Unmanned Aircraft (UA), most popularly known as ‘drones’, are aircraft without a pilot on board. Such aircraft can either be piloted remotely, in which case it is also termed a Remotely Piloted Vehicle (RPV), or be automated or autonomous. Automated drones are programmed to follow pre-defined waypoints, but the remote pilot may take control if required, whereas autonomous drones prohibit the intervention of remote pilots. Generally, drones are denoted by the term ‘UAS’ (Unmanned Aircraft System), which encompasses both the UA itself as well as any equipment used to control it such as the ‘Command Unit’.
UA are available in three main configurations, namely fixed wing (like conventional aeroplanes, mostly used as model aircraft), rotary wing (most popularly multirotors) and, less commonly, flapping wing (similar to birds). The most common configuration is multirotors (also known as multicopters), especially quadrotors, which are popular due to their ability to hover and fly at slow speeds that renders them useful for various applications. In fact, UA are increasingly being adopted for an expanding range of applications, for both commercial and recreational purposes, including surveillance, surveys, inspections, mapping and in agriculture. In view of this, it is crucial to regulate the use of UA to ensure the safety and security of both the public as well as manned aircraft.
To this end, EASA has issued regulations for UAS which became applicable as National Law in each of the EASA Member States on the 31st December 2020. These regulations adopt a risk-based approach, classifying UAS operations into three main categories based on the level of risk, namely ‘Open’, ‘Specific’ and ‘Certified’.
The Certified category, which is the highest risk category, comprises UAS operations which involve the transport of people or the carriage of dangerous goods, or are conducted over assemblies[1] of people with an UA of characteristic dimensions greater than or equal to 3 metres. Being the category with the highest risk, both the UA and UAS operator in this category require certification, and the remote pilot needs to be licensed similar to a conventional aircraft pilot. It should be noted that the regulations distinguish between the UAS operator, who is the owner of the UA, and may be an individual or an organisation, and the remote pilot, who is the person flying the drone.
The lowest risk category is the Open category. In this category, the risk is maintained low by ensuring that UA operations conform to certain parameters, including: no autonomous operations, a maximum height above ground level of 120 m (but may be reduced by the respective Member State if necessary), the UA must not weigh more than 25 kg, cannot carry dangerous goods or drop any material, and must be flown within Visual Line Of Sight (VLOS) at all times (except if flying in First Person View (FPV) mode, in which case an UA observer is required). Operations in the Open category are further classified into three subcategories, namely A1, A2, and A3, depending on the class of the UA (C0 – C4, depending on the weight) and which in turn determines how close the UA can fly to people.
Operations which exceed any parameter of the Open category but do not fall into the Certified category are classed as being in the ‘Specific’ category. For such operations, the UAS Operator is required to obtain an Operational Authorisation from the CAD, by submitting a Specific Operations Risk Assessment (SORA) detailing the risks of the operation and any mitigation measures adopted. Alternatively, if the operation conforms to a pre-defined Standard Scenario, Operators may simply submit an Operational Declaration confirming their operation is in line with the respective Standard Scenario and adopt the listed mitigation measures.
The preliminary requirement of the regulations issued by EASA is the registration of UAS operators, if their UA weighs more than 250 g, or if it weighs less than 250 g but is equipped with a recording device such as a camera or microphone, unless it is a ‘toy’, that is, the documentation explicitly states that the product conforms to the Toy Directive, 2009/48/EC. UAS operators residing in Malta should register on tmcad.idronect.com and are issued with a UAS Operator Registration Certificate (Fig. 1) containing a UAS Operator Registration number together with a corresponding QR-code. This number, or the corresponding QR-code, should be printed and affixed to all UA belonging to the UAS Operator. Registration on this system costs €25 and is renewable annually. Tourists/ drone operators having a UAS registration number issued by another EASA member state have the option of paying €10 for two months or €25 for an entire year.
A valid third-party insurance policy is also required upon registration. It should be noted that EASA does not mandate insurance for drone operations but leaves it up to each individual Member State to decide whether it is required in the respective state. Due to the nature of the Maltese airspace, all of which is ‘controlled’, Malta is mandating third-party insurance for all UAS operations.
Once registered, UAS operators may submit flight requests in the system, specifying the date/time of operation, the location and the UA that will be used. The system enables Operators to view the weather forecast and sunset/sunrise time on the day of operation, as well as the areas on the map which are restricted for UAS operations (for security, safety or environment purposes), thereby allowing them to plan their flight accordingly (Fig. 2). If the flight request meets certain requirements, namely: it does not infringe any restricted zones, the flight time is between half an hour before sunrise up to half an hour after sunset, and the maximum height above the ground is 60 m, then the authorisation is granted automatically and immediately by the system, called an ‘auto-authorisation’.
Conversely, if any of these requirements are exceeded, then TM-CAD needs to evaluate the flight request, possibly requiring a risk assessment to be submitted detailing mitigation measures that may need to be adopted. In these cases, TM-CAD may also request the Operator to use a tracking device provided by the Authority whilst conducting their operations, to enable real-time monitoring of the flight as well as recording of the flight parameters for retrieval if and when required.
It should be noted that flight authorisations are granted based on specific terms and conditions which are listed on the ‘Authorisation Form’. For example, UA flights cannot be conducted over private property without the explicit permission of the owner of the property, and Operators must also respect the privacy and data protection of individuals, which are governed under the GDPR regulations.
Regulations also require the certification of remote pilots flying UA of classes C1 – C4 in the Open category, depending on the subcategory of operation. Operations in subcategories A1 and A3 require completion of online training and then taking an online multiple-choice exam at TM-CAD, whereas operations in subcategory A2 require additional theoretical and practical training (which may be self-training), and sitting for an additional theoretical exam at TM-CAD as well as a self-practical assessment. Upon passing the exam, remote pilots are issued with a Remote Pilot Identification number, together with a certificate indicating ‘Proof of completion of the online training’ for subcategories A1 and A3 (Fig.3), and a ‘Remote pilot certificate of competency’ for subcategory A2. Training for subcategories A1 and A3 is available by TM-CAD on its website, but practical and/or theoretical training in all subcategories may be undertaken at any private institute in any Member State and will be valid in all other Member States. This training is valid for five years and requires a refresher before the validity expires, or a repeat of the training if the validity has already expired.
In order to ensure that these regulations are being followed, law enforcement officers will conduct checks to verify that UAS operators hold a valid registration number and third-party insurance, as well as to confirm that remote pilots are licensed according to the requirements of their respective operation. To this end, UAS operators or remote pilots caught breaching the laws will be penalised as per penalties defined in the Maltese Air Navigation Order, which range from fines to prison sentences depending on the severity of the breach.
Further information on these regulations is available in the ‘Unmanned Aircraft’ section of the Transport Malta website, and any additional questions may be addressed to drones.aviation@transport.gov.mt.
Figure 1: UAS Operator Registration Certificate

Figure 2: Map of the Maltese Islands indicating restricted zones

OR

Figure 3: Proof of Completion of the Online Training

[1] It should be noted that the EASA regulations do not specify the number of persons for an ‘assembly’, ‘crowd’ or ‘gathering’ of people, but defines these terms as “gatherings where persons are unable to move away due to the density of the people present.”