A no-drone zone is airspace where unmanned aircraft are prohibited or restricted, and until this year, private facilities had almost no way to get one. Airports, military bases, and national security sites had protected airspace. The refinery, the stadium, the substation, and the prison next door did not, no matter how many drones showed up. That changed on May 6, 2026, when the FAA published its long-awaited proposed rule establishing a petition process for critical infrastructure to restrict drone operations overhead, implementing a mandate Congress issued nearly a decade ago.
For security directors, this is one of the most consequential airspace developments in years, and it comes with a catch almost nobody is talking about: a flight restriction is a line on a map, and the drones that worry you most are flown by people who ignore maps. This guide explains what the new rule creates, who qualifies, how the petition process works, what evidence a successful application needs, and why a no-drone zone without drone detection is a rule you cannot enforce and a promise you cannot verify.
The FAA restricts drone operations in several kinds of airspace: around airports, over military installations, during major events under temporary flight restrictions, and across sensitive areas like the Washington, D.C. flight restricted zone. Flying in these zones without authorization is a federal violation, and the FAA popularized the phrase No Drone Zone for exactly these areas.
The gap has always been everything else. Under Section 2209 of the FAA Extension, Safety, and Security Act of 2016, Congress ordered the FAA to create a process letting fixed-site facilities petition for their own drone restrictions. The deadline was January 2017. The rule finally arrived as a proposed rule in May 2026, pushed across the line by Executive Order 14305, Restoring American Airspace Sovereignty. Nearly a decade late, private critical infrastructure is getting its path to protected airspace.
The proposed rule establishes a new category of restricted airspace called an Unmanned Aircraft Flight Restriction, or UAFR, under a new 14 CFR Part 74. The structure is petition-based: no facility gets protection automatically. Owners and operators apply to the FAA, demonstrate eligibility and need, and receive a defined restriction over their site if approved. The FAA identified roughly 125,000 candidate facilities and expects about 9,000 applications over the first five years, which tells you two things: the eligible universe is enormous, and the agency expects facilities to self-select based on genuine risk.
The framework proposes two designation types: a standard restriction that preserves a transit path for certificated operators broadcasting Remote ID, and a stricter designation for the most sensitive sites. That transit-lane design matters, because it means even inside a UAFR, compliant commercial drones may lawfully pass through, and the question of which drone overhead is legal becomes an identification problem, not just a map problem.
Eligibility is deliberately demanding. Under the proposal, an applicant must be a fixed site, fall within critical infrastructure as federally defined, and already have protective security measures in place, identify the specific assets vulnerable to drone-related threats, and demonstrate that damage or disruption to the facility would have a regional or national-level debilitating impact. The rule draws on the 16 critical infrastructure sectors, and the statute specifically names categories including energy facilities, oil refineries, chemical plants, railroad facilities, amusement parks, and state prisons.
Read that eligibility list the way an application reviewer will. A facility that cannot describe its drone exposure with specificity, which assets are vulnerable, what has actually been flying overhead, what security measures already exist, is not writing a competitive petition. The rule rewards facilities that know their airspace, and penalizes the ones that only suspect they have a problem.
This is the practical heart of the rule for security teams. A UAFR petition is an evidence exercise: you are asking a federal agency to restrict public airspace over your site, and the application has to justify it with your facility's specific vulnerability and threat picture. The strongest possible exhibit is a documented record of actual drone activity: how many incursions, at what times, on what flight paths, over which assets, with which aircraft repeating.
That record comes from one place. A drone detection system produces the time-stamped tracks, incursion counts, and repeat-signature analysis that convert we are worried about drones into 47 documented incursions in six months, 60 percent at night, three repeat aircraft, two overflights of the switchyard. Facilities that deploy detection now enter the UAFR process with a petition-grade evidence file, and facilities that wait will be assembling anecdotes. The same record also supports every other legal avenue, from FAA complaints to law enforcement referrals, as covered in our pillar guide to legally responding to drones over your property.
Now the honest part, the part the rule's headlines skip. A UAFR does three valuable things: it makes violation of the zone a clear federal offense, it strips innocent explanations from any drone found inside it, and it strengthens every enforcement conversation that follows. Here is what it does not do: it does not detect a single drone, and it does not stop one. The compliant operators who respect the zone were never your threat. The contraband courier over the prison and the surveillance flight over the substation are flown by people for whom the map was never the obstacle.
This is the same lesson that runs through every layer of drone law: rules govern the willing. The FAA's Remote ID mandate identifies drones whose operators comply. A UAFR restricts drones whose operators check the map. For everyone else, enforcement begins with knowing they are there, which is a detection and monitoring function no airspace designation can perform. A facility with a UAFR and no detection has a stronger legal position and the same blind sky. And if a violation does need to be stopped in the air rather than prosecuted afterward, that authority belongs to certified agencies under the framework we cover in our guide to drone mitigation and authorization.
The rule is proposed, not final, which makes this the window to act on three fronts:
Comment before August 5, 2026. The comment period, extended to August 5, is the venue to shape eligibility criteria, processing timelines, and enforcement provisions. Operators of eligible facilities should be on the docket.
Assess eligibility honestly. Map your facility against the sector categories and the debilitating-impact standard. State prisons, energy sites, refineries, chemical plants, and rail facilities are named in the statute itself and should be preparing now. Critical infrastructure operators sit at the center of the rule's intent.
Start the evidence file today. Petitions will be judged on demonstrated vulnerability and existing security measures, and both criteria favor facilities already operating detection. Eligible public agencies can fund that deployment at 100 percent federal cost share through the FEMA Counter-UAS Grant Program, which means the evidence-gathering layer and the eventual enforcement layer can both arrive without capital budget.
Section 2209 waited almost ten years, and the arrival of a real petition process is genuinely good news for every facility that has watched drones operate overhead with no recourse. When the rule finalizes, critical infrastructure will finally be able to draw a legal line in its own sky. But a line is all it draws. The facilities that benefit most will be the ones that treat the UAFR as the legal layer of a complete program: detection to know what is flying, documentation to prove it, the restriction to make it enforceable, and certified law enforcement to act on it.
We believe the right way to read this rule is as federal confirmation of what security teams already know: your airspace is an asset, and protecting an asset starts with watching it. The petition will ask what you have seen over your facility. The strongest answer is a database, not a guess.
Preparing a UAFR petition, or building the drone activity record that will support one? Talk to our team about detection and reporting for your site.
Related reading:
Drone Mitigation: What It Means, Who Can Legally Do It, and How to Get Authorized
Detecting Drones: A Complete Guide to Finding Unauthorized UAS