The “specific” category: SORA, standard scenarios and operational authorization explained

Sooner or later almost every ambitious drone pilot runs into the limits of the open category: The inspection is supposed to go beyond visual line of sight, the aircraft weighs more than 25 kilograms, or the job requires a flight closer to people than A2 allows. That is where the “specific” category begins – with terms like SORA, SAIL, PDRA, STS and LUC that look like bureaucratic jargon at first glance. This guide sorts out the system for you: when you fall into the “specific” category, which four routes lead in, how a risk assessment works, and why all of this changes hardly anything for plane spotters at the airport.

The “specific” category: the short answer

The “specific” category is the middle one of the three European operational categories for drones. It covers all flights that do not comply with the rules of the open category but are not yet risky enough to fall into the certified category. Anyone who wants to fly here needs an operational authorization from the authority in advance – or uses a standard scenario and only submits a declaration. The basis for both is a risk assessment: Either EASA has already worked it out in advance, or you create it yourself using the SORA method.

Three categories, one principle: risk decides

European drone law classifies every flight by its risk, not by whether it is private or commercial. Implementing Regulation (EU) 2019/947 knows three levels:

• Open: low risk, no prior authorization. This is where almost all hobby pilots fly, divided into A1, A2 and A3. Which subcategory your drone opens is explained in the article Drone classes C0 to C6.
• Specific: increased risk, operation only with a declaration or authorization.
• Certified: high risk, comparable to crewed aviation, for example when transporting people.

One important point that the LBA expressly stresses: First check whether your project does fit into the open category after all. If it does, you need no operational authorization – not even if you earn money with the drone. Anyone who, for example, needs only the EU A2 remote pilot certificate and a C2 drone for shots closer to people saves themselves the entire authorization route.

When you end up in the “specific” category

EASA names some typical triggers. Just one of them is enough for a flight to leave the open category:

• Flight beyond visual line of sight (BVLOS), that is, without direct visual contact with the drone,
• takeoff mass over 25 kilograms,
• flight altitude over 120 meters above ground,
• dropping of material or the dispersal of substances,
• operation in built-up areas with a drone over 4 kilograms or without a class marking.

On top of that come cases that arise from national rules. In Germany, Section 21h of the Air Traffic Regulations (LuftVO) defines geographical areas in which operation is partly permitted only in the “specific” category – above all the zones around airports. Which kinds of areas exist and how you find them on the map is shown by the guide Geozones and the dipul map.

Four routes into the “specific” category

EASA describes four ways to fly legally in the “specific” category. They differ mainly in how much review work lies with the authority and how much responsibility lies with you.

Route	What you do	What the authority does
Standard scenario (STS)	Submit a declaration, meet all conditions	Confirms receipt and completeness
PDRA	Apply based on a predefined risk assessment	Reviews and grants the operational authorization
Own SORA	Create a full risk assessment	Reviews and grants the operational authorization
LUC	Obtain an operator certificate with a management system	Grants privileges with which you may authorize yourself

What all four routes have in common: You must be registered as an operator, just as in the open category. How that works is explained in the article Registering a drone. According to EASA, you do not need a separate registration for the “specific” category.

Standard scenarios: STS-01 and STS-02

The standard scenarios are the fastest route into the “specific” category. For two common types of operation, the EU has already done the risk assessment and defined fixed conditions. If you meet them all, you submit an operational declaration instead of an application. The LBA then does not review an operations manual, and you may fly as soon as the authority has confirmed your declaration. Declarations have been possible since January 1, 2024.

STS-01 applies to flights within visual line of sight over a controlled ground area, including in populated surroundings. The most important conditions according to the LBA:

• drone of class C5 or a C3 drone with a suitable accessory kit,
• at most 120 meters above the nearest point of the earth’s surface, with exceptions near artificial obstacles,
• a defined controlled ground area in which no uninvolved persons are present,
• an operations manual meeting the requirements of the regulation.

STS-02 allows flights beyond visual line of sight, but only in sparsely populated areas and likewise over a controlled ground area. Required are a drone of class C6, the same altitude limit of 120 meters and an operations manual. How far the drone may move away from the remote pilot depends on whether airspace observers are used; the exact distance limits are in Appendix 1 of the regulation.

For both scenarios you need an STS remote pilot certificate covering theoretical knowledge and a confirmation of practical training for the respective scenario. FPV flight is excluded under STS-01 because you must keep the drone in sight yourself. Which technology C5 and C6 drones bring is explained in the article on classes C0 to C6; the rules for video-goggle pilots are explained in FPV drones.

PDRA: the predefined risk assessment

If your project does not fit exactly into a standard scenario, a PDRA can help, a Predefined Risk Assessment. Here too, EASA has already done the risk assessment for common types of operation and published it as an acceptable means of compliance for Article 11. The difference from a standard scenario: You still need an operational authorization, and the authority reviews your application. In return, you are not tied to C5 or C6 drones.

The PDRAs with an “S” in the name are based on the standard scenarios, those with a “G” cover further generic operations. EASA offers, for example, a sample operations manual template for operation under PDRA-S01. The agency keeps developing further PDRAs. If none fits, the route via your own SORA remains.

Understanding SORA step by step

The Specific Operations Risk Assessment was developed by the international expert group JARUS and adopted by EASA as an acceptable means of compliance for Article 11 of Regulation 2019/947. Article 11 stipulates what a risk assessment must achieve: describe the operation, set safety objectives, determine the risks on the ground and in the air, name possible mitigations and show that these are robust enough.

SORA translates these obligations into a procedure with ten steps. At its core everything revolves around three values:

• GRC (Ground Risk Class): How dangerous would a crash be for people on the ground? Population density, flight within or beyond visual line of sight, and the size of the drone have an influence.
• ARC (Air Risk Class): How likely is an encounter with crewed aircraft? Decisive are airspace class, altitude, proximity to airfields and traffic density. A good introduction to the topic is provided by the articles Airspace classes A to G and Recognizing airspaces on maps.
• SAIL (Specific Assurance and Integrity Level): The remaining ground and air risk yields the SAIL from I to VI. It determines how strictly the operational safety objectives (OSO) must be met.

With risk-reducing measures you can lower GRC and ARC – for example with a parachute system, a cordoned-off ground area or a flight window at low-traffic times. Each measure must demonstrate a certain robustness, that is, how well it is substantiated and backed up. In addition, SORA requires that the drone stays within the intended operational volume in the event of a failure and that the adjacent area is assessed.

SAIL	Evidence for the drone according to EASA
I–II	Declaration
III	Compliance with the EASA means of compliance for SAIL III
IV	Design Verification Report from EASA
V–VI	Type certificate under Part 21

The table shows why most operators aim for a low SAIL: From SAIL III on, robust evidence about the drone design is needed, and from SAIL IV on nothing works without EASA review of the drone type.

SORA 2.0 and SORA 2.5

There is now the revised version SORA 2.5. The authorities have accompanied the switch with transition periods that differ from country to country. In Germany, applications until December 31, 2025 could still be submitted under version 2.0 or 2.5, and for initial applications from January 1, 2026, SORA 2.5 applies exclusively. According to the LBA, the procedure differs between the two versions only in individual form steps.

The application in Germany: how it works

The aviation authority of the state in which you live or in which your company has its seat is responsible. Many federal states, including Bavaria, Berlin, North Rhine-Westphalia and Saxony, have transferred this task to the Federal Aviation Office (Luftfahrt-Bundesamt) in Braunschweig. In the remaining states you submit the application to the respective state aviation authority using its own forms. A current overview of responsibilities is offered by dipul.

The applicant is always the registered operator. Even if a consulting firm helps, communication with the LBA runs through you. The LBA describes the regular process in seven steps:

According to the regulation, the application includes your operator number, the risk assessment, an operations manual if risk and complexity require it, and the confirmation that a suitable insurance is in place at the start of operations. What drone liability insurance must cover is explained in the article Drone insurance.

For simple projects the LBA has a simplified procedure called FastFlight: visual-line-of-sight flight, at most SAIL II, and measures with low robustness or medium robustness substantiated via EASA means of compliance. The responsibility for all evidence lies entirely with the applicant. Important for scheduling: Because of high application numbers, the LBA points to waiting times and regularly publishes a non-binding estimate. The fees are based on the fee ordinance of the aviation administration, and your cost notice states the amount.

Equipment and duties in operation

In everyday flying too, the “specific” category has its own rules. According to EASA, every drone in the “specific” category must transmit a Remote ID, even when operating under standard scenarios. In addition, the regulation requires at least a flashing green light so that the drone is recognizable at night. How Remote ID works and what the drone transmits is explained in the article Remote ID for drones.

The operator must designate a remote pilot for each flight and ensure that a possible failure does not take the drone out of the operational volume. The remote pilot needs the qualification specified in the authorization and must not fly under the influence of alcohol or other intoxicating substances. An STS remote pilot certificate is valid for five years according to EASA and is recognized in all EASA states.

LUC: the operator certificate for professionals

The Light UAS Operator Certificate is aimed at organizations with many and varied operations. According to EASA, only organizations can apply for a LUC, not private individuals. The operator must build a management system that covers all drone activities. In return it receives privileges: The authority can allow it to authorize certain operations itself, for example within standard scenarios, PDRAs or beyond.

The LBA grants the privileges step by step depending on the operator’s experience. The basic privilege corresponds to the scope of an operational authorization and can be extended later. A LUC is valid indefinitely as long as the organization meets the requirements. So far only a few German LUC operators are listed on the LBA website.

Flights abroad and the special case of model aircraft

A German operational authorization is not automatically valid in other EASA states. For cross-border operation you first obtain the authorization of your state of registration and then apply to the authority of the country of operation for a confirmation. The LBA provides its own form for this. What hobby pilots should keep in mind when traveling is in Taking your drone on vacation, the specifics of the neighboring countries in Flying a drone in Austria and Flying a drone in Switzerland.

Organized model flying takes its own path: For flights within model aircraft clubs and associations that are authorized under Article 16 of the regulation, no operational authorization in the “specific” category is necessary. What that looks like in practice is explained in Model flying in a club.

What this means for plane spotters

For spotters the most important insight is: The “specific” category is no back door for aerial photos of the airport. True, drone operation in Germany in the 1,000-meter zone around airports and in the corridor along the extended runway centerlines is permitted only in this category. But it does not follow that every authorization applies there. The authority must assess and authorize exactly this operation at exactly this location. According to EASA, a separate flight authorization from the body responsible for a geographical area can also be necessary. And in the control zone of a commercial airport you additionally need clearance from air traffic control. How air traffic control works is shown in DFS German Air Traffic Control.

Such authorizations are intended for commercial and official operations, such as surveying, inspection or obstacle checks. For private spotter pictures they are practically not provided for. The details around airport zones are summarized in the guide Drones near airports, and the authorization route for professional shots is described in Aerial photos of airports. Why authorities leave no leeway here is shown by the articles on Drone sightings at airports, the 2018 Gatwick drone incident and Drone defense at airports.

Short-notice airspace restrictions are, by the way, often announced via NOTAM – how to read them is explained in Reading and understanding NOTAMs.

Typical misunderstandings

• “Commercial automatically means specific.” Wrong. What matters is the risk. Many commercial flights run legally in the open category.
• “With an authorization I may fly anywhere.” The authorization applies only within the defined scope. Geozones and control zones require additional consents.
• “A standard scenario works with any drone.” Only with drones of class C5 or C6, under STS-01 also with C3 and a suitable accessory kit.
• “The LBA does SORA for me.” The operator creates the risk assessment. The authority only reviews it.
• “Once authorized, always authorized.” Duration and scope are stated in the authorization, and significant changes require a new version.

Conclusion

The “specific” category is the tool for everything that goes beyond hobby flights: beyond visual line of sight, heavier, higher or closer to people and sensitive places. The easiest entry is via the standard scenarios STS-01 and STS-02 – with a C5 or C6 drone, STS certificate and declaration. For everything else the route leads through an operational authorization with a PDRA or your own SORA, at the LBA exclusively under version 2.5 since 2026. Anyone who flies many operations can secure privileges with a LUC. For plane spotters, the situation remains clear: At the airport, no private route leads into the air.