The European Union’s planned Trusted Drone Label would test drones against 12 security criteria and would not exclude any of them for where they were made. The European Commission published the study’s preliminary findings for the EU Drone Summit in Brussels, which closes today.
The United States went the other way. Since 22 December 2025 every drone and drone part made abroad has been on the FCC’s Covered List, which bars new approvals. DJI and Autel are challenging their place on it.
The study’s hardware criterion says it “shall not restrict components solely on the basis of their country of origin.” Its authors write that the manufacturers, operators and authorities they consulted disagreed about origin rules but gave “much stronger support” to transparency. A labelled drone’s maker would keep lists of its software and critical hardware, with each part’s supplier and origin, and show them to assessors on request. The assessor checks that the lists exist, not that they are accurate.
What a drone would have to do
Ten of the 12 criteria are technical. Firmware must carry a cryptographic signature that the drone checks before running it, and older versions with known flaws must not be reinstallable. Commands must come from an authenticated source and be protected against replay. The drone must detect interference with its navigation, warn the pilot and respond predictably.
Two of the ten concern data. A labelled drone would send no flight, telemetry or camera data to outside networks or to its manufacturer unless the operator switched it on. After landing, the block would have to hold across restarts and software updates, and long-lived login tokens that keep data flowing would not be allowed.
Accredited assessment bodies in the EU, public or private, would examine each model. The people consulted estimated four to eight weeks per assessment. The study recommends running the label under the EU’s cybersecurity certification framework, administered by ENISA, the EU cybersecurity agency, with EASA advising on drone-specific standards. A label would last about two to three years, which the authors call a working proposal.
The study proposes no subsidies. In its second survey, 23 of 31 respondents named public procurement as the strongest reason to take the label up.
Behind the Commission’s date
The label is voluntary and does not exist yet. The 43-page booklet presented at the summit says it is not the study’s final deliverable or “an announcement of an operational certification scheme”. The study concludes in January 2027.
Before applications open, rules on validity, product changes, vulnerability handling, fees and use of the label still have to be settled. Three criteria, covering Remote ID and navigation, have no suitable test method yet. In February, the Commission’s Action Plan on Drone and Counter-Drone Security promised to “develop by Q4 2026 an EU Trusted Drone Label”.
What the Commission’s advisers said
The summit also took stock of the Drone Strategy 2.0, adopted in 2022. The Commission’s Drone Leaders’ Group, 22 members chaired by Filip Cornelis, the Commission’s director for aviation, dated its report 21 October. Parrot and Manna sit on it. The report says the 2022 vision is still right and that “the principal gap lies between ambition and delivery.”
The group was told of operators waiting more than a year for approvals, and of one that paused its European operations because national and city authorities did not work together. An approval from one EU country still cannot be used in another without a second assessment. Members called U-space, the EU’s system for managing low-level drone traffic, “very slow and unpredictable”.
The group asks for a delivery programme with named owners and deadlines, more staff at EASA and national authorities, and public reports at least once a year. They would count outcomes such as regular commercial flights beyond the pilot’s sight and approval times. The Commission says the report is the group’s view, not its own.
Commissioner Apostolos Tzitzikostas was on the programme for the summit’s keynote this morning. By this afternoon the Commission had published neither his speech nor the findings of its own review.
