Kiri

European Union Aviation Safety Agency

Notice of Proposed Amendment 2024-107

issued in accordance with Article 6 of MB Decision 01-2022

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 1 of 15

An agency of the European Union

Regular update of the AMC & GM

to Commission Implementing Regulation (EU) 2019/947

Operation of drones in the ‘open’ and ‘specific’ category

AMC & GM to Regulation (EU) 2019/947 — Issue 1, Amendment 3

RMT.0730 — Subtask 3

EXECUTIVE SUMMARY

This Notice of Proposed Amendment (NPA) proposes to amend the acceptable means of compliance (AMC)

and guidance material (GM) to the Annex to Commission Implementing Regulation (EU) 2019/947 due to the

introduction of a new version of the specific operations risk assessment, i.e. SORA 2.5.

The objective is to introduce some simplifications while maintaining a high level of safety for the operation of

unmanned aircraft systems (UASs) in the ‘specific’ category, and to improve the level of harmonisation in the

implementation of the Regulation while fostering a level playing field.

REGULATION(S) INTENDED TO BE AMENDED/ ISSUED n/a

ED DECISION(S) INTENDED TO BE AMENDED — ED Decision 2019/021/R 'AMC and GM to Commission

Implementing Regulation (EU) 2019/947'

AFFECTED STAKEHOLDERS UAS operators (private and commercial); national competent authorities; UAS maintenance organisations; UAS maintenance training organisations; UAS continuing airworthiness management organisation; UAS maintenance licence holders; UAS manufacturers; other airspace users (manned aircraft); general public

WORKING METHODS

Development Impact assessment(s) Consultation

By EASA Light Focused (Advisory Bodies) — NPA

RELATED DOCUMENTS / INFORMATION

— ToR RMT.0730 - Regular update of the acceptable means of compliance and guidance material to Commission Implementing Regulation (EU) 2019/947 on the rules and procedures for the operation of unmanned aircraft | EASA

— ED Decision 2022/002/R - Regular update of the AMC & GM to Regulation (EU) 2019/947: AMC & GM to Regulation (EU) 2019/947 — Issue 1, Amendment 2 | AMC & GM to the Annex to Regulation (EU) 2019/947 — Issue 1, Amendment 2 | EASA

PLANNING MILESTONES: Refer to the latest edition of the EPAS Volume II.

European Union Aviation Safety Agency NPA 2024-107

Table of contents

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 2 of 15

An agency of the European Union

Table of contents

1. About this NPA .......................................................................................................... 3

1.1. How this regulatory material was developed .................................................................... 3

1.2. How to comment on this NPA ............................................................................................ 3

1.3. The next steps .................................................................................................................... 4

2. In summary — why and what .................................................................................... 5

2.1. Why we need to act ........................................................................................................... 5

2.1.1. Description of the issue ............................................................................................ 5

2.1.2. Who is affected by the issue .................................................................................... 5

2.1.3. Conclusion on the need for rulemaking ................................................................... 5

2.2. What we want to achieve — objectives ............................................................................. 5

2.3. How we want to achieve it — overview of the proposed amendments ........................... 6

2.4. What are the stakeholders’ views ...................................................................................... 9

3. Expected benefits and drawbacks of the proposed regulatory material .................. 10

4. Proposed regulatory material .................................................................................. 11

5. Monitoring and evaluation ...................................................................................... 12

6. Proposed actions to support implementation .......................................................... 13

7. References ............................................................................................................... 14

Appendix — Quality of the NPA ........................................................................................ 15

1. The regulatory proposal is of technically good/high quality ............................................ 15

2. The text is clear, readable and understandable ............................................................... 15

3. The regulatory proposal is well substantiated ................................................................. 15

4. The regulatory proposal is fit for purpose (achieving the objectives set) ........................ 15

5. The regulatory proposal is proportionate to the size of the issue ................................... 15

6. The regulatory proposal applies the ‘better regulation’ principles ................................. 15

7. Any other comments on the quality of this document (please specify) .......................... 15

European Union Aviation Safety Agency NPA 2024-107

1. About this NPA

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 3 of 15

An agency of the European Union

1. About this NPA

1.1. How this regulatory material was developed

The European Union Aviation Safety Agency (EASA) identified the need to mitigate the safety risk

involved in UAS operations conducted in the ‘specific’ category’ and to foster the uniform and

harmonised application of Commission Implementing Regulation (EU) 2019/947 (the UAS Regulation)

(as described in Chapter 2), and after having assessed the impacts of the possible intervention actions,

identified rulemaking as the necessary intervention action.

This rulemaking activity is included in the 2024 edition of Volume II of the European Plan for Aviation

Safety (EPAS)1 under Rulemaking Task (RMT).0730 Subtask 3.

The text of this NPA is based on the specific operations risk assessment (SORA) v2.52 published by the

Joint Authorities for Rulemaking on Unmanned Systems (JARUS) and consulted through the JARUS

website. All comments, including those provided by European stakeholders, were addressed and EASA

participated in their review and assessment. The related comment-response document (CRD) is

available on the JARUS website3. EASA adapted the JARUS version of SORA 2.5 to the peculiarities of

the UAS operations conducted in the European sky and developed the related regulatory material in

line with Regulation (EU) 2018/11394 (the Basic Regulation). Considering that SORA v2.5 was already

publicly consulted by JARUS, this consultation focuses on the adaptations to the European peculiarities

that were developed according to the Rulemaking Procedure5, as well as in accordance with the

objectives and working methods described in the Terms of Reference (ToR) for this RMT6.

1.2. How to comment on this NPA

Since a public consultation was already carried out by JARUS, the subject draft regulatory material is

hereby submitted for consultation with the EASA advisory bodies.

Please, submit your comments via email to drones@easa.europa.eu using the Excel file Comment

sheet - NPA 2024-107 (RMT.0730 Subtask 3).

The deadline for the submission of comments is 31 January 2025.

1 European Plan for Aviation Safety (EPAS) 2024 - 13th edition | EASA 2 Publications – JARUS 3 http://jarus-rpas.org/wp-content/uploads/2024/10/SORA-v2.5-External-Comment-Response-Document.xlsx 4 Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common rules in the field of

civil aviation and establishing a European Union Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No 3922/91 (OJ L 212, 22.8.2018, p. 1) (http://data.europa.eu/eli/reg/2018/1139/oj).

5 EASA is bound to follow a structured rulemaking process as required by Article 115(1) of Regulation (EU) 2018/1139. Such a process has been adopted by the EASA Management Board (MB) and is referred to as the ‘Rulemaking Procedure’. See MB Decision No 01-2022 of 2 May 2022 on the procedure to be applied by EASA for the issuing of opinions, certification specifications and other detailed specifications, acceptable means of compliance and guidance material ('Rulemaking Procedure'), and repealing Management Board Decision No 18-2015 (EASA MB Decision No 01-2022 on the Rulemaking Procedure, repealing MB Decision 18-2015 (by written procedure) | EASA (europa.eu)).

6 ToR RMT.0730 - Regular update of the acceptable means of compliance and guidance material to Commission Implementing Regulation (EU) 2019/947 on the rules and procedures for the operation of unmanned aircraft | EASA (europa.eu)

European Union Aviation Safety Agency NPA 2024-107

1. About this NPA

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 4 of 15

An agency of the European Union

1.3. The next steps

Following the focused consultation of the draft regulatory material, EASA will review all the comments

received and will duly consider them in the subsequent phases of this rulemaking activity.

Considering the above, EASA may issue a Decision in order to amend the AMC and GM to Commission

Implementing Regulation (EU) 2019/947 to support its application.

When issuing the Decision, EASA will also provide feedback to the commentators and information to

the public on who engaged in the process and/or provided comments during the consultation of the

draft regulatory material, which comments were received, how such engagement and/or consultation

was used in rulemaking, and how the comments were considered.

European Union Aviation Safety Agency NPA 2024-107

2. In summary — why and what

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 5 of 15

An agency of the European Union

2. In summary — why and what

2.1. Why we need to act

The core element of UAS operations in the ‘specific’ category is the risk assessment methodology

known as the specific operation risk assessment (SORA), which was published by JARUS in 2017. Since

then, the methodology has been applied by UAS operators from various countries. Feedback was

collected by the JARUS community, leading to the need for modifications to simplify and facilitate its

application. A new version, SORA 2.57, was published by JARUS in May 2024. More details are provided

in the next sections.

2.1.1. Description of the issue

The main issues identified with the application of SORA 2.0 were as follows:

— the ground risk was based on a qualitative description of the population density, making it

difficult to apply;

— the conditions triggering the requirements to contain the operation within its operational

volume were overprescriptive;

— the language and structure of the text was not easy for UAS operators to read and follow.

2.1.2. Who is affected by the issue

The current SORA places a burden on UAS operators and manufacturers to identify the requirements

and evidence needed to ensure the safety of UAS operations, as well as for national competent

authorities to analyse them. The risk assessment is open to interpretation, making it difficult to

achieve uniform implementation among the EASA Member States.

2.1.3. Conclusion on the need for rulemaking

EASA concluded, as explained further in Chapter 3, that intervention was necessary and that non-

rulemaking action could not effectively address the issue. Therefore, amendments to the related AMC

and GM are necessary.

2.2. What we want to achieve — objectives

The overall objectives of the EASA system are defined in Article 1 of the Basic Regulation.

The draft regulatory material presented here is expected to contribute to achieving these overall

objectives by addressing the issue described in Section 2.1.

More specifically, with the regulatory material presented here, EASA intends to increase the safety,

efficiency and harmonisation as regards the implementation of the UAS Regulation.

7 Publications – JARUS

European Union Aviation Safety Agency NPA 2024-107

2. In summary — why and what

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 6 of 15

An agency of the European Union

2.3. How we want to achieve it — overview of the proposed amendments

The SORA 2.5 package includes amendments to the Main Body and to Annexes A, B, E and I.

Additionally, it introduces Annex F. The modifications introduced in SORA 2.5 are summarised in the

explanatory note published by JARUS8.

EASA made limited changes to the JARUS SORA 2.5 to address European-specific provisions:

— The cybersecurity provisions were not included because, after analysing the JARUS proposal,

they were considered insufficiently proportionate. A report has been developed and submitted

to JARUS for consideration in future revisions.

— According to the Basic Regulation, competence for verifying compliance with production,

operational, and training aspects is assigned to national competent authorities, while

competence for design aspects is assigned to the European Commission, exercised through

EASA. For UASs classified with a specific assurance and integrity level (SAIL) of IV, manufacturers

are required to obtain a design verification report from EASA. Similarly, this applies when a

mitigation or containment measure with a high level of robustness is used. For operations

classified under SAIL V and VI, a type certificate issued in accordance with Part 21 of Commission

Regulation (EU) No 748/2012 is required.

— The option for national competent authorities to require a different level of robustness for

containment in exceptional cases has been added. This may apply, for example, to special UAS

operations such as the inspection of a closed runway at an aerodrome with multiple runways.

— For reviewing supporting evidence for mitigation and operational safety objectives of an

application, national competent authorities may use different approaches:

— Directly assess evidence;

— Make use of ‘recognised entities’ to assess the evidence and provide recommendations

to the competent authority. In this case, the competent authority retains the

responsibility to define the final assessment and may define the process to recognise such

entities;

— Make use of ‘designated entities’; these entities should be understood as ‘qualified

entities’ according to Article 69 of the Basic Regulation. EASA shall propose in the

upcoming NPA on the regular update of Commission Implementing Regulation (EU)

2019/947 (planned for 2025), to replace the term ‘designated’ with ‘qualified’. Such

entities need to comply with the ‘essential requirements for qualified entities’ described

in Annex VI to the Basic Regulation and may even be granted the privilege to issue a

certificate of operational authorisation by the competent authority.

— UAS terminology has been standardised throughout EU documentation by using:

— fixed-wing configurations such as aeroplanes, kites, gliders, etc.;

— rotorcraft helicopter, including all vertical-lift configurations having up to two rotors;

— rotorcraft gyroplane, a special configuration with a non-powered rotor;

8 Publications – JARUS

European Union Aviation Safety Agency NPA 2024-107

2. In summary — why and what

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 7 of 15

An agency of the European Union

— VTOL-capable aircraft (including rotorcraft), which include vertical-lift configurations with

three or more rotors and fixed-wing aircraft capable of vertical take-off and landing;

— lighter-than-air configurations, including airships, hot-air balloons, etc.

— The term ‘EVLOS’ (extended visual line of sight) has been removed throughout SORA, as EU

regulations never refer to it. It has been replaced with ‘BVLOS with AO’ (beyond visual line of

sight operation with airspace observer) since it is equivalent. The requirement to develop

procedures and correct phraseology between the remote pilot and the AO has been added.

— Before deciding to use SORA to assess the risk of an operation (refer to paragraph S3.1,

‘Introduction to SORA walkthrough’), the UAS operator should check if for the drone used the

exclusion criteria for small-tethered aircraft in Annex I to the Basic Regulation apply.

Additionally, the concept of harmless drones has been removed, as it is already embedded in

the ‘open’ category as UAS with class label C0.

— In Step #2, the maximum speed of UA with a take-off mass of less than 250 g, considered to

have an iGRC of 1, has been reduced to 19 m/s to be consistent with the maximum speed of

UAS with class label C0.

— In Step #5, the strategic mitigation measures for VLOS are extended to cases where the airspace

observer is situated alongside the remote pilot. EASA considers this an error since the mitigation

is valid even when the airspace observer is distant from the remote pilot to extend the

operational range. The paragraph has been amended to include operations where one or more

airspace observers are located such that the UA is always under the VLOS of either the remote

pilot or one airspace observer. The AO must be able to scan the sky and communicate in real

time with the remote pilot, informing them of other manned or unmanned aircraft in the

operational area.

— In Step #8, when using a UA that weighs less than 250 g, containment is always low. It is clarified

that the reference weight is the take-off mass. Moreover, this is not valid if the operation is a

multiple simultaneous operation (MSO), where the competent authority may have additional

safety and security considerations.

— Paragraph 5.2.3 of Annex A has been amended as follows:

— the reaction time of 1 second to activate a parachute is not considered realistic; a more

conservative estimate of 3 seconds has been indicated;

— the use of a parachute as an ‘alternative’ contingency procedure has been removed, as

UAS operators should not be encouraged to activate parachutes within the operational

volume;

— the altitude measurement error of 1 m for the barometer is not considered realistic and

has been replaced with ‘10 m’.

— In Annex B, the text related to M2 mitigation has been slightly amended to reflect

MoC SC.Light-UAS.2512 published by EASA. Specifically, the provisions for the level of integrity

of criterion #1 have been modified using MoC text, which is considered clearer and equivalent.

— OSO #2, ‘UAS designed and produced by a competent and/or proven entity’, has been split into

two criteria: one for the design organisation and another for the production organisation,

European Union Aviation Safety Agency NPA 2024-107

2. In summary — why and what

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 8 of 15

An agency of the European Union

reflecting the division of competence in the EU system between national competent authorities

and EASA. This was already present in EASA SORA 2.0.

— In OSO #3, the criteria for the UAS operator and the design organisation have been separated.

Maintenance inputs that the design organisation should provide to the UAS operator have been

included in a new criterion. This does not introduce any content changes, as JARUS SORA

already showed in the OSO table that criterion #1 applied to both the UAS operator and the

design organisation. EASA’s addition only clarifies this. Moreover, the title of OSO #3 has been

changed to ‘Maintenance of UAS’ to reflect this approach.

— The level of robustness for OSO #5 is inconsistent with the definitions in paragraph S2.4: for

SAIL III, it is ‘low’, but evidence needs to be available. This approach aligns more with a medium

level of robustness. To avoid confusion, the level of robustness has been elevated to ‘medium’

without changing the provisions in Annex E for OSO #5. A similar change has been introduced

for OSO #4 to reflect that, in the EU system, a DVR is required for UAS operated in SAIL IV, and

a type certificate is required for SAIL V and VI under Part 21 of Commission Regulation (EU) No

748/2012. To maintain consistency, the level of robustness for SAIL IV is set to ‘medium’, and

for SAIL V, it is set to ‘high’, without modifying the provisions in Annex E for OSO #4.

— The reference to functional test-based (FTB) approach has been removed from OSO #4 for

SAIL IV, as it is only acceptable up to SAIL III, as explained in the FTB means of compliance

published by EASA.

— The JARUS SORA 2.5 package includes Annex F, which describes the ground-risk model and

provides mathematical justifications for the ground-risk classes used in SORA. This document is

not intended for daily use by UAS operators but should be considered by operators with

advanced skills when proposing deviations from the ground-risk tables in the SORA main body.

It was decided not to publish it as acceptable means of compliance or guidance material but

rather to refer to the version available on the JARUS website. The most commonly used formula

is for calculating the critical area tailored to a defined UAS, which has been made available on

the Innovative Air Mobility Hub through an automated algorithm.

— JARUS proposed a new structure for the SORA main body, distinguishing between ‘guidance’

(examples or explanations) and ‘requirements’ (procedures to be followed). In the EU

regulatory system, the term ‘requirements’ refers to provisions defined in regulations, so it has

been replaced with the term ‘procedures’. Additionally, the proposed format was incompatible

with the IT tools used by EASA. Each section’s nature as either ‘guidance’ or ‘procedure’ has

been indicated in brackets.

— The application form and issuance of the operational authorisation have been adapted to the

peculiarities of SORA 2.5. More specifically, the application form has been amended to reflect

Section A.2 of SORA Annex A.

— AMC1 UAS.SPEC.030(3)(e) has been amended to refer to SORA Annex A, which provides a

template for the operations manual. Examples of operations manuals are available on the EASA

website9.

9 https://www.easa.europa.eu/en/downloads/139674/en

European Union Aviation Safety Agency NPA 2024-107

2. In summary — why and what

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 9 of 15

An agency of the European Union

— AMC1 UAS.SPEC.030(2), which provides the application form for operational authorisation, has

been amended to reflect the form in Chapter A.2 of Annex A of SORA.

— AMC1 UAS.SPEC.030(3)(e) has been amended to require the development of an operations

manual with the structure defined in Chapter A3 of Annex A.

— AMC1 UAS.SPEC.040(1), which provides the form for issuing an operational authorisation, has

been amended to reflect the changes provided by SORA 2.5. Additionally, a few new fields have

been introduced:

— dropping of material;

— maximum number of UAS that may be simultaneously operated by a single remote pilot;

— type of C2 link.

— Predefined risk assessments (PDRAs — AMC 2 to 6 to Article 11) have not been adapted to

SORA 2.5 due to a new PDRA format under development by JARUS, which should improve

usability. The new format is expected to be published by spring 2025 following public

consultation. EASA may then issue a new decision incorporating them into the EU regulatory

framework.

— AMC1/GM1 to Article 11 have been amended to indicate that the EASA decision will be

immediately applicable, allowing UAS operators to apply for operational authorisations using

SORA 2.5. However, Decision 2019/021/R introducing SORA version 2.0 will not be repealed,

thus enabling UAS operators finalising applications for operational authorisations to still apply

using SORA 2.0. Each Member State will define for how long it will be accepting applications

using SORA 2.0. Both operational authorisations issued based on SORA 2.0 and 2.5 comply with

Article 11 of Commission Implementing Regulation (EU) 2019/947. In some cases, SORA 2.0 is

more conservative than SORA 2.5, particularly regarding containment requirements. Therefore,

UAS operators may find it advantageous to update their operational authorisations to comply

with SORA 2.5. Each Member State will define the validity of the operational authorisations

issued under SORA 2.0.

2.4. What are the stakeholders’ views

JARUS conducted a public consultation and comments were issued to JARUS by the following

stakeholders:

— national competent authorities,

— UAS industry,

— EASA,

— other stakeholders.

All the comments were addressed and were evaluated as described in the CRD produced by JARUS10.

10 http://jarus-rpas.org/wp-content/uploads/2024/10/SORA-v2.5-External-Comment-Response-Document.xlsx

European Union Aviation Safety Agency NPA 2024-107

3. Expected benefits and drawbacks of the proposed regulatory material

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 10 of 15

An agency of the European Union

3. Expected benefits and drawbacks of the proposed regulatory material

EASA assessed that intervention was required and that new or amended AMC and GM are necessary

to effectively address the issues described in Section 2.1, because the objectives described in

Section 2.2 cannot be achieved effectively by non-rulemaking action.

Keeping the risk assessment methodology as it is, would have created a non-harmonised application

of the UAS Regulation due to ambiguity and unclarity of some parts of the text. The proposed

amendments are expected to improve clarity without creating any drawbacks.

The proposed regulatory material has been developed in view of the better regulation principles, and

in particular the regulatory fitness principles. In particular, the proposed regulatory material is

expected to:

— alleviate existing regulatory burden by simplifying the conditions requiring the compliance with

high level of containment of the UAS operations;

— limit the regulatory burden created by amended requirements to the minimum by allowing

those UAS operators already authorised with SORA 2.0 to keep the validity of their operational

authorisation for 2 years.

European Union Aviation Safety Agency NPA 2024-107

4. Proposed regulatory material

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 11 of 15

An agency of the European Union

4. Proposed regulatory material

Please refer to:

— draft ED Decision 202X/XXX/R issuing Amendment 4 to Issue 1 of the Acceptable Means of

Compliance and Guidance Material to Commission Implementing Regulation (EU) 2019/947

‘AMC and GM to Commission Implementing Regulation (EU) 2019/947 — Issue 1,

Amendment 4’

— draft Annex to draft ED Decision 202X/XXX/R ‘Acceptable Means of Compliance and Guidance

Material to the Annex to Commission Implementing Regulation (EU) 2019/947 — Issue 1,

Amendment 4

European Union Aviation Safety Agency NPA 2024-107

5. Monitoring and evaluation

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 12 of 15

An agency of the European Union

5. Monitoring and evaluation

EASA plans to monitor and evaluate whether the proposed regulatory material has supported affected

stakeholders achieve the objectives described in Section 2.2 by collecting:

— statistics from national competent authorities on operational authorisations they have issued;

— feedback on the authorisation process from national competent authorities and UAS operators

during Advisory Body meetings;

— usage data and occurrences from UAS operators.

European Union Aviation Safety Agency NPA 2024-107

6. Proposed actions to support implementation

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 13 of 15

An agency of the European Union

6. Proposed actions to support implementation

In order to support affected stakeholders with the implementation of the proposed regulatory

material, EASA plans to take the following actions:

— focused communication for Advisory Body meeting(s) (MAB, UAS TeB);

— publication of promotion material on its website;

— organisation of dedicated thematic webinars.

European Union Aviation Safety Agency NPA 2024-107

7. References

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 14 of 15

An agency of the European Union

7. References

— Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and

procedures for the operation of unmanned aircraft (OJ L 152, 11.6.2019, p. 45)

European Union Aviation Safety Agency

Appendix — Quality of the NPA

TE.RPRO.00034-014 © European Union Aviation Safety Agency. All rights reserved. ISO 9001 certified.

Proprietary document. Copies are not controlled. Confirm revision status through the EASA intranet/internet. Page 15 of 15

An agency of the European Union

Appendix — Quality of the NPA

To continuously improve the quality of its documents, EASA welcomes your feedback on the quality

of this document with regard to the following aspects:

Please provide your feedback on the quality of this document as part of the other comments you have

on this NPA. We invite you to also provide a brief justification, especially when you disagree or strongly

disagree, so that we consider this for improvement. Your comments will be considered for internal

quality assurance and management purposes only and will not be published (e.g. as part of the CRD).

1. The regulatory proposal is of technically good/high quality

Please choose one of the options

Fully agree / Agree / Neutral / Disagree / Strongly disagree

2. The text is clear, readable and understandable

Please choose one of the options

Fully agree / Agree / Neutral / Disagree / Strongly disagree

3. The regulatory proposal is well substantiated

Please choose one of the options

Fully agree / Agree / Neutral / Disagree / Strongly disagree

4. The regulatory proposal is fit for purpose (achieving the objectives set)

Please choose one of the options

Fully agree / Agree / Neutral / Disagree / Strongly disagree

5. The regulatory proposal is proportionate to the size of the issue

Please choose one of the options

Fully agree / Agree / Neutral / Disagree / Strongly disagree

6. The regulatory proposal applies the ‘better regulation’ principles[1]

Please choose one of the options

Fully agree / Agree / Neutral / Disagree / Strongly disagree

7. Any other comments on the quality of this document (please specify)

[1] For information and guidance, see:

− https://ec.europa.eu/info/law/law-making-process/planning-and-proposing-law/better-regulation-why-and-

how_en

− https://ec.europa.eu/info/law/law-making-process/planning-and-proposing-law/better-regulation-why-and-

how/better-regulation-guidelines-and-toolbox_en

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 1 of 184

Acceptable Means of Compliance and Guidance Material

to Commission Implementing Regulation (EU) 2019/947 — Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R

‘AMC and GM to Regulation (EU) 2019/947 — Issue 1, Amendment 3’

This document shows deleted, new or amended text as follows:

— deleted text is struck through;

— new or amended text is highlighted in blue;

— an ellipsis ‘[…]’ indicates that the rest of the text is unchanged.

Note to the reader

In amended, and in particular in existing (that is, unchanged) text, ‘Agency’ is used interchangeably

with ‘EASA’. The interchangeable use of these two terms is more apparent in the consolidated versions.

Therefore, please note that both terms refer to the ‘European Union Aviation Safety Agency (EASA)’.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 2 of 184

The following abbreviations are added to the LIST OF ABBREVIATIONS

ATZ aerodrome traffic zone

CAA civil aviation authority

COTS commercial off-the-shelf

CSP comprehensive safety portfolio

FTB functional test-based

FTS flight termination system

HF human factors

iGRC intrinsic ground risk class

RCM remote crew member

SLA service-level agreement

SMS safety management system

S&A see and avoid

TLOS target level of safety

UTM UAS traffic management

VHL very high-level airspace

GM1 Article 11 is amended as follows:

GM1 AMC1 Article 11 Rules for conducting an operational risk assessment

ED Decision 2023/012/R

GENERAL

The operational risk assessment required by Article 11 of the UAS Regulation may be conducted using

the methodology described in AMC1 Article 11. This methodology is basically the specific operations

risk assessment (SORA) developed by JARUS. With Decision 2024/xxx/R SORA version 2.5 was

introduced. Decision 2019/021/R, introducing SORA version 2.0, has not been repealed in order to

allow those UAS operators, that are finalising an application for an operational authorisation, to still

be allowed to apply using SORA 2.0. Each MS will define for how long they will accept applications

using SORA 2.0. Other methodologies might be used by the UAS operator as alternative means of

compliance.

[…]

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 3 of 184

AMC1 Αrticle 11 is replace by the following:

AMC1 Article 11 Rules for conducting an operational risk assessment

(SORA)

SPECIFIC OPERATIONS RISK ASSESSMENT (SORA) (SOURCE JARUS SORA V2.5)

Edition November 2024

Section 0 Executive Summary (GUIDANCE)

S0.1 The SORA approach

The Specific Operations Risk Assessment (SORA) process is intended to provide a risk-proportionate

method to determine the required evidence and assurances needed for an Unmanned Aircraft System

(UAS) to be acceptably safe within the “Specific” category of UAS Operations as defined in Article 3(b)

of Regulation (EU) 2019/947.

The SORA provides structure and guidance to both the competent authority and the applicant to

support an application to operate a UAS in a given operational environment. The benefit of this process

is that both the applicant and competent authority can allocate their available resources and time

proportionally to the risk of the UAS operation.

The SORA uses a holistic safety risk management process to evaluate the risks related to a given UAS

operation and then provide proportionate provisions that a UAS operation should meet to ensure a

target level of safety (TLOS) is met. This TLOS is defined for people and aircraft uninvolved in the UAS

operation and is commensurate with existing manned aviation levels of safety to these same

stakeholders. These values were chosen to ensure that UAS operations would not pose more risk to

third parties than manned aviation which are seen as socially acceptable rates (see Section 5(f) in the

Scoping Paper to AMC RPAS 1309 Issue 21 and Section 1.2.1 in Annex F2 version 2.5):

i. for ground risk - less than one fatality per million hours (1E-6 fatalities per hour) (See Annex F2

Section 1.2.1 for more details),

ii. for air risk - less than one mid-air collision per 10 million flight hours (1E-7 mid-air collisions per

flight hour) for operations that primarily occur under self-separation and see-and-avoid

(primarily uncontrolled airspace). For operations that occur with separation provided by an air

navigation service provider (primarily controlled airspace), the TLOS is one mid-air collision per

billion flight hours (1E-9 mid-air collisions per flight hour).

The SORA has been developed using assumptions expected to be both credible and conservative

across a wide range of UAS Operations.

Under the specific category, different UAS operations will have different levels of inherent risk and

thus will need to demonstrate varying levels of ability to maintain control of the operation to meet

the TLOS. To do this, the SORA has developed the specific assurance and integrity levels (SAIL), which

maps the maximum allowable loss of control rate to operational, organisational, personnel, design,

and manufacturing risk controls that aim to ensure that an operation meets the TLOS. This means a

1 jar_04_doc_amc_rpas_1309_issue_2_2.pdf (jarus-rpas.org) 2 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 4 of 184

UAS operating in a high-risk environment (example: over a large city near an airport) would have to

demonstrate more to the competent authority than the same UAS operating in a low-risk environment

(example: at a closed test range and below 30 m).

S0.2 The SORA methodology

Figure 1 — The SORA process

Note: If UAS operations are conducted across different environments, some steps may need to be

repeated for each particular environment.

The SORA methodology consists of ten systematic steps:

Step #1: Documentation of the proposed operation(s)

This is a preparatory step which is intended to ensure the applicant has sufficient information to

complete Steps #2 to #9 of the SORA process. This information should enable the subsequent steps of

the SORA process to be completed successfully.

Step #2: Intrinsic ground risk class (iGRC)

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 5 of 184

The intrinsic ground risk class is determined by the UA characteristics (maximum characteristic

dimension and maximum speed) as well as the at-risk population density in the operational volume

and ground risk buffer.

Step #3: Final ground risk class

The final ground risk class is determined based on any mitigation measures put in place, as described

in Annex B, which may have a significant effect on the likelihood of a fatality after loss of control of the

operation, including:

i. strategic mitigations intended to reduce the risk before flight,

ii. tactical mitigations intended to reduce the risk during flight,

iii. mitigations intended to reduce the effect of a ground impact.

A final GRC higher than 7 is out of the scope of SORA and should be handled in the certified category.

Step #4: Initial air risk class (ARC)

The determination of air risk class is done in Steps #4 & #5. In Step #4, the initial ARC is assessed based

on an expected generalised encounter rate in the airspace identified in Step #1. The parameters that

define the four categories of ARC (a, b, c, d) are: if the airspace is atypical (e.g., segregated), altitude,

controlled by air traffic versus uncontrolled, airport versus non-airport environment, and airspace over

urban versus rural environments.

Step #5: Residual air risk class

The residual ARC is obtained after applying any relevant strategic mitigation measures in order to lower

the initial air risk class. Two types of strategic mitigation measures, as described in Annex C, exist in

the SORA. Air risk mitigations are either operational restrictions (e.g., boundaries, time of operation)

which are controlled by the UAS operators, or by the structure and associated rules of the airspace

which are controlled by the relevant authorities (e.g. UTM, U-space).

Step #6: Tactical mitigation performance requirement (TMPR) and robustness levels

Tactical mitigation requirements on the operation are then applied in Step #6 to mitigate any

remaining unacceptable residual risk of a mid-air collision with manned air traffic after the strategic

mitigations have been applied.

Tactical mitigation performance requirements (TMPR) address the functions of detect, decide,

command, execute and feedback Loop (see Annex D to AMC1 to Article 11), for each residual air risk

class.

Step #7: SAIL determination

A SAIL (scaled from I to VI) is then assigned to the operation described Step #1 based on the final GRC

and residual ARC.

Step #8: Containment provisions

The containment provisions aim to ensure that the target level of safety can be met for both ground

and air risk in the adjacent area.

There are three possible levels of robustness for containment: low, medium and high; each with a set

of safety provisions described in Annex E to AMC1 to Article 11 as a function of UA characteristics,

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 6 of 184

SAIL, average population density in the defined adjacent area and the presence of outdoor assembly

within 1 km of the outer limit of the operational volume.

Step #9: Identification of Operational Safety Objectives (OSO)

The SAIL level identifies levels of integrity and assurance (low, medium, high) to be met for each

operational safety objective (OSO) according to criteria provided in Annex E to AMC1 to Article 11.

For the assigned SAIL, the UAS operator is required to show compliance with each of the 17 OSOs, at

the defined robustness level (for lower SAILs, some OSOs are classified as ‘NR’ (not required) in table

14. Even if in this case the UAS operator is not required to show compliance to the competent

authority, the UAS operator is expected to still consider them, at least with low level of integrity). The

OSOs cover, but are not limited to: the UAS designer, UAS operator or other organisations involved in

maintenance, related services and training, UAS technical aspects, deterioration of external systems

supporting UAS operations, human machine interface, human error, adverse operating conditions.

Step #10: Comprehensive Safety Portfolio

The comprehensive safety portfolio (CSP) is a suite of documents showing compliance with the

provisions resulting from the SORA steps for the proposed operation. If the comprehensive safety

portfolio does not provide appropriate evidence as determined by the SORA process at the given SAIL,

changes to the proposed operation (e.g., reduction of the intrinsic risk of the operation), additional

mitigation measures, possible UAS design changes, or further analysis/evidence may be needed.

Annex A to AMC1 to Article 11 provides guidance and templates on how to provide relevant

information to the competent authority as part of the SORA process.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 7 of 184

Section 1 Introduction (GUIDANCE)

S1.1 Preface

The SORA provides a methodology to guide both the applicant and the competent authority in

determining whether a UAS operation can be conducted in a safe manner. The document should not

be used as a checklist, nor be expected to provide answers to all the potential challenges related to

the UAS operation. The SORA is a guide that allows an operator to identify the risk and, if needed,

reduce it to an acceptable level by tailoring their mitigations to the operation. This involves meeting

or exceeding the target level of safety (TLOS) regardless of the complexity of the UAS operation, UA

size, or the area of operation. The TLOS of operations under the specific category covered by SORA is

equivalent to that of the category open and certified categories. For this reason, it does not contain

prescriptive provisions but rather safety objectives to be met at various levels of robustness

commensurate with risk.

S1.2 Purpose of the document

(a) The purpose of the SORA is to propose a methodology of risk assessment to support an

application for authorization to operate a UAS within the specific category.

(b) Due to the operational differences and expected increase in level of risk of the operating

environment, the specific category cannot automatically take credit for the safety and

performance data demonstrated with the large number of UAS operating in the open category.

Therefore, the SORA provides a consistent approach to assess the additional risks associated

with the expanded operations not covered by the open category.

(c) This methodology is proposed as an acceptable means to evaluate the safety risks and

determine the acceptability of a proposed UAS operation within the specific category.

(d) The methodology is based on the principle of a holistic system safety risk-based assessment

model used to evaluate the risks of a given operation. The model considers the most common

safety threats associated with a specified hazard, the relevant design, and the proposed

operational mitigations for a specific UAS operation(s). The SORA then helps to evaluate the

risks systematically and determine any needed limitations required for safe operation. This

method allows the applicant to determine acceptable risk levels and to validate that those levels

are complied with by the proposed operations. The competent authority may also apply this

methodology to gain confidence that the UAS operator can conduct the operation safely.

(e) The methodology, related processes, and values proposed in this document are intended to

guide an applicant when performing a risk assessment of an intended operation to obtain an

operational authorisation by the competent authority. At the same time, this material is

intended to support the competent authority while assessing the completeness and

acceptability of an application to operate in the specific category.

S1.3 Applicability

(a) The methodology presented in this document is aimed at evaluating the safety risks involved

with the operation of one or multiple UAS of any type and size. In the case of multiple

simultaneous UA operating relative to each other, such as displays for entertainment, it is

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 8 of 184

recommended to examine common mode failures and adapt the application of the SORA as

needed in consultation with the competent authority.

(b) The methodology is designed to be applicable to all levels of automation.

(c) Safety risks associated with collisions between UA and manned aircraft are in the scope of the

methodology. The risk of collision between two UA will be addressed in future revisions of the

document. It is expected that multiple simultaneous operations and concurrent high-volume

operators have a deconfliction strategy for their own UA.

(d) The carriage of dangerous goods on board the UAS (e.g., weapons, munitions of war, explosives,

hazardous medical samples) that present additional hazards are excluded from the scope of this

methodology and might require additional safety considerations (e.g., demonstration of the

ability to contain the dangerous good).

(e) Privacy, environmental and financial aspects are excluded from the applicability of this

methodology.

(f) In addition to performing the SORA process, the UAS operator should also ensure compliance

to all other regulatory applicable to the UAS operation that are not necessarily addressed by

the SORA, i.e., the SORA does not preclude any additional regulatory requirements

implemented by the competent authority.

(g) The SORA can be used to get operational authorisation for UAS operations conducted in

multiple locations. In that situation, the UAS operator needs to provide a SORA that is applicable

to all these areas to show that the SORA provisions will be met for all flights performed under

the operational authorisation. If an applicant can demonstrate to have sufficient procedures in

place to correctly allocate operational volumes, buffers, adjacent areas and airspaces, a generic

location authorisation could be considered as described in GM2 UAS.SPEC.030(2).

S1.4 SORA documents

SORA is made of the following documents:

Main Body (AMC1 to Article 11): describing the SORA risk assessment process;

Annex A to AMC1 to Article 11: guidelines for the applicant on collecting and presenting system and

operation information for a specific UAS operation to the authority;

Annex B to AMC1 to Article 11: integrity and assurance levels for the mitigations used to reduce the

intrinsic ground risk class;

Annex C to AMC1 to Article 11: air risk strategic mitigations;

Annex D to AMC1 to Article 11: air risk tactical mitigations;

Annex E to AMC1 to Article 11: integrity and assurance levels for the operational safety objectives

(OSO);

Annex F3: Theoretical basis for ground risk classification and containment provisions;

Annex I to AMC1 to Article 11: glossary.

3 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 9 of 184

Section 2. Key concepts and definitions (GUIDANCE)

S.2.1 Risk in the context of SORA

(a) The definition of “risk” as provided in the SAE ARP 4754B / EUROCAE ED-79B: “the combination

of the frequency (probability) of an occurrence and its associated level of severity” is used.

(b) The consequence of an occurrence will be designated as a harm of some type.

(c) Many different categories of harm can arise from any given occurrence. This document will

focus on occurrences of harm (e.g., an UAS crash) that are short-lived and usually give rise to

potential loss of life. Chronic events (e.g., toxic emissions over a period of time), are explicitly

excluded from this assessment. The categories of harm in this document are the potential for:

i. fatal injuries to third parties on the ground4;

ii. hazard to third parties in the air.

(d) As the SORA only addresses safety risk, it is acknowledged that the competent authorities, when

appropriate, may consider additional categories of harm (e.g., cybersecurity, privacy, disruption

of a community, environmental damage, financial loss, etc.).

(e) Fatal injury is a well-defined condition and known by the competent authorities. Therefore, the

risk of under-reporting fatalities is almost non-existent. The quantification of the associated risk

of fatality is straightforward. The usual means to measure fatalities are by the number of deaths

within a particular operating time interval (e.g., fatal accident rate per million flying hours), or

the number of deaths for a specified circumstance (e.g., fatal accident rate per number of take-

offs).

(f) Damage to critical infrastructure is a more complex condition and different countries may have

differing sensitivities to this harm. Therefore, the quantification of the associated risks may be

difficult and subject to national specificities, thus it is not addressed within the SORA and should

be subject to a separate risk assessment. This should be done in cooperation with the

organization responsible for the infrastructure, as they are most knowledgeable of the threats.

S.2.2 Semantic model in the context of SORA

(a) The semantic model is a key aspect to understanding the SORA and introduces concepts and

common terms for all users of the SORA.

(b) To facilitate effective communication of all aspects of the SORA, the methodology requires

standardized use of terminology for phases of operation5, procedures, and operational

volumes. The semantic model shown in Figure 2, provides a consistent use of terms for all SORA

users. Figure 3 provides a graphical representation of the model and a visual reference to

further aid the reader in understanding the SORA terminology.

4 Risk to involved persons should be mitigated through appropriate procedures. Involved persons should accept the risk of

the UAS operation by informed consent. 5 An operation may be a single flight or, multiple sequential and/or simultaneous flights, that are assessed under a single

SORA process.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 10 of 184

Figure 2 - SORA semantic model

Figure 3 - Graphical Representation of SORA Semantic Model

(c) The SORA considers two states of the operation – in control and loss of control. The SAIL score

of the operation is inversely proportional to the acceptable loss of control rate of the operation

to meet the safety objectives. The higher the SAIL score, the higher the level of integrity and

assurance of the operational safety objectives becomes, which should result in a decreased loss

of control rate for the operation.

S2.2.1 The operational volume

(a) The operational volume is defined as the volume in which the operation is intended to take

place safely.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 11 of 184

(b) It is made up of the flight geography and the contingency volume.

(c) The operational volume is the basis to determine the air risk class (ARC) of an operation.

(d) The main SORA process is applied to the operational volume and ground risk buffer. To protect

the adjacent area and airspace the UAS operation should be contained within the operational

volume.

S.2.2.2 The flight geography

(a) The flight geography is the volume where the UAS operates in normal operations.

(b) Depending on the type of the operation, the flight geography can be defined as a flight corridor

for each planned trajectory, a larger volume to allow for a multitude of similar flights with

changing flight paths or a set of different flight volumes fulfilling some specific conditions.

(c) Whenever a particular flight requires the UA to traverse or loiter/hold at a specific point of

interest, this point shall be included inside the flight geography. Refer to chapter A.5 of Annex

A for additional information.

(d) The flight geography should include trajectories and volumes required for diversions to

alternate destinations and operational procedures (e.g., in case of loss of C2 Link or miss-

approach).

S2.2.3 The contingency volume

(a) The contingency volume surrounds the flight geography. The outer limit of the contingency

volume is equivalent to the outer limit of the operational volume.

(b) Entry into this volume is always considered an abnormal situation and requires the execution

of appropriate contingency procedures to return the UA to the flight geography.

(c) The outer boundary of the flight geography should include sufficient margins for system and

operational errors (e.g., deviation from planned trajectory, map error and latency).

(d) It should be noted that an abnormal situation may also occur inside the flight geography.

S.2.2.4 The ground risk buffer

(a) The ground risk buffer is an area on the ground that surrounds the footprint of the contingency

volume.

(b) If the UA exits the contingency volume during a loss of control of the operation, it is expected

to safely terminate the operation within the ground risk buffer.

(c) The appropriate size of the ground risk buffer is based on the individual risk of an operation and

is driven by the flight characteristics of the UA and the identified containment provisions of the

SORA.

(d) The footprint of the operational volume plus the ground risk buffer is the area used to

determine the ground risk class (GRC).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 12 of 184

S.2.2.5 The adjacent area

(a) The adjacent area represents the ground area adjacent to the ground risk buffer where it is

reasonably expected a UA may crash after a loss of control situation resulting in a flyaway.

(b) While the adjacent area inner limit starts at the outer limit of the ground risk buffer, the outer

limit of the adjacent area is calculated starting from the inner limit of the ground risk buffer.

(c) The size of the adjacent area depends on the UA performance. Authorities should notice and

prevent cases where an applicant tries to include in the operational volume areas which are not

intended for use but are only there for manipulation of the composition of the adjacent area.

S.2.2.6 The adjacent airspace

(a) The adjacent airspace corresponds to the airspace where it is reasonably expected that a UA

may fly after a loss of control situation resulting in a flyaway.

(b) The adjacent airspace is the airspace adjacent to the operational volume.

S.2.3 States of the operation

S.2.3.1 Operation in control

(a) An operation is considered in control, when the remote crew is able to continue the

management of the current flight situation, such that no persons on the ground or in the air

onboard manned aircraft are put in immediate danger.

(b) This holds true for both normal and abnormal situations, however the safety margins in the

abnormal situation are reduced. In the abnormal state, it is the remote crews’ duty to try to

return the operation back into the controlled state by executing contingency procedures as

soon as practical.

(c) Normal operation

Utilises standard operating procedures, a set of instructions covering policies, procedures and

responsibilities set out by the UAS operator that supports operational personnel in ground and

flight UAS operations safely and consistently.

(d) Abnormal situation

i. An abnormal situation is an undesired state where it is no longer possible to continue the

flight using standard operating procedures, but the safety of the aircraft, persons on the

ground or in the air is not in immediate danger. In this case contingency procedures should

be applied.

ii. Contingency procedures are designed to potentially prevent a significant future event

(e.g., loss of control of the operation) that has an increased likelihood to occur due to the

current abnormal state of the operation. These procedures should return the operation

to a controlled state and allow the return to using standard operating procedures or allow

the safe cessation of the flight.

S.2.3.2 Loss of control of the operation

(a) Loss of control of the operation is a state that corresponds to situations:

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 13 of 184

i. when the outcome of the situation highly relies on providence, or

ii. which could not be handled by a contingency procedure.

(b) In the context of the semantic model, this includes situations where a UA has exited the

operational volume and is potentially operating over or in an area that may be characterised by

a different level of ground or air risk.

(c) The ‘loss of control’ state is also entered, if a UA does not follow the predefined route and the

remote pilot is unable to control it, it crashes or if an unplanned flight termination sequence is

executed, even if this happens inside the operational volume.

(d) Emergency procedures are executed in case of loss of control of the operation. They are

executed by the remote crew and may be supported by automated features of the UAS (or vice

versa) and are intended to mitigate the effect of failures that cause or lead to an emergency

condition (e.g. flight termination system). Emergency procedures should be activated as soon

as the UA reaches the boundary of the operational volume. However, as soon as the remote

crew identifies a failure condition where the UA cannot be recovered through contingency

procedures (e.g., loss of propulsion), the remote crew may initiate the emergency procedures

when the UAS is in the operation volume. Emergency procedures deal with affecting the UA to

either:

i. return to a state where the operation is ‘in control’, or

ii. minimize hazards until the flight has ended.

(e) Emergency response plan (ERP)

i. The ERP deals with the potential hazardous secondary or escalating effects after a loss of

control of the operation (e.g., timely intervention of emergency services).

ii. It is different from the emergency procedures, as it does not deal with the control of the

UA.

iii. The ERP is used for coordinating all activities needed to respond to incidents and

accidents.

(f) Containment is a feature consisting of technical and operational mitigations that are meant to

contain the flight of the UA within the defined operational volume and ground risk buffer and

reduce the likelihood of a loss of control of the operation resulting in a flyaway.

S.2.4 Robustness

(a) To properly understand the SORA process, it is important to introduce the key concept of

robustness.

(b) Robustness is the term used to describe the combination of two key characteristics of a risk

mitigation or operational safety objective: the level of integrity (i.e., how good the

mitigation/objective is at reducing risk), and the level of assurance (i.e., the degree of certainty

with which the level of integrity is ensured).

(c) The activities used to substantiate the level of integrity and assurance are detailed in the

Annexes B, C, D and E to AMC1 to Article 11. These annexes provide either guidance material

or reference industry standards and practices where applicable.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 14 of 184

(d) Table 1 provides guidance to determine the level of robustness based on the level of integrity

and the level of assurance.

Low assurance Medium assurance High assurance

Low integrity Low robustness Low robustness Low robustness

Medium integrity Low robustness Medium robustness Medium robustness

High integrity Low robustness Medium robustness High robustness

Table 1 – Robustness, integrity and assurance matrix

(e) For example, if an applicant demonstrates a medium level of integrity with a low level of

assurance the overall robustness will be considered as low as the robustness is equal to the

lowest level of either integrity or assurance.

(f) Any given risk mitigation or operational safety objective will have different provisions for the

different levels of robustness. The SORA contains three levels of robustness: low, medium and

high, commensurate with risk.

(g) Guidance for the level of assurance is provided below. An applicant is required in all cases

achieve the level of integrity and perform, produce or obtain any necessary evidence required.

i. In a low level of assurance the applicant declares that the required level of integrity has

been achieved. The competent authority will validate6 the compliance statement and may

decide to review the evidences at a later stage (e.g. during oversight).

ii. In a medium level of assurance the applicant has supporting evidence that the required

level of integrity has been achieved. This is typically achieved by means of testing or

operational data. The competent authority will validate6 the compliance statement and

the existence of the evidence. The competent authority may decide to review the

evidences at a later stage (e.g. during oversight).

iii. In a high level of assurance the achieved integrity is verified7 to be acceptable by the

competent authority or by an entity that is designated8 by the competent authority.

(h) The specific criteria defined in the SORA Annexes take precedence over the criteria defined in

paragraph (g) above.

(i) To accommodate national specificities that cannot and should not be standardised, the

competent authorities might require different activities to substantiate the level of robustness.

National specificities could include nationally sensitive infrastructure, protection of

environmental areas, etc.

S2.5 Roles and responsibilities

a. While performing an assessment using the SORA process several key actors might be required

to interact in different phases of the process. The main actors applicable to the SORA are

described in this section.

6 Refer to definition I.153 in Annex I to AMC to Article 11. 7 Refer to definition I.154 in Annex I to AMC to Article 11. 8 An entity designated by the competent authority should be understood in the meaning of a qualified entity as described

in Article 69 of Regulation (EU) 2018/1139. The competent authority may give to the designated entity the privilege to issue a certificate or the operational authorisation.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 15 of 184

b. Applicant – The applicant is the party seeking an operational authorisation. The applicant should

substantiate the safety of the operation by performing the SORA. Supporting material for the

assessment may be provided by third parties (e.g., the designer of the UAS or equipment, UTM

service providers, etc.).

c. UAS operator – The UAS operator is an applicant that has obtained an operational authorisation

from the competent authority. The operational authorisation allows the UAS operator to

perform a series of flights, provided that they are performed in accordance with the scope and

limitations of the operational authorisation, based on the SORA compliance demonstration. The

UAS operator is responsible for the safe operation of the UAS. Hence the compliant execution

of the procedures, training and other applicable programs as well as the observation of the

limits and other requirements of the applicable concept of operations are the UAS operator’s

obligation.

d. UAS design and production organisation – The UAS design and production organisation is the

party that designs and produces the UAS. In some cases, a UAS may be equipped with one or

more components (e.g., parachute) designed and produced by an entity other than the UAS

manufacturer and installed by a UAS component integrator (that may be also the same entity

designing the component or a different one or the UAS operator itself). It may be expected that

sometimes the design and production of the UAS or components are carried out by two

different organisations. The design and production organisation has unique design evidence

(e.g., system performance, system architecture, software/hardware development

documentation, test/analysis documentation, etc.) that they may choose to make available to

one or many UAS operator(s) or to the competent authority or to EASA to help substantiate the

operator’s SORA safety case. Alternatively, a design and production organisation may utilise the

SORA to target design objectives for specific or generalised operations, tailored to the relevant

SAIL. To obtain airworthiness approval(s), these design objectives could be complemented by

use of Light UAS certification specifications (CS) or industry consensus standards if they are

found acceptable by EASA.

e. Competent authority – The competent authority that is referred to throughout this AMC is the

authority designated by the Member State in accordance with Article 17 of Regulation (EU)

2019/947 to assess the safety case of UAS operations and to issue the operational authorisation

in accordance with Article 12 of the same regulation. The competent authority may accept an

applicant’s submission of an operations manual with an associated SORA based risk assessment.

Through the SORA process, the applicant may need to consult with the competent authority to

ensure consistent application or interpretation of individual steps. The competent authority

should also have oversight of the UAS operator in accordance with point h of article 18 of

Regulation (EU) 2019/947. The competent authority may decide to make use of ‘recognised

entities’ for reviewing supporting evidence for mitigations and operational safety objectives of

an application when required. In this case the competent authority keeps the responsibility

when issuing an operational authorisation based on the recommendation provided by the

‘recognised entity’. As alternative a competent authority may use a ‘designated entity’, also

referred as ‘qualified entity’ in accordance with Article 69 of Regulation (EU) 2018/1139. In this

case the ‘designated entity’ may receive the privilege to issue the operational authorisation.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 16 of 184

According to Regulation (EU) 2018/1139 (the EASA ‘Basic Regulation’), EASA is the competent

authority in the European Union to verify compliance of the UAS design and its components

with the applicable rules, while the authority that is designated by the Member State is the

competent authority to verify compliance with the operational requirements and compliance

of the personnel’s competency with those rules. The following elements are related to the UAS

design:

— the OSOs marked in Table 14 as those for which the designer is expected to develop the

evidences;

— M2 mitigation: criterion #1;

— verification of the system to contain the UAS to avoid an infringement of the adjacent

areas on the ground and/or adjacent airspace in accordance with Step#8 of the SORA

process.

If the UAS operation is classified as SAIL V and VI, compliance with the design provisions defined

by SORA (i.e. design-related OSOs, mitigation means linked with the design and containment

function) should be demonstrated through a type certificate (TC) issued by EASA according to

Annex I (Part 21) to Regulation (EU) No 748/20129, as defined in Article 40(1)(d) of Regulation

(EU) 2019/94510. For the other OSOs and mitigation means, the competent authority may verify

compliance.

If the UAS operation is classified as SAIL IV, compliance with the design-related SORA provisions

(i.e. design-related OSOs, mitigation means linked with the design and containment function)

should be demonstrated through a DVR11 issued by EASA. Evidence of compliance with the

other OSOs and mitigations (not related to design) will be provided to the competent authority

according to the level of robustness of the OSOs, that will assess them as part of the application

for the operational authorisation.

If the UAS operation is classified as SAIL I, II or III, the competent authority may accept a

declaration submitted by the UAS operator for the compliance with all OSOs and mitigations

related to design. The competent authority may check the statements of the UAS operator, in

particular with regard to the claimed level of integrity and robustness of the UAS for the

considered SAIL.

Despite the SAIL, when the claimed level of robustness of the mitigation means M2 or of

containment is high, the competent authority should require the UAS operator to use a UAS

with a DVR issued by EASA limited to compliance with those mitigation means12.

f. Air navigation service provider (ANSP) – The ANSP is the designated provider of air traffic service

in a specific area of operation (airspace). The ANSP assesses and/or should be consulted

whether the proposed operation can be safely conducted in the particular airspace that they

9 Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness

and environmental certification of aircraft and related products, parts and appliances, as well as for the certification. 10 Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country

operators of unmanned aircraft systems (OJ L 152, 11.6.2019, p. 1) (https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32019R0945).

11 https://www.easa.europa.eu/sites/default/files/dfu/guidelines_design_verification_uas_medium_risk.pdf 12 If the UAS has a DVR covering the full design, this may cover also the mitigation means.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 17 of 184

cover. Whether an ANSP approval would be required may depend on whether the particular

operation may be considered as being compliant with the rules of the air (thus being integrated

in the airspace) or should be managed as a contained hazard (for example through

segregation)13.

g. U-space service provider – U-space service providers are entities that provide services to

support safe and efficient use of airspace. These services may support an operator’s compliance

with their safety obligation and risk analysis.

h. Remote pilot in command (RPIC) – The remote pilot that is designated by the UAS operator as

being in command and charged with the safe conduct of the flight. Some UAS operations may

require employing more than one remote pilot with different tasks, however in this case only

one is responsible as remote pilot in command. For some UAS operations, there might be more

than one remote pilot. In any case, at every moment of the operation, there shall be only one

remote pilot in command (i.e. the one having the authority to cancel or delay any or all flight

operations, being responsible of the safety of the flight). This might be the case for the following

examples:

I. multiple remote pilots, all having similar tasks (one is acting as RPIC, the others are acting

as “backup” remote pilots);

II. operations where different persons in the remote crew may control some functions of

the UAS (e.g. airspace observers in a drone light show may activate the flight termination

system). A RPIC having the overall responsibility of the flight should be identified.

III. long flights where different remote pilots may be in command for a defined leg of the

flight. The operator should have clear handover procedures indicating at any time who is

the RPIC.

i. Remote crew – The remote crew includes all UAS operator personnel involved in the operation

of the UAS, with duties essential to the safe operation of the UAS. The remote pilot in command

is part of the remote crew.

j. Maintenance staff – Ground personnel in charge of maintaining the UAS before and after flight

in accordance with UAS maintenance instructions.

13 The role of ANSP as a function is distinct from that of the aviation regulator or the function of safety oversight.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 18 of 184

Section 3. The SORA walkthrough

Section 3 describes to the operator how to complete the required SORA’s steps.

S3.1 Introduction to the SORA walkthrough (GUIDANCE)

(a) This section describes how the SORA process is detailed in the document. The intent is to

provide both an applicant and a competent authority with clear guidance in terms of what is

expected from the SORA process.

(b) Following headers are applied:

i. Task Description: is a recommendation to be followed by the applicants completing the

SORA process.

ii. Outcome: is what is achieved when the task description has been completed.

iii. Instructions: is material provided to applicants to better identify and understand the steps

contained in the task description.

S3.2 Before starting the SORA process

S3.2.1 Outcome (GUIDANCE)

Determine whether the operator should carry out the SORA process.

S3.2.2 Task description (PROCEDURE)

(a) Before starting the SORA process, the following aspects should be verified:

i. if the UAS operator uses a tethered aircraft for which Regulation (EU) 2019/947 does not

apply14;

ii. if the operation falls under the open category;

iii. if the UAS operation is covered by STS 01 or STS 02 as defined by the Appendix 1 to

Regulation (EU) 2019/947 and the UAS used bear a class identification label C5 or C6;

iv. if the UAS operation is covered by one of the PDRAs published by EASA as AMC to Article

11 to Regulation (EU) 2019/947

v. if the operation falls under the certified category;

vi. if the operation is subject to specific no-go criteria from the competent authority.

(b) If none of the above cases apply, the SORA process should be applied.

14 According to Annex I of Regulation 2018/1139, the EU regulation is not applicable when the Uas operator uses a tethered

aircraft with: (a) no propulsion system, where the maximum length of the tether is 50 m, and where:

(i) the MTOM of the aircraft, including its payload, is less than 25 kg, or (ii) in the case of a lighter-than-air aircraft, the maximum design volume of the aircraft is less than 40 m3;

(b) a MTOM of no more than 1 kg. In this case national regulations apply.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 19 of 184

S3.3 The SORA process phases (GUIDANCE)

(a) As part of the SORA, it is critical to review the steps and to validate the assumptions and

derivations made throughout this process. The SORA process has a natural break point after Step

#9 (see Figure 4), from which the SORA process can be split into two phases.

i. Phase 1 focuses on the derivation of safety requirements and proposed means of

compliance, and

ii. Phase 2 focuses on compliance with the derived safety from Phase 1.

(b) The phases ensure there is a review of the first phase outputs for the applicant to determine if

any adjustments to the proposed operation are required before undertaking the second phase.

This approach should minimise unnecessary iterations in the operational procedures, remote crew

requirements, and system(s) design in the proposed operations and mitigations.

(c) An additional benefit of the phases is that it provides an engagement point with the competent

authority. This is intended to support reaching a preliminary agreement that Phase 1 has been

undertaken correctly, and that the derived requirements and proposed means of compliance for

Phase 2 are appropriate.

Figure 4 – The SORA process phases

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 20 of 184

S3.3.1 Phase 1 (Requirements derivation) (GUIDANCE)

(a) The purpose of Phase 1 is to derive all relevant safety requirements based on the proposed

operation which should result in a document suite that sufficiently describes the proposed

operation(s). This should include the relevant information, safety claims and derived requirements

of Step #1 to Step #9. The applicant should collect explanations, but not the entire justification, of

the means by which the applicant will demonstrate compliance with any safety claims and derived

in Phase 1. This can assist both the applicant and competent authority in ensuring any means of

compliance proposed is valid and will result in satisfying the safety claims or . This may take the

form of an initial compliance matrix (an example is provided in, Chapter A.4 of Annex A to AMC 1

to Article 11).

(b) The results of this phase may be the basis for a pre-application evaluation by the competent

authority. The competent authority may or may not be able to provide a formal agreement until

the submission and review of final compliance evidence (covered in Phase 2).

(c) It is recommended that the applicant contacts the competent authority as early as possible in

order to present the available information and reach a common initial understanding and in-

principle agreement on the safety claims, in particular the final GRC, residual ARC, and SAIL.

S3.3.2 Phase 2 (Compliance with requirements) (GUIDANCE)

(a) Phase 2 occurs after the completion of Step #9. This phase is a final set of iterations to complete

the SORA process. This should result in a SORA Comprehensive Safety Portfolio (CSP), which

collects the work done in all previous steps of the SORA into a comprehensive, justified

document suite showing compliance with the SORA provisions.

(b) If completed correctly, the CSP should provide all the necessary claims, arguments and evidence

to support the assessment and approval of the proposed operation.

Section 4. The SORA process

S4.1 Step #1 – Documentation of the proposed operation(s)

S4.1.1 Introduction (GUIDANCE)

Step #1 provides an opportunity for an applicant to collect and present contextual information on

the proposed operation and the intended safety claims made during Phase 1 of the SORA process.

S4.1.2 Outcome(GUIDANCE)

A sufficiently detailed operational concept, that allows the applicant to continue through the SORA

process.

S4.1.3 Task description (PROCEDURE)

(a) Compile operational, technical, and organisational information. This may include:

i. Various maps, figures, diagrams and other information detailing the operational volume,

ground risk buffers, adjacent area, and adjacent airspace to facilitate the determination

of:

A. the intrinsic ground risk class (i.e., population density maps, land use information),

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 21 of 184

B. the initial air risk class (i.e., airspace use information, aerodromes, and airspace

charts), and

C. the adjacent areas.

ii. Information on the operational, technical, and organisational elements of:

A. the operation and functions during flight, including intended flight profiles, states,

and modes that provide safety throughout the nominal, contingency, and

emergency phases of flight,

B. any ground and air risk mitigations (strategic and tactical) used to reduce the

intrinsic ground risk or initial air risk.

(b) A description of the contingency volume and ground risk buffers, and how they were

determined.

(c) The applicant may use Chapter A3 of Annex A to AMC1 to Article 11to assist in understanding

the type of data that needs to be presented and any other information that supports the risk

assessment to the authority.

S4.2 Step #2 – Determination of the intrinsic ground risk class (iGRC)

S4.2.1 Introduction (GUIDANCE)

(a) In this step the UAS operator is required to assess the intrinsic ground risk of the operational

volume and ground risk buffer.

(b) No ground risk mitigations will be applied at this step, this may be completed in Step #3.

S4.2.2 Outcome (GUIDANCE)

Calculation and documentation of the intrinsic ground risk class.

S4.2.3 Task description (PROCEDURE)

iGRC footprint

(a) Identify the maximum characteristic dimension and the maximum speed of the UA.

(b) Identify the iGRC footprint:

i. Identify the flight geography;

ii. calculate the contingency volume;

iii. calculate the initial ground risk buffer (the final ground risk buffer calculation will be

completed in Step #8);

(c) Identify the highest population density within the iGRC footprint.

(d) Identify the iGRC of the footprint using Table 2 for fixed wing, rotorcraft – helicopter, rotorcraft

– gyroplane, VTOL capable aircraft (including multirotor)15.

15 In case of lighter than air configurations the UAS operator may propose a GRC class based on the model defined in Annex F,

available at http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 22 of 184

Intrinsic UAS Ground Risk Class

Maximum UA characteristic dimension

1m 3m 8m 20m 40m

Maximum speed 25 m/s 35 m/s 75 m/s 120 m/s 200 m/s

Maximum iGRC population density (people/km2)

Controlled ground area 1 1 2 3 3

< 5 2 3 4 5 6

< 50 3 4 5 6 7

< 500 4 5 6 7 8

< 5,000 5 6 7 8 9

< 50,000 6 7 8 9 10

> 50,000 7 8 Not part of SORA

— A UA with a take off mass less than or equal to 250g and having a maximum speed less than or equal

to 19 m/s is considered to have an iGRC of 1 regardless of population density.

— A UA expected to not penetrate a standard dwelling will get a -1 GRC reduction in Step 3 from the

M1(A) sheltering mitigation when not overflying large open assemblies of people, see Annex B for

additional details.

Table 2 - Intrinsic ground risk class (GRC) determination

(e) For UA with a maximum characteristic dimension greater than 40m the iGRC should be

calculated following the guidance in Appendices A and B in Annex F16.

S4.2.4 Instruction (GUIDANCE)

Intrinsic UA characteristics

(a) For maximum UA characteristic dimension examples refer to definition I.141 of Annex I to

AMC 1 to Article 11.

(b) Maximum speed:

i. The maximum speed is conservatively defined as the maximum possible commanded

airspeed of the UA, as defined by the designer,

ii. This is not the mission specific maximum commanded airspeed of the UA as reducing the

mission airspeed may not necessarily reduce the impact area. Mitigations that limit

airspeed below the maximum speed value during an impact can be accounted for in Annex

B to AMC 1 Article 11, part of Step #3.

16 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 23 of 184

Identification of the iGRC

(a) The iGRC is found at the intersection of the applicable maximum population density and the left

most column matching both criteria, the maximum UA characteristic dimension and the

maximum speed in Table 2.

(b) The applicant can provide substantiation to the competent authority for a different iGRC. See

Annex F17 Appendix A for further guidance.

(c) Operations that do not have a corresponding iGRC (i.e., grey cells on the table) are outside the

scope of the SORA methodology. Applicants falling in these categories should consider the

certified category.

(d) In the event that population density values are not available or not accurate the UAS operator

may use qualitative descriptors for the iGRC table, the following approximations can be used as

guidance:

Quantitative Population

Value (people/km2)

Qualitative Descriptors

Area Description

Controlled ground area

Controlled ground / Extremely remote

Areas that are controlled where unauthorized people are not allowed to enter. Hard to reach areas (mountains, remote deserts, etc), large bodies of water away from expected boat traffic, where it is reasonably expected that people will rarely be present.

< 5 Remote

Areas where people may be, such as forests, deserts, large farm parcels, etc. Areas where there is approximately 1 small building every km^2.

< 50 Lightly populated Areas of small farms. Residential areas with very large lots (~ 4 acres or 16,000 m^2).

< 500 Sparsely populated / Residential lightly populated

Areas comprised of homes and small businesses with large lot sizes (~1 acre or 4,000 m^2).

< 5,000 Suburban / Low density metropolitan

Areas of single-family homes on small lots, apartment complexes, commercial buildings, etc. Can contain multistorey buildings, but generally most should be below 3-4 stories.

< 50,000 High density metropolitan

Areas of mostly large multistorey buildings. The downtown area of most cities. Areas of dense skyscrapers.

> 50,000 Assemblies of people The densest areas in the largest cities. Large gatherings of people such as professional sporting events, large concerts, etc.

Table 3 - correspondence between quantitative and qualitative assessment of the iGRC

17 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 24 of 184

iGRC Footprint

Figure 5 - Visualisation of the intrinsic GRC Footprint

(a) The applicant needs to have defined the area at risk when conducting the operation, which is

defined as the intrinsic GRC footprint. This is composed of the operational volume plus the

ground risk buffer as shown in Figure 5.

(b) The operational volume is composed of the flight geography and the contingency volume (refer

respectively to points S2.2.3, S2.2.4 and S2.2.5 for additional information). To determine the

operational volume the applicant should consider the position keeping capabilities of the UAS

in 4D space (latitude, longitude, height and time). In particular, the accuracy of the navigation

solution, the flight technical error of the UAS, the path definition error (e.g., map error) and

latencies should be accounted for in this determination.

(c) The iGRC footprint is used to determine the population density. It is expected that for many

flight operations, the iGRC footprint may cover segments with different population densities.

The segment with the highest population density should be used when determining the iGRC.

Ground risk buffer

(a) An appropriate initial ground risk buffer could be defined:

i. with a 1-to-118 principle, or

ii. a different ground risk buffer value may be proposed by the applicant using the principles

outlined in Section 4, Criteria 3 of Annex E of AMC 1 to Article 11.

(b) Cases where the final ground risk buffer may be different than the initial one could include:

i. Medium and high level of containment,

ii. Use of ground risk mitigations, such as a parachute.

Controlled ground area

(a) A controlled ground area is defined as the intended UAS operational area where only involved

persons (if any) are present.

(b) Controlled ground areas are a way to strategically mitigate the ground risk; the assurance that

there will be no uninvolved persons in the iGRC footprint is under the full responsibility of the

UAS operator. The competent authority may request evidence on how the UAS operator will

ensure control of the area during operation.

18 For an explanation of the 1:1 rule, see AMC1 UAS.OPEN.030(1). Please note that in this AMC the 1:1 rule is applied to

evaluate the distance from people. For the evaluation of the size of the ground risk buffer.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 25 of 184

Non-typical cases

(a) There are certain cases, for example aircraft whose maximum characteristic dimension and

maximum speed differ significantly from the selected column, which may have a large effect on

the iGRC. This may not be well represented in the iGRC table and lead to an increase or decrease

in iGRC. See Annex F19 Section 1.8 for further guidance.

(b) The applicant may consider that the iGRC is too conservative for their UA. Therefore, an

applicant may decide to calculate the iGRC by applying the mathematical model defined in

Annex F19 Section 1.8. The UAS operator should choose the column that matches the critical

area calculated for the UA that is used, as identified in Table B.8 of Annex B to AMC 1 to Article

11. An automatic tool to calculate the critical area of a UA is available on the EASA website20.

Population density information

(a) Determining the population density to calculate the iGRC in Step #2 should be done using maps

with appropriate grid size based on the operation. Competent Authorities should designate

specific maps to be used for determining population densities.

(b) If there are no available population density maps acceptable to the NAA, the qualitative

population density descriptors (see Table 3) may be used to estimate the population density

band in the operational volume and ground risk buffer. Alternatively, the authority may require

or permit applicants to provide appropriate population density maps. Table 4 below presents

the suggested optimal grid size for different maximum heights of the operational volume:

Max. Height (AGL) of the OV Suggested Optimal Grid Size

(meter x meter) Feet Meters

500 152 >200 x 200

1,000 305 >400 x 400

2,500 762 >1,000 x 1,000

5,000 1,524 > 2,000 x 2,000

10,000 3,048 >4,000 x 4,000

20,000 6,096 >5,000 x 5,000

60,000 18,288 >10,000 x 10,000

Table 4 - Suggested grid size for authoritative maps

(c) The authority designated map should be at the suggested optimal grid size. If mapping products

do not exist at the suggested optimal grid size, the authority should use the closest grid size

available. If the closest grid size available is smaller than the suggested optimal grid size, then

the map should be smoothed to the suggested optimal grid size.

(d) If the applicant identifies inaccuracies in the designated static population density map, they can

provide alternative data that demonstrates the correction in the estimated average population

density of the area (i.e., using other mapping products, satellite imagery, on-site inspections,

local knowledge of the area, etc.). If accepted by the competent authority, the applicant can

19 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf 20 https://www.easa.europa.eu/en/domains/drones-air-mobility/operating-drone/critical-area-assessment-tool-caat

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 26 of 184

use the alternative data to determine the iGRC. Use of time-based restriction arguments (e.g.,

flying at night) for reduction of people at risk on the ground are addressed in SORA Step#3.

(e) Additional information can be found in Annex F21 Section 3.2.

S4.3 Step #3 – Final Ground Risk Class (GRC) determination (optional)

S4.3.1 Introduction (GUIDANCE)

(a) The intrinsic risk of a person being struck by the UA during a loss of control of the operation can

be reduced by means of acceptable mitigations.

(b) In this step, the UAS operator may identify ground risk mitigations and reduce the GRC of the

operation.

S4.3.2 Outcome (GUIDANCE)

(a) Identification of the mitigations applied to reduce the iGRC for the iGRC footprint;

(b) Identification of the applicable mitigation provisions;

(c) Determination of the final GRC by subtracting the credit derived by the mitigations from the

iGRC;

(d) Collection of information and references used to substantiate the application of the ground risk

mitigation(s).

S4.3.3 Task description (PROCEDURE)

(a) Identify the applicable mitigations listed in Table 5 that could lower the iGRC of the iGRC

footprint. All mitigations must be applied in numerical sequence:

Level of Robustness

Mitigations for ground risk Low Medium High

M1(A) - Strategic mitigations - Sheltering -1 -2 N/A

M1(B) - Strategic mitigations - Operational restrictions N/A -1 -2

M1(C) - Tactical mitigations - Ground observation -1 N/A N/A

M2 - Effects of UA impact dynamics are reduced N/A -1 -2

Table 5 - Mitigations for Final GRC determination

(b) Identify in Annex B to AMC 1 Article 11 the provisions needed to comply with in order to receive

appropriate credit for the mitigation.

(c) In case a M2 mitigation that affects the UA descent behaviour is used, assess if the size of the

ground risk buffer defined in Step #2 is still valid.

(d) Determine the final GRC by applying the appropriate correction to the iGRC.

21 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 27 of 184

S4.3.4 Instruction (GUIDANCE)

Ground risk mitigations

(a) Step #3 is an optional step.

(b) The mitigations used to modify the iGRC have a direct effect on the safety objectives associated

with an operation, and therefore it is important to ensure their robustness. This has particular

relevance for technical mitigations (e.g., parachute).

(c) The Final GRC determination is based on the availability and correct application of the

mitigations to the operation. Table 5 provides a list of potential mitigations and the associated

relative correction factor. All mitigations must be applied in numeric sequence to perform the

assessment. Annex B to AMC1 Article 11 provides additional details on the robustness of each

mitigation. Competent authorities may define or accept additional mitigations and the relative

correction factors.

(d) A quantitative approach to mitigations allows a reduction in the iGRC by 1 point if the mitigation

reduces the at-risk population to the next lowest iGRC population band. This is in most cases

approximately a factor of 10 (90% reduction) compared to the risk that is assessed before the

mitigation means are applied. Such quantitative criteria may be used to validate the risk

reduction that is claimed when applying Annex B to AMC1 Article 11 .

(e) In rare situations, iGRC reductions larger than the ones shown in Table 5 may be possible. Refer

to Annex B to AMC1 Article 11 for further guidance.

(f) When applying all the M1 mitigations, the final GRC cannot be reduced to a value lower than

the lowest value in the applicable column in Table 2. This is because it is not possible to reduce

the number of people at risk below that of a controlled ground area.

(g) In case the mitigation influences the descent behaviour of the UA, for example by using a

parachute, the ground risk buffer size should be redefined using the updated assumptions

including the effects of the mitigation means.

(h) Additional information can be found in Chapter A.3 if Annex A to AMC1 Article 11, for guidance

on presenting the data supplementing the risk assessment to the competent authority.

Multiple partial mitigations

For situations where multiple partial mitigations do not meet the criteria within Annex B individually

but when taken together achieve cumulative order(s) of magnitude reductions, the competent

authority may accept a reduction of the final GRC score.

What if the final GRC is greater than 7?

If the final GRC is greater than 7, the operation is considered to have more risk than the SORA is

designed to support. The applicant may discuss options available with the competent authority, such

as using the certified category or a new application (as stated in Figure 1).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 28 of 184

S4.4 Step #4 – Determination of the initial Air Risk Class (ARC)

S4.4.1 Introduction to the air risk process (GUIDANCE)

(a) The SORA uses the operational airspace defined in Step 1 as the baseline to evaluate the intrinsic

risk of mid-air collision with manned aircraft and for determining the initial air risk class (ARC).

The initial ARC may be modified/lowered by applying strategic and tactical mitigation means.

An example of strategic mitigations to reduce collision risk may be by operating during certain

times or within certain boundaries. After applying strategic mitigations any residual risk of mid-

air collision is addressed by means of tactical mitigations.

(b) Tactical mitigations take the form of detect and avoid systems or alternate collaborative means,

such as ADS-B, systems transmitting on SRD 860 frequency band, U-Space services22 or

operational procedures. Depending on the residual risk of mid-air collision, the tactical

mitigation performance requirement(s) may vary.

(c) As part of the SORA process, the UAS operator should cooperate with the relevant service

provider for the airspace (e.g., ANSP or U-Space service provider) and obtain the necessary

authorisations. Additionally, generic local authorisations or local procedures allowing access to

a certain portion of airspace may be used if available. The competent authority or ANSP may

impose additional strategic or tactical mitigations on airspace authorisations, taking into

account uncertainties related to UA reliability, conspicuity, and other factors.

(d) The SORA recommends that, irrespective of the results of the risk assessment, the operator pay

particular attention to all features that may increase the detectability of the UA in the airspace.

Therefore, technical solutions that improve the electronic conspicuousness or detectability of

the UAS are recommended.

S.4.4.2 Outcome (GUIDANCE)

(a) Identification of the risk of collision between the UA and a manned aircraft;

(b) Documentation of information and references used to determine the initial ARC of the

operational volume.

S.4.4.3 Task description (PROCEDURE)

Operational volume

(a) Identify the vertical limit of the operational volume:

i. Identify the vertical limit of the flight geography;

ii. Identify and document the contingency procedures in case the UA will exceed the height

of the flight geography;

iii. Evaluate the maximum height the UA will travel above the limit of the flight geography

when applying the contingency procedures before it enters again in the flight geography.

(b) Check if there are official airspace collision risk maps available. The competent authority, ANSP,

or U-space service provider, may elect to directly map the airspace collision risks using airspace

characterization studies. These maps would directly show the initial/residual air risk class (ARC)

22 Some U-Space services could also be used as strategic mitigations.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 29 of 184

for a particular airspace. If the competent authority, ANSP, or U-space service provides an air

collision risk map (static or dynamic), the applicant should use that service to determine the

initial/residual ARC and go directly to section S4.5 “Application of strategic mitigations” to

reduce the initial ARC, provided that a further reduction is still possible.

(c) If point b is not applicable, identify the initial ARC of the operational volume using the decision

tree found in Figure 6.

Figure 6 - ARC assignment process

S4.4.4 Instruction (GUIDANCE)

Identification of the initial ARC

(a) As seen in Figure 6, the airspace is categorized into 12 aggregated collision risk categories. These

categories were characterized by altitude, controlled versus uncontrolled airspace,

airport/heliport versus non-airport/non-heliport environments, airspace over urban versus

rural areas, and lastly atypical (e.g., segregated) versus typical airspace. The categories

correspond to the airspace encounter classes (AECs), which provide a further qualitative

delineation of unmitigated collision risk that is elaborated in Annex C.

(b) During the UAS operation, the operational volume may span many different airspace

environments. The applicant needs to do an air risk assessment for the entire range of the

operational volume. An example scenario of operations in multiple airspace environments is

provided at the end of Annex C to AMC1 Article 11.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 30 of 184

(c) The ARC is a qualitative classification of the rate at which a UAS would typically encounter a

manned aircraft within that volume of airspace. The ARC is an initial assignment of the

aggregated collision risk for the airspace, before mitigations are applied. Actual collision risk of

a specific local operational volume could be much different and can be addressed in the

application of strategic mitigations to reduce the ARC section (this step is optional, see section

S4.5).

(d) Although the unmitigated risk captured by the initial ARC is conservative, there may be

situations where that conservative assessment may not suffice. It is important that both the

competent authority and operator take great care to understand the operational volume and

under what circumstances the definitions in Figure 6 could be invalidated. In some situations,

the competent authority may raise the operational volume initial ARC to a level which is higher

than that indicated by Figure 6. The ANSP should be consulted to assure that the assumptions

related to the operational volume are accurate.

(e) A competent authority may designate parts of their airspace as atypical. ARC-b, ARC-c, ARC-d

are generally defining airspace with increasing risk of collision between a UAS and manned

aircraft.

Identification of the vertical limit of the operational volume

(a) The vertical limit of the flight geography is the maximum height where the UA is intended to

operate in normal conditions.

(b) On top of the flight geography the UAS operator should identify the extent of the contingency

volume as the maximum height the UA will travel when applying the contingency procedures.

Atypical air environment

(a) An atypical air environment (leading to ARC-a classification) is defined as airspace where the

risk of collision between a UAS and manned aircraft is acceptably low without the addition of

any tactical mitigation. This is usually the case, when it can be generally expected that no

manned aircraft use the airspace volume intended for the operation.

(b) Examples may include operation in reserved or restricted airspaces, or operation at very low

altitudes (including in close proximity to obstacles) in those areas where manned aircraft

generally do not operate23.

S4.5 Step #5 – Application of strategic mitigations to determine residual ARC (optional)

S.4.5.1 Introduction (GUIDANCE)

(a) As stated before, the ARC is a qualitative classification of the rate at which a UAS would

encounter a manned aircraft in a given airspace environment. However, it is recognized that

the operational volume may have a collision risk that differs from the Initial ARC assigned.

(b) If an applicant considers that the initial ARC assigned is too high for the condition in the local

operational volume, then refer to Annex C to AMC1 Article 11 for the ARC reduction process.

23 Refer to definition I.19 in Annex I to AMC1 to Article 11.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 31 of 184

(c) If the applicant considers that the initial ARC assignment is correct for the condition in the local

operational volume, then that initial ARC becomes the residual ARC.

S.4.5.2 Outcome (GUIDANCE)

(a) Identification of the strategic mitigations applied to reduce the initial ARC of the operational

volume.

(b) Identification of the residual ARC.

(c) Documentation of information and references used to support the application of strategic

mitigations.

S.4.5.3 Task description (PROCEDURE)

(a) Identify the applicable strategic mitigations listed in Section 5 of Annex C to AMC1 Article 11.

(b) Identify the residual ARC of the operational volume following the process listed in Section 6 of

Annex C to AMC1 Article 11.

(c) Utilise Chapter A3 of Annex A to AMC1 Article 11, for further guidance on presenting the data

supplementing the risk assessment to the authority.

(d) If flying in VLOS, consider the additional guidance below.

S.4.5.4 Instruction (GUIDANCE)

Application of the strategic mitigations

For VLOS operations or operations where the remote pilot is supported by one or multiple airspace

observers (located in a way that the UA is always at a VLOS distance of the remote pilot or of one

airspace observer that is able to scan the sky and communicate real time with the remote pilot

informing of possible other manned or unmanned aircraft in the area of operation24), the initial air risk

class can be reduced by one class. In these conditions, the crew is assumed to have the ability to assess

the other aircraft activity in the airspace and therefore is able to lower the encounter rate, applying

this mitigation both before and during the operation. The mitigation cannot be used to reduce the ARC

to an ARC-a. In ARC-d environments, an additional agreement with ATC might be required.25

S4.6 Step #6 – Tactical mitigation performance requirement (TMPR) and robustness levels

S4.6.1 Introduction (GUIDANCE)

Tactical mitigations are applied to mitigate any residual risk of a mid-air collision needed to achieve

the applicable airspace safety objective.

S4.6.2 Outcome (GUIDANCE)

(a) Identification of the applicable TMPR and corresponding level of robustness.

(b) Collection of information and references to be used to support the compliance with the TMPR.

24 This type of operation is some times referred to as ‘EVLOS’. 25 This information will be reflected in a future version of Annex C.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 32 of 184

S.4.6.3 Task description (PROCEDURE)

Identify if flying in VLOS or BVLOS.

VLOS Operations

(a) Develop and document a VLOS de-confliction scheme, in which it is explained which methods

will be used for detection, and

(b) Define the associated criteria applied for the decision to avoid incoming traffic. In case the

remote pilot relies on detection by aerial observers, the use of phraseology will have to be

described as well.

BVLOS Operations

(a) Identify the applicable TMPR level deriving it from the residual ARC using Table 6.

(b) Identify the applicable TMPR according to Section 5 of Annex D to AMC1 Article 11.

(c) Utilise Chapter A.3 of Annex A to AMC1 Article 11, for further guidance on presenting the data

supplementing the risk assessment to the authority.

Residual ARC Tactical mitigation performance requirements (TMPR) and

corresponding level of robustness

ARC-d High

ARC-c Medium

ARC-b Low

ARC-a No requirement

Table 6 - Tactical mitigation performance requirement (TMPR) and TMPR level of robustness

assignment

S.4.6.4 Instruction (GUIDANCE)

Applications of tactical mitigations

Tactical mitigations will take the form of either ‘see and avoid’” (i.e., operations under VLOS) or may

require a system which provides an alternate means of achieving the applicable airspace safety

objective (operation using a detect and avoid (DAA) system, or multiple DAA systems). Annex D to

AMC 1 Article 11 provides the method for applying tactical mitigations.

VLOS operations

(a) VLOS is considered an acceptable tactical mitigation for collision risk for all ARC levels.

(b) Notwithstanding the above, the operator is advised to consider additional means to increase

situational awareness with regard to air traffic operating in the vicinity of the operational

volume.

(c) In the case of multiple segments of the flight, those segments done under VLOS do not have to

meet the TMPR nor the TMPR robustness requirements, whereas those done BVLOS do need

to meet the TMPR and the TMPR robustness requirements.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 33 of 184

(d) In general, the VLOS provisions are applicable when one or more airspace observers are

employed. In this case additional requirements over and above VLOS may be proposed,

including definition of procedures and phraseology. Communication latency between remote

pilot and airspace observers should be less than 15 seconds.

(e) For VLOS operations, it is assumed that an airspace observer is not able to detect traffic beyond

2 NM. (Note that the 2 NM range is not a fixed value and may largely depend on atmospheric

conditions, aircraft size, geometry, closing rate, etc.). Therefore, the operator may have to

adjust the operation and /or procedures accordingly.

Tactical mitigation performance requirement (TMPR) levels

(a) High TMPR (ARC-d): This is airspace where either the manned aircraft encounter rate is high,

and/or the available strategic mitigations are Low. Therefore, the resulting residual collision

risk is high, and the TMPR is also high. In this airspace, the UAS may be operating in integrated

airspace and will have to comply with the operating rules and procedures applicable to that

airspace, without reducing existing capacity, decreasing safety, negatively impacting current

operations with manned aircraft, or increasing the risk to airspace users or persons and

property on the ground. This is no different than the requirements for the integration of

comparable new and novel technologies in manned aviation. The performance level(s) of those

tactical mitigations and/or the required variety of tactical mitigations is generally higher than

for the other ARCs. If operations in this airspace are conducted more routinely, the competent

authority is expected to require the operator to comply with the recognised DAA system

standards (e.g., those developed by RTCA SC-228 and/or EUROCAE WG-105).

(b) Medium TMPR (ARC-c): A medium TMPR will be required for operations in airspace with a

moderate likelihood of encounter with manned aircraft, and/or where the strategic mitigations

available are medium robustness. Operations with a medium TMPR will likely be supported by

systems currently used in aviation to aid the remote pilot with detection of other manned

aircraft, or on systems designed to support aviation that are built to a corresponding level of

robustness. Traffic avoidance manoeuvres could be more advanced than for a low TMPR.

(c) Low TMPR (ARC-b): A low TMPR will be required for operations in airspace where the likelihood

of encountering another manned aircraft is low but not negligible and/or where strategic

mitigations address most of the risk and the resulting residual collision risk is low. Operations

with a low TMPR are supported by technology that is designed to aid the remote pilot in

detecting other traffic, but which may be built to lesser standards. For example, for operations

below 500 feet AGL, the traffic avoidance manoeuvres are expected to mostly be based on a

rapid descent to an altitude where manned aircraft are not expected to ever operate.

(d) No TMPR (ARC-a): This is airspace where the manned aircraft encounter rate is expected to be

extremely low, and therefore there is no need for a TMPR. It is defined as airspace where the

risk of collision between a UAS and manned aircraft is acceptable without the addition of any

tactical mitigation. An example of this may be UAS flight operations in some parts of Alaska or

northern Sweden where the manned aircraft density is so low that the airspace safety threshold

could be met without any tactical mitigation.

(e) Annex D to AMC1 Article 11 provides information on how to satisfy the TMPR based on the

available tactical mitigations and the TMPR Level of Robustness.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 34 of 184

Guidance on airspace / operation requirements

(a) Modifications to the initial and subsequent approvals may be required by the competent

authority or ANSP as safety and operational issues arise.

(b) The operator and competent authority need to be cognizant that the ARCs are a generalized

qualitative classification of collision risk. Local circumstances could invalidate the aircraft

density assumptions of the SORA, for example with special events. It is important that both the

competent authority and operator fully understand the airspace and air-traffic flows and

develop a system which can alert operators to changes to the airspace on a local level. This will

allow the operator to safely address the increased risks associated with these events.

(c) There are many airspaces, operational and equipage requirements which have a direct impact

on the collision risk of all aircraft in the airspace. Some of these requirements are general and

apply to all airspaces, while some are local and are required only for a particular airspace. The

SORA cannot possibly cover all the possible requirements required by the competent authority

for all conditions in which the operator may wish to operate. The applicant and the competent

authority need to work closely together to define and address these additional requirements.

(d) The SORA process should not be used to support operations of a UAS in a given airspace without

the UAS being equipped with the required equipment for operations in that airspace (e.g.

equipment required to ensure interoperability with other airspace users). In these cases,

specific exemptions may be granted by the competent authority. Those exemptions are outside

the scope of the SORA.

(e) Operations in controlled airspace, an airport/heliport environment or a Mode-C

Veil/Transponder Mandatory Zone (TMZ) will likely require prior approval from the ANSP. The

applicant should ensure that they coordinate with the relevant ANSP/authority prior to

commencing operations in these environments.

S4.7 Step #7 – Specific Assurance and Integrity Levels (SAIL) determination

S.4.7.1 Introduction (GUIDANCE)

(a) The SAIL parameter consolidates the ground and air risk analyses and drives the required

activities.

(b) The SAIL represents the level of confidence that the UAS operation will stay under control.

S.4.7.2 Outcome (GUIDANCE)

Identification of the SAIL.

S.4.7.3 Task description (PROCEDURES)

Identify the SAIL associated with the proposed operation deriving it from the final GRC and residual

ARC using Table 7.

SAIL Determination

Residual ARC

Final GRC a b c d

≤2 I II IV VI

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 35 of 184

3 II II IV VI

4 III III IV VI

5 IV IV IV VI

6 V V V VI

7 VI VI VI VI

>7 Operation classified in the certified category

Table 7 - SAIL determination

S.4.7.4 Instruction (GUIDANCE)

(a) The level of confidence that the operation will remain in control is represented by the SAIL.

(b) The SAIL is not quantitative but instead corresponds to:

i. the level of OSO robustness to be complied with (see Table 14),

ii. description of activities that might support compliance with those objectives, and

iii. the evidence that indicates the objectives have been satisfied.

S.4.8 Step #8 – Determination of containment provisions

S.4.8.1 Introduction (GUIDANCE)

(a) The containment provisions ensure that the target level of safety can be met for both ground

and air risk in the adjacent area.

(b) The containment provisions are derived from the difference between the final ground risk level

in the operational volume plus ground risk buffer, and the final ground risk level in the adjacent

area.

(c) There are three possible levels of robustness for containment: low, medium and high; each with

a set of safety requirement described in Annex E to AMC1 Article 11.

S.4.8.2 Outcome (GUIDANCE)

(a) A set of operational limits for population in the adjacent area.

(b) A derived level of robustness for containment.

S.4.8.3 Task description (PROCEDURE)

a) If the UA has a take-off weight of less than 250g apply low containment with no required

operational limits for the population in the adjacent area and go to Step #9. However when

conducting a multiple simultaneous operation (MSO), the competent authority may require to

have additional considerations related to safety and security.

Otherwise:

b) Determine the size and population characteristics of the adjacent area:

i. Calculate the size of the adjacent area for the operation. The lateral outer limit of the

adjacent area is calculated from the operational volume as the distance flown in 3 minutes

at maximum speed of the UA:

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 36 of 184

A. if the distance is less than 5 km, use 5 km,

B. if the distance is between 5 km and 35 km, use the distance calculated,

C. if the distance is more than 35 km, use 35 km.

ii. Calculate the average population density between the outer limit of the ground risk buffer

and the outer limit of the adjacent area.

iii. Assess the presence of outdoor assemblies of people during the time when the flight takes

place within 1 km of the outer limit of the operational volume.

c) Determine a set of operational limits appropriate for intended operation using the columns in

Tables 8-13

i. Choose an operational limit for the acceptable average population density in the

established adjacent area.

ii. Choose an operational limit for the acceptable size of assemblies of people within 1km

surrounding the operational volume.

d) Use Tables 8-13 to identify the required containment robustness level for the chosen

operational limits, the characteristic dimension of the UA and the SAIL of the operation.

1 m UA (< 25 m/s) Sheltering assumed applicable for the UA in the adjacent area

Average population density allowed

No upper limit < 50,000 ppl/km2

Outdoor assemblies allowed within 1km of the OPS volume

> 400k Assemblies of 40k to

400k Assemblies < 40k

SAIL

I & II High Medium Low

III Medium Low Low

IV & VI Low Low Low

V & VI Low Low Low

Table 8 - Containment provisions 1m UA

3 m UA (< 35 m/s) Shelter applicable for the UA in the adjacent area

Average population density allowed

No upper limit < 50,000 ppl/km2

< 5,000 ppl/km2

Outdoor assemblies allowed within 1km of the operational

volume > 400k

Assemblies of 40k to 400k

Assemblies < 40k people

SAIL

I & II Out of scope High Medium Low

III Out of scope Medium Low Low

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 37 of 184

IV Medium Low Low Low

V & VI Low Low Low Low

Table 9 - Containment provisions 3m UA with shelter assumption

3 m UA (< 35 m/s) Shelter not applicable for the UA in the adjacent area

Average Population density allowed

No Upper Limit < 50,000 ppl/km2 < 5,000 ppl/km2

< 500 ppl/km2

Outdoor Assemblies allowed within 1km of the

operational volume > 400k

Assemblies of 40k to 400k

Assemblies < 40k people

SAIL

I & II Out of scope High Medium Low

III Out of scope Medium Low Low

IV Medium Low Low Low

V & VI Low Low Low Low

Table 10 - Containment provisions 3m UA without shelter assumption

8 m UA (< 75 m/s) Sheltering assumed not applicable for the UA in the adjacent area

Average population density allowed

No upper limit

< 50,000 ppl/km2

< 5,000 ppl/km2

< 500 ppl/km2

< 50 ppl/km2

Outdoor assemblies allowed within 1km of the

operational volume > 400k

Assemblies of 40k to

400k Assemblies < 40k

SAIL

I & II Out of scope

Out of scope

High Medium Low

III Out of scope

Out of scope

Medium Low Low

IV Out of scope

Medium Low Low Low

V Medium Low Low Low Low

VI Low Low Low Low Low

Table 11 - Containment provisions 8m UA

20 m UA (< 125 m/s) Sheltering assumed not applicable for the UA in the adjacent area

Average population density allowed

No upper limit

< 50,000 ppl/km2

< 5,000 ppl/km2

< 500 ppl/km2

< 50 ppl/km2

Outdoor assemblies allowed within 1km of the

operational volume > 400k

Assemblies of 40k to

400k Assemblies < 40k

SAIL

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 38 of 184

I & II Out of scope

Out of scope

Out of scope

High Medium

III Out of scope

Out of scope

Out of scope

Medium Low

IV Out of scope

Out of scope

Medium Low Low

V Out of scope

Medium Low Low Low

VI Medium Low Low Low Low

Table 12 - Containment provisions 20m UA

< 40 m UA (< 200 m/s) Sheltering assumed not applicable for the UA in the adjacent area

Average population density allowed

No upper limit

< 50,000 ppl/km2

< 5,000 ppl/km2

< 500 ppl/km2

< 50 ppl/km2

Outdoor assemblies allowed within 1km of the

operational volume > 400k

Assemblies of 40k to

400k Assemblies < 40k

SAIL

I & II Out of scope

Out of scope

Out of scope

Out of scope High

III Out of scope

Out of scope

Out of scope

Out of scope Medium

IV Out of scope

Out of scope

Out of scope

Medium Low

V Out of scope

Out of scope

Medium Low Low

VI Out of scope

Medium Low Low Low

Table 13 - Containment provisions 40m UA

e) Ensure the operation complies with the containment provisions listed in Annex E – Section 4.

S.4.8.4 Instruction (GUIDANCE)

Utilise Chapter A3 of Annex A to AMC1 Article 11 for further guidance on presenting the data

supplementing the risk assessment to the authority.

Adjacent Area

(a) The adjacent area represents the ground area adjacent to the ground risk buffer where it is

reasonably expected a UA may crash after a loss of control situation resulting in a flyaway.

(b) The operator is not approved to plan flights in this area and it should only be overflown

unintentionally in the event of a loss of control that results in a fly away.

(c) In the above situation, the direction and duration of the fly away is assumed to be random, thus

the average population density of the adjacent area is used, instead of the maximum as is done

in Step #2.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 39 of 184

(d) Conservative simplifications for calculating the average population density may be used by the

operator when compliance with the operational limit can be assured.

Calculating the size of the adjacent area

The diagram below in Figure 7 depicts how to determine the adjacent area size.

Figure 7 - Lateral limits - Adjacent area

If the ground risk buffer is larger than the adjacent area then the assessment of adjacent area is not

required.

Adjacent area containment provisions

(a) When using Tables 8-13 to identify the required containment robustness level of the operation:

i. Select the correct table based on the maximum characteristic dimension of the UA used

in Step 2.

A. For a 3m UA determine whether sheltering can be applied in the adjacent area

B. If sheltering applies for a UA greater than 3m, the operator can use Annex F26 to

apply the credit and determine the appropriate containment provisions;

ii. Identify the correct row based on the SAIL found in Step 7;

iii. identify the appropriate column to derive the containment level of robustness based on

the adjacent area population density.

iv. If the results are ‘out of scope’, the operation cannot be conducted in the specific

category. In this case, adjusting the location of the operation or an increase of the SAIL of

the operation could be considered.

(b) Example: An operation uses a SAIL III 2.5 m drone with a maximum speed of 30 m/s, sheltering

is applicable, the outer limit of the adjacent area is 5.4 km from the boundary of the operational

volume. An assessment of the adjacent area shows no large assemblies of people within 1 km

and the area is mostly over rural and suburban areas, expecting an average population density

between 1k-4k people/km^2. This results in low containment provisions. If the UAS operator

26 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 40 of 184

decides to use a UA with low containment, the operator should document operational

limitations for the low containment SAIL III UA:

i. No assemblies of people > 40k people within 1 km of the operational volume

ii. The adjacent area (5,4km from the operational volume) average population density

should not exceed 50,000 people/km^2.

Adjacent area operational limitations

(a) The UAS operator defined operational limitations have to be adhered to when planning the

operational volume for a flight operation.

(b) The UAS operator should have a procedure to identify and take into account scheduled open

air assemblies of people in excess of the operational limitations within 1 km of the operational

volume. The values for the sizes of assemblies of people are to be understood as rough order

of magnitude guidelines as measuring the actual values is not practical.

(c) If the ground risk buffer size exceeds 1km, the adjacent area consideration for all assemblies of

people is not applicable.

Containment feedback into ground risk buffer and operational volume definition

(a) If the UAS operator determines they require medium or high robustness containment for their

operational objective, there might be a recursive effect, as these containment provisions have

higher provisions on the fidelity of the ground risk buffer size calculation. It is possible, that this

results in a bigger ground risk buffer size compared to the one defined by the operator in Step

#1.

(b) If this is the case, the applicant needs to go back to Step #2 and re-evaluate the GRC.

(c) Alternatively, the operator might choose to reduce the size of their operational volume

described in Step #1 to allow for a larger ground risk buffer.

Containment provisions for adjacent airspace

By containing flight to the operational volume and assuring the immediate cessation of the flight in

case of an unlikely breach of the operational volume, low robustness containment is generally

considered sufficient to allow operations adjacent to all airspaces. In cases of high density adjacent

airspace, the competent authority may require a higher level of assurance.

Notes on using an alternative method for ground risk containment

The methodology proposed in Step 8 may overestimate the adjacent area risk in certain cases.

Applicants may therefore employ an alternative method to compute the ground risk containment

provisions, as described in Annex F27, Section 5.3. Due to the increased workload of this method for

applicants and authorities, its application should be limited to cases where effective mitigations might

be applied in the adjacent area. This method also allows the possibility of “No Containment” provisions

for the adjacent ground risk. Nevertheless, the adjacent airspace must also be considered, and thus

the competent authority needs to confirm that the adjacent airspace can be sufficiently protected

without containment.

27 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 41 of 184

S4.9 Step #9 – Identification of Operational Safety Objectives (OSO)

S.4.9.1 Introduction (GUIDANCE)

This step of the SORA process is to map the operation’s SAIL score to required levels of robustness of

the operational safety objectives (OSO).

S.4.9.2 Outcome (GUIDANCE)

(a) Identification of the required robustness levels of the individual OSOs,

(b) Collection of information and references to be used to show compliance with the OSO provisions.

S.4.9.3 Task description (PROCEDURE)

(a) Identify the level of robustness of each OSO, deriving it from the SAIL of the proposed operation

using Table 14.

(b) Refer to Annex E to AMC1 Article 11 for the integrity and assurance provisions of each OSO

based on its level of robustness:

i. Identify the provisions for procedures and document them accordingly,

ii. Identify the technical provisions for the UAS and document them accordingly,

iii. Identify the training provisions for the personnel essential for the safety of the operation

and document them accordingly.

OSO ID

SAIL Dependencies

(Crit. references as per Annex E)

I II III IV V VI Operator Training

org Designer

OSO#01 Ensure that the UAS operator is competent and/or proven

NR L M H H H x

OSO#02 UAS designed and produced by a competent and/or proven entity

NR NR L M H H x28

OSO#03 Maintenance of UAS L L M M H H Crit. 2 Crit. 3

Crit. 1

28 Annex E includes provisions for both design and production organisations.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 42 of 184

OSO#04 UAS components essential to safe operations are designed to an airworthiness design standard

NR NR NR M H H x

OSO#05 UAS is designed considering system safety and reliability

NR NR(c) M M H H x

OSO#06 C3 link characteristics are appropriate for the operation

NR L L M H H x x

OSO#07 Conformity check of the UAS configuration L L M M H H Crit. 1 Crit. 2

Crit 1

OSO#08 Operational procedures are defined, validated and adhered to

L M H H H H x Crit 1

OSO#09 Remote crew trained and current L L M M H H x x

OSO#13 External services supporting UAS operations are adequate to the operation

L L M H H H x

OSO#16 Multi crew coordination L L M M H H Crit. 1 Crit. 3

Crit. 2

OSO#17 Remote crew is fit to operate L L M M H H x

OSO#18 Automatic protection of the flight envelope from human errors

NR NR L M H H x

OSO#19 Safe recovery from human error NR NR L M M H x

OSO#20 A human factors evaluation has been performed and the HMI found appropriate for the mission

NR L L M M H x x

OSO#23 Environmental conditions for safe operations defined, measurable and adhered to

L L M M H H x

OSO#24 UAS designed and qualified for adverse environmental conditions

NR NR M H H H x

Table 14 - Recommended operational safety objectives (OSO)

(c) See further guidance in Annex E to AMC1 Article 11 regarding UAS designs that employ novel or

complex features which have very limited operational experience and intend to be operated in

SAIL II.

S.4.9.4. Instruction (GUIDANCE)

(a) Table 14 is a consolidated list of common OSOs that historically have been used to ensure safe

UAS operations. It represents the collected experience of many experts and is therefore a solid

starting point to determine the required safety objectives for a specific operation.

(b) While the operator is the organisation responsible for showing compliance for all OSOs, some

of the evidence may be developed by other organisations such as designer or training

organisations as identified in Table 14.

(c) Table 14 indicates the corresponding OSOs. In this table:

i. NR stands for “not required” to show compliance to the competent authority, however,

the applicant is still expected to consider the operational safety objective at a low integrity

level,

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 43 of 184

ii. L stands for low robustness,

iii. M stands for medium robustness,

iv. H stands for high robustness.

S.4.10 Step #10 – Comprehensive safety portfolio

S.4.10.1 Introduction (GUIDANCE)

(a) The final step of the SORA involves the compilation of the Comprehensive Safety Portfolio (CSP).

(b) The CSP is a structured argument using the SORA process, that is supported by a body of

evidence which provides a robust safety case. This demonstrates that the proposed operation

has been assessed correctly and meets its SORA objectives.

S.4.10.2 Outcome (GUIDANCE)

(a) A completed CSP to be provided to the competent authority for the application for the

operational authorisation.

(b) By documenting all elements of the SORA, the competent authority can assess a standardised

document suite that provides assurance that the SORA process has been completed correctly

and the operation can be conducted safely.

S.4.10.3. Task description (PROCEDURE)

(a) Finalise and present all the documentation that needs to be included in the CSP. This should

include:

i. The finalized detailed operational description from Step #1 that details the proposed

operation(s), providing the air and ground risk information necessary to validate the

safety claims within the proposed operational context;

ii. All safety claims and their robustness made through Steps #2 (iGRC), #3 (M1(A), M1(B),

M1(C), M2), #4 (initial ARC), #5 (Strategic Mitigations for Air Risk), updated (if required)

from Phase 1 to reflect the finalised operation;

iii. All derived provisions based on the safety claims; the final GRC, the residual ARC, TMPR,

the OSOs associated with the SAIL, and the containment provisions;

iv. Compliance evidence, which is the data, facts, and information that provide the necessary

justification for each of the safety claims and derived provisions made through the SORA

process at the robustness level required. The CSP covers operational, technical, personnel,

and organisational compliance evidence;

v. The necessary linkages and references between documents, that ensures the CSP makes

a justified safety case that demonstrates the operation has satisfied all required SORA

safety claims and derived provisions,

vi. It is expected that a finalised compliance matrix (based on the initial compliance matrix if

developed in Phase 1) will be used to map the safety claims and derived provisions to the

compliance evidence.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 44 of 184

(b) Refer to Annex A to AMC1 Article 11 for more guidance on structuring documentation as part of

the CSP.

S.4.10.4. Instruction (GUIDANCE)

(a) The applicant should only put information into the CSP as required by the items mentioned

above. If a requirement has a low robustness (ref. Section S2.4), it is mostly sufficient to self-

declare the compliance by a statement in the CSP. SORA provisions for self-declaration in no

way prevents the competent authority from requesting further documents to validate the

declaration, if considered necessary for the given operation.

(b) The CSP is expected to be a collection of documents specific to the operation(s). It can be

modularized and consist of multiple sub-documents and sub-sections to accommodate the

need to perform the intended operation(s).

(c) Appropriate references and version/configuration control apply to all documents in the CSP,

including subsections and sub-documents. Annex A to AMC1 Article 11, Chapter A4 provides a

template that could be used for developing the CSP that is in line with the provisions of the

Main Body to SORA. Any changes may require a separate process from the competent authority.

The management of any changes should follow the relevant competent authority’s

requirements.

(d) A completed and valid CSP forms the basis for the issue of an operational authorisation.

(e) In the case the operator uses external service(s), reference(s) to Service Level Agreement(s)

(SLA) providing a delineation of responsibilities between the Service Provider(s) and the

operator should be included as part of the CSP. It should also detail the functionality, limitations

and performance of the service.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 45 of 184

Annex A to AMC1 Article 11 is replaced by the following:

Annex A to AMC1 to Article 11

GUIDELINES ON COLLECTING AND PRESENTING SYSTEM AND OPERATIONS FOR AN UAS OPERATION

CONDUCTED IN THE SPECIFIC CATEGORY

The aim of this annex is to provide guidance to UAS operators for collecting and presenting evidence

and data. This will assist applicants with compiling a complete application to obtain operational

authorization for UAS operations in the specific category.

This document does not replace civil regulations but provides recommendations and guidance as to

how sUAS operators can comply with those regulations, using the SORA process.

This document is composed of five chapters.

A.1: Key Principles for completing the application documents in the specific category

This chapter explains the different documents and how to use them to present an application.

A.2: SORA Risk Assessment writing template

This chapter is intended to support the applicant with compiling all the information necessary to

perform a risk assessment.

A.3: Operations Manual Structure

This chapter provides an operations manual structure for applicants to follow in order to present their

operations manual in an appropriate manner.

A.4: Compliance Matrix

This chapter provides a template for applicants on how to present the reference between the SORA

driven provisions and the operations manual.

A.5: How to present a flight area

This chapter contains guidance to applicants on how to create and include a flight area into the

operations manual.

A.1 Key Principles for completing the application documents

How does an application generally work?

The operations manual serves as the basis for an operational authorisation in the specific category.

When the competent authority issued the operational authorisation it accepts and the related

operations manual.

General workflow

Before starting to collect information and describing procedures, the applicant should outline a

preliminary operational concept (Refer to paragraph S.3.1 to AMC 1 to Article 11). This preliminary

operational concept ensures that the applicant can effectively explore all available options, and select

the most suitable approach for their specific needs.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 46 of 184

Key considerations for this initial plan include:

— the intended flight location(s);

— the maximum operational flight altitude and speed;

— the flight mode: either Visual Line of Sight (VLOS), or Beyond Visual Line of Sight (BVLOS) with

or without AO;

— the type of UAS to be used;

— environmental limitations (time of day, weather).

In the next step, the applicant assesses the risk for the intended operation and develops a high-level

view of the SORA provisions. For this, they should use the template provided in section A.2 and follow

each step of the SORA process.

It is considered best practice for applicants to engage with the competent authority before moving to

the data collection and procedure description (refer to paragraph S.3.3 of AMC1 to Article 11). In this

dialogue, the applicant shares their preliminary operational information and initial risk assessment.

The competent authority and the applicant evaluate the alignment of the risk assessment with the

operational information and check the correct application of the SORA steps. The competent authority

may provide feedback to applicants on their expectations on how to achieve an operational

authorisation considering the resulting Specific Assurance Integrity Level (SAIL).

Once the risk assessment has been validated and the applicant has secured confirmation from the

competent authority, the next step involves identifying the specific provisions that arise from this risk

assessment. Following this identification, the applicant must then collect the relevant evidence and

information, as well as describe the procedures that will be implemented. The applicant must ensure

that all integrity and corresponding assurance provisions are met. These can be found in the Annexes

B – E to AMC1 Article 11. It is recommended to utilize the operations manual structure from Chapter

A.3 for this purpose.

The applicant should use the template provided in chapter A.4 (compliance matrix) once all

procedures are described and the evidence collected. This is done by providing the corresponding

reference to the integrity and/or assurance evidence for each requirement. This document serves as

a check list for the applicant to review prior to submission of an application. The competent authority

may use this document as a reference to assist in the review process.

The competent authority reviews the application in accordance with the provisions arising from the

risk assessment and the respective SAIL. In this process, the implementation of all technical and

operational requirements is checked based on the descriptions in the operations manual, or other

associated documents as required. The competent authority has the option to request revisions of

documents or to ask for additional supporting documentation.

For the applicant to address the additional demands effectively, the competent authority may also

provide guidance on how the applicant can proceed to close any outstanding issues.

Figure 1 below graphically depicts the process described above and thus serves as an additional

illustration of the general workflow.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 47 of 184

Figure A.1 Recommended level of detail and use of supporting documents and references

Applicant Prepares a general operational

information

Applicant Consults competent authority on risk assessment and intended operation

Applicant Prepares required documents according to risk

assessment and operation.

Applicant Submits the application with the prepared

documents

Competent Authority Assesses the application

Competent Authority Prepares feedback for the applicant

Competent Authority Issues an operational authorisation

Applicant Performs an initial risk assessment and identifies

requirements (SORA Steps 2-9)

A.2

Confirmation

received?

?

A.2 A.3 A.4

All provisions

met?

No

No

Yes

optional

Yes

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 48 of 184

The operations manual and associated annexes should enable the applicant to describe to the

competent authority the intended operation(s) to a level of detail that effectively enables:

— the identification of the Ground Risk Class (GRC), Air Risk Class (ARC), associated mitigations,

and SAIL determination.

— compliance with the required Operational Safety Objectives (OSOs), mitigations and

containment. The provisions can be assessed and verified with the information contained or

referenced by it.

The applicant should only put information into the operations manual that is recommended above.

Supporting documents as evidence for the points above can usually be kept internal to the operator’s

organisation and may not need to be submitted to the competent authority. The competent authority

may request further documents, if considered necessary for the given operation.

Document setup for additional flight areas, UAS or operations

When a UAS operator seeks to expand their approved operations manual(s) to include a new flight

area, UAS, or operation, the primary question is whether the underlying risk assessment covers these

additions. If it does, the new information can be incorporated into existing parts (See chapter A.3 of

this Annex — Part A to T) of the operations manual. Otherwise, it is considered best practice to

establish new parts for this information.

When dealing with complex operational structures it’s recommended to align the manual's structure

with the competent authority to ensure it meets both national and industry standards.

Operation-specific details should typically be organized into separate parts for clarity during approval

and ease of use. Conversely, general or related information can be consolidated into a shared

segment. An example would be adding an additional UAS with the same characteristic dimensions,

but a different set of procedures. This could be added to the existing part B, for illustration purposes

see Figure 2.

Figure A.2 Common scenarios and how they may impact the operations manual

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 49 of 184

A.2 SORA risk assessment template

How to use this chapter?

The UAS operator should submit an application for an operational authorisation according to the form

provided in AMC1 UAS.SPEC.030(2). By providing this questionnaire-style template for documenting

the risk assessment, applicants are encouraged to focus on the essential information required and to

avoid unnecessary lengthy explanations about their operational procedures.

The remarks section is optional and designed for applicants to provide additional information when

needed, helping to prevent misunderstandings. At this stage, no evidence is required, as the provisions

are determined by the risk analysis process.

Once the application form is completed, both the applicant and the competent authority will have all

the necessary information to complete phase 1 assessment (for reference see figure A.1). Please note

that for phase 1 the fields 2.9 (OM references) and 2.10 (compliance evidence file reference) of the

application form (AMC1 UAS.SPEC.030(2) may not be filled yet.

In situations involving the use of multiple UAs or flight locations with varying ground or air risk classes,

it is advisable to consult with the competent authority. This practice helps ensure alignment with

expectations and adherence to national standards. In certain cases, it might be possible to include

multiple flight areas or UAs into one form.

Evidence should not be included in application form. Instead, it should be incorporated into the

operations manual (OM) A.3 and referenced in the Comprehensive Safety Portfolio (A.4.).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 50 of 184

A.3 Operations manual structure

How to use this chapter?

The intention of this operations manual structure is to provide a standardised framework for

documenting essential information related to a specific operation. This serves only as an example

structure for applicants to create a comprehensive document that outlines the procedures and

relevant details necessary for the safe and efficient execution of an operation.

The structure divides the operations manual into logical subject parts, that offer a structure on where

to include specific topics crucial for creating a standardised manual for safe UAS operation.

While the structure is not inherently mandatory, the topics it contains should be incorporated into the

operations manual as needed for the specific operation(s) to provide the relevant information and

evidence required for safe UAS operation. It is advisable to adhere to the provided structure, as it

aligns with the expectations and practices of most authorities. An example of an operations manual

may be found on the EASA website.29

In general, any information that does not have direct operational relevance to the operator or staff

should be placed in the relevant Annex to ensure the document remains concise and reader-friendly.

The key intentions and purposes of this structure include:

1. Standardisation: It ensures that all critical aspects of the operation are documented

consistently, following industry standards, regulations, and best practices.

2. Compliance: It helps operators meet regulatory requirements by specifying the information and

procedures needed to obtain necessary approvals and certifications.

3. Clarity: It provides a clear and organized structure for conveying operational procedures, safety

protocols, and other essential information, reducing the risk of misunderstandings and errors.

4. Safety: It emphasizes safety measures, emergency procedures, and risk mitigation strategies to

enhance overall safety during the operation.

5. Efficiency: It streamlines the process of creating an operations manual by providing predefined

sections and guidelines, saving time and effort for applicants.

6. Consistency: It ensures that all UAS operators involved in the same type of operation follow the

same documented procedures, promoting uniformity and reducing the potential for confusion.

7. Reference: It serves as a valuable reference document for UAS operators, remote crew

members, authorities, and other stakeholders involved in or overseeing the operation.

8. Documentation: It aids in the systematic recording of operational details, making it easier to

track changes, updates, and compliance with evolving regulations.

29 https://www.easa.europa.eu/en/downloads/139674/en

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 51 of 184

Recommended structure for the operations manual

Cover Page

Document Control

Other applicable documents

Purpose and scope of this document

List of Content

List of definitions and abbreviations

1. General part (Part A)

1.1. Opening statement

1.2. Security and privacy statement

1.3. Environmental statement

1.4. The operating organisation

1.4.1. Structure / organisational chart

1.4.2. Duties and responsibilities of the personnel

1.5. Change management

1.6. Retention periods

1.7. Document control

1.8. Requirements and qualifications of the personnel

1.8.1. Control monitoring unit

1.8.2. Maintenance personnel

1.8.3. Ground staff

1.8.4. Training, examination and supervision personnel

1.9. Crew member is “fit for the operation”

1.9.1. Preventive health care

1.9.2. Duty hours and rest periods

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 52 of 184

2. Procedures (Part B)

2.1. Multi-crew coordination

2.2. Flight planning

2.2.1. Use of up-to-date materials

2.2.2. Geographical zones

2.3. External services and systems

2.3.1. Services

2.3.2. Systems

2.4. Procedures for obtaining and evaluating weather conditions

2.5. Procedures for responding to unexpected adverse weather conditions

2.6. Procedures for TMPR (tactical mitigation performance requirement)

2.7. Occurrence reporting

2.7.1 What must be reported?

2.7.2. Who reports?

2.7.3. What must be observed after reporting?

2.8. Procedures specifically for UAS 1

2.8.1. Normal procedures

2.8.2. Contingency procedures

2.8.3. Emergency procedures

2.9. Procedures specifically for UAS 2

2.9.1. Normal procedures

2.9.2. Contingency procedures

2.9.3. Emergency procedures

3. Flight areas (Part C)

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 53 of 184

3.1. General operational limitations

3.1.1. Environmental conditions

3.1.2. Technical operational Limitations

3.2. Flight area 1

3.2.1. Description

3.2.2. Calculation of CV / GRB

3.2.3 Specific procedures of the flight area

3.2.4. Emergency response plan (ERP) — Local information

3.3. Flight area 2

3.3.1. Description

3.3.2. Calculation of CV / GRB

3.3.3. Specific procedures of the Flight area

3.3.4. Emergency response plan (ERP) — Local information

3.4. Flight area 3

3.4.1. Description

3.4.2. Calculation of CV / GRB

3.4.3. Specific procedures of the flight area

3.4.4. Emergency response plan (ERP) — Local information

4. Training (Part D)

5. Emergency response plan (Part E)

5.1. General

5.2. Creation of the emergency response plan

5.3. ERP template

5.4. Preparation and briefing

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 54 of 184

5.5. Reporting procedures and obligations after an emergency

6. Technical part of UAS (Part T) (reference to the manufacturer’s instructions may be

sufficient)

6.1. UAS 1 [model/type]

6.1.1. Description

6.1.2. Image / graphic

6.1.3. C3 Link

6.1.4. Parachute (M2)

6.1.5. TMPR

6.1.6. Containment

6.1.7. Human–machine interface (HMI)

6.1.8. Payload

6.1.9. Automatic protection of the flight envelope

6.1.10. Designed and qualified for adverse environmental conditions

6.2. UAS 2 [model/type]

6.2.1. Description

6.2.2. Image / graphic

6.2.3. C3 Link

6.2.4. Parachute (M2)

6.2.5. TMPR

6.2.6. Containment

6.2.7. Human–machine interface (HMI)

6.2.8. Payload

6.2.9. Automatic protection of the flight envelope

6.2.10. Designed and qualified for adverse environmental conditions

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 55 of 184

7. Maintenance (Part M)

7.1. General

7.2. Software updates

7.3. Maintenance UAS 1 [model/type]

7.4. Maintenance UAS 1 [model/type]

8. Annex

8.1. Evidence

8.1.1. Organisational

8.1.1.1. Organisation operating certificate

8.1.1.2. Maintenance program / organisation certificate

8.1.2. Operational

8.1.2.1. Operational agreements (e.g. with ATC)

8.1.2.2. M1

8.1.2.3. Flight tests

8.1.2.4. Performance of external services and systems

8.1.3. Technical

8.1.3.1. Design (DVR, TC)

8.1.3.2. M2

8.1.3.3. Manufacturer competence

8.2. Printed forms

8.2.1. List of maintenance personnel

8.2.2. List of personnel authorised to conduct Pre-flight and Post-flight Inspections

8.2.3. List of the training / experience level of personnel

8.2.4. List of authorised remote pilots

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 56 of 184

8.2.5. List of training on the emergency response plan (ERP)

8.2.6. Operator flight logbook

8.2.7. Technical logbook

8.3. Check lists

8.3.1. ERP template

8.3.2. Pre-flight inspection — check list

8.3.3. Post-flight inspection — check list

8.4. Manuals

8.4.1. Maintenance manual for UAS 1

Reference table for provisions

The following table offers a comprehensive overview of the suitable locations within the operations

manual where the provisions specified in the Annexes to AMC 1 to Article 11 (SORA) can be sensibly

incorporated.

OSOs ↓ Integrity (I) /

Assurance (A) Criterion OM

OSO #01

I - Part A

Part D

A - Annex 8.1.1.1

OSO #02

I - Part T

A - Annex 8.1.3.3

OSO #03

I - Part M Chapter 7.1

Annex 8.1.1.2

A

#1 Part A Chapter 1.7

Annex 8.1.1.2

#2

Part A Chapter 1.6

Part A Chapter 1.7

Annex 8.1.1.2

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 57 of 184

OSO #04

I - Part T

A - Annex 8.1.3.1

OSO #05

I - Part T

A - Annex 8.1.3.1

OSO #06

I - Part T Chapter 6.1.3

A - Annex 8.1.3.1

OSO #07

I -

Part B Chapter 2.8.1

Part D

Annex 8.2.6

A

#1 Part A Chapter 1.7

#2 Part A Chapter 1.7

OSO #08

I

#1

Part B

Part D

Annex 8.3

#2 Part B

Part D

#3 Part E

A -

Part B

Part D

Annex 8.1.2.3

Part E

Annex 8.3.1

OSO #09

I - Part A Chapter 1.7

A - Part D

OSO #13

I - Part B Chapter 2.3

A - Part B Chapter 2.3

Annex 8.1.2.4

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 58 of 184

OSO #16

I

#1 Part B Chapter 2.1

#2 Part D

A

#1 Part B Chapter 2.1

Annex 8.1.2.3

#2 Part D

#3 Annex 8.1.2.4

OSO #17

I - Part A Chapter 1.9

A - Part A Chapter 1.9

OSO #18

I - Part T

A - Annex 8.1.3.1

OSO #19

I - Part B Chapter 2.8

A - Annex 8.1.3.1

OSO #20

I - Part T Chapter 6.1.7

A - Annex 8.1.3.1

OSO #23

I -

Part B Chapter 2.4

Part C Chapter 3.1.1

Part D

A -

Part C Chapter 3.1

Part B Chapter 2.4

Annex 8.1.2.3

Part D

OSO #24

I - Part T

A - Annex 8.1.3.1

M1

I - Part C Chapter 3.2.3.2

A - Annex 8.1.2.2

M2 I - Part T

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 59 of 184

A - Annex 8.1.3.2

ARC

Mitigation

I - Part C Chapter 3.2.3.3

A - Annex 8.1.2.1

TMPR

I -

Part B Chapter 2.8.3.4

Part B Chapter 2.8.3.5

Part T Chapter 6.1.5

A - Annex 8.1.3.1

Containment

I - Part T Chapter 6.1.6

A - Annex 8.1.3.1

Payload

I - Part T Chapter 6.1.8

A - Annex 8.1.3.1

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 60 of 184

A.4 Compliance Matrix

How to use this chapter?

This chapter provides a template for applicants on how to present the reference between the SORA

driven provisions and the operations manual from A.3 of Annex A to AMC1 Article 11 to the competent

authority.

For all provisions that must be fulfilled to conduct a safe UAS operation, the applicant should put the

specific reference into the table where it can be found.

For those OSOs that in Table 14 of the AMC 1 to Article 11 (SORA main body) are identified as ‘NR’ the

UAS operator is still expected to consider its applicability at least as low integrity level even if it is not

required to show compliance to the competent authority. In this case the UAS operator may still

indicate, as good practice, the reference to the evidence.

This is not a list of declarations or evidence — but the reference where it can be found.

Example:

…

Provision Level of robustness

Reference to documentation

OSO #08

☒ Low

☐ Medium

☐ High

Document name:

MyOperationsManual.pdf

Chapter or Page number:

Chapter B, page 42 – 47

Chapter Annex, page 815

…

The level of robustness is in this case is SAIL dependant and should be checked accordingly (e.g. low for

SAIL II).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 61 of 184

Compliance Matrix

Provision Level of robustness Reference to documentation

Ground risk mitigations

M1 (A) Strategic mitigations

- Sheltering

☐ None

☐ Low

Document name:

_____________________________

Chapter or Page number:

_____________________________

M1 (B) Strategic mitigations

- Operational restrictions

☐ None

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

M1 (C) Tactical mitigations

- Ground observation

☐ None

☐ Low

Document name:

_____________________________

Chapter or Page number:

_____________________________

M2 – Effects of UA impact dynamics

are reduced

☐ None

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

Strategic air risk mitigations

Air risk class mitigation ☐ ARC-d (AEC 1 or 2) → ARC-c

☐ ARC-d (AEC 1 or 2) → ARC-b

☐ ARC-d (AEC 3) → ARC-c

Document name:

_____________________________

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 62 of 184

☐ ARC-d (AEC 3) → ARC-b

☐ ARC-c (AEC 4) → ARC-b

☐ ARC-c (AEC 5) → ARC-b

☐ ARC-c (AEC 6,7,8) → ARC-b

☐ ARC-c (AEC 9) → ARC-b

Chapter or Page number:

_____________________________

Tactical mitigations performance requirements

TMPR level ☐ VLOS (deconfliction scheme)

☐ BVLOS

☐ No requirement (ARC-a)

☐ Low requirement (ARC-b)

☐ Medium requirement (ARC-c)

☐ High requirement (ARC-d)

Document name:

_____________________________

_

Chapter or Page number:

_____________________________

_

TMPR function

Detect Document name:

_____________________________

Chapter or Page number:

_____________________________

Decide Document name:

_____________________________

Chapter or Page number:

_____________________________

Command Document name:

_____________________________

Chapter or Page number:

_____________________________

Execute Document name:

_____________________________

Chapter or Page number:

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 63 of 184

_____________________________

Feedback loop Document name:

_____________________________

Chapter or Page number:

_____________________________

TMPR robustness TMPR integrity and assurance

objectives

Document name:

_____________________________

Chapter or Page number:

_____________________________

Containment provisions

Containment ☐ Low

☐ Medium

☐ High

☐ Tethered

Document name:

_____________________________

Chapter or Page number:

_____________________________

Operational Safety Objectives

OSO #01

Ensure that the UAS operator is

competent and/or proven

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #02

UAS manufactured by competent

and/or proven entity

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 64 of 184

OSO #03

Maintenance of the UAS

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #04

UAS components essential to safe

operations are designed to an

Airworthiness Design Standard (ADS)

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

Chapter or Page number:

_____________________________

OSO #05

UAS is designed considering system

safety and reliability

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #06

C3 link characteristics (e.g. performance

spectrum use) are appropriate for the

operation

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #07

Conformity check of the UAS

configuration

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #08

Operational procedures are defined,

validated and adhered to

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #09

Remote crew trained and current

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 65 of 184

OSO #13

External services supporting UAS

operations are adequate for the

operation

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #16

Multi-crew coordination

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #17

Remote crew is fit to operate

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #18

Automatic protection of the flight

envelope from human errors

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #19

Safe recovery from human error

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

OSO #20

A human factors evaluation has been

performed and the human machine

interface (HMI) found appropriate for

the mission

☐ NR

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

OSO #23

Environmental conditions for safe

operations are defined, measurable and

adhered to

☐ Low

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 66 of 184

OSO #24

UAS is designed and qualified for

adverse environmental conditions

☐ NR

☐ Medium

☐ High

Document name:

_____________________________

Chapter or Page number:

_____________________________

Confirmation

Have all safety provisions been described and met?

☐Yes

☐No

Place, date Name and signature

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 67 of 184

A.5 How to document and present a flight area

How to use this chapter?

This chapter provides guidelines on how to prepare and present a flight area, typically located under

Part C of the operations manual. The goal is to present the proposed flight area in a way that is both

straightforward and easy to understand. This is crucial not just for the competent authority reviewing

this section, but especially for all individuals participating in the flight operation who consult the

operations manual.

It is worth noting that this section is also relevant for operators who have the privilege to analyse,

approve and document flight areas independently, such as those under a generic operational

authorisation.

For better usability, section A.5 is divided into two main subsections:

A.5.1 provides a comprehensive guide on creating a KML file, which is a file format for displaying

information in a geographic context. It also specifies the basic necessities for the illustration and delves

into the methods of depicting the flight area, as well as explaining the underlying reasons for these

representations in the operations manual.

A.5.2 provides a sample computation for determining the minimum dimensions of the contingency

volume and the ground risk buffer. These examples are intended solely as illustrative calculations. For

a more in-depth analysis, one can also employ sophisticated flight mechanics-based computations.

These calculations can be incorporated into the operations manual annex.

While adhering to these guidelines, it is important to cite the source of the calculations used.

If the applicant chooses to use alternative calculations, it is important to provide clear explanation and

supporting documentation that outlines the methodology and its safety assurances.

A5.1 Presentation

The provided graphical representation of the flight area should contain as a minimum:

— An area: flight geography in transparent green colour

— An area: contingency volume in transparent yellow colour

— An area: ground risk buffer in transparent red colour

— A position: remote pilot’s position (for VLOS operation)

— A position: take off / landing position (optional)

The applicant should provide the flight area to the competent authority when required. This should

be in the format of a *.kml file or a similar format suitable for visualisation, accompanied by the

operations manual or a referenced document that includes all pertinent flight area details. There are

two methods for delineating the flight area: "inside out" or "reverse". The choice between them

largely depends on the constraining factor. For many applications, the "inside out" method will

provide the desired areas based on the specific flight geography.

However, there may be situations where it's preferable to utilise the maximum available ground risk

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 68 of 184

buffer (e.g., controlled ground) and then determine the maximum possible flight geography from that.

This is called “reverse”.

inside out: reverse:

Figure 8 — Inside out versus reverse computation of the flight area

Areas within the flight geography that need to be excluded for any reason (e.g. higher ground risk)

should be addressed in the same way as to surround them with a contingency volume and a ground

risk buffer.

A screenshot of the flight area, accompanied by a concise description, all input values, and the

calculations for contingency volume (CV) and ground risk buffer (GRB) should be documented. For

instance, in Part C of the operations manual according to A.3.

The content should be presented in a manner that is easily comprehensible to all parties involved in

the operation, enabling swift access to all pertinent data during routine operations. It is also crucial

for the competent authority to understand the calculation process. If the derivation of the calculation

or the overall rationale is unusually extensive, it is advisable to relocate the sections not directly

pertinent to daily operations, to the OM's annex.

Example:

Detailed information for each flight area is typically located under Part C, following the recommended

format outlined in A.3. In a structured chapter layout, this might appear as:

3 Part C – Flight Areas

3.2 Flight area [project name]

Description

The flight area, along with its precise coordinates, is delineated in the accompanying KML file "[project

name.kml]".

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 69 of 184

Figure 9 — Graphical representation of the flight area

The centre of the figure is located at [N53.1234567 E11.1234567].

The remote pilot’s position is located at [N53.1434567 E11.1434567].

General comment: [The flight area is an area used for agricultural purposes, …]

Special procedures/mitigations: [CTR Clearance for airport XY is required, as per OM 2.2]

Calculation of CV / GRB

The contingency volume and the ground risk buffer were determined using Annex A, Chapter 5

UA characteristics:

— Type: [rotary wing without parachute]

— Altitude measurement: [barometric]

— Maximum speed in operation V0: [10,0 m/s]

— Maximum permissible wind speed VWind: [3,0 m/s]

— Characteristic dimension CD: [1,50 m]

— Maximum pitch angle Θmax: [45°]

The following parameters were used:

— Hight of the Flight Geography HFG: [100,0 m]

— Calculation method: [from inside]

— Manoeuvre on entering into the contingency volume (horizontal): [stopping]

— Manoeuvre on entering the contingency volume (vertical): [kinetic into potential]

— Manoeuvre on entering the Ground Risk Buffer: [power off]

Assumptions:

— GNSS accuracy SGNSS: [0,5 m]

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 70 of 184

— Position holding error SPos: [3,0 m]

— Map error SK: [1,0 m]

— Reaction time tR: [1,0 s]

— Altitude measurement error HAM: [HBaro = 1,0 m]

— Additional distance (horizontal) SAdd: [0,0 m]

— Additional distance (vertical) HAdd: [0,0 m]

Reasons for deviations from the standard values:

— SGPS ([0,5 m] instead of [3,0 m]): [The UA is equipped with …]

— …

— HCM ([3,0 m] instead of [5,1 m]): [The assumption based on …]

Results

Flight altitude

— Altitude of the flight geography HFG: [100,0 m]

Contingency Volume:

— Horizontal SCV: [34,5 m]

— Vertical HCV: [113,1 m]

Ground Risk Buffer:

— Horizontal SGRB: [113,8 m]

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 71 of 184

Figure 10 — Schematic representation of Flight Geography, Contingency Volume and

Ground Risk Buffer

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 72 of 184

A5.2 Calculations used in the example case above

5.2.1 Information Required for calculations

0, m/s

Maximum operational speed that is flown. This corresponds to the information in

field 0.8 in the A.2 form.

Note: A speed below 3 m/s for multirotor and 1.25 ∙ Stall,clean for fixed-wing

aircraft is not considered realistic.

CD, m

The "maximum UA characteristic dimension" or "CD" is the maximum possible

length of a straight line that can be spanned from one point on the UA geometry

to another point. Propellers and rotors are part of the geometry, whereby their

most unfavourable position is considered. This corresponds to the information in

field 0.6 of the A.2 form.

Note: Commonly used values for:

Fixed-wing aircraft

• Wing-span or

• Fuselage length

Multirotor

• Diagonal distance from rotor tip to rotor tip, rotors in unfavourable

position

Wind, m/s Maximum wind speed specified in the operations manual up to which the UA may

be operated.

FG Flight geography

CV Contingency volume

GRB Ground risk buffer

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 73 of 184

Figure 11 — Schematic representation of Flight Geography, Contingency Volume and

Ground Risk Buffer

5.2.2 Computation Flight Geography

Variant 1 (inside out):

The size of the flight geography usually results from the operator's desired flight geography. The

contingency volume and the ground risk buffer just add up to this area.

Variant 2 (reverse):

Determination of the maximum flight geography available, e.g. when operating over a controlled

ground area.

In this example (controlled ground), the ground projection of flight geography, contingency volume

and the ground risk buffer must be completely contained in the controlled ground area. A

calculation in reverse is recommended:

The outer limit of the ground risk buffer corresponds to the topology of the controlled ground area.

In the first step, the horizontal extent (width) of the ground risk buffer is subtracted from the

topology of the controlled ground area. This gives the boundary between the contingency volume

and the ground risk buffer.

In the second step, the horizontal extent (width) of the contingency volume is then subtracted from

this limit. This results in the maximum possible expansion of the flight geography as the remaining

area.

Notes on the realistic definition of particularly small flight geographies:

Flight Geography horizontal

Width flight geography: FG FG ≥ 3 CD

F light Geography vertical

Height flight geography: FG FG ≥ 3 CD

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 74 of 184

Note: Smaller values than FG = 3 CD and FG = 3 CD are considered unrealistic, also for automated

waypoint flights.

5.2.3 Computation Contingency Volume

Notes on the realistic dimensioning of the contingency volume. Assumptions can be substituted with

real values if evidence is available:

Contingency volume horizontal

GNSS accuracy: GNSS GNSS = 3 m

Position holding error: Pos Pos = 3 m

Map error: K K = 1 m

Reaction distance: R

Manual initiation of measures

Reaction time: R = 3 s, with 0 results in

with 0 results in

R = 0

Note: R can also be smaller in fully automatic systems (e.g.

geofence).

Contingency manoeuvres: CM

Multirotor - stopping

Based on CM = 1

2 R

2 + 0 R follows for a

thrust to weight ratio of at least 2

thrust ≥ 2

and a maximum pitch angle of less than 45 degrees

Θmax ≤ 45°

The minimum distance for stopping to hovering mode is:

CM = 1

2

0 2

tan(Θ)

Fixed-wing aircraft -180° turn:

Assumption: roll angle Φmax ≤ 30°

The radius for the turn is:

CM = 0

2

tan(Φ)

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 75 of 184

Horizontal extension of the

contingency volume: CV CV = GPS + Pos + K + R + CM

Examples

Example multirotors:

0 = 10 m

s , Θ = 45°, [tan(45°) =

1]

SCV = 3 m + 3 m + 1 m + 10 m + 1

2 ∙

(10 m s

) 2

9,81 m s2 ∙ 1

= 22,1 m

Example fixed-wing aircraft:

0 = 30 m

s , Φ = 30°

SCV = 3 m + 3 m + 1 m + 30 m + (30

m s

) 2

9,81 m s2 ∙ tan(30°)

= 195,9 m

Contingency volume vertical

Altitude measurement error: AM

AM = Baro = 10 m for barometric altitude measurement,

or

AM = GNSS = 4 m for GNSS-based altitude measurement

Note: when operating close to large buildings the altitude

information provided by GNSS may not be reliable.

Reaction distance: R

Manual initiation of measures

Reaction time: R = 3 s, with 45° pitch angle results

R = 0 ∙ 0,7 ∙ R

Note: R can also be smaller in fully automatic systems (e.g.

geofence).

Contingency manoeuvres: CM

For multirotor

The forward kinetic energy is completely converted into

potential energy.

This results in

CM = 1

2 0

2

For fixed-wing aircraft

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 76 of 184

Exit the FG upwards with a 45° pitch angle, then fly on a

constant circular path with V0 and radius r until level flight is

achieved.

With

= 0

2

results in the contingency manoeuvre height being

approximately

CM = 0

2

∙ 0,3

Contingency volume: CV CV = FG + AM + R + CM

Examples

Height of flight geography FG = 100 m

Example multirotor: 0 = 10 m

s

CV = 100 m + 4 m + 7 m + 1

2 ∙

(10 m s

)

9,81 m s2

2

= 116,1 m

Example fixed-wing a/c: 0 = 30 m

s

CV = 100 m + 4 m + 21 m + (30

m s

) 2

9,81 m s2

∙ 0,3 = 152,52 m

5.2.4 Computation ground risk buffer

Ground risk buffer horizontal

Simplified approach: 1:1 rule: GRB GRB = CV + 1

2 CD

Ballistic approach: GRB

Note: Only permitted for

helicopters and VTOL capable UAS

(including multirotor)!

GRB = 0 √ 2 CV

+

1

2 CD + 30

Termination with parachute: GRB

Note: Values below Wind = 3 m

s are

not considered realistic for this

computation.

P = Time to open the parachute

From the rate of descent with the parachute open (z) and the

maximum permissible wind speed for operation (Wind) results

GRB = 0 P + Wind CV

z

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 77 of 184

Termination with fixed-wing

aircraft: GRB

• Power is switched off:

A glide ratio of = 1

=

L

D results in

GRB = CV

• Power is switched off and the flight control surfaces are

permanently set in a way that no gliding is possible:

The simplified approach can be chosen (1:1 rule).

Examples

Simplified approach:

Multirotor: 0 = 10 m

s , CD = 1,5 m,

CV = 113,1 m

GRB = 113,1 m + 1

2 ∙ 1,5 m = 113,85 m

Ballistic Approach:

Multirotor: 0 = 10 m

s , CD = 1,5 m,

CV = 113,1 m

GRB = 10 m

s √ 2 ∙ 113,1 m

9,81 m s2

+ 1

2 ∙ 1,5 m = 48,77 m

Fixed-wing aircraft only power is

switched off: 0 = 30 m

s , CD = 3 m,

CV = 149,52 m

= 20

GRB = 149,52 m ∙ 20 = 2990,4 m

Fixed-wing aircraft power is

switched off and flight control

surfaces set so that no gliding is

possible: 0 = 30 m

s , CD = 3 m,

CV = 149,52 m

GRB = 149,52 m + 1

2 ∙ 3 m = 151,02 m

GRB vertical - not applicable -

5.2.5 Examples of Computation for VLOS/BVLOS maximum distance(s)

When determining the operating range for visual line of sight (VLOS) operations, care must be taken

to ensure that the remote pilot can actually operate the UAS within visual range.

To check whether the described UAS operation is in VLOS or beyond visual line of sight (BVLOS), the

following calculations may be used.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 78 of 184

VLOS / BVLOS with

AO limit

The maximum possible VLOS distance between remote pilot or observer and

UA results from the smaller value of ALOS and DLOS. Anything beyond that is

considered BVLOS.

ALOS

Attitude Line of Sight

The attitude line of sight defines the maximum distance up to which a remote

pilot can detect the position and orientation of the UA. Up to this limit, the

remote pilot is able to control the flight path of the UA and is able to determine

the attitude and position of the UA. This distance was determined in practical

tests.

DLOS

Detection Line of Sight

The detection line of sight defines the distance up to which other aircraft can

be visually detected, and sufficient time is available for an avoidance

manoeuvre. The ground visibility is crucial for this.

GV

Ground Visibility

The ground visibility depends on the operational area and the meteorological

conditions, and must be determined at the respective time of operation. The

procedure for precisely determining ground visibility should be described in

chapter 2.2.1 of the OM. The use of landmarks or the use of a transmissometer

are possible.

The maximum ground visibility to be assumed is 5 km, analogue to the visibility

according to the VFR rules in airspace G.

ALOS limit For rotorcraft and multirotors

ALOSmax = 327 ∙ CD + 20 m

For fixed-wing aircraft:

ALOSmax = 490 ∙ CD + 30 m

DLOS limit DLOSmax = 0,3 ∙ GV

GV depends on the actual ground visibility at site and time of operation.

However, it always applies:

GVmax = 5 km

If the largest possible distance between the remote pilot’s location and the outer side of the

contingency volume (boundary between contingency volume and ground risk buffer) is greater than

the VLOS boundary, no VLOS operation can take place. UAS operations must then take place in BVLOS.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 79 of 184

5.2.6 Examples for maximum VLOS distances

The following table is valid for a ground visibility of 5 km or more.

Characteristic dimension

(CD)

Maximum VLOS distance

Rotary Wing Fixed Wing

1 m 347 m 520 m

2 m 674 m 1010 m

3 m 1000 m 1500 m

3,5 m 1164,5 m 1500 m

4 m 1328 m 1500 m

4,53 m 1500 m 1500 m

> 4,53 m 1500 m 1500 m

Figure 12: Multirotor VLOS Range

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 80 of 184

Figure 13: Fixed-wing VLOS Range

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 81 of 184

Annex B to AMC1 to Article 11 is replaced by the following:

Annex B to AMC1 to Article 11

INTEGRITY AND ASSURANCE LEVELS FOR THE MITGATIONS USED REDUCE THE INTRINSIC GROUND

RISK CLASS

B.1 How to use Annex B

The following table provides the basic principles to consider when using SORA Annex B.

# Principle description Additional information

#1 Annex B provides assessment criteria for the integrity (i.e., safety gain) and

assurance (i.e., method of proof) of the applicant’s proposed mitigations. The

proposed mitigations are intended to reduce the intrinsic Ground Risk Class

(GRC) associated with a given operation.

The identification and

implementation of

mitigations is the

responsibility of the

applicant.

#2 Annex B does not cover the Level of Involvement (LoI) of the Competent

Authority. Lol is based on the Competent Authority assessment of the

applicant’s ability to perform the given operation.

#3 A proposed mitigation should have a positive effect on reducing the ground

risk associated within defined operational limitations.

#4 To achieve a given level of integrity/assurance, when more than one criterion

exists for that level of integrity/assurance, all applicable criteria need to be

met, unless specified otherwise.

If a criterion for a mitigation

is not applicable it can be

ignored (e.g., passive

mitigations do not require

training or activation).

#5 Annex B intentionally uses non-prescriptive terms (e.g., suitable, reasonably

practicable) to provide flexibility to both the applicant and the Competent

Authorities. This does not constrain the applicant in proposing mitigations,

nor the Competent Authority in evaluating what is needed on a case-by-case

basis.

#6 This Annex in its entirety also applies to single-person organisations.

#7 Annex B mitigations are applied to the operational volume and ground risk

buffer. Annex B mitigations may be applied to the adjacent area.

Details of mitigation

application to adjacent area

can be found in Annex F30.

#8 All bullet points within all tables in this Annex are meant to be fulfilled unless

followed by OR.

30 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 82 of 184

#9 The GRC cannot be lowered to a value less than the equivalent for controlled

ground area.

#10 Any criterion labelled “Technical design” will most likely require the support

of the UAS or Component designer for providing declarations and if applicable

gathering the required evidence.

Authorities may divide the

requirements for different

responsible parties in local

regulations.

#11 The applicant may claim more points of GRC reduction than indicated in Table

11 (Table 5 in the Main Body), when the appropriate orders of magnitude

reduction of the risk to uninvolved people can be demonstrated. Any of these

claims should be fulfilled to the high robustness level.

Table B. 1 – Basic principles

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 83 of 184

B.2 M1(A) – Strategic mitigations –Sheltering

M1(A) mitigation is linked to the fact that people spend on average a very small amount of time

outdoors unprotected by a structure. Therefore, operators using sufficiently small UAS can expect to

have a large percentage of the population sheltered from an impact. This assumption may also apply

to larger UAS, in these cases, the sheltering effectiveness should be demonstrated.

Time based arguments such as “I fly at night and there are less people outdoors in my iGRC footprint”

do not belong to M1(A) low robustness. At medium robustness time-based arguments are included.

Sheltering at low robustness is to be understood as a generally applicable mitigation given by the

characteristics of the environment being flown, with no operational restrictions added.

To prevent double counting time-based restrictions, M1(A) medium robustness mitigation cannot be

combined with any M1(B) mitigations. However, M1(A) low robustness has no operational restrictions

and can be combined with M1(B) mitigations.

LEVEL of INTEGRITY

Low Medium

M1(A) –

Sheltering

Criterion #1

(Evaluation of

people at risk)

If the applicant claims a reduction due to a

sheltered operational environment, the

applicant:

a) flies over operational environments

generally consisting of structures

providing shelter,

b) it is reasonable to expect that on

average a vast majority of the

uninvolved people will be located under

a structure1

This mitigation cannot be claimed when only

overflying open-air assemblies of people or

areas with no shelter.

Same as low. In addition, the

applicant restricts operating

times (e.g. during night time)

and demonstrates that an even

greater proportion of

uninvolved people are

sheltered.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 84 of 184

Comments

1 The consideration of this mitigation may vary based on local conditions. A

metastudy of time-activity pattern studies shows that people generally spend

at most 10% of their time outside. Diffey, B. (2010). An overview analysis of

the time people spend outdoors. The British journal of dermatology. 164. 848-

54. 10.1111/j.1365-2133.2010.10165.x.

The intention is to estimate the proportion of people outside on average and

not at a specific time of day or year. There will be times when at specific

locations temporarily there are more people exposed, but it should be

sufficient to expect that on average the proportion of people exposed outside

is below 10%. However, assemblies of people should be avoided. Applicants

and/or authorities may consider to adapt this ratio based on other evidence.

When the UAS operator applies M1(A) with at least medium level of

robustness the competent authority should issue an operational authorisation

with precise identification of the location, since the same conditions may not

apply in all locations at all times.

Criterion #2

(Evaluation of

penetration

hazard)

The applicant uses a drone that is not expected to penetrate structures and

fatally injure people under the shelter2.

Comments

2 Guidance on how to evaluate sheltering effect can be found from:

• ASSURE UAS Ground Collision Severity Evaluation A4 report section

"4.12. Structural Standards for Sheltering (KU)", pages 103 to 111, or

• MITRE presentation given during the UAS Technical Analysis and

Applications Center (TAAC) conference in 2016 titled ‘UAS EXCOM

Science and Research Panel (SARP) 2016 TAAC Update’ - PR 16-3979.

In general, it can be expected that UAS with a take off mass of less than 25

kg are not able to penetrate into buildings except in rare cases where the

UAS speed or building materials are unusual (tents, glass roofs, etc).

Table B. 2- Level of integrity assessment criteria for M1(A) mitigation

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 85 of 184

LEVEL of ASSURANCE

Low Medium

M1(A) –

Sheltering

Criterion #1

(Evaluation of

people at risk)

The applicant declares that the operation is

in an environment that has structures1

providing shelter where people are

generally expected to be, and the applicant

does not fly over large open -air assemblies

of people.

Same as Low. In addition, the

applicant has time-based

restrictions in place and

evidence to support that a

higher proportion of people

are sheltered.

Medium robustness M1(A)

mitigation cannot be

combined with M1(B)

mitigations.

Comments 1 For example a city or town consists generally of structures providing shelter.

While it may also include areas that are not sheltered, the mitigation is

expected to be provided in the majority of such cases.

Criterion #2

(Evaluation of

penetration

hazard)

The applicant declares that the UA used has a take off mass of less than 25

kg.

OR

For UA with take off mass higher than 25 kg1, the applicant has supporting

evidence that the required level of integrity is achieved. This is typically done

by means of testing, analysis, simulation, inspection, design review or

through operational experience.

Comments 1UA technical information needed for the evaluation may require support

from the UAS designer.

Table B. 3 - Level of assurance criteria for M1(A) mitigation

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 86 of 184

B.3 M1(B) – Strategic mitigations – Operational restrictions

M1(B) mitigations are intended to reduce the number of people at risk on the ground independently

of sheltering. These mitigations are applied pre-flight.

Improvements in static data population density maps are not part of M1(B) mitigation and should be

already used in the intrinsic ground risk assessment at Step #2. Use of best available data is

encouraged to be used already for the iGRC determination.

An authority may on a case-by-case basis accept pure time exposure arguments for ground risk

reduction but should consider how this affects the cumulative risk. M1(B) mitigations are

combinations of limitations on time and location of the operation to reduce the number of people at

risk at a set time and location.

LEVEL of INTEGRITY

Medium High

M1(B) –

Operational

restrictions

Criterion #1

(Evaluation of

people at risk)

The applicant provides spacetime-based restrictions (e.g., flying over a

market square when it is not crowded) to substantiate that the actual

density of people during the operation is lower than in Step #2.

This can be done by means of:

a) An analysis or appraisal of characteristics1 of the location and time2

of operation, AND/OR

b) Use of temporal density data (e.g., data from a supplemental data

service provider) relevant for the proposed area. This can incorporate

real time or historical data.

Comments

1 Characteristics of the location should be understood as land use that

relate to the presence of people, e.g., industrial area, urban park or

shopping centres.

2 Time should be understood as time of day or day of the week that would

influence the presence of people, e.g., weekend for industrial plants,

night-time, time after opening hours of shops.

Criterion #2

(Impact on at

risk population)

The at-risk population is lowered by at

least 1 iGRC population band3 (~90%)

using one or more methods described

in the Level of Integrity for Criterion

#1 above.

The at-risk population is

lowered by at least 2 iGRC

population bands3 (~99%)

using one or more methods

described in the Level of

Integrity for Criterion #1

above.

Comments 3 iGRC population band is described in “3.6.4 – Step #3” of SORA Main

body.

Table B. 4 - Level of integrity assessment criteria for M1(B) mitigation

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 87 of 184

LEVEL of ASSURANCE

Medium High

M1(B) –

Operational

restrictions

Criterion #1

(Evaluation of

people at risk)

All mapping products, data sources and processes used to claim

lowering the density of population at risk are accepted by the competent

authority.

Comments N/A

Criterion #2

(Impact on at

risk population)

The applicant has supporting

evidence that the required level of

integrity is achieved. This is typically

done by means of analysis,

simulation, surveys or through

operational experience.

The claimed level of integrity is

validated by the competent

authority of the MS or by an

entity that is designated by the

competent authority against a

standard considered adequate

by the competent authority

and/or in accordance with

means of compliance acceptable

to that authority.

Comments

Quantitative and qualitative mitigations can in combination meet the

target reductions of at-risk populations set in medium and high integrity

levels.

Table B. 5 - Level of assurance criteria for M1(b) mitigation

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 88 of 184

B.4 M1(C) – Tactical Mitigations – Ground observation

M1(C) mitigation is a tactical mitigation where the remote crew or the system can observe most of

the overflown area(s), allowing the detection of uninvolved people in the operational area and

manoeuvring the UA, so that the number of uninvolved people overflown during the operation is

significantly reduced.

LEVEL of INTEGRITY

Low

M1(C) –

Ground

observation

Criterion #1

(Procedures)

To achieve a reduction of people at risk:

a) The remote crew members observe the vast majority of the

overflown areas during the operation, and identify area(s) of less risk

on the ground;

b) The remote pilot will reduce the number of people at risk by adjusting

the flight path while the operation is ongoing (e.g., flying away from

the area with a higher risk on the ground or overflying only the

identified area(s) of less risk on the ground).

Comments 1 iGRC population band is described in “4.2.3– Step #3” of SORA Main

body.

Criterion #2

(Technical

means)

If the mitigation is achieved through the use of technical means1 (e.g.,

camera(s) mounted on the UA or visual ground observers with

radios/phones), these should provide data of sufficient quality allowing

reliable detection of uninvolved people on the ground.

Comments 1Criterion 2 may require support from the UAS or Component designer

to gather the required evidences.

Table B. 6 - Level of integrity assessment criteria for M1(C) mitigation

LEVEL of ASSURANCE

Low

M1(C) –

Ground

observation

Criterion #1

(Procedures)

The operational procedures for the mitigation are documented.

The applicant declares that the required level of integrity has been

achieved.

Comments N/A

Criterion #2

(Technical

means)

Authorities may allow the use of technical means1 for ground

observation with assurance criteria acceptable to them.

Comments 1Criterion 2 may require support from the UAS or Component designer to

gather the required evidences.

Table B. 7 - Level of assurance assessment criteria for M1(C) mitigation

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 89 of 184

B.5 M2 – Effects of the UA impact dynamics are reduced

M2 mitigations are intended to reduce the effect of ground impact once the control of the operation

is lost. This is done either by reducing the probability of lethality of a UA impact (i.e., energy, impulse,

transfer energy dynamics, etc.) and/or by reducing the size of the expected critical area (see table 8

below). Examples include, but are not limited to parachutes, autorotation, frangibility, stalling the

aircraft to slow the descent and increase the impact angle. An applicant should demonstrate the

required total amount of reduction (see integrity criteria) in either or both factors.

The base assumption in SORA for UAS impact lethality before M2 mitigation is applied is that most311

impacts are lethal. Based on the characteristic dimensions of an UA, the related critical areas are below

displayed in Table 8. Depending on whether the mitigation is passive, manually activated or

automatically activated the applicant should provide correspondingly adequate evidence and

procedures for a given level of robustness. Reduction of the inherent critical area of a UA by way of

analysis should be conducted already in Step #2 of SORA and is not part of M2 mitigation.

Critical area calculations are defined in Annex F32 chapter 1.833. The SORA Main Body assumes the

following critical areas for each characteristic dimension:

Maximum characteristic dimension (m) 1 3 8 20 40

Critical area (m2) 6.5 65 650 6500 65,000

Table B. 8 - Critical areas associated with the maximum characteristic dimension (unmitigated)

Applicants claiming for a mitigation by reduction of critical area shall use the values above as the

baseline of comparison to show the appropriate mitigation.

If an applicant has used the modifications according to Annex F32 in Step #2, or using the automatic

tool available on the EASA website34, to show a corrected critical area for their UAS and matched the

corrected critical area to a column in Table 8, then this table value is used as the baseline against which

the mitigation is assessed.

If an applicant has used the modifications according to Annex F32 in Step #2 to show both a corrected

critical area and matching population density, then this custom critical area value is used as the

baseline against which the mitigation is assessed, and the custom population density value must be

used as a limitation in the operation.

31 Most UA impacts are assumed to be lethal in the SORA ground risk model except:

• Impacts during slide of UA with characteristic dimension less or equal to 1 m

• Any impacts during slide of UA with total kinetic energy below 290 Joules

See Annex F (http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf) for more details on calculation.

32 http://jarus-rpas.org/wp-content/uploads/2024/06/SORA-v2.5-Annex-F-Release.JAR_doc_29pdf.pdf 33 Additional guidelines on the assessment of the critical area may be found at

https://www.easa.europa.eu/en/downloads/139781/en. 34 https://www.easa.europa.eu/en/domains/drones-air-mobility/operating-drone/critical-area-assessment-tool-caat

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 90 of 184

LEVEL of INTEGRITY

Mediumg High

M2 – Effects of UA impact dynamics are reduced

Criterion #1 (Technical design)

(a) Effects of impact dynamics and immediate post impact hazardsa, critical area or the combination of these results are reduced such that the risk to population is reduced by an approximate 1 order of magnitude (90%)b,c.

(b) When applicable, in case of malfunctions, failures or any combinations thereof that may lead to a crash, the UAS contains all elements required for the activation of the mitigationd.

(c) When applicable, any failure or malfunction of the proposed mitigation itself (e.g., inadvertent activation) does not adversely affect the safety of the operation.

Same as Medium. In addition:

(a) When applicable, the activation of the mitigation is automatedd,e,f.

(b) The effects of impact dynamics and immediate post impact hazardsa, critical area or the combination of them are reduced such that the risk to the population is reduced by an approximate 2 orders of magnitude (99%)b,c.

Comments

a Examples of immediate post impact hazards include fires and release of high energy parts. b Latest research on UAS impacts estimate injuries using the Abbreviated Injury Scale (AIS) developed for automotive impact tests and test dummies. An impact that has a 30% chance of causing injury of AIS level 3 injury or greater is estimated to have a 10% probability of death. Note that the SORA methodology only considers fatalities. It does not provide guidance on the injury levels / thresholds beyond which an injury should be considered as a fatality. Further Guidance on how to evaluate impact severity measurement may be found for example in Ranges of Injury Risk Associated with Impact from Unmanned Aircraft Systems DOI: 10.1007/s10439-017-1921-6, ASSURE UAS reports A14 and A4 on UAS Ground Collision Severity Evaluation. c The reduction in risk detailed here is equivalent to a “System Risk Ratio” which requires that the combination of functional performance (i.e., the reduction in risk when the mitigation functions as intended) and reliability (i.e., the chance that the mitigation does not function as intended) combined meet the requirement. d For medium robustness the applicant is expected to address only probable malfunctions, failures and their combinations. e An automated activation may be required when reaction time is critical or the operator cannot determine the need for activation. f The applicant may nevertheless implement an additional manual activation function. g MoC to Light-UAS.251235 is an acceptable means to comply with the medium level of robustness for M2. Moreover, it provides additional explanation of the M2 criteria.

Criterion #2 (Procedures)

Any equipment used to reduce the effect of the UA impact dynamics are installed and maintained in accordance with UAS/Mitigation designer instructions.

Comments N/A

35 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-mitigation-

means-m2-ref-amc

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 91 of 184

Criterion #3 (Training)

When use of the mitigation requires action from the remote crew, then appropriate training must be provided for the remote crew by the operator. The operator must ensure that the personnel responsible (internal or external) for the installation and maintenance of the mitigation measures are qualified for the task.

Comments N/A

Table B.15 - Level of Integrity Assessment Criteria for M2 mitigation

LEVEL of ASSURANCE

Medium High

M2 – Effects

of UA impact

dynamics are

reduced

Criterion #1

(Technical

design)

The applicant has supporting evidence to

claim the required level of integrity and

reliability is achieved. This is typically done by

means of testing, analysis, simulationa,

inspection, design review or through

operational experience.

A UAS with a C0 or C1 class mark or with

MTOM lower or equal to 900g and a

maximum speed of 19 m/s fulfils this

assurance Criteria 1.

The applicant may declare compliance with

MoC to Light-UAS.2512b providing the

supporting evidence defined in it.

The competent authority

should request the applicant

to use a UAS for which EASA

has verified the claimed

integrity through a DVR.

Comments a When a simulation is used, the validity of the targeted environment used in the

simulation needs to be justified.

b https://www.easa.europa.eu/en/document-library/product-certification-

consultations/means-compliance-mitigation-means-m2-ref-amc

Criterion #2

(Procedures)

(a) Procedures are validated against standards

considered adequate by the competent

authority of the MS and/or in accordance

with the means of compliance acceptable

to that authority.

(b) The adequacy of the procedures is proved

through:

i) Dedicated flight tests, or

ii) Simulation, provided that the

representativeness of the simulation

means is proven for the intended

purpose with positive results.

Same as Medium. In

addition:

(a) The DVR covers the

procedures, flight tests

and simulations

(b) The competent

authority of the MS or

by an entity that is

designated by the

competent authority

verifies that the

procedures developed

by the UAS operator

are acceptable.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 92 of 184

Comments AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of

robustness) is considered an acceptable means of compliance.

Criterion #3

(Training)

a) Training syllabus is available.

b) The operator provides theoretical and

practical training for the remote crew.

c) Personnel responsible for installation and

maintenance of the mitigation measures

have completed relevant training.

Same as medium. In

addition, the competent

authority of the MS or an

entity that is designated by

the competent authority:

a) validates the training

syllabus.

b) Verifies the remote

crew competencies

Comments N/A

Table B. 10 - Level of Assurance Assessment Criteria for M2 mitigation

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 93 of 184

B.6 Mitigations effects table for determining the final GRC

Ground risk mitigation Level of Robustness

Low Medium High

M1(A) – Strategic mitigations - Sheltering

-1 -2 N/A

M1(B) – Strategic mitigation – Operational restrictions

N/A -1 -2

M1(C) – Tactical mitigations – Ground observation

-1 N/A N/A

M2 – Effects of UA impact dynamics are reduced

N/A -1 -2

Table B. 91 - Mitigations effect for final GRC determination

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 94 of 184

Annex E to AMC1 to Article 11 is amended as follows:

Annex E to AMC1 to Article 11

INTEGRITY AND ASSURANCE LEVELS FOR THE OPERATIONAL SAFETY OBJECTIVES (OSOs)

E.1. How to use SORA Annex E

The following Table E.1 provides the basic principles to consider when using SORA Annex E.

Principle description Additional information

#1 Annex E provides assessment criteria for the integrity (i.e. safety gain) and assurance (i.e. method of proof) of OSOs proposed by an applicant.

The identification of OSOs for a given operation is the responsibility of the applicant. The relationships between the SAIL and the Low/Medium/High level of robustness of an OSO can be found in Step #9 of the SORA Main Body.

#2 Annex E does not cover the LoI of the competent authority. Lol is based on the competent authority’s assessment of the applicant’s ability to perform the given operation.

#3 To achieve a given level of integrity/assurance, wWhen more than one criterion exists for a given that level of integrity/assurance in an OSO, all the applicable criteria need to be met at the required integrity/assurance level to satisfy the given OSO.

#4 ‘Optional’ ‘Not required (NR)’ cases defined in SORA main body Table 14 6 do not need to be defined in terms of integrity and assurance levels in Annex E.

All robustness levels are acceptable for OSOs for which an ‘optional’ level of robustness is defined in Table 6 ‘Recommended OSOs’ of the SORA main body. Applicants are encouraged anyway to consider also the OSO classified an NR

#5 When the criteria to assess the level of integrity or assurance of an OSO rely on ‘standards’ that are not yet available, the OSO needs to be developed in a manner acceptable to the competent authority.

#6 Annex E intentionally uses non-prescriptive terms (e.g. suitable, reasonably practicable) to provide flexibility to both the applicant and the competent authorities. This does not constrain the applicant in proposing mitigations, nor the competent authority in evaluating what is needed on a case-by-case basis.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 95 of 184

#7 This annex in its entirety also applies to single-person organisations.

#8 Some of the OSOs refer to the Functional Test Based (FTB) approach which is described in detail in section E.3.

Table E.1 – Basic principles to consider when using SORA Annex E

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 96 of 184

E.2 OSOs related to technical issues with the UAS

OSO #01 — Ensure that the UAS operator is competent and/or proven

TECHNICAL ISSUE WITH THE UAS Level of integrity

Low (SAIL II)

Medium (SAIL III)

High (SAIL IV to VI)

OSO #01 Ensure that the UAS operator is competent and/or proven

Criteria Criterion

The applicant is knowledgeable of the UAS 1 being used and as a minimum has the following relevant operational procedures2:

(a) checklists, (b) maintenance, (c) training, (d) responsibilities, and associated

duties.

Same as Low. In addition, the applicant has an

organization appropriate13 for the intended

operation, with at least the following in place: Also,

the applicant has a method to identify, assess, and

mitigate the risks associated with flight operations.

These should be consistent with the nature and

extent of the operations specified.

a) a method to continuously evaluate whether the

operator is operating according to the terms of

the operational authorization and check whether

the mitigations proposed as part of the

operational authorization are still appropriate;

b) occurrence analysis procedures and reporting to

the designer in case of design-related in-service

events.

Same as medium

The applicant has a safety management system in place in line with ICAO Annex 19 principles.

Comments

N/A

1 Including monitoring of any related

airworthiness directives or

recommendations issued by National

Aviation Authorities and designer

recommendations (Service Bulletin, Service

Information Letter, etc.)

13 For the purpose of this assessment, ‘appropriate’ should be interpreted as commensurate with/proportionate to the size of the organisation and the complexity of the operation.

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 97 of 184

2 Operational procedures (checklists, maintenance, training, etc.) can be justified in the context of other applicable OSO.

TECHNICAL ISSUE WITH THE UAS Level of assurance

Low (SAIL II)

Medium (SAIL III)

High (SAIL IV to VI)

OSO #01 Ensure that the UAS operator is competent and/or proven

Criteria Criterion The elements delineated in the level of integrity are available and addressed in the operations manual ConOps.

Prior to the first operation, the competent authority of the MS or an entity that is designated by the competent authority performs an audit of the organisation.

The applicant holds an organisational operating certificate(e.g. LUC) or has a recognised flight test organisation. In addition, the competent authority of the MS or an entity that is designated by the competent authority verifies the UAS operator’s competencies.

Comments N/A

N/A Audits should be adapted to the size and scope of the organization and focus on items that can be connected to the applicable OSOs and their robustness depending on the SAIL of the operation. Audits can take the form of desk reviews, if deemed appropriate.

OSO #02 — UAS designed and produced by a competent and/or proven entity

TECHNICAL ISSUE WITH THE UAS Level of integrity

Low (SAIL III)

Medium (SAIL IV)

High (SAIL V & VI)

OSO #02 UAS designed and produced by a competent and/or proven entity

Criteria Criterion for design

As a minimum, design documentation covers: (a) the specification of the materials;

and (b) the suitability and durability of the

materials used

a) processes necessary to allow for

repeatability in manufacturing and

Same as low. In addition, design documentation also covers: (a) the configuration control; and (b) identification and traceability.

The design organisation complies with Subpart J of Annex I (Part 21) to Regulation (EU) No 748/2012.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 98 of 184

conformity within acceptable

tolerances,

(c)configuration control.

Criteria Criterion for production

As a minimum, production procedures cover (a) the, configuration control; (b) the processes necessary to allow for

repeatability in manufacturing, and (c) conformity within acceptable

tolerances.

Same as low. In addition, production procedures also cover: (a) the configuration control; (b)(a) the verification of incoming

products, parts, materials, and equipment;

(c)(b) identification and traceability; (d)(c) in-process and final inspections &

testing; (e)(d) the control and calibration of tools; (f)(e) handling and storage; and (g)(f) the control of non-conforming

items.

The production organisation complies with the organisational requirements that are defined in Subpart F or G of Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A N/A N/A

TECHNICAL ISSUE WITH THE UAS Level of assurance

Low (SAIL III)

Medium (SAIL IV)

High (SAIL V & VI)

OSO #02

UAS designed and produced by a competent and/or proven entity

Criteria Criterion for design

The specifications, suitability and durability of the materials are declared against a standard recognised by the competent authority and/or in accordance with means of compliance acceptable to the competent authority.

Same as low. In addition, evidence is available that the UAS has been designed in accordance with design procedures.

The competent authority should request the applicant to use a UAS for which EASA has verified the claimed integrity through a DVR.

Same as medium. In addition:

In addition, the competent authority should request the applicant to operate a UAS designed by an organisation approved by EASA according to Subpart J of Annex I (Part 21) to Regulation (EU) No 748/2012

Criterion for production

The declared production procedures are developed to a standard that is considered adequate by the competent authority that issues the operational

Same as low. In addition, evidence is available that the UAS has been produced in conformance with its design.

Same as medium. In addition:, the competent authority of the MS or an entity that is designated by the competent authority validates

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 99 of 184

authorisation and/or in accordance with a means of compliance acceptable to that authority.

compliance with the production organisational requirements that are defined in Subpart F or G of Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A N/A N/A

OSO #03 — UAS maintained by competent and/or proven entityMaintenance of UAS

TECHNICAL ISSUE WITH THE UAS Level of integrity

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #03 Maintenance of UAS maintained by a competent and/or proven entity (e.g. industry standards)

Criterion #1 (Design)

The UAS designer maintenance instructions and requirements (including scheduled maintenance) to ensure a safe operation are defined.

Criteria Criterion #2 procedure

(a) The UAS Operator1 maintenance instructions2 and requirements3 are defined, and, when applicable, cover the UAS designer’s instructions and requirements4/5, and are adhered to. (b) The maintenance staff is competent and has received an authorisation to carry out UAS maintenance. (c) The maintenance staff use the UAS maintenance instructions while performing maintenance.

Same as low. In addition: (a) Preventive/sScheduled maintenance/ inspection of each UAS is organised and in accordance with a the UAS Operator maintenance programme on the basis of the UAS designer scheduled maintenance requirements4 and adapted to the specificities of UAS operations. (b) Upon completion, the maintenance log system is used to record all the maintenance conducted on the UAS, including releases. A maintenance release can only be accomplished by a staff member who has received a maintenance release authorisation for that particular UAS model/family.

Same as medium. In addition, the maintenance staff work in accordance with a maintenance procedure manual that provides information and procedures relevant to the maintenance facility, records, maintenance instructions, release, tools, material, components, defect deferral, etc. The UAS operator complies with Regulation (EU) 2024/1107.

Comments

N/A

1The maintenance may be performed by an organization other than the Operator (e.g. use of a third party).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 100 of 184

2The UAS Operator maintenance instructions are the information establishing how to carry out the needed maintenance/repairs.

These instructions are used by the maintenance staff while performing maintenance.

3 The UAS Operator maintenance requirements are the needs for maintenance on the UAS, e.g. inspection after hard landing,

regular check of lighting system. The UAS Operator ensures these requirements are covered in the UAS maintenance instructions.

4 The UAS Operator may just reuse the UAS designer instructions and requirements for maintenance.

5 The UAS designer instructions and requirements for maintenance are sometimes referred to as ICA (Instructions for Continuing Airworthiness).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 101 of 184

TECHNICAL ISSUE WITH THE UAS Level of assurance

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #03 Maintenance of UAS maintained by a competent and/or proven entity (e.g. industry standards)

Criterion #1 (design)

The UAS designer maintenance instructions and requirements (including scheduled maintenance) to ensure a safe operation are defined.

The UAS scheduled maintenance requirements are developed in accordance with standards considered adequate by the competent authority of the MS and/or in accordance with a means of compliance acceptable to that authority. In addition, if the UAS has a DVR or a type certificate according to Regulation (EU) 748/2012,, the maintenance programme includes the scheduled maintenance requirements developed as part of the design.

Criterion #12 (Procedure)

(a) The UAS operator maintenance

instructions are documented1. (b) The maintenance conducted on the UAS is recorded in a maintenance log

system2/31/2. (c) A list of the maintenance staff authorised to carry out maintenance is established and kept up to date.

Same as low. In addition: (a) The UAS operator maintenance programme covers the UAS designer’s scheduled maintenance requirements and it is developed in accordance with standards considered adequate by the competent authority of the MS and/or in accordance with a means of compliance acceptable to that authority. In addition, if the UAS has a DVR or©(R)TC, the maintenance programme includes the scheduled maintenance requirements developed as part of the design. (b) A list of the maintenance staff with maintenance release authorisation is established and kept up to date.

Same as medium. In addition, the maintenance programme and the maintenance procedures manual are validated by the competent authority of the MS or by an entity that is designated by the competent authority. The UAS operator complies with Regulation (EU) 2024/1107.

Comment

1 The UAS Operator may just reuse the UAS

designer instructions and requirements for

maintenance.

21 The objective is to record all the maintenance performed on the aircraft, and why it is performed (rectification of defects or malfunctions, modifications, scheduled maintenance, etc.). 32 The maintenance log may be requested for inspection/audit by the approving authority or an authorised representative.

N/A N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 102 of 184

Criterion #23 (Training)

A record of all the relevant qualifications, experience and/or training completed by the maintenance staff is established and kept up to date.

Same as low. In addition: (a) The initial training syllabus and training standard, including theoretical/practical elements, duration, etc., is defined and is commensurate with the authorisation held by the maintenance staff. (b) For staff that hold a maintenance release authorization, the initial training is specific to that particular UAS model/family. (c) All maintenance staff have undergone initial training.

Same as medium. In addition: (a) A programme for the recurrent training of staff holding a maintenance release authorisation is established; and (b) This programme is validated by the MS or by an entity that is designated by the competent authority. The UAS operator complies with Regulation (EU) 2024/1107.

Comments N/A N/A N/A

OSO #04 — UAS components essential to safe operations are designed to an airworthiness design standard developed to authority recognized design standards

(a) For SAIL up to III, applicants are still encouraged to appropriately design their UAS (i.e. apply OSO #4). In this case the UAS components essential to safe operations

are those whose failure would significantly impair the capability of the operator to meet the requested target level of safety in terms of loss of control of the operation.

The term component is meant as including any element of the UAS .

(b) Starting at SAIL IV, it is considered that the safety objective associated to the SAIL of one operation (e.g. probability of loss of control of the operation below 10-4/FH

for a SAIL IV operation) should be achieved with a UAS designed to be compliant with SC light UAS verified by EASA.

The list of airworthiness design standard (ADS) to be complied with through OSO#04 is not intended to duplicate requirements already covered by other design-

related OSOs. While OSO #04 aims at ensuring that the UAS as a whole is designed according to an ADS f(for example, the design and construction, structure, and

flight performance is part of the ADS, but not other OSOs), other design-related OSOs focus on particular systems/functionalities of the UAS and or technical disciplines

(e.g., safety):

— OSOs #05 (System Safety Related)

— OSO #06 (C3)

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 103 of 184

— OSO #07 (conformity check)

— OSO #13 (external systems)

— OSO #18 (automatic protection of envelope)

— OSO #20 (HMI)

— OSO #23/#24 (adverse environment).

TECHNICAL ISSUE WITH THE UAS

Level of integrity

Low Medium (SAIL IV)

High

(SAIL V) (SAIL VI)

OSO #04 UAS components essential to safe operations are designed to an airworthiness design developed to authority recognised design standards

Criteria Criterion

The UAS components essential to safe operations are is designed to an

airworthiness design standards1

considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority to contribute to the overall safety objective of 10-4/FH for the loss of

control of the operation. The standards and/or the means of compliance should be applicable to a low level of integrity and the intended operation.

The UAS components essential to safe operations are is designed to an

airworthiness design standards1

considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority to contribute to the overall safety objective of 10-5/FH for the loss of control of the operation. The standards and/or the means of compliance should be applicable to a medium level of integrity and the intended operation.

The UAS components essential to safe operations are is designed to an

airworthiness design standards1

considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority to contribute to the overall safety objective of 10-6/FH for the loss of control of the operation. The standards and/or the means of compliance should be applicable to a high level of integrity and the intended operation.

Comments

In case of experimental flights that investigate new technical solutions, the competent authority may accept that recognised standards are not met.

1 EASA Special Condition Light-UAS is the recommended airworthiness design standard

The applicant can propose their own airworthiness design standard(s) to the competent authority.

When aspects of an airworthiness design standards is covered by an OSO (for instance OSO#05), the OSO requirement takes precedence.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 104 of 184

TECHNICAL ISSUE WITH THE UAS

Level of assurance

Low Medium

(SAIL IV)

Medium

High

(SAIL V & VI)

OSO #04 UAS components essential to safe operations are designed to an airworthiness design developed to authority recognised design standards

Criteria Criterion

The competent authority should request the applicant to use a UAS for which EASA has verified the claimed integrity through a DVR.

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012. The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A N/A N/A

Comment

In case the applicant decides to apply OSO #4 for UAS operated in SAIL I to III, then may use MoC light UAS.FTB (https://www.easa.europa.eu/en/document- library/product-certification- consultations/final-means-compliance- special-condition-light ).

N/A

OSO #05 — UAS is designed considering system safety and reliability

This OSO complements:

(a) the safety requirements for containment defined in the main body; and

(b) OSO #10 and OSO #12, which only address the risk of a fatality while operating over populated areas or assemblies of people.

(a) OSO #05 ensures that the contribution of the UAS or of any external system supporting the operation to the loss of control of the operation

inside the operational volume is commensurate to the acceptable level of risk associated with each SAIL. OSO#05 safety objectives are to be

considered in conjunction with the containment safety requirements (Step#8 and section 4 of this Annex) and, when applicable, the ground risk

mitigation requirements (Annex B, in particular M2 Criterion # 1 requirements). In combination, these three sets of safety objectives ensure that

whatever the SAIL of the operation, the target level of safety is met and no single failure is expected to lead to a catastrophic effect.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 105 of 184

(b) Note on SAIL II operations: Some UAS designs may employ novel or complex features which have very limited operational experience. If such

features are identified by the competent authority or applicant, the applicant should assure that the equipment, systems, and installations are

designed to minimize hazards in the event of a probable failure of the UAS or of any external system supporting the operation. This should be

done through a declaration with a simple written justification from the applicant including functional diagrams and a description of how the

system functions.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 106 of 184

TECHNICAL ISSUE WITH THE UAS

Level of integrity

Low Medium High (SAIL V & VI) (SAIL III) (SAIL IV)

OSO #05 UAS is designed considering system safety and reliability

Criteria Criterion

The equipment, systems, and installations

are designed to minimise1 hazards21 in

the event of a probable32 malfunction or failure of the UAS or of any external system supporting the operation.

Same as low. In addition, the strategy for detection, alerting and management of any malfunction, failure or combination thereof, which would lead to a hazard, is available.

Same as medium. In addition: (a) Major failure conditions are not more

frequent than remote34; (b) Hazardous failure conditions are not more

frequent than extremely remote34; (c) Catastrophic failure conditions are not more

frequent than extremely improbable34; (d) No single failure can lead to a Catastrophic

Failure Condition; and (d) SW and AEH whose development error(s)

may cause or contribute to hazardous or catastrophic failure conditions are developed to an industry standard or a methodology considered adequate by EASA and/or in accordance with means of compliance acceptable to EASA45.

Comments

1 The minimization of hazard criterion

correlates to the contribution of the UAS

and of any external system supporting the

operation to the loss of control of the

operation rate, thus the SAIL of the

operation. As an example, at SAIL III, the

contribution of the UAS and of any external

system supporting the operation to the loss

of control of the operation rate could be

10-4/FH assuming a traditional 10%

contribution of the technical aspects to the

safety of an operation.

NOTE TO THE READER HERE WE WILL ADD

REFERENCE TO A ANY MOC WE MY

Applicants may show compliance by MoC Light UAS.2510

34 NOTE TO THE READER HERE WE WILL ADD REFERENCE TO A ANY MOC WE MY PUBLISH BEFORE PUBLICAITON OF THE DECISION 54 NOTE TO THE READER HERE WE WILL ADD REFERENCE TO A ANY MOC WE MY PUBLISH BEFORE PUBLICAITON OF THE DECISION

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 107 of 184

PUBLISH BEFORE PUBLICAITON OF THE

DECISION

21 For the purpose of this assessment, the term ‘hazard’ should be interpreted as a failure condition that relates to major, and hazardous, or catastrophic consequences (the term “Catastrophic” is intentionally not included since the TLOS is considered met for SAIL I to IV operations with the provision of Note 1 above and, if applicable M2 requirements in Annex B). 32 For the purpose of this assessment, the term ‘probable’ should be interpreted in a qualitative way as ‘anticipated to occur one or more times during the entire system/operational life of a UAS’. Applicants may show compliance by CM- SA-003 - SORA OSO#5 UAS designed considering system safety and reliability (SAIL III)

TECHNICAL ISSUE WITH THE UAS

Level of assurance

Low Medium High (SAIL V & VI) (SAIL III) (SAIL IV)

OSO #05 UAS is designed considering system safety and reliability

Criteria Criterion

A functional hazard assessment1/2 and a

design and installation appraisal3 that show that hazards are minimised, are available.

Same as low. In addition:

(a) Safety analyses assessment are conducted in line with standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority. (b) A strategy for the detection of single failures of concern includes pre-flight checks. The competent authority should request the applicant to use a UAS for which EASA has validated the claimed integrity through a DVR.

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 108 of 184

TECHNICAL ISSUE WITH THE UAS

Level of assurance

Low Medium High (SAIL V & VI) (SAIL III) (SAIL IV)

Comments

1The severity of failure conditions (no safety effect, minor, major, hazardous and catastrophic) should be determined according to the definitions provided in JARUS AMC RPAS.1309 Issue 2.

2 Eurocae ED-280 “Guidelines for UAS

safety analysis for the specific category

(low and medium levels of robustness)”

may be considered by the applicant to

support compliance with this criterion

(FHA).

For SAIL III and IV, Eurocae ED-280

“Guidelines for UAS safety analysis for the

specific category (low and medium levels

of robustness)” may be considered

acceptable by the competent authority to

support compliance with this criterion

(FHA).

3 A simple written justification from the operator including functional diagrams and a description of how the system works explaining why the integrity claim is met is an acceptable means of compliance.

Applicants may show compliance by CM-

SA-003 - SORA OSO#5 UAS designed

considering system safety and reliability

(SAIL III)

N/A For SAIL IV, Eurocae ED-280 “Guidelines for UAS safety analysis for the specific category (low and medium levels of robustness)” may be considered acceptable by the competent authority to support compliance with this criterion.

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 109 of 184

OSO #06 — C3 link characteristics (e.g. performance, spectrum use) are appropriate for the operation

(a) For the purpose of the SORA and this specific OSO, the term ‘C3 link’ encompasses:

(1) the C2 link; and

(2) any communication link required for the safety of the flight.

(b) To correctly assess the integrity of this OSO, the applicant should identify the following:

(1) The performance requirements for the C3 links necessary for the intended operation.

(2) All the C3 links, together with their actual performance and RF spectrum usage.

Note: The specification of the performance and RF spectrum for a C2 Link is typically documented by the UAS designer in the UAS flight

manual.

Note: The main parameters associated with the performance of a C2 link (RLP) and the performance parameters for other communication

links (e.g. RCP for communication with ATC) include, but are not limited to, the following:

(i) the transaction expiration time;

(ii) the availability;

(iii) the continuity; and

(iv) the integrity.

Refer to the ICAO references for definitions.

(3) The RF spectrum usage requirements for the intended operation (including the need for authorisation if required).

Note: Usually, countries publish the allocation of RF spectrum bands applicable in their territories. This allocation stems mostly from the

International Communication Union (ITU) Radio Regulations. However, the applicant should check the local requirements and request

authorisation when needed since there may be national differences and specific allocations (e.g. national sub-divisions of ITU allocations).

Some aeronautical bands (e.g. AM(R)S, AMS(R)S 5030-5091MHz) were allocated for potential use in UAS operations under the ICAO scope

for UAS operations classified as cat. C (‘certified’), but their use may be authorised for operations under the ‘specific’ category. It is

expected that the use of other licensed bands (e.g. those allocated to mobile networks) may also be authorised under the ‘specific’

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 110 of 184

category. Some un-licensed bands (e.g. industrial, scientific and medical (ISM) or short-range devices (SRDs)) may also be acceptable under

the ‘specific’ category; for instance, for operations with lower integrity requirements.

(4) Environmental conditions that might affect the performance of C3 links.

TECHNICAL ISSUE WITH THE UAS

Level of integrity

Low

(SAIL II & III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #06 C3 link characteristics (e.g. performance, spectrum use) are appropriate for the operation

Criteria Criterion

(a) The applicant determines that the performance, RF spectrum usage1 and environmental conditions for C3 links are adequate to safely conduct the intended operation. (b) The remote pilot has the means to continuously monitor the C3 performance and ensures that the performance continues to meet the operational requirements2.

Same as low3. Same as low. In addition, the use of licensed4 frequency bands for C2 Links is required.

Comments

1 For a low level of integrity, unlicensed frequency bands might be acceptable under certain conditions, e.g.: (a) the applicant demonstrates compliance with other RF spectrum usage requirements (e.g. Directive 2014/53/EU), by showing that the UAS equipment is compliant with these requirements; and (b) the use of mechanisms to protect against interference (e.g. FHSS, frequency de-confliction by procedure). 2 The remote pilot has continual and timely access to the relevant C3 information that could affect the safety of flight. For operations requesting only a low level of integrity for this OSO, this could be achieved by monitoring the C2 link signal strength and receiving an alert from the UAS HMI if the signal strength becomes too low.

3 Depending on the operation, the use of licensed frequency bands might be necessary. In some cases, the use of non-aeronautical bands (e.g. licensed bands for cellular network) may be acceptable.

4 This ensures a minimum level of performance and is not limited to aeronautical licensed frequency bands (e.g. licensed bands for cellular network). Nevertheless, some operations may require the use of bands allocated to the aeronautical mobile service for the use of C2 Link (e.g. 5030 – 5091 MHz). In any case, the use of licensed frequency bands needs authorisation.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 111 of 184

TECHNICAL ISSUE WITH THE UAS

Level of assurance

Low

(SAIL II & III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #06 C3 link characteristics (e.g. performance, spectrum use) are appropriate for the operation

Criteria Criterion

The applicant declares that the required level of integrity has been achieved.

The competent authority should request the applicant to use a UAS for which EASA has verified the claimed integrity through a DVR.

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A. N/A

N/A

OSO #07 — Inspection of the UAS (product inspection) to ensure consistency with the ConOps Conformity check of the UAS configuration

(a) The intent of this OSO is to ensure that the UAS used for the operation conforms to the UAS data used to support the approval/authorisation of the operation.

(b) This OSO does not describe a pre or post flight inspection as part of normal operations, these are covered under OSO #8.

TECHNICAL ISSUE WITH THE UAS

Level of integrity

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #07 Inspection of the UAS (product inspection) to ensure consistency with the ConOps Conformity check of the UAS configuration

Criteria Criterion

The remote crew ensures that the UAS is in a condition for safe operation and conforms to the approved ConOps.1

The operator has UAS conformity check procedures ensuring periodically that:

a) the UAS intended to be used for the operation is in a condition for safe operation,

b) the UAS configuration conforms to the UAS design data (including any design limitations, e.g., maximum payload weight)

considered under the approved concept of operation.

Comments 1 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see the table below).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 112 of 184

TECHNICAL ISSUE WITH THE UAS Level of assurance

Low Medium High

OSO #07 nspection of the UAS (product inspection) to ensure consistency with the ConOps Conformity check of the UAS configuration

Criterion #1 (Procedures)

Product inspection is The UAS conformity check procedures are documented and accounts for the manufacturer’s recommendations, if available.

Same as low. In addition, the UAS conformity checks are the product inspection is documented using checklists.

Same as medium. In addition, ,the product inspection procedures are validated by the competent authority of the MS or by an entity that is designated by the competent authority.

Comments N/A N/A N/A

Criterion #2 (Training)

The remote crew is trained to perform the UAS conformity check the product

inspection, and that training is self- declared (with evidence available).

(a) A training syllabus including a UAS conformity check product inspection procedure is available. (b) The UAS operator provides evidences of the competency-based, theoretical and practical training.

The competent authority of the MS or an entity that is designated by the competent authority: (a) validates the training syllabus; and (b) verifies the remote crew competencies.

Comments N/A N/A N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 113 of 184

E.3 OSOs related to operational procedures

OSO #08 – Operational procedures are defined, validated and adhered to

(a) Operational procedures address normal, abnormal and emergency situations potentially resulting from technical issues with the UAS or external

systems supporting UAS operation, human errors or critical environmental conditions.

(b) Standard operating procedures are a set of instructions covering policies, procedures, and responsibilities set out by the applicant that supports

operational personnel in ground and flight operations of the UA safely and consistently during normal situations.

(c) Contingency procedures are designed to potentially prevent a significant future event (e.g., loss of control of the operation) that has an increased

likelihood to occur due to the current abnormal state of the operation. These procedures should return the operation to a normal state and enable the

return to using standard operating procedures, or allow the safe cessation of the flight.

(d) Emergency procedures are intended to mitigate the effect of failures that cause or lead to an emergency condition.

(e) The emergency response plan (ERP) deals with the potential hazardous secondary or escalating effects after a loss of control of the operation (e.g., in

the case of ground impact, mid-air collision or flyaway) and is decoupled from the Emergency Procedures, as it does not deal with the control of the

UA.

OPERATIONAL PROCEDURES

Level of integrity

Low

(SAIL I)

Medium

(SAIL II)

High

(SAIL III to VI)

OSO #08, OSO #11, OSO #14 and OSO #21

Operational

procedures

are defined,

validated

and adhered

to

Criterion #1 (Procedure definition)

(a) Operational procedures1 appropriate for the proposed operation are defined and, as a minimum, cover the following elements: (1) Flight planning; (2) Pre- and post-flight inspections; (3) Procedures to evaluate the environmental conditions before and during the mission (i.e. real-time evaluation) including

assessment of meteorological conditions (METAR, TAFOR, etc.) with a simple recording system,; (4) Procedures to cope with unexpected adverse operating conditions (e.g. when ice is encountered during an operation not

approved for icing conditions); (5) Normal procedures; (6) Contingency procedures (to cope with abnormal situations); (7) Emergency procedures (to cope with emergency situations); (8) Pre-flight procedures including briefing of any involved persons about the potential risks and actions to take in case of

misbehaviour of the UA,

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 114 of 184

OPERATIONAL PROCEDURES

Level of integrity

Low

(SAIL I)

Medium

(SAIL II)

High

(SAIL III to VI)

(9) Occurrence-reporting procedures; and (b) The limitations of the external systems supporting the UAS operation2 are defined in an OM.

(c) The UAS flight manual / manufacturer instructions are available and the relevant information (e.g. limitations) is

utilized to define the operational procedures

Comments

1 Operational procedures cover the deterioration of the UAS itself and any external system supporting the UAS operation. Please refer to part B of the OM example published by on the EASA website at https://www.easa.europa.eu/en/downloads/139674/en To properly address the deterioration of external systems required for the operation, it is recommended to: (a) identify these ‘external systems’; (b) identify the modes of deterioration of the ‘external systems’ (e.g. complete loss of GNSS, GDOP/PDOP, latency issues, etc.) which

would lead to a loss of control of the operation; (c) describe the means to detect these modes of deterioration of the external systems ; and (d) describe the procedure(s) used when deterioration is detected (e.g. activation of the emergency recovery capability, switch to

manual control, etc.). 2 In the scope of this assessment, external systems supporting the UAS operation are defined as systems that are not already part of the UAS but are used to: (a) launch/take off the UA; (b) make pre-flight checks; or (c) keep the UA within its operational volume (e.g. GNSS, satellite systems, air traffic management, U-space). External systems activated/used after a loss of control of the operation are excluded from this definition.

Criterion #2 (Procedure complexity)

Operational procedures are complex and may potentially jeopardise the crew’s ability to respond by increasing the remote crew’s workload and/or their interaction with other entities (e.g. ATM, etc.).

Contingency/emergency procedures require manual control by the remote pilot2 when the UAS is usually automatically controlled.

Operational procedures are simple.

Comments N/A

2 It should be considered that not all UAS have a mode where the pilot could directly control the surfaces; moreover, it may require significant skill not to make things worse.

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 115 of 184

OPERATIONAL PROCEDURES

Level of integrity

Low

(SAIL I)

Medium

(SAIL II)

High

(SAIL III to VI)

Criterion #23 (Consideration of Potential Human Error)

At a minimum, operational procedures1 provide: (a) a clear distribution and assignment of tasks, and (b) an internal checklist to ensure staff are adequately performing their assigned tasks.

Operational procedures take human error into consideration.

Same as medium. In addition, the remote crew3 receives crew resource management (CRM)4 training.

Comments

N/A 1Please refer to part B of the OM example published by on the EASA website at https://www.easa.europa.eu/en/downloads/139674/en

N/A

3 In the context of SORA, the term ‘remote crew’ refers to any person involved in the mission. 4 CRM training focuses on the effective use of all the remote crew to ensure safe and efficient operation, reducing error, avoiding stress and increasing efficiency.

Criterion #3

(Emergency Response Plan)

The Emergency Response Plan (ERP):

a) is suitable for the situation6;

b) effectively mitigates all anticipated hazardous secondary effects after the initial crash;

c) clearly delineates Remote Crew member(s) duties;

d) is practical to use and trained, so that the Remote Crew can execute the procedures effectively under stress.

The ERP contains at minimum:

a) the list of anticipated emergency situations with secondary effects;

b) the procedures for each of the identified anticipated emergency situation (including criteria to identify each of these situations);

c) the list of relevant contacts to reach (e.g., Air Traffic Control, police, fire brigade, first responders).

Comments 6 The ERP should be proportional to the potential secondary effects of a ground impact, i.e., those effects that may occur after the initial ground impact (e.g., fire, release of poisonous gas).

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 116 of 184

OPERATIONAL PROCEDURES

Level of assurance

Low

(SAIL I)

Medium

(SAIL II)

High

(SAIL III to VI)

OSO #08, OSO #11, OSO #14 and OSO #21

Operational

procedures

are defined,

validated

and adhered

to

Criteria#1, #2 and #3

(a) The UAS operator developed operational procedures and ERP do not require validation against either a standard or a means of compliance that is considered adequate by the competent authority of the MS.

(b) The UAS operator declares the adequacy of the operational procedures and ERP. is declared, except fFor At least the emergency procedures, which are tested.

(a) Normal, contingency, and emergency procedures and ERP are documented and part of the operations manual (OM).

(b) Operational procedures and ERP are validated against developed according respectively to AMC2 UAS.SPEC.030(3)(e) and AMC3 UAS.SPEC.030(3)(e) standards considered adequate by the competent authority of the MS and/or in accordance with the means of compliance acceptable to that authority1.

(c) The adequacy of the contingency and emergency procedures is proven through: (1) dedicated flight tests; or (2) simulation, provided that the

representativeness of the simulation means is proven valid for the intended purpose with positive results; or

(3) any other means acceptable to the competent authority.

Same as medium. In addition: (a) Flight tests performed to validate

the operational procedures and checklists cover the complete flight envelope or are proven to be conservative.

(b) The operational procedures, checklists, flight tests and simulations are validated by the competent authority of the MS or by an entity that is designated by the competent authority.

(c) The representativeness of the tabletop exercise of the ERP is validated by the competent authority of the MS or by an entity that is designated by the competent authority..

Comments

N/A Operational procedures do not require validation against either a standard or a means of compliance that is considered adequate by the competent authority.

1 AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of robustness) is considered an acceptable means of compliance.

Alternative Criteria #1, #2 and #3 taking credit for functional test-based methods

FUNCTIONAL TEST-BASED METHODS (for SAILs up to IV included)

If the applicant has evidence of FTB flight hours proportionate to the risk/SAIL of the operation meeting one of the set of conditions

described either in section E.3(c) or section E.3(d) and executed:

(a) within the full operational scope/envelope intended by the UAS Operator, and

(b) following the operational procedures referred to in the operational authorization,

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 117 of 184

then the assurance that the operational procedures are adequate is met at the level corresponding to the SAIL being demonstrated by the functional test-based approach3.

Comments 3 As an example, if the number of test cycles supporting the FTB flying hours is proportionate to the risk of a SAIL III operation (i.e., 3,000FH), the assurance level for OSO #08 is fulfilled at High Level.

E.4 OSOs related to remote crew training

OSO #09 – Remote crew trained and current

(a) The applicant needs to propose a competency-based, theoretical and practical training that:

(1) is appropriate for the operation to be approved allowing the remote crew to control the normal, abnormal and emergency situations potentially resulting from technical issues with the UAS or external systems supporting UAS operation, human errors or critical environmental conditions; and

(2) includes proficiency requirements and recurrent training.

(b) The entire remote crew (i.e. any person involved in the operation) should undergo competency-based, theoretical and practical training specific to their duties (e.g. pre-flight inspection, ground equipment handling, evaluation of the meteorological conditions, etc.).

REMOTE CREW COMPETENCIES Level of integrity

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #09, OSO #15 and OSO #22 Remote crew trained and current

Criteria Criterion

The competency-based, theoretical and practical training is adequate for the operation1 and ensures knowledge of:

(a) ensures knowledge of:

(a1) the UAS Regulation; (b2) airspace operating principles; (c3) airmanship and aviation safety; (d4) human performance limitations; (e5) meteorology and assessment of meteorological conditions; (f6) navigation/charts; (g7) knowledge of the UAS; and (h8) operating procedures and ERP.

(9) use of external services, including service limitations and system recovery if any1

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 118 of 184

(b) is adequate for the operation, i.e., allows the remote crew to control the normal, abnormal and emergency situations potentially

resulting from technical issues with the UAS or external systems supporting UAS operation, human errors or critical environmental

conditions.2/3

(c) specifies or proficiency requirements and training recurrence.

Comments

1 If external services are used, the UAS operator is responsible for using the services in the intended manner (e.g., as defined in a service level agreement) and ensuring that the remote crew is trained to use the service as intended.

2 The details of the areas to be covered for the different subjects listed above is provided by AMC1 UAS.SPEC.050(1)(d) (Theoretical knowledge subjects for the training of the remote pilot and all personnel in charge of duties essential to the uas operation in the ‘specific’ category), AMC2 UAS.SPEC.050(1)(d) (Practical-skill training of the remote pilot and all personnel in charge of duties essential to the uas operation in the ‘specific’ category) and AMC2 UAS.SPEC.050(1)(d) (UAS operation-specific endorsement modules)).

13 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below).

REMOTE CREW COMPETENCIES Level of assurance

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #09, OSO #15 and OSO #22 Remote crew trained and current

Criteria Criterion

Training is self-declared (with evidence available).

(a) Training syllabus is available and kept up to date.

(b) The UAS operator provides competency-based, Evidences of theoretical and practical training are available.

The competent authority of the MS or an entity that is designated by the competent authority: (a) validates the training syllabus; and (b) verifies the remote crew

competencies.

Comments N/A N/A N/A

E.5 OSOs related to safe design

(a) The objectives of OSO#10 and OSO#12 are to complement the technical containment safety requirements by addressing the risk of a fatality while operating over populated areas or assemblies of people.

(b) In the scope of this assessment, external systems supporting UAS operations are defined as systems that are not already part of the UAS but are used to:

(1) launch/take off the UA;

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 119 of 184

(2) make pre-flight checks; or

(3) keep the UA within its operational volume (e.g. GNSS, satellite systems, air traffic management, U-space).

External systems activated/used after a loss of control of the operation are excluded from this definition.

LEVEL of INTEGRITY

Low Medium High

OSO #10 & OSO #12

Criteria

When operating over populated areas or assemblies of people, it can be reasonably expected that a fatality will not occur from any probable1 failure2 of the UAS or any external system supporting the operation.

When operating over populated areas or assemblies of people, it can be reasonably expected that a fatality will not occur from any single failure3 of the UAS or any external system supporting the operation. SW and AEH whose development error(s) could directly lead to a failure affecting the operation in such a way that it can be reasonably expected that a fatality will occur, are developed to a standard considered adequate by the competent authority and/or in accordance with means of compliance acceptable to that authority.

Same as medium

Comments

1 For the purpose of this assessment, the term ‘probable’ should be interpreted in a qualitative way as, ‘anticipated to occur one or more times during the entire system/operational life of a UAS’. 2 Some structural or mechanical failures may be excluded from the criterion if it can be shown that these mechanical parts were designed according to aviation industry best practices.

3 Some structural or mechanical failures may be excluded from the no-single failure criterion if it can be shown that these mechanical parts were designed to a standard considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority

LEVEL of ASSURANCE

Low Medium High

OSO #10 & OSO #12

Criteria

A design and installation appraisal is available. In particular, this appraisal shows that: (a) the design and installation features (independence, separation and redundancy) satisfy the low integrity criterion; and

Same as low. In addition, the level of integrity claimed is substantiated by analysis and/or test data with supporting evidence. If the operation is classified as SAIL IV, the competent authority should request the

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 120 of 184

LEVEL of ASSURANCE

Low Medium High

(b) particular risks relevant to the ConOps (e.g. hail, ice, snow, electromagnetic interference, etc.) do not violate the independence claims, if any.

applicant to use a UAS for which EASA has verified the claimed integrity through a DVR.

I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A N/A N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 121 of 184

E.6 OSOs related to the deterioration of external systems supporting UAS operations

OSO #13 – External services supporting UAS operations are adequate to the operation

For the purpose of SORA and this specific OSO, the term ‘external services supporting UAS operations’ encompasses any service providers necessary for the safety of the flight1, such as:

— communication service providers (CSPs);

— Navigation Service Provider (e.g., Global navigation satellite system),

— and U-space service providers1.

— Externally provided electrical power (e.g., in the case where no emergency backup generator is available and the safety of the flight is dependent on continuous power delivery).

The interface between the UAS Operator and the external services may take the form of a Service Level Agreement (SLA) or similar document.

DETERIORATION OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS BEYOND THE CONTROL OF THE UAS

Level of integrity

Low (SAIL I & II)

Medium (SAIL III)

High (SAIL IV to VI)

OSO #13 External services supporting UAS operations are

Criteria Criterion

The applicant ensures that the level of performance for any externally provided service necessary for the safety of the flight1 is adequate for the intended operation. If the externally provided service requires communication between the UAS operator and the service provider, the applicant ensures there is effective communication to support the service provision. Roles and responsibilities between the applicant and the external service provider are defined.

1 External service should be understood as any service that is provided to the UAS operator, which is necessary to ensure the safety of a UAS operation and is provided by a service provider other than the UAS operator. Examples of external services are: - provision of geographical zones data and geographical limitations (including orography); - collection and transfer of occurrence data; - training and assessment of remote pilots; - communication services that support the C2 link and any other safety-related communication; - services that support navigation, e.g. GNSS services (compliance with requirement UAS.STS-01.030(6) could be ensured by referring to the conditions of use of such services in the

corresponding Service Definition Document (SDD) or an equivalent one if available.); - provision of services related to flight planning and management, including related safety assessments; and - U-space services, which are defined in the corresponding regulation(s) and may include one or more of the above-mentioned services.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 122 of 184

DETERIORATION OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS BEYOND THE CONTROL OF THE UAS

Level of integrity

Low (SAIL I & II)

Medium (SAIL III)

High (SAIL IV to VI)

adequate for the operation

Comments 1 A service whose loss would directly lead to a loss of control of the operation as identified per OSO#05.

Comments N/A N/A

Requirements for contracting services with the service provider may be derived from ICAO Standards and Recommended Practices (SARPs) that are currently under development.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 123 of 184

DETERIORATION OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS BEYOND THE CONTROL OF THE UAS

Level of assurance

Low (SAIL I & II)

Medium (SAIL III)

High (SAIL IV to VI)

OSO #13 External services supporting UAS operations are adequate for the operation

Criteria Criterion

The applicant declares1 that the requested level of performance for any externally provided service necessary for the safety of the flight is achieved (without evidence being necessarily available).

The applicant has supporting evidence that the required level of performance for any externally provided service required for the safety of the flight can be achieved for the full duration of the mission. This may take the form of an SLA or any official commitment that prevails between a Service Provider and the applicant on relevant aspects of the service (including quality, availability and responsibilities). The applicant has means to monitor externally provided services that affect flight-critical systems and take appropriate actions if real-time performance could lead to the loss of control of the operation.

Same as medium. In addition: (a) the evidence of the

performance of an externally provided service is achieved through demonstrations; and

(b) the competent authority of the MS or an entity that is designated by the competent authority validates the claimed level of integrity.

Comments

N/A

1 Supporting evidence for this declaration may still be requested by the competent authority.

Supporting evidence may take the form of a Service-Level Agreement (SLA) or any official commitment that prevails between a Service Provider and the applicant on relevant aspects of the service (including quality, availability, responsibilities).

As an example, if an applicant uses an external surveillance service they should have evidence available supporting the claim that the service meets

N/A N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 124 of 184

performance requirements in Annex D.

E.7 OSOs related to human error

OSO #16 — Multi-crew coordination

This OSO applies only to those personnel directly involved in the flight operation.

HUMAN ERROR MULTI CREW COORDINATION

Level of integrity

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #16 Multi crew coordination

Criterion #1 (Procedures)

Procedure(s) to ensure coordination between the crew members and robust and effective communication channels is (are) available and at a minimum cover: (a) assignment of tasks to the crew, and (b) establishment of step-by-step communications.1

Comments 1 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see the table below).

Criterion #2 (Training)

Remote crew training covers multi-crew coordination

Same as low. In addition, the remote crew2 receives CRM3 training.

Same as medium.

Comments N/A

2 In the context of the SORA In line with the definition I.110 provided in Annex I to AMC1 Article 11, the term ‘remote crew’ refers to any person that performs duties essential to the safety of flight (e.g. AO, UA observers) involved in the mission. 3 CRM training focuses on the effective use of all the remote crew to assure a safe and efficient operation, reducing error, avoiding stress and increasing efficiency.

N/A

Criterion #3 (Communicati on devices)

N/A

Communication devices comply with standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority.

Same as Medium. In addition Ccommunication devices are redundant4 and comply with standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 125 of 184

The applicant determines that the performance of

communication devices is adequate to safely

conduct the intended operation.

The remote crew has the means to check the performance of the communication devices at intervals deemed appropriate to ensure the performance continues to meet the operational requirements.

Comments N/A N/A

4 This implies the provision of an extra device to cope with the failure of the first device.

HUMAN ERROR LEVEL of ASSURANCE

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #16 Multi crew coordination

Criterion #1 (Procedures)

(a) Procedures are do not require validation validated against either a standard or a means of compliance considered adequate by the competent authority of the MS.

(b) The adequacy of the procedures and checklists is declared.

(a) Procedures are validated against standards considered adequate by the competent authority of the MS and/or in accordance with the means of compliance acceptable to that authority1.

(b) The adequacy of the procedures is proven through: (1) dedicated flight tests; or (2) simulation, provided that the

representativeness of the simulation means is proven valid for the intended purpose with positive results; or

(3) any other means acceptable to the competent authority.

Same as medium. In addition: (a) flight tests performed to

validate the procedures cover the complete flight envelope or are proven to be conservative; and

(b) the procedures, flight tests and simulations are validated by the competent authority of the MS or an entity designated by the competent.

Comments N/A

1 AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of robustness) is considered an acceptable means of compliance.

N/A

Alternative Criterion #1 taking credit for

FUNCTIONAL TEST-BASED METHODS (for SAILs up to IV included): N/A3

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 126 of 184

HUMAN ERROR LEVEL of ASSURANCE

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

functional test- based methods

If the applicant has evidence of FTB flight hours proportionate to the risk/SAIL of the

operation meeting one of the set of conditions described either in section 3(c) or section

3(d) and executed:

● within the full operational scope/envelope intended by the UAS Operator, and

● following the operational procedures referred to in the operational authorization,

then the assurance that the operational procedures are adequate is met at the level corresponding to the SAIL being demonstrated by the functional test-based approach2.

Comments

2 As an example, if the number of test cycles supporting the FTB flying hours is proportionate to the risk of a SAIL III operation (i.e., 3,000FH), the assurance level for OSO#16 Criterion #1 is fulfilled at Medium Level.

3 Functional test-based method are not considered feasible for operations with a SAIL V or VI.

Criterion #2 (Training)

Training is self-declared (with evidence available).

(a) Training syllabus is available. (b) The UAS operator provides competency-based,

Evidences of theoretical and practical training are available.

The competent authority of the MS or an entity that is designated by the competent authority: (a) validates the training syllabus;

and (b) verifies the remote crew

competencies.

Comments N/A N/A N/A

Criterion #3 (Communication devices)

N/A

The applicant has supporting evidence that the required level of integrity is achieved. This is typically done by testing, analysis, simulation11, inspection, design review or through operational experience.

If the communication device is included in the UAS configuration, T the competent authority should request the applicant to operate a UAS designed by an organisation approved by EASA according to Subpart J of Annex I (Part 21) to Regulation (EU) No 748/2012. Otherwise the competent authority of the MS or an entity that is designated by the competent authority validates the claimed level of integrity.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 127 of 184

HUMAN ERROR LEVEL of ASSURANCE

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

Comments N/A

1 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

N/A

OSO #17 — Remote crew is fit to operate

(a) For the purpose of this assessment, the expression ‘fit to operate’ should be interpreted as physically and mentally fit to perform their duties and safely discharge their responsibilities.

(b) Fatigue and stress are contributory factors to human error. Therefore, to ensure that vigilance is maintained at a satisfactory level of safety, consideration may be given to the following:

(1) remote crew workload and duty times;

(2) regular breaks;

(3) rest periods;

(4) personal Protective Equipment (PPE);

(5) workplace environment, including ergonomics of the workstation; and

(4) handover/takeover procedures.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 128 of 184

HUMAN ERROR Level of integrity

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #17 Remote crew is fit to operate

Criteria Criterion

The applicant has a policy defining the criteria1 and the means for the how the remote crew can declare themselves fit to operate before starting their duty and report themselves unfit, if required,

during their shift. conducting any operation.

Same as low. In addition: (a) Duty, flight duty and resting times for the remote

crew are defined by the applicant and adequate for the operation.

(b) The UAS operator defines requirements appropriate for the remote crew to operate the UAS.

Same as Medium. In addition: (a) The remote crew is medically fit, (b) A fatigue risk management system

(FRMS) is in place to manage any escalation in duty/flight duty times.

Comments

N/A 1 Criteria should take into account local legislation and may cover drugs (including prescriptions) and alcohol consumption.

N/A N/A

HUMAN ERROR LEVEL of ASSURANCE

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #17 Remote crew is fit to operate

Criteria Criterion

The policy defining the criteria and the means for to define how the remote crew to declares themselves fit to operate before starting their duty and report themselves unfit, if required during their shift (before an operation) is documented. The remote crew fit-to-operate declaration (before an operation) is based on a policy defined by the applicant.

Same as low. In addition: (a) Remote crew duty, flight duty and the resting

time policy are documented. (b) Remote crew duty cycles are logged and cover

at a minimum: 1. when the remote crew member’s duty

day commences, 2. when the remote crew members are free

from duties, and 3. resting times within the duty cycle.

(c) There is evidence that the remote crew is fit to operate the UAS.

Same as medium. In addition: (a) Medical standards considered adequate

by the competent authority and/or the means of compliance acceptable to that authority are established and the competent authority of the MS or an entity that is designated by the competent authority verifies that the remote crew is medically fit.

(b) The competent authority of the MS or an entity that is designated by the competent authority y validates the duty/flight duty times.

(c) If an FRMS is used, it is validated and monitored by the competent authority of

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 129 of 184

the MS or an entity that is designated by the competent authority.

Comments N/A N/A N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 130 of 184

OSO #18 — Automatic protection of the flight envelope from human errors

(a) Each UA is designed with a flight envelope that describes its safe performance limits with regard to relevant flight parameters such as minimum and maximum operating speeds, and its operating structural strength.

(b) Automatic protection of the flight envelope is intended to prevent the remote pilot from operating the UA outside its flight envelope. If the applicant demonstrates that the remote-pilot is not in the loop, this OSO is not applicable.

(c) A UAS implementing such an automatic protection function will ensure that the UA is operated within an acceptable flight envelope margin even in the case of incorrect remote-pilot control inputs (human errors).

(d) UAS without automatic protection functions are susceptible to incorrect remote-pilot control inputs (human errors), which can result in the loss of the UA if the designed performance limits of the aircraft are exceeded.

(e) Failures or development errors of the flight envelope protection are addressed in OSOs #5, #10 and #12.

HUMAN ERROR

LEVEL of INTEGRITY

Low (SAIL III)

Medium (SAIL IV)

High (SAIL V & VI)

OSO #18 Automatic protection of the flight envelope from human errors

Criteria Criterion

The UAS flight control system incorporates automatic protection of the flight envelope to prevent the remote pilot from making any single input under normal operating conditions that would cause the UA to exceed its flight envelope or prevent it from recovering in a timely fashion.

The UAS flight control system incorporates automatic protection of the flight envelope to ensure the UA remains within the flight envelope or ensures a timely recovery to the designed operational flight envelope following remote pilot error(s).1/2

Comments Applicants may show compliance by CM-AS-012- SORA OSO#18 Envelope protection (SAIL III)

1 The distinction between a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below). 2 Compared to the Low level of robustness, Medium and a High levels need to address any operating conditions (normal, abnormal and emergency) and the potential for multiple errors.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 131 of 184

HUMAN ERROR

LEVEL of ASSURANCE

Low (SAIL III)

Medium (SAIL IV)

High (SAIL V & VI)

OSO #18 Automatic protection of the flight envelope from human errors

Criteria Criterion

The automatic protection of the flight envelope has been developed in-house or out of the box (e.g. using commercial off-the-shelf elements), without following specific standards.

The competent authority should request the applicant to use a UAS for which EASA has verified the claimed integrity through a DVR.

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments Applicants may show compliance by CM-AS- 012- SORA OSO#18 Envelope protection (SAIL III)

N/A

N/A

OSO #19 — Safe recovery from human errors

(a) This OSO addresses the risk of human errors which may affect the safety of the operation if not prevented or detected and recovered in a timely fashion.

i) Errors can be made by anyone involved in the operation.

ii) An example could be a human error leading to the incorrect loading of the payload, with the risk of it falling off the UA during the operation.

iii) Another example could be a human error not to extend the antenna mast, thus reducing the C2 link coverage.

Note: the flight envelope protection is excluded from this OSO since it is specifically covered by OSO #18.

(b) This OSO covers: UAS design, i.e. systems detecting and/or recovering from human errors (e.g. safety pins, use of acknowledgment features, fuel or energy consumption monitoring functions …).

i) procedures and lists,

ii) training, and

iii) UAS design, i.e. systems detecting and/or recovering from human errors (e.g. safety pins, use of acknowledgment features, fuel or energy consumption monitoring functions …)

(c) Operational procedures and training are covered in OSO#08 and OSO#09 respectively.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 132 of 184

HUMAN ERROR

LEVEL of INTEGRITY

Low (SAIL III)

Medium (SAIL IV & V)

High (SAIL VI)

OSO #19 Safe recovery from Human Error

Criterion #1 (Procedures and checklists)

Procedures and checklists that mitigate the risk of potential human errors from any person involved with the mission are defined and used. Procedures provide at a minimum: — a clear distribution and assignment of tasks, and — an internal checklist to ensure staff are adequately performing their assigned tasks.

Comments N/A N/A N/A

Criterion #2 (Training)

— The remote crew1 is trained to use procedures and checklists. — The remote crew1 receives CRM2 training.3

Comments

1 In the context of SORA, the term ‘remote crew’ refers to any person involved in the mission. 2 CRM training focuses on the effective use of all the remote crew to ensure a safe and efficient operation, reducing error, avoiding stress and increasing efficiency. 3 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below).

Criterion #3 (UAS design)

Systems detecting and/or recovering from human errors are developed according to industry best practices.

Systems detecting and/or recovering from human errors are developed to standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority.

Same as medium.

Comments N/A

N/A 1 National Aviation Authorities (NAAs) may define the standards and/or the means of compliance they consider adequate. The SORA Annex E will be updated at a later point in time with a list of adequate standards based on the feedback provided by the NAAs.

N/A

HUMAN ERROR

LEVEL of ASSURANCE

Low (SAIL III)

Medium (SAIL IV & V)

High (SAIL VI)

OSO #19 Safe recovery from human error

Criterion #1 (Procedures and checklists)

(a) Procedures and checklists are not validated against either a standard or a means of compliance considered adequate by the competent authority of the MS.

(a) Procedures and checklists are validated against standards considered adequate by the competent authority of the MS and/or in accordance with the means of compliance acceptable to that authority1.

Same as medium. In addition: (a) Flight tests performed to validate the procedures and checklists cover the complete flight envelope or are proven to be conservative.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 133 of 184

HUMAN ERROR

LEVEL of ASSURANCE

Low (SAIL III)

Medium (SAIL IV & V)

High (SAIL VI)

(b) The adequacy of the procedures and checklists is declared.

(b) The adequacy of the procedures and checklists is proven through:

(1) dedicated flight tests, or (2) simulation, provided that the representativeness of the simulation means is proven valid for the intended purpose with positive results; or (3) any other means acceptable to the competent authority of the MS.

(b) The procedures, checklists, flight tests and simulations are validated by the competent authority of the MS or an entity that is designated by the competent authority.

Comments N/A

1 AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of robustness) is considered an acceptable means of compliance.

N/A

Criterion #2 (Training)

Consider the criteria defined for the level of assurance of the generic remote crew training OSO (i.e. OSO #09, OSO #15 and OSO #22) corresponding to the SAIL of the operation.

Comments N/A N/A N/A

Criterion #3 (UAS design)

The applicant declares that the required level of integrity has been achieved1.

The applicant has supporting evidence that the required level of integrity is achieved. That evidence is provided through testing, analysis, simulation2, inspection, design review or operational experience. If the operation is classified as SAIL IV, the competent authority should request the applicant to use a UAS for which EASA has verified the claimed integrity through a DVR. If the operation is classified as SAIL V the competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 134 of 184

OSO #20 — A human factors evaluation has been performed and the HMI has been found appropriate for the mission

HUMAN ERROR

LEVEL of INTEGRITY

Low (SAIL II & III)

Medium (SAIL IV & V)

High (SAIL VI)

OSO #20 A Hhuman Ffactors evaluation has been performed and the HMI found appropriate for the mission

Criteria Criterion

The UAS information and control interfaces are clearly and succinctly presented and do not confuse, cause unreasonable fatigue, or contribute to remote crew errors that could adversely affect the safety of the operation.

Same as Medium. In addition, the human factors evaluation is expected to cover:

(a) an appraisal to check that the

remote crew workload remains

acceptable in both normal and

emergency situations;

(b) an appraisal of the efficiency of

the emergency procedures

(efficacy of the actions, expected

potential latencies);

analyses to check if prioritization of alarms and emergency procedures should be put in place to organize emergency procedures in such a way that they remain adapted to the criticality of the situation.

Comments If an electronic means is used to support potential airspace observer(s) VOs in their role to maintain awareness of the position of the unmanned aircraft, its HMI: — is sufficient to allow the airspace observer(s) VO to determine the position of the UA during operation; and

HUMAN ERROR

LEVEL of ASSURANCE

Low (SAIL III)

Medium (SAIL IV & V)

High (SAIL VI)

Comments

1 Supporting evidence may or may not be available. N/A

2 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 135 of 184

— does not degrade the airspace observer(s) VO ability to: — scan the airspace visually where the unmanned aircraft is operating for any potential collision hazard; and — maintain effective communication with the remote pilot at all times.

HUMAN ERROR

LEVEL of ASSURANCE

Low (SAIL II & III)

Medium (SAIL IV & V)

High (SAIL VI)

OSO #20 A Human Factors evaluation has been performed and the HMI has been found appropriate for the mission

Criteria Criterion

The applicant conducts a human factors evaluation of the UAS to determine whether the HMI is appropriate for the mission. The HMI evaluation is based on inspection or analyses. The adequacy of the result of the HMI evaluation is declared.

Same as Low but the HMI evaluation is based on demonstrations or simulations.1 The competent authority should request EASA to witness the HMI evaluation of the UAS. For operations classified in SAIL VI the competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012

Same as Medium. In addition, EASA witnesses the HMI evaluation of the UAS and the competent authority of the MS or an entity that is designated by the competent authority witnesses the HMI evaluation of the possible electronic means used by the AO. The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A

1 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

N/A

Alternative Criterion taking credit for functional test-based methods

If the applicant has evidence of FTB flight

hours proportionate to the risk/SAIL of the

operation meeting one of the set of

conditions described either in section 3(c)

or section 3(d) and executed:

(a) within the full operational

scope/envelope intended by the UAS

Operator, and

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 136 of 184

(b) following the operational procedures

and the remote crew training referred

to in the operational authorization,

(c) then the assurance that the

operational procedures are adequate

is met at the level corresponding to

the SAIL being demonstrated by the

functional test-based approach2.

Comments

2 As an example, if the number of test cycles supporting the FTB flying hours is proportionate to the risk of a SAIL III operation (i.e., 3,000FH), the assurance level for OSO#20 is fulfilled at Low Level.

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 137 of 184

E.8 OSOs related to adverse operating conditions

OSO #23 — Environmental conditions for safe operations are defined, measurable and adhered to

ADVERSE OPERATING CONDITIONS

LEVEL of INTEGRITY

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #23 Environmental conditions for safe operations are defined, measurable and adhered to

Criterion #1 (Definition)

The environmental conditions for safe operations are defined and reflected in the flight manual or equivalent document.1

Comments

1 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below). The definition of the environmental conditions for safe operation should take into account the limitations provided in the flight manual / manufacturer instructions (refer to OSO#8)

Criterion #2 (Procedures)

Procedures to evaluate environmental conditions before and during the mission (i.e. real-time evaluation) are available and include assessment of meteorological conditions (METAR, TAFOR, etc.) with a simple recording system.2

Comments 2 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below).

Criterion #3 (Training)

Training covers assessment of meteorological conditions.3

Comments 3 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below).

ADVERSE OPERATING CONDITIONS

LEVEL of ASSURANCE

Low (SAIL I & II)

Medium (SAIL III & IV)

High (SAIL V & VI)

OSO #23 Environmental conditions for safe operations defined, measurable and adhered to

Criterion #1 (Definition)

The applicant declares that the required level of integrity has been achieved.

The applicant has supporting evidence that the required level of integrity is achieved. This is typically done by testing, analysis, simulation, inspection, design review or through operational experience. If the operation is classified as SAIL IV, the competent authority should request the applicant to use a UAS for which EASA has issued a DVR.

The competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012

Comments N/A

.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 138 of 184

Criterion #2 (Procedures)

(a) Procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority of the MS. (b) The adequacy of the procedures and checklists is declared.

(a) Procedures are validated against standards considered adequate by the competent authority of the MS and/or in accordance with the means of compliance acceptable to that authority1. (b) The adequacy of the procedures is proven through: (1) dedicated flight tests, or (2) simulation, provided that the representativeness of the simulation means is proven valid for the intended purpose with positive results; or (3) any other means acceptable to the competent authority of the MS.

Same as medium. In addition: (a) Flight tests performed to validate the procedures cover the complete flight envelope or are proven to be conservative. (b) The procedures, flight tests and simulations are validated by the competent authority of the MS or an entity that is designated by the competent authority.

Comments N/A

1 AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of robustness) is considered an acceptable means of compliance.

N/A

Criterion #3 (Training)

Training is self-declared (with evidence available).

— Training syllabus is available. — The UAS operator provides competency- based, theoretical and practical training.

The competent authority of the MS or an entity that is designated by the competent authority: — validates the training syllabus; and — verifies the remote crew competencies.

Comments N/A N/A N/A

OSO #24 — UAS is designed and qualified for adverse environmental conditions (e.g. UA controllability and performance, adequate sensors, DO-160 qualification)

(a) To assess the integrity of this OSO, the applicant determines:

(1) whether credit can be taken for the equipment environmental qualification tests / declarations, e.g. by answering the following questions:

(i) Is there a Declaration of Design and Performance (DDP) available to the applicant stating the environmental qualification levels to which the equipment was tested?

(ii) Did the environmental qualification tests follow a standard considered adequate by the competent authority (e.g. DO-160)?

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 139 of 184

(iii) Are the environmental qualification tests appropriate and sufficient to cover all the environmental conditions related to the operation?

(iv) If the tests were not performed following a recognised standard, were the tests performed by an organisation/entity that is qualified or that has experience in performing DO-160 like tests?

(2) Can the suitability of the equipment for the intended/expected UAS environmental conditions be determined from either in-service experience or relevant test results?

(3) Any environmental limitations which, if exceeded, would compromise affect the suitability of the equipment or the operability or controllability of the UA (e.g. maximum cross wind) for the intended/expected UAS environmental conditions.

(b) The lowest integrity level should be considered for those cases where a UAS equipment has only a partial environmental qualification and/or a partial demonstration by similarity and/or parts with no qualification at all.

ADVERSE OPERATING CONDITIONS

LEVEL of INTEGRITY

N/A Medium (SAIL III)

High (SAIL IV to VI)

OSO #24 UAS is designed and qualified for adverse environmental conditions

Criteria Criterion

N/A

The UAS is designed to limit the effect of environmental conditions defined and reflected in the flight manual or equivalent document.

The UAS is designed using environmental standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to EASA that authority.

Comments N/A

N/A As an example, if a UAS is proposed to be operated in raining conditions, it is not necessarily proposed to comply with DO-160G waterproof conditions; rain conditions can be limited as long as representative of the environmental conditions Applicants may show compliance by CM- AS-013 - SORA OSO#24 UAS designed and qualified for adverse environmental conditions (SAIL III)

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 140 of 184

ADVERSE OPERATING CONDITIONS

LEVEL of ASSURANCE

N/A Medium (SAIL III)

High (SAIL IV to VI)

OSO #24 UAS is designed and qualified for adverse environmental conditions

Criteria Criterion

N/A

The applicant has supporting evidence that the required level of integrity has been achieved. This is typically done by testing, analysis, simulation2, inspection, design review or through operational experience.

If the operation is classified as SAIL IV, the competent authority should request the applicant to use a UAS for which EASA has issued a DVR. If the operation is classified SAIL V or VI, the competent authority should request the applicant to use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments N/A

2 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified Applicants may show compliance by CM-AS-013 - SORA OSO#24 UAS designed and qualified for adverse environmental conditions (SAIL III)

N/A

Criterion N/A

FUNCTIONAL TEST-BASED METHODS:

If the applicant has evidence of FTB flight

hours proportionate to the SAIL of the

operation meeting one of the set of conditions

described either section E.3(c) or section E.3(d)

and executed:

(a) within the full operational scope/envelope

intended by the UAS Operator, and

(b) following the maintenance, operational

procedures and the remote crew training

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 141 of 184

ADVERSE OPERATING CONDITIONS

LEVEL of ASSURANCE

N/A Medium (SAIL III)

High (SAIL IV to VI)

referred to in the operational

authorization,

then the assurance that the operational procedures are adequate is met at the level corresponding to the SAIL being demonstrated by the functional test-based approach2.

Comments N/A

2 As an example, if the number of test cycles supporting the FTB flying hours is proportionate to the risk of a SAIL III operation (i.e. 3,000FH), the assurance level for OSO#24 is fulfilled at medium Level.

N/A

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 142 of 184

E.3 Functional Test-Based (FTB) Approach

a. The objective of this section is to give some insight into the Functional Test-Based (FTB)

approach referenced throughout Annex E to AMC1 Article 11. This is articulated around three

different but complementary perspectives:

i. FTB as a Means of Compliance (MoC) to support UAS designers in demonstrating UAS

operational reliability for the purposes of obtaining an FTB design appraisal;

ii. FTB design appraisal gained by UAS designers taken credit for by UAS operators when

showing compliance with some of Annex E to AMC1 Article 11 OSOs;

iii. FTB as a means for UAS operators to take credit for safe and successful operations over

time to expand their operational authorisation (based on the concept of “reliability

growth model”).

These three approaches are detailed in the following sections b), c) and d).

b. For FTB as a Means of Compliance (MoC) to support UAS designers in demonstrating UAS

operational reliability refer to the MoC SC Light-UAS FTB37 published by EASA:

c. FTB design appraisal gained by UAS designers taken credit for by UAS operators when showing

compliance with some of Annex E to AMC1 Article 11 OSOs:

i. An FTB design appraisal gained by a UAS designer presents several benefits both for the

UAS operator going through the operational authorization (OA) process and the competent

authority issuing such OA, in particular when the UAS operator does not have a full

relationship with the designer or does not have all the design details.

ii. In order for a UAS Operator to take credit for a FTB design appraisal gained by a UAS

designer, the following conditions need to be met at a minimum:

— The functional tests supporting the FTB design appraisal gained by a UAS designer

have been executed within the full operational scope/envelope intended by the

UAS operator; this means that the test cycles are fully representative of the

operators’ intended operations with test points to verify safe operation at the

operational limits and corners of the vehicle envelope.

— The functional tests supporting the FTB design appraisal gained by a UAS designer

have been executed following the operational procedures and the remote crew

training referred to in the operational authorization (and meeting the integrity

assurance of the associated OSOs).

— The UAS operator maintenance instructions are established based on the UAS

designer’s instructions and requirements which were used for maintenance,

repair, or replacement of UAS sub-systems during the functional tests supporting

the FTB design appraisal gained by the UAS designer.

— Any UAS configuration differences compared to the initial configuration used by

the UAS designer to gain the FTB design appraisal are confirmed by the UAS

37 https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-

special-condition-light

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 143 of 184

designer not to impair the validity of the design appraisal.

— The minimum number of test cycles are proportionate to the risk of the operation,

with at least:

○ 30 hours for SAIL I;

○ 300 hours for SAIL II;

○ 3,000 hours for SAIL III; and

in order to achieve a 95% confidence (assuming a binomial/Poisson distribution for

the operational level hazard rate and no failures during the test)38.

Note that FTB methods are not considered feasible for UAS operations with a SAIL

above or equal to IV.

— The functional tests supporting the FTB design appraisal gained by a UAS designer

have been executed by the UAS designer according to principles/standards

considered adequate by the competent authority in charge of granting the

operational authorization, including at a minimum the following principles:

○ The functional tests supporting the FTB design appraisal gained by a UAS

designer have been executed using an acceptable sample size of unmanned

aircraft.

○ Safe life limits for UAS subsystems sensitive to wear-out conditions based on

the maximum cycles and hours demonstrated by one or more fleet leader

UAS (i.e. the UAS with the longest time and/or cycles compared to other UAS

used during the FTB testing) have been derived by the UAS designer and

captured in the FTB design appraisal limitations.

iii. Additionally, induced failure tests may help demonstrate compliance with the following

OSOs and Step #8:

— OSO#05 and Step #8: safety and reliability / safe design (e.g., induced failure tests

with no loss of control or containment as path-fail criteria);

— OSO#06: C3 link performance appropriate for the operation (e.g., if the distance

from a C2 radio transmitter/receiver is a critical factor, then the demonstration of

the maximum allowable range from the transmitter/receiver in the most likely

worst-case conditions is needed);

— OSO#18: Automatic protection of the flight envelope from human errors;

However, this kind of test is not addressed in this version of Annex E to AMC1 Article 11

since competent authorities are still in the process of defining the modalities of test-

based approaches. In the meantime, credit for induced failure testing may be proposed

on a case-by-case basis by a UAS operator depending on the scope of the FTB design

appraisal gained by the UAS designer.

38 See the Rule of Three: https://en.wikipedia.org/wiki/Rule_of_three_(statistics)

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 144 of 184

d. FTB as a means for UAS operators to take credit for safe and successful operations over time to

expand their operational authorisation (based on the concept of “reliability growth model”):

i. An FTB approach should also allow UAS operators to take credit for safe and successful

operations over time to expand their operational authorisation based on the concept of

“reliability growth”, while still respecting the conditions of section 3(c).

ii. UAS operators should be able to operate with a low SAIL approval and then, through

operational experience, gather sufficient operational data to justify an increase in the

SAIL, based upon the increase in operational reliability demonstrated by the operators.

This approach would only be valid under representative operating conditions, not

requesting additional strategic or tactical mitigations.

Notes:

— The competent authority may accept accumulation of FTB hours between

operators if the UAS configuration, operational procedures, training, etc. are

demonstrated to be equivalent.

— This option does not cover expanded operating conditions which would require

additional testing and/or analysis to be performed by the UAS designer. As an

example, a UAS operator may start with a SAIL II operational authorisation to fly

over population density up to 500 ppl/km2 and, if they demonstrate 3,000 hours

with no loss of control, they could be allowed to fly a SAIL III operation under the

exact same operating conditions, except for an increase of the maximum

population density allowed (5,000 ppl/km2).

iii. To be relevant, the UAS Operator would need to show that:

— the next population band does not introduce new or unique hazards, or if so, these

new or unique hazards are shown to be properly mitigated through test or analysis;

— the reliability demonstrated through operational testing demonstrates the

required operational reliability at the higher SAIL level desired;

— any UAS configuration differences compared to the initial configuration do not

impair the validity of the argument.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3

Annex to ED Decision 202X/XXX/R Page 145 of 184

E.4 Containment requirements

a. In SORA Main Body, Step #8: Determination of containment requirements addresses the risk posed by an operational loss of control that could infringe

on areas adjacent to the operational volume and buffers. The ground risk (in the adjacent area) and air risk in the adjacent airspace dictate the level

of safety requirements to be met by containment design features and operational procedures.

b. The following section provides the generic containment requirements for the following 3 levels of containment: Low, Medium and High.

CONTAINMENT LEVEL of INTEGRITY

Low Medium High2

Criterion #1

(Operational Volume

Containment)

(Qualitative) No probable1 single failure of the UAS or any external system supporting the operation

shall lead to operation outside of the operation volume.

OR

(Quantitative) The probability of the failure condition “UA leaving the operational volume” shall be less

than 10-3/Flight Hour (FH).

(Qualitative) No single failure of the UAS or

any external system supporting the

operation shall lead to operation outside of

the operational volume.

OR

(Quantitative) The probability of the failure

condition “UA leaving the operational

volume” shall be less than10-4/FH.

Comments 1 Failures anticipated to occur one or more times during the entire operational life of an item.

2 This may be achieved by a tether that

prevents the drone from exiting the

operational volume (see chapter below).

3 Failures unlikely to occur with each UA

during its operational life but that may occur

several times when considering the total

operational life of a number of UA of this

type.

AMC & GM to Regulation (EU) 2019/947

Issue 1, Amendment 3