Onboard Drone Autonomy: What Changes for Operators

In sales conversations and datasheets, the word autonomy is used loosely. For operators, asset managers and maintenance leads responsible for industrial plant and infrastructure, what counts is not the marketing promise but the legally binding frame. Article 2 of Implementing Regulation (EU) 2019/947 defines it unambiguously: autonomous operation means an operation during which the unmanned aircraft operates without the remote pilot being able to intervene.

A basic operational distinction follows from that legal definition. Almost all systems used industrially are not flying autonomously at all, but in a highly automated manner. As long as a remote pilot can override control commands over an existing radio link, abort the flight or trigger an emergency stop, ultimate responsibility in air law stays with the human. Genuine autonomy begins precisely at the point where the system makes its own navigational decisions with no fallback level. The decisive operator question is therefore not whether an aircraft is technically capable of flying a trajectory, but what the operator has to demonstrate without gaps to authorities, inspection bodies and insurers once the human leaves the control loop.

A strict methodological boundary is needed here. This piece deals exclusively with onboard flight and navigation decisions made in real time. Subsequent automated image analysis, crack detection or thermographic damage classification is a separate process step that has to be treated separately, for instance within structured inspection programmes such as dike inspection as a programme or in structural condition analysis for dams and reservoirs from the air.

In practice, genuine onboard autonomy today happens mainly where environmental conditions make human intervention physically impossible: in fully enclosed spaces and industrial assets such as tanks, silos, boilers, ballast tanks or underground sewer systems. This is where the technology delivers its primary operational benefit, by removing the need for hazardous rope access or confined space entry.

In legal terms, the inside of a building is clear ground. The German Federal Aviation Office (Luftfahrt-Bundesamt, LBA) states in its FAQ on UAS operation: "Diese Anforderungen gelten nicht für den Betrieb von UAS in Gebäuden" — these requirements do not apply to the operation of UAS inside buildings. The registration, categorisation and competence requirements of the EU frame therefore do not bite inside a building. That opens up industrial use cases in demanding infrastructure of the kind typical for enclosed assemblies in offshore drone inspection.

In day-to-day operation, though, the practical dividing line between indoors and outdoors is often fluid. According to figures from the inspection drone manufacturer Flyability, up to 70 percent of flights with inspection systems such as the Elios platform take place at least partly outdoors. Even the short hop from the set-down point across the site to a manway or sewer shaft activates the full European legal frame for unmanned aviation. Operators therefore have to assess these transition zones properly under air law from the outset.

To judge how robust a system will be in service, asset managers have to separate the real state of the art from academic research concepts. In enclosed industrial environments no global navigation satellite system (GNSS) is available. Positioning therefore rests on onboard SLAM algorithms (simultaneous localisation and mapping) that combine LiDAR measurements with optical cameras for optical flow and velocity measurement.

One central procurement criterion is the safety concept against obstacle collisions. A publicly documented market example — expressly without any supply or partner relationship — is the Elios platform from the manufacturer Flyability. It relies on a collision-tolerant protective structure in the form of an enclosing carbon cage rather than active sense-and-avoid. In narrow pipes, dusty boilers or complex lattice structures, optical avoidance systems frequently fail through occlusion or sensor reflections; mechanical collision tolerance allows flight to continue despite unavoidable contact with walls.

Automated docking functions and onboard path adaptation are today established mainly at ground-based stations, of the kind used in automated systems for permanent site coverage. There the approach to the charging contacts runs at high precision over optical fiducials and close-range sensors, and the commercial arrangement around who runs that station is set out under drone-as-a-service.

As soon as an aircraft leaves the enclosed space, the planning problem changes fundamentally. What limits the operation is no longer the physical flight capability or payload of the device, but the demonstration made in the operating authorisation. Where the unmanned system makes onboard flight decisions outdoors, the regulatory demands on evidence rise markedly.

Regulation (EU) 2019/947 divides operations into the open, specific and certified categories. Almost all complex inspection flights with autonomous or automated trajectory guidance fall into the specific category. That frame requires a systematic risk assessment, whose details are set out in the practical treatment of BVLOS approval and the SORA route. Rather than hoping for exemptions, operators have to present a traceable safety chain that effectively bounds faulty autonomous decisions in the airspace. The same logic already governs routine outdoor programmes such as power line and infrastructure inspection and environmental monitoring, where the authorisation, not the aircraft, is the gating item.

One central legal criterion for onboard decision logic is the behaviour on loss of link. Point UAS.SPEC.050 in Part B of the Annex to Regulation (EU) 2019/947 obliges the UAS operator to establish procedures and operational limits appropriate to the intended type of operation and the associated risk. Deterministic behaviour on loss of the command and control link (C2 link) therefore belongs in the operator's documented operating procedures, and a loss of control must not result in the unmanned aircraft leaving its assigned operational volume in an uncontrolled way.

The regulatory risk assessment follows the current standard SORA 2.5, developed by the international expert body JARUS and formally introduced by EASA with ED Decision 2025/018/R of 29 September 2025 (incorporated into the June 2026 revision of the Easy Access Rules for Unmanned Aircraft Systems).

In SORA 2.5, containment takes a key role: it is assessed at Step 8, before the operational safety objectives (OSOs) are determined at Step 9. What is assessed is the residual risk that the system leaves the defined operational volume through malfunction or navigation error and intrudes into the adjacent area. The risk analysis distinguishes precisely between the operational volume, the ground risk buffer and the adjacent area. An autonomous system has to guarantee that on a break in the C2 link it transitions immediately into pre-programmed, safe contingency behaviour — holding position, a controlled return, or an emergency landing inside the buffer.

For operators of industrial plant, the same problem comes up repeatedly in authorisation procedures: manufacturers advertise sophisticated artificial intelligence and onboard autonomy, yet supply no standardised test evidence for the authority. Authorities and inspection bodies do not accept marketing promises. What is required is traceable, manufacturer-independent test reports and validated hardware documentation.

This evidence is particularly critical in demanding infrastructure inspections with small safety margins to structures, as in bridge inspection without a closure. Here the operator has to be able to show exactly how the system responds to unforeseen gusts, GNSS shadowing or sensor faults.

• Deterministic abort criteria: evidence that on sensor failure or contradictions in attitude determination the onboard computer triggers defined safety manoeuvres rather than computing unpredictable corrections.
• Validated geofencing and buffer limits: test evidence that physical boundaries are stored tamper-proof in the flight controller and cannot be overflown through software timeouts.
• Complete telemetry logging: gapless recording of all raw sensor data, control commands and state decisions of the onboard stack for subsequent audit by inspection authorities.
• Documented failure modes: written verification of the failure probabilities of individual components of the onboard navigation computer against the required integrity levels.

Introducing onboard-autonomous inspection systems calls for precise wording in tenders and specifications. Operators should not confine technical specifications to flight times and sensor models, but make the regulatory evidence duties the core of the procurement.

1. Fix the operating envelope in writing: unambiguous definition of the environmental limits (temperature range, dust loading, wind speeds, GNSS availability and lighting conditions) for which the onboard algorithm is qualified.
2. Fix the failure behaviour deterministically: contractual definition of the exact contingency procedures on loss of the C2 link, of individual sensors, or of battery voltage.
3. Flight logs as auditable evidence: an obligation on the vendor to supply standardised, unencrypted telemetry data to satisfy regulatory evidence duties.
4. Settle who holds the authorisation and the operating responsibility: clear contractual allocation of who acts as the registered operator, who provides the remote pilots and who maintains the SORA documentation.

As a manufacturer-independent systems integrator, werob helps operators structure these interfaces between technology, authorisation law and operating practice: from neutral specification and system selection through operational software integration to continuous monitoring of the fleets in service, without itself acting as an OEM or model developer. Operators get a vendor-neutral overall solution that holds up in industrial practice both technically and in terms of authorisation.