SAFER SKIES Act 2026: What State and Local Law Enforcement—and Organizations Seeking Drone Detection—Need to Know
The SAFER SKIES Act changed the United States counter-drone landscape. It did not make every counter-UAS system legal for every buyer, and it did not give private security teams, venues, utilities, airports, or property owners blanket authority to interfere with a drone.
What the law did was create a defined federal pathway for qualifying state, local, Tribal, and territorial law-enforcement and correctional agencies to conduct certain counter-unmanned aircraft system operations. The implementing rule separates detection and warning from mitigation, requires federal training and certification for activities that rely on the Act’s legal protections, limits the technology that may be used under those protections, and establishes policy, planning, privacy, coordination, and reporting requirements.
For organizations that want drone-detection capability, the most important point is this:
“Drone detection” is not one legal or technical category. The law turns on what a system actually does, what information it collects, whether it transmits radiofrequency energy, who operates it, and how it is used.
That distinction should drive every threat assessment, procurement decision, policy, and response plan.
Status as of September 2, 2026: The Department of Justice (DOJ) and Department of Homeland Security (DHS) interim final rule has been effective since July 1, 2026. Public comments are due September 4, 2026, so agencies should monitor later guidance and any final-rule changes.
What Is the SAFER SKIES Act?
Congress enacted the SAFER SKIES Act as Title LXXXVI of the National Defense Authorization Act for Fiscal Year 2026. The President signed it into law on December 18, 2025. The Act amended 6 U.S.C. § 124n and, for the first time, created a federal statutory pathway for qualifying state, local, Tribal, and territorial law-enforcement and correctional agencies to take specified actions against a credible drone threat.
The law covers threats to:
People, facilities, and assets
Venues used for large-scale public gatherings or events
Critical infrastructure
Correctional facilities
The statute can provide relief from specified federal criminal laws that would otherwise create legal barriers to certain detection and mitigation activities. That relief applies only when the agency, personnel, technology, policy, operation, and reporting comply with the statutory and regulatory framework. The enacted SAFER SKIES Act also contains a sunset: the expanded state, local, Tribal, and territorial authority is scheduled to terminate December 31, 2031, unless Congress changes the law.
Detection and Mitigation Are Not the Same Authority
The implementing rule establishes two certification tiers.
Detection and Warning
Detection and Warning Certification covers Act-dependent activities used to detect, identify, monitor, or track a drone; warn its operator; and exercise the Act’s limited confiscation authority after an aircraft is no longer in flight when legally appropriate.
The FBI’s National Counter-UAS Training Center (NCUTC) provides the federal detection-and-warning curriculum through a secure online portal. Personnel must complete the curriculum and pass the assessment. Vendor training, consultant training, and another agency’s course can be valuable for system operation and readiness, but they do not replace the required federal certification.
Personnel holding only Detection and Warning Certification may not disrupt, take control of, disable, damage, destroy, catch, or net an aircraft in flight. The rule makes that prohibition absolute, even during an emergency. A threat requiring mitigation must be handled by mitigation-certified personnel operating under the rule or coordinated with an authorized federal counter-UAS capability.
Mitigation
Mitigation includes actions such as disrupting a drone’s control link, seizing or exercising control of the aircraft, or using reasonable force to disable, damage, or destroy it. Mitigation-certified personnel must complete the applicable NCUTC training, hold current Detection and Warning Certification, and possess a valid FAA Part 107 remote-pilot certificate.
Before mitigation, the operator must reasonably determine that the specific aircraft poses a credible threat. The action must be proportionate, use the least disruptive effective means available under the circumstances, and account for the risk to manned aviation, lawful drones, communications, people, and property. A mitigation action that creates more danger than the drone itself is not proportionate under the rule.
The Most Important Distinction for Drone-Detection Buyers
Some detection methods can be used without relying on the special authority and legal relief created by the SAFER SKIES Act. Others may intercept, record, capture, or decode communications and therefore can implicate federal surveillance law.
The rule expressly states that cameras, acoustic sensors, and radar may remain available on the same legal basis as before the Act when their operation does not require the Act’s relief. Radar and other RF-emitting equipment may still require FCC licensing or authorization, and systems near airports may trigger additional FAA or airport requirements.
The interagency legal advisory on UAS detection and mitigation technology makes the practical test clear: legality does not turn solely on labels such as “passive,” “active,” “detection,” or “mitigation.” It turns on the system’s functions and its actual use. A system advertised as “passive RF detection” may still create legal concerns if it records, decodes, captures, or intercepts electronic communications.
What State and Local Law Enforcement Must Build
The SAFER SKIES Act is an operational framework, not a procurement shortcut. A compliant program requires more than trained officers and a sensor.
1. Confirm Agency and Personnel Eligibility
The Act’s authority is exercised by qualifying law-enforcement and correctional agencies through their officers and employees. Contractors cannot be used as substitute operators for mitigation or as the de facto operational controller of a government C-UAS program.
Agencies that do not have the resources for a stand-alone program may receive support from an accredited agency through a mutual-aid agreement, memorandum of understanding, task-force arrangement, or other authorized written agreement. The accredited agency remains responsible for the C-UAS operation.
2. Select the Correct Certification Path
Detection and Warning Certification is the logical starting point for many agencies. It supports airspace awareness, threat characterization, operator warning, evidence preservation, ground response, and informed requests for federal or mitigation-certified assistance.
Mitigation should follow a documented mission need, not a desire to own the most aggressive technology available.
3. Adopt an Agency Policy
Before conducting an operation that relies on SAFER SKIES authority, an agency must adopt an implementation policy or, for detection-and-warning-only programs, an abbreviated detection and warning policy. The policy must designate a senior Agency Approving Official, identify authorized personnel, establish recurrent training, address public notification, and define privacy, retention, dissemination, and compliance procedures.
The policy requires legal-counsel review and annual renewal. Agencies without in-house counsel may use the alternative review path identified in the rule.
4. Prepare a C-UAS Operations Plan
Each Act-dependent detection-and-warning operation and each mitigation operation requires a C-UAS Operations Plan signed by the Agency Approving Official and certified for legal sufficiency. The plan documents the mission, location, dates, systems, personnel, airspace, known authorized aircraft, risk assessment, data handling, communications, response, and contingency procedures.
Most operational windows may last up to 30 days. Fixed-site persistent-protection plans can support standing windows of up to 365 days when the rule’s conditions are met.
5. Use the Right Technology and Complete Coordination
For activity that relies on SAFER SKIES authority, agencies must use a technology category on the federal Authorized Technologies List and, when the corresponding category has been populated, a specific make, model, and hardware version on the Authorized Systems List. A manufacturer’s name, prior federal sale, or marketing statement is not proof that every configuration is authorized.
RF-emitting systems may require FCC authorization. Mitigation also requires advance federal coordination, FAA airspace coordination, and real-time air-traffic notification. Agencies should verify the approved hardware, firmware, software, frequencies, power levels, and operating limitations—not just the product family.
6. Protect Data and Prepare for Reporting
The rule requires First and Fourth Amendment protections, minimization of incidental collection, controlled dissemination, audit trails, and limits on the retention of communications records. Covered communications records generally may not be kept longer than 180 days unless a defined exception applies.
Detection activity must be included in semiannual operational summaries. Mitigation and other specified actions trigger more immediate reporting, including a post-operation report within 48 hours and immediate notification when an action causes unintended consequences.
What Private Organizations and Critical-Infrastructure Owners Can Do
The Act does not grant private organizations independent authority to jam, spoof, take control of, damage, or destroy drones. It also does not authorize a private organization to use an RF-intercept system merely because that organization owns a stadium, utility, hospital, airport, data center, campus, or other sensitive site.
It does, however, preserve a meaningful private-sector role. The federal rule recognizes that private companies may design, sell, install, maintain, and support systems; train agency personnel on specific equipment; and provide detection services using systems that do not require SAFER SKIES authority or relief from otherwise applicable laws.
Organizations seeking detection capability should take six practical steps.
1. Define the Security Problem
Do not begin with a product demonstration. Begin with the protected site, likely threat actors, legitimate drone activity, critical time periods, potential launch areas, blind spots, consequences, and the decision the detection system must support.
A correctional facility concerned about contraband delivery has a different detection problem than a stadium, electrical substation, airport, hospital heliport, or corporate research campus.
2. Separate Awareness From Interception
Ask whether the proposed solution detects a physical object or reads a public broadcast, or whether it captures and decodes communications between a drone and its controller. That distinction may determine whether the system can be lawfully operated by a private organization.
FAA Remote ID can provide useful identification and location information for compliant aircraft, but it is not a complete counter-drone solution. Some aircraft may be exempt, operating in an FAA-Recognized Identification Area, malfunctioning, noncompliant, modified, or intentionally not broadcasting. Remote ID is one data source—not proof that every transmitting drone is safe or that every non-transmitting object is hostile.
3. Require Independent Legal and Technical Review
Do not rely solely on a vendor’s representation that a product is “legal,” “passive,” “FAA approved,” or “federally compliant.” Counsel and a qualified technical advisor should review the exact configuration, data collected, emissions, interfaces, storage, third-party sharing, cybersecurity, and proposed use.
4. Build a Law-Enforcement Response Relationship
A detection alert has little operational value if no one knows who will verify it, contact the pilot, dispatch a ground team, preserve evidence, notify the FAA, or request federal support.
Critical-infrastructure owners, airports, and event operators should establish a written relationship with the law-enforcement agency expected to respond. The rule specifically requires agencies to report the protection requests they receive from critical-infrastructure and airport owners, including requests they cannot support. That reporting may inform future federal decisions about whether additional authority is needed for infrastructure owners.
5. Establish Data Governance Before Collection Begins
Document what will be collected, who can see it, how long it will be retained, how alerts will be validated, what will be shared with law enforcement, and how irrelevant or incidental data will be deleted. Include public-records, privacy, cybersecurity, evidentiary, and vendor-access considerations.
6. Exercise the Entire Response Chain
Run tabletop and field exercises that test detection, classification, authorization checks, command notification, ground-team response, FAA and law-enforcement contacts, evidence handling, public messaging, and after-action reporting. A sensor that performs well in a demonstration can still fail as a security capability if the organization has not rehearsed the human decisions around it.
A Drone Alert Is a Cue—Not a Verdict
Detection does not automatically establish unlawful activity or a credible threat. A drone may be operating under Part 107, recreational rules, public-aircraft authority, a waiver, an airspace authorization, or a coordinated public-safety mission. Land ownership also does not create ownership of the navigable airspace above a site.
Every response framework should separate:
Detection: Something is present.
Classification: The object is likely a drone rather than a bird, balloon, or crewed aircraft.
Identification: Available information is correlated with Remote ID, known operations, flight restrictions, or an authorized mission.
Assessment: Behavior, location, payload indicators, intelligence, and context are evaluated.
Response: The appropriate legal, safety, security, or law-enforcement action is selected.
Skipping those steps increases the chance of false accusations, disruption of lawful aviation, poor evidence, or an unsafe response.
Ten Questions to Ask Before Buying a Drone-Detection System
What exact data does the system collect, record, decode, or infer?
Does it intercept communications between the aircraft and controller?
Is it receive-only, or does any component emit RF energy?
What FCC equipment authorization, license, waiver, or spectrum coordination is required?
Does the product contain mitigation functions, and can those functions be physically and administratively disabled?
Is the quoted configuration on an applicable federal list when list status is required—and does the listing match the hardware and approved functions?
Which drone types, protocols, frequencies, sizes, speeds, and flight profiles can it detect, and which can it miss?
What are the demonstrated false-positive, false-negative, classification, location-accuracy, and detection-range results in an environment similar to ours?
Where is data processed and stored, who can access it, and can the vendor use operational data for another purpose?
What staffing, training, maintenance, calibration, network, cybersecurity, evidence, reporting, and sustainment costs exist beyond the purchase price?
The FAA has warned organizations to independently validate performance because real-world system behavior can differ from marketing claims. A site acceptance test should use controlled aircraft, known routes, realistic clutter, authorized aviation, and documented pass/fail criteria.
FEMA Counter-UAS Funding: What Agencies Should Know for FY2027
Federal funding and federal authority are related, but they are not the same thing.
The 2025 budget reconciliation law appropriated $500 million through the State Homeland Security Grant Program for state and local capabilities to detect, identify, track, or monitor UAS threats consistent with Titles 18 and 49 of the U.S. Code. FEMA structured its Counter-Unmanned Aircraft Systems Grant Program across two fiscal years:
FY2026: $250 million, prioritized for the eligible State Administrative Agencies associated with 2026 World Cup and national America 250 security requirements.
FY2027: The remaining $250 million, plus applicable unused FY2026 funds, is expected to expand eligibility to all states and territories.
Only State Administrative Agencies apply directly to FEMA. Local agencies and other eligible public entities must work through their state as subapplicants or subrecipients. The applicable Notice of Funding Opportunity controls eligibility and allowable costs; a grant award never creates legal authority to operate a technology.
For Texas, the State Administrative Agency is the Texas Office of the Governor, Homeland Security Grants Division. Texas projects commonly move through state and regional preparedness processes, so agencies should begin building the threat statement, capability gap, regional benefit, concept of operations, staffing plan, lifecycle budget, and legal-compliance approach before the FY2027 application window opens.
Start With the Threat, Not the Hardware
The best counter-UAS programs are mission-driven, legally informed, and operationally rehearsed. A useful threat and risk assessment should answer:
What people, events, operations, facilities, or assets require protection?
What suspicious, unsafe, or unlawful drone activity has occurred?
What legitimate drone and crewed-aircraft activity should be expected?
Where could a drone launch, recover, loiter, approach, or hide from sensors?
Which consequences matter most: injury, contraband, surveillance, interruption, collision, payload delivery, reputational harm, or loss of operations?
What decisions must an alert support, and how quickly?
Which detection layers are technically effective and legally available?
Which agency has authority to respond, and how will it be contacted?
What information must be preserved for investigation or prosecution?
How will the program be trained, exercised, maintained, audited, and improved?
Only after those questions are answered should an organization define technical requirements or compare products.
How Patriot Drone Operations Can Help
Patriot Drone Operations helps public-safety agencies, organizations, and critical-infrastructure stakeholders turn drone concerns into a practical readiness program. Our support can include:
Site-specific UAS threat and vulnerability assessments
Counter-UAS policy and concept-of-operations development support
Detection-capability requirements and vendor-neutral planning
Drone incident-response procedures and coordination workflows
Tabletop exercises and scenario-based training
UAS threat recognition, observation, reporting, and evidence-awareness training
Program and grant-readiness planning
Patriot Drone Operations does not issue NCUTC certification, provide legal opinions, or grant governmental counter-UAS authority. We help clients identify the right questions, build defensible plans, prepare their personnel, and coordinate effectively with legal counsel, law enforcement, and federal partners.
Explore Patriot Drone Operations’ Counter-UAS services and request a consultation.
Patriot Drone Operations is based in San Antonio and supports organizations across Texas and nationwide.
Frequently Asked Questions About the SAFER SKIES Act
-
The Act became law on December 18, 2025. The DOJ and DHS interim final rule governing state, local, Tribal, and territorial law-enforcement and correctional-agency C-UAS operations became effective July 1, 2026.
-
It creates a pathway for qualifying agencies to mitigate a credible drone threat, but only through properly trained and certified personnel using authorized technology and following the required policy, planning, airspace, spectrum, coordination, safety, privacy, and reporting procedures. It is not automatic authority for every officer or every incident.
-
Potentially, yes, when the system and its use do not require the special authority or legal relief provided by the Act and comply with all other applicable laws. Examples identified in the federal rule include electro-optical, infrared, acoustic, and radar detection, although radar and other RF-emitting systems may require FCC authorization. Every proposed system should receive configuration-specific legal and technical review.
-
The SAFER SKIES Act does not grant private owners independent authority to jam, spoof, seize control of, damage, or destroy a drone. These organizations should build lawful detection, reporting, and coordination relationships with properly authorized law-enforcement and federal partners.
-
No. Federal guidance warns that broad labels do not determine legality. The key questions include whether the technology records, decodes, captures, or intercepts electronic communications and how the collected data is used.
-
No. Remote ID is an important awareness and identification layer for compliant aircraft, but not every detected object will broadcast Remote ID. It also does not independently determine whether a flight is lawful, authorized, unsafe, or threatening.
-
Contractors may provide technical support, maintenance, and system-specific training. They may also provide detection services that do not require SAFER SKIES authority. The federal rule prohibits contractors from operating mitigation systems or exercising de facto operational control under a turnkey or managed-service arrangement.
-
No. Federal certification establishes the required legal and operational qualification under the rule. Personnel still need system-specific instruction and proficiency training for the equipment they will use. Conversely, vendor training does not replace federal certification.
-
Not merely because they perform public-safety functions. The Act’s independent authority applies to qualifying law-enforcement and correctional agencies. Other public-safety organizations can perform important support, incident-command, planning, communications, and response roles consistent with law and written arrangements.
-
Conduct a site-specific threat and risk assessment. Define the problem, document legitimate and suspicious activity, identify the agency expected to respond, and determine what information a detection system must provide before evaluating products.
About the Author
Rachel Skalisky is Co-Owner and Chief Instructor of Patriot Drone Operations. She is a U.S. Army Air Defense Artillery officer with more than a decade of UAS and counter-UAS experience involving airspace planning, UAS threat analysis, critical-infrastructure defense, readiness exercises, training, and coordination. Her military background is provided for professional context only and does not constitute endorsement by the U.S. Army, Department of Defense, or any government agency.
This article is educational and is not legal advice. Counter-UAS law is technology- and use-specific. Agencies and organizations should consult qualified legal counsel and appropriate federal, state, local, Tribal, and territorial authorities before acquiring, testing, installing, or operating detection or mitigation technology.