Choosing a drone consultancy: what the work involves and how to judge it

What the work actually consists of

Most of the work is written, not flown. An operation that falls outside the open category is a specific category operation, and EASA states plainly that a drone is operated in the specific category when it is operated outside the operational limitations of the open category: beyond visual line of sight, above 120 m, above 25 kg maximum take-off mass, dropping material, or over an urban area above 4 kg or without a class identification label (EASA, specific category). Everything a consultancy does downstream follows from which of those thresholds you cross, and how.

There are four routes into the specific category, and choosing between them is the first substantive piece of advice you buy: a declaration against a standard scenario, an operational authorisation following a predefined risk assessment, an operational authorisation without one and therefore with a full SORA, or operating under a light UAS operator certificate. The routes differ in cost, lead time and how much of the reasoning you must produce yourself.

The authorisation itself comes from the national aviation authority of the state of registration, before the flights begin, and it can cover an unlimited number of flights over an unlimited period unless the authority limits it. A geographical zone adds a separate flight authorisation from whoever controls that zone, and that requirement is independent of category. A supplier who does not raise geographical zones early has not read your operating area.

The Operations Manual is your document, not the consultancy’s. EASA puts the responsibility to develop it on the operator, and it goes to the authority together with the predefined risk assessment, or together with the SORA where no predefined assessment applies. Good advisory work leaves you able to defend and maintain that manual after the invoice is paid.

How to tell competence from noise

Competence shows up as specificity about your operation within the first conversation. A supplier who can name which threshold your flight crosses, which route that suggests, and what evidence the route demands, is reasoning. A supplier who answers in categories of service is selling.

Be careful with the language of standing. Advisers advise; authorities decide. Anyone who implies they can obtain an authorisation for you, or that their involvement makes an application safe, is describing something they do not control. The same caution applies to standards: ISO states that ISO 31000 is not a certifiable risk management standard and cannot be used for certification purposes, so a claim of certification against it is a claim about nothing (ISO 31000:2018).

Local knowledge is not decoration. In Norway, registration, the online courses and the exam all run through the authority’s own channels, and the unmanned aviation section keeps limited telephone hours (Luftfartstilsynet, drones). A supplier who knows how a specific authority behaves in practice will give you a realistic schedule rather than an optimistic one.

• Names the threshold your operation crosses, not a service tier
• Explains why one route beats the others for your case
• Distinguishes what an adviser produces from what an authority decides
• Talks about who maintains the documents in twelve months
• Is willing to say that part of the work is yours

What the deliverables should look like

Ask for the shape of the output before the work starts. A useful engagement ends in documents you can hand to an authority, an auditor or a new safety manager without translation: a scoping note that fixes the operational volume and the assumptions behind it, a risk assessment with its reasoning visible, an Operations Manual you recognise as describing your own organisation, and a short register of what remains open.

The reasoning matters more than the format. A risk assessment whose conclusions cannot be traced back to a stated assumption is not reviewable, and anything not reviewable will be questioned at the worst possible moment. ISO 31000 describes risk management as identifying, analysing, evaluating, treating, monitoring and communicating risk, with criteria for monitoring and improving it over time. If a deliverable stops at the assessment and says nothing about monitoring, it covers roughly half the subject.

Expect the boundaries to be written down too. Advisory outputs are decision support: they inform an application, they do not settle it. A deliverable that states its own limits is easier to trust than one that does not, and if you want to sanity check your own position before commissioning anything, the SORA readiness tool covers the same questions a first workshop would.

Questions worth asking before you sign

The questions below are not a test of knowledge. They are a test of whether the supplier will describe the work honestly, including the parts that are slow, contested or yours to carry.

The answers you want are specific and sometimes uncomfortable. “We do not know yet, and here is what we would need to find out” is a stronger answer than a confident schedule offered before anyone has looked at your airspace. On method, ask how the supplier works before you ask what it costs: a description of the process, such as the one on the how we work page, tells you more about a supplier than a price does.

• Which route into the specific category do you expect for this operation, and why not the others?
• What will we have to produce ourselves, and when?
• Which assumptions in the assessment are the fragile ones?
• What happens to these documents when the operation changes?
• Who on your side actually writes the assessment, and who reviews it?
• What have you seen this authority push back on?

Where these projects go wrong

The most common failure is scope written around the operation as described in a proposal rather than the operation as it will be flown. The paperwork then holds together until the first day when a pilot needs to do something the assessment never contemplated, and the gap surfaces in the field instead of on paper.

The second failure is documentation nobody owns. A manual written entirely by an external adviser tends to describe an organisation that does not exist, with procedures nobody on the crew recognises. It passes a desk check and fails a real one. The fix is unglamorous: the operator drafts, the adviser challenges.

The third is treating an authorisation as an end state. Aircraft change, crews change, sites change, and geographical zones change around you. Occurrence reporting is the mechanism that keeps the picture current, and it depends on people being willing to report. SKYbrary describes just culture as an atmosphere of trust in which people are encouraged to provide essential safety-related information while remaining clear about where the line between acceptable and unacceptable behaviour is drawn (SKYbrary, Just Culture). A supplier who never asks how your people report is not looking at the part of the system that decides whether the rest works.

The fourth is buying a document when the problem is a decision. If nobody internally has decided how much risk the organisation is prepared to carry, no external assessment can settle it, and the engagement will circle until someone does.