Congress told the FAA to build a petition-based no-fly process for critical infrastructure in 2016. The deadline was March 31, 2019. Last year, with the agency still having produced nothing, the White House issued Executive Order 14305 — signed June 6, 2025 — directing the FAA to get on with it. On May 6, 2026, the FAA finally published the Notice of Proposed Rulemaking in the Federal Register, docket FAA-2026-4558, RIN 2120-AL33. The 181-page document proposes an entirely new regulatory part — 14 CFR Part 74 — and introduces a framework called Unmanned Aircraft Flight Restrictions, or UAFRs. Comments close July 6, 2026.

The delay was not incidental. The FAA spent the intervening years developing Remote ID, drafting Part 108 for beyond-visual-line-of-sight operations, and wrestling with how to build airspace restrictions that would not simply carpet-bomb low-altitude commercial access. The proposal that emerged reflects those tensions. It is narrower than many in the security community wanted and more bureaucratically demanding than industry feared — a deliberate design choice that will be tested in the docket fight ahead.

The Two-Tier UAFR Framework

Part 74 defines two restriction categories. A Standard UAFR prohibits most unmanned aircraft operations unless operators satisfy prior FAA safety and security requirements; the default ceiling is 400 feet AGL. Lateral boundaries cannot extend beyond a facility's property lines, with adjusted ceilings proposed for facilities with structures exceeding 300 feet. Part-time Standard UAFRs — those not in continuous effect — are capped at 290 consecutive days per year, a constraint intended to prevent operators from locking up permanent low-altitude corridors under temporary-restriction authority.

A Special UAFR applies where heightened security concerns justify it. Operators seeking to fly within a Special UAFR must obtain advance approval from both the FAA and the sponsoring federal agency. Designations under either tier are time-limited, with a maximum duration of five years before reassessment is required. Material changes to a designated site must be reported within five business days; annual activity reports are mandatory for all UAFR holders.

The scope is substantial. The FAA modeled eligibility against all 16 critical-infrastructure sectors defined in National Security Memorandum 22 (April 30, 2024): chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government services and facilities, healthcare, information technology, nuclear, transportation systems, and water and wastewater. Across those sectors, the agency counted more than 9,000 potentially eligible facilities. The FAA estimates annualized regulatory costs at $21–31 million — a range that stakeholders will scrutinize closely, given how much of that burden falls on operators rather than facility owners.

Who Can Still Fly, and the Remote ID Gate

The proposal does not seal the airspace around designated sites for everyone. Commercial and public-safety operators flying under Parts 91, 107, 108, 135, and 137 retain transit rights through Standard UAFRs, provided they are actively broadcasting Remote ID and have notified the facility in advance. Recreational flyers are excluded from those transit rights entirely. Section 74.250 codifies a discrete set of exemptions: facility inspections and security operations, public safety missions, package delivery, and general transit. The exemption structure matters for the drone-delivery industry in particular, which has been lobbying for clarity on how Part 74 will interact with existing Part 135 air carrier certificates.

Critically, Remote ID is not just a transit tool under this proposal — it is a prerequisite for designation itself. A facility seeking UAFR status must demonstrate it has Remote ID sensing capability before the FAA will process the petition. That requirement effectively makes the rule self-limiting: facilities that have not invested in detection infrastructure cannot weaponize Part 74 to obtain airspace exclusions. It also creates a procurement incentive that the C-UAS industry will not miss.

What the rule conspicuously does not do: it authorizes no geo-fencing, no jamming, no capture, and no counter-UAS mitigation of any kind. Authority over active defeat measures remains outside FAA jurisdiction and is governed by a separate — and still incomplete — federal C-UAS authorization framework.

The Docket Fight

The NPRM arrived with broadly supportive but carefully hedged industry reaction. Jeff Gunnulfsen, Assistant Vice President of Security and Risk Management at the American Fuel and Petrochemical Manufacturers, described the operating reality driving facility owners' support: "We're seeing increased threats and more occurrences of unknown drones flying over our sites." Liz Forro, Policy Director at the Commercial Drone Alliance, said: "This proposal represents a significant step forward in modernizing how our low-altitude ecosystem works."

FAA Administrator Bryan Bedford framed the rule as an enforcement instrument: "It gives law enforcement a clear, effective tool to deter unauthorized drone activity around sensitive sites." Transportation Secretary Sean P. Duffy added his endorsement.

Notably, even the operator side has been measured rather than hostile. Vic Moss, CEO of the Drone Service Providers Alliance, called the design workable:

"The two-tiered UAFR approach is a very palatable solution for drone operators."

The structural tension remains real, though. A Part 74 designation gives a facility legal standing to exclude compliant operators — the ones already broadcasting Remote ID and following the rules. The threat actors the rule is ostensibly designed to address are, by definition, not consulting regulations.gov before flying a contraband drop into a prison yard. The FAA cited two incidents as illustrative: an April 2024 Georgia prison contraband-drone event, and a March 2026 theft of 15 agricultural spray drones from a New Jersey warehouse. Neither attacker would have been deterred by a UAFR. Anthony McCarty, Senior VP-Government at Asylon Robotics and a retired Air Force colonel, framed the threat side plainly: "Drones pose the risk of being used in a malign way for everything from surveillance" on down — positioning UAFRs as one layer of a layered defense rather than a standalone solution.

Beyond the philosophical debate, practitioners are flagging technical ambiguities that the FAA will need to resolve before a final rule. Transit language in the proposal is described as unclear in edge cases, particularly where a Standard UAFR's property-boundary limit intersects with public navigable airspace. First Amendment and newsgathering exemptions — historically a flashpoint in airspace restriction rulemakings — are not explicitly addressed in the proposal. The interaction between Part 74 and Part 108's nascent BVLOS framework remains underspecified, a gap that matters enormously for operators building long-range commercial routes that may cross designated zones.

The comment window runs through July 6, 2026, via regulations.gov docket FAA-2026-4558. Given the seven-year delay that preceded this NPRM, the pace of finalization is anyone's guess — though EO 14305's continued existence as a forcing function suggests the current administration will not tolerate another multi-year slip.

Sources