”
