The FAA 2209 NPRM Is Behind Us. What Now for Critical Infrastructure & CUAS?

The comment window on the FAA's Section 2209 rule closed August 5^th. That's the news here, not a final rule, which is still six to twelve months out at best. But the fact that comments are closed changes what critical infrastructure operators should be doing right now, and most haven't started.

Section 2209 has been ten years in the making. Congress ordered the FAA to build this process back in 2016, gave the agency 180 days to do it, and it finally moved a decade later. This movement was forced via an executive order last June (2025) directing the FAA to publish the proposal “promptly.” It landed in May (2026) which opened a 60-day public comment period. The FAA is now sitting on a heavy comment record from many individuals and organizations including over fourteen trade associations across energy, chemical, transportation, and other sectors, all pushing in roughly the same direction.

What the FAA Section 2209 Creates

The rule establishes two new classes of airspace designations, Unmanned Aircraft Flight Restriction (UAFR) and Special Unmanned Aircraft Flight Restriction (SUAFR), under a new Part 74. It's not a Temporary Flight Restriction. It's not a physical barrier. And it is explicitly not counter-UAS authority. What it is: a legal block of airspace drawn around a facility's property that turns an intrusion from a nuisance into an enforceable violation with civil and, in some cases, criminal penalties behind it.

That distinction matters more than the “just airspace” framing suggests. Before this rule, a private facility had no standing mechanism to ask for a no-fly designation. The only precedent was the FAA's ad hoc use of special security instructions, granted case by case to a small number of federally connected sites. Section 2209 turns that exception into a real process, and the FAA expects somewhere between 120,000 and 150,000 facilities across 16 sectors to be eligible. This isn't a niche rule for nuclear plants and airports. It touches nearly every operator who is classified as critical infrastructure.

What It Allows, What It Doesn't, and Why That Still Matters

There are two types of Unmanned Flight Restrictions. Standard (UAFR), which most applicants will get, runs for five years, requires Remote ID receiving capability and basic physical security, and still lets vetted commercial operators transit the airspace with notice.

Special (SUAFR), the higher bar, is reserved for facilities with a credible federal security sponsor, restricts flyovers more tightly, and carries the threat of criminal liability under 49 U.S.C. 46307 for violations, not just FAA civil penalties.

Here's the part most coverage glosses over: UAFRs nor SUAFRs grants zero mitigation authority to the infrastructure operator. Nothing in Part 74 lets a facility jam, spoof, net, or shoot down a drone that violates its restriction. That authority sits in a separate piece of federal policy, the Safer Skies Act, which took effect July 6 as part of the 2026 NDAA and builds a two-tier detection-and-mitigation framework for state and local law enforcement. Section 2209 and Safer Skies are two different buckets that happen to share a shelf.

So why bother with the airspace designation if it doesn't stop anything on its own? Because the people closest to this rulemaking suggest a UAFRs/SUAFRs to become a practical prerequisite for a facility that later wants mitigation authority delegated to it. Get the legal designation in place now or get in line behind everyone else once that door opens. There's also an unresolved wrinkle worth knowing about if you operate across state lines: the NPRM never addresses whether it preempts the state-level critical infrastructure drone laws that have already proliferated in the absence of a federal rule. For a multi-state operator, that's a live risk remaining to be mitigated, not a technicality.

What the Final Rule Will Almost Certainly Require

A few pieces of Part 74 are close to locked, whatever else changes in the final version.

1. Remote Identification (RID)

RID receiving capability is one of them. Every UAFR/SUAFR applicant will need the ability to detect RID broadcasts from compliant operators transiting nearby airspace. What's still genuinely open is the technology question: does a phone app that reads RID satisfy the requirement, or does the FAA expect a commercial sensor system? Nobody knows yet, and no vendor performance standard exists to guide a purchase. Treat the requirement as fixed and the implementation as unsettled.

2. UAS Response Plan

The security plan fight is the sharpest live dispute in the record. The FAA's draft language calls for a “drone security plan.” Industry has been pushing back toward a narrower “drone response plan,” arguing that handing over a full physical security posture creates its own exposure and offering executive-level certification as an alternative to submitting the whole document. How that gets resolved will set the tone for how much operational detail every applicant has to disclose going forward.

3. Eligibility

Every sector's comments land on the same concern: the FAA's proposed thresholds, 100,000 barrels a day for refineries, 500 million cubic feet a day for natural gas processing, chemical categories borrowed from a CFATS program that's been legally dead since 2023, are arbitrary cutoffs that exclude facilities carrying real risk. The consistent ask across sectors is to replace hard numeric gates with a risk-based or case-by-case pathway instead.

Why Operators Should Move Before the Final Rule, Not After

Two things are worth starting now, independent of when the FAA actually finalizes this.

First, start building the eligibility file: throughput numbers, chemical inventories, and any documented drone activity near the site. The NPRM asks for up to 24 months of activity data “where available,” and facilities without that record risk waiting years even after the rule takes effect, since the review timeline stacks on top of the data-collection window rather than running alongside it.

Second, get ahead of Remote ID. If a site doesn't have receiving capability deployed yet, this is the moment to understand the technology landscape and vet solutions on your own terms, before a finalized rule creates a rush and vendors start marketing aggressively into a captive market with no performance standard to hold them to.

Neither of these depends on knowing exactly what the final rule says. They depend on knowing what it will almost certainly require, and getting there before every other eligible facility in the country is trying to do the same thing at once.

The real payoff here isn't the airspace restriction itself. It's what a UAFR sets a facility up for next. If mitigation authority for critical infrastructure does eventually get delegated the way Safer Skies and the broader policy direction suggest it might, a facility that already holds a UAFR walks into that conversation with standing. A facility that waited for the final rule to force its hand won't.