IRImplementing rule
Annex B to AMC1 Article 11
INTEGRITY AND ASSURANCE LEVELS FOR THE MITGATIONS USED TO REDUCE THE INTRINSIC GROUND RISK CLASS (iGRC) B.1 How to use Annex B The following table provides the basic principles to consider when using the SORA Annex B.
| # | Principle description | Additional information |
|---|---|---|
| #1 | Annex B provides the assessment criteria for the integrity (i.e. safety gain) and assurance (i.e. method of proof) of the applicant’s proposed mitigations. The proposed mitigations are intended to reduce the iGRC associated with a given operation. | The identification and implementation of mitigations is the responsibility of the applicant. |
| #2 | A proposed mitigation should have a positive effect on reducing the ground risk associated with defined operational limitations. In the case where a mitigation is available but does not reduce the ground risk, its level of integrity should be considered equivalent to ‘None’. | |
| #3 | To achieve a given level of integrity/assurance, when more than one criterion exists for that level of integrity/assurance, all applicable criteria need to be met, unless specified otherwise. | If a criterion for a mitigation is not applicable, it can be ignored (e.g. passive mitigations do not require training or activation). |
| #4 | Annex B intentionally uses non-prescriptive terms (e.g. suitable, reasonably practicable) to provide flexibility to both applicants and competent authorities. This does not constrain the applicant in proposing mitigations, nor the competent authority in evaluating what is needed on a case-by-case basis. | |
| #5 | Annex B in its entirety also applies to single-person organisations. | |
| #6 | Annex B mitigations are applied to the operational volume and ground risk buffer. Annex B mitigations may be applied to the adjacent ground area. | Details of mitigation application to adjacent ground area can be found in Annex F Edition 2.5. |
| #7 | All bullet points within all tables in this Annex are meant to be fulfilled unless followed by ‘or’. | |
| #8 | The GRC cannot be lowered to a value less than the equivalent for controlled ground area. | |
| #9 | Any criterion labelled ‘technical design’ will most likely require the support of the UAS or component designer for providing statements of compliance and, if applicable, gathering the required evidence. | |
| #10 | The applicant may claim more points of GRC reduction than indicated in Table 11 (Table 5 in this AMC (SORA Main Body)) when the appropriate orders of magnitude reduction of the risk to uninvolved people can be demonstrated. Any of these claims should be fulfilled to ‘high’ robustness level. |
Table B.1— Basic principles B.2 M1(A) — Strategic mitigations — Sheltering The M1(A) mitigation is linked to the fact that people spend on average a very small amount of time outdoors unprotected by a structure. Therefore, operators that use sufficiently small UAS can expect to have a large percentage of the population sheltered from an impact. This assumption may also apply to larger UAS; in these cases, the sheltering effectiveness should be demonstrated. Time-based arguments such as ‘I fly at night and there are less people outdoors in my iGRC footprint’ do not belong to M1(A) low robustness. At medium robustness, time-based arguments are included. Sheltering at low robustness is to be understood as a generally applicable mitigation given by the characteristics of the environment being flown, with no operational restrictions added. To prevent double-counting time-based restrictions, M1(A) medium robustness mitigation cannot be combined with any M1(B) mitigations. However, M1(A) low robustness has no operational restrictions and can be combined with M1(B) mitigations.
| LEVEL of INTEGRITY | |||
|---|---|---|---|
| Low | Medium | ||
| M1(A) — Sheltering | Criterion #1 (Evaluation of people at risk) | If the UAS operator claims a reduction due to a sheltered operational environment, the UAS operator: a) flies over operational environments generally consisting of structures providing shelter (e.g. buildings); b) it is reasonable to expect that on average a vast majority of the uninvolved people will be located under a structure1. This mitigation cannot be claimed when flying over outdoor assemblies of people or over areas with no shelter. | Same as low. In addition, the UAS operator restricts operating times (e.g. during night-time) and demonstrates that an even greater proportion of uninvolved people are sheltered. |
| Comments | 1 The consideration of this mitigation may vary based on local conditions. A metastudyof time-activity pattern studies shows that people generally spend at most 10% of their time outside. Diffey, B. (2010) . An overview analysis of the time peoplespend outdoors. The British journal of dermatology. 164. 848-54. 10.1111/j.1365-2133.2010.10165.x. The intention is to estimate the proportion of people outside on average and not at a specific time of day or year. There will be times when at specific locations temporarily there are more people exposed, but it should be sufficient to expect that on average the proportion of people exposed outside is below 10%. However, assemblies of people should be avoided. UAS operators and/or competent authorities may consider adapting this ratio based on other evidence. Please, see GM2 UAS.SPEC.030(2) to identify whether the application of M1 triggers the need to apply for an operational authorisation with precise or generic locations. | ||
| Criterion #2 (Evaluation of penetration hazard) | The UAS operator uses a UA that is not expected to penetrate structures and fatally injure people under the shelter2. | ||
| Comments | 2 Guidance on how to evaluate the sheltering effect can be found in the following: — ASSURE UAS Ground Collision Severity Evaluation A4 report section ‘4.12. Structural Standards for Sheltering (KU)’, pp. 103–111, or — MITRE presentation given during the UAS Technical Analysis and Applications Center (TAAC) conference in 2016 titled ‘UAS EXCOM Science and Research Panel (SARP) 2016 TAAC Update’ - PR 16-3979. In general, it can be expected that UAS with a take-off mass of less than 25 kg are not able to penetrate into buildings except in cases where the UAS speed or building materials are unusual (e.g. tents, glass roofs, etc). | ||
Table B.2 — Level of integrity assessment criteria for M1(A) mitigation
| LEVEL of ASSURANCE | |||
|---|---|---|---|
| Low | Medium | ||
| M1(A) — Sheltering | Criterion #1 (Evaluation of people at risk) | The UAS operator declares that the operation is in an environment that has structures1 providing shelter where the vast majority of people are generally expected to be, and the UA does not fly over large outdoor assemblies of people. | Same as ‘low’. In addition, the UAS operator has time-based restrictions in place and evidence to support that a higher proportion of people are sheltered. Medium robustness M1(A) mitigation cannot be combined with M1(B) mitigations. |
| Comments | 1 For example, a city or town consists generally of structures providing shelter. While it may also include areas that are not sheltered, the mitigation is expected to be provided in most of such cases. | ||
| Criterion #2 (Evaluation of penetration hazard) | The applicant declares that the UA used has a take-off mass of less than 25 kg. OR For UA with a take-off mass higher than 25 kg1, the UAS operator has supporting evidence that the required level of integrity is achieved. This is typically done by means of testing, analysis, simulation, inspection, design review or through operational experience. | ||
| Comments | 1UA technical information needed for the evaluation may require support from the UAS designer. | ||
Table B.3 — Level of assurance criteria for M1(A) mitigation
B.3 M1(B) — Strategic mitigations — Operational restrictions M1(B) mitigations are intended to reduce the number of people at risk on the ground independently of sheltering. These mitigations are applied before the flight. Improvements in the data included in the static data population density maps are not part of M1(B) mitigations and should be already used in the intrinsic ground risk assessment at Step #2. Use of best available data is encouraged to be used already for the iGRC determination. A competent authority may on a case-by-case basis accept pure time exposure arguments for ground risk reduction but should consider how this affects the cumulative risk. M1(B) mitigations are combinations of limitations on time and location of the operation to reduce the number of people at risk at a set time and location.
| LEVEL of INTEGRITY | |||
|---|---|---|---|
| Medium | High | ||
| M1(B) — Operational restrictions | Criterion #1 (Evaluation of people at risk) | The UAS operator provides space-time-based restrictions (e.g. flying over a market square when it is not crowded) to substantiate that the actual density of people during the operation is lower than that in Step #2. This can be done by means of: a) an analysis or appraisal of the characteristics of the location1 and the time2 of operation; AND/OR b) the use of temporal density data (e.g. data from a supplemental data service provider) relevant for the proposed area; this can incorporate real-time or historical data. | |
| Comments | 1 The characteristics of the location should be understood as land use that relates to the presence of people, e.g. industrial area, urban park or shopping centres. 2 Time should be understood as time of day or day of the week that would influence the presence of people, e.g. weekend for industrial plants, night-time, time after opening hours of shops. | ||
| Criterion #2 (Impact on population at risk) | The population at risk is lowered by at least 1 iGRC population band3 (~90 %) using one or more methods described in the level of integrity for criterion #1 above. | The population at risk is lowered by at least 2 iGRC population bands3 (~99 %) using one or more methods described in the level of integrity for criterion #1 above. | |
| Comments | 3 The iGRC population band is described in ‘4.2.3 Step #2’ of the SORA Main Body. | ||
Table B.4 — Level of integrity assessment criteria for M1(B) mitigation
| LEVEL of ASSURANCE | ||||
|---|---|---|---|---|
| Medium | High | |||
| M1(B) — Operational restrictions | Criterion #1 (Evaluation of people at risk) | All mapping products, data sources and processes used to claim lowering the density of population at risk are accepted by the competent authority. | ||
| Comments | N/A | |||
| Criterion #2 (Impact on population at risk) | The UAS operator has supporting evidence that the required level of integrity is achieved. This is typically done by means of analyses, surveys or through operational experience. | The claimed level of integrity is validated by the competent authority of the Member State or by an entity that is designated by the competent authority against a standard considered adequate by the competent authority and/or in accordance with means of compliance acceptable to that authority. | ||
| Comments | Quantitative and qualitative mitigations can in combination meet the target reductions of populations at risk set in ‘medium’ and ‘high’ integrity levels. | |||
Table B.5 — Level of assurance criteria for M1(b) mitigation
B.4 M1(C) — Tactical mitigations — Ground observation The M1(C) mitigation is a tactical mitigation where the remote crew or the system can observe most of the overflown area(s), allowing the detection of uninvolved people in the operational area and manoeuvring the UA so that the number of uninvolved people overflown during the operation is significantly reduced.
| LEVEL of INTEGRITY | ||
|---|---|---|
| Low | ||
| M1(C) — Ground observation | Criterion #1 (Procedures) | To achieve a reduction of the number of people at risk: a) the remote crew members observe the vast majority of the overflown areas during the operation and identify area(s) of lower risk on the ground (e.g. presence of uninvolved people and obstacles); b) the remote pilot reduces the number of people at risk by adjusting the flight path while the operation is in progress (e.g. flying away from the area with a higher risk on the ground or overflying only the identified area(s) of lower risk on the ground).1 |
| Comments | 1 The iGRC population band is described in Chapter 4.2.3 Step #2 of this AMC (SORA Main Body. | |
| Criterion #2 (Technical means) | If the mitigation is achieved through the use of technical means1 (e.g. camera(s) mounted on the UA or visual observers on the ground with radios/phones), these should provide data of reliable quality allowing the reliable detection of uninvolved people on the ground. | |
| Comments | 1Criterion #2 may require support from the UAS or the component designer to gather the required evidence. | |
Table B. 6 - Level of integrity assessment criteria for M1(C) mitigation
| LEVEL of ASSURANCE | ||
|---|---|---|
| Low | ||
| M1(C) — Ground observation | Criterion #1 (Procedures) | The operational procedures for the mitigation are documented. The UAS operator declares that the required level of integrity has been achieved. |
| Comments | N/A | |
| Criterion #2 (Technical means) | Competent authorities may allow the use of technical means1 for ground observation with assurance criteria acceptable to them. | |
| Comments | 1Criterion #2 may require support from the UAS or the component designer to gather the required evidence. | |
Table B. 7— Level of assurance assessment criteria for M1(C) mitigation
B.5 M2 Effects of UA impact dynamics are reduced M2 mitigations are intended to reduce the effect of ground impact once the control of the operation is lost. This is done by either reducing the probability of lethality of a UA impact (i.e. energy, impulse, transfer of energy dynamics, etc.) and/or by reducing the size of the expected critical area (see Table B.8 below). Examples include but are not limited to parachutes, autorotation, frangibility, stalling the aircraft to slow the descent and increase the impact angle. UAS designers should demonstrate the required total amount of reduction (see integrity criteria) in either or for both factors. The base assumption in the SORA for UAS impact lethality before mitigation M2 is applied is that most impacts are lethal. Based on the characteristic dimensions of a UA, the related critical areas are displayed in Table B.8 below. Depending on whether the mitigation is passive, manually activated or automatically activated, UAS designers should provide correspondingly adequate evidence and procedures for a given level of robustness. The reduction of the inherent critical area of a UA by way of analysis should be conducted already in Step #2 of the SORA and is not part of mitigation M2. Critical area calculations are defined in Annex F Edition 2.5 Chapter 1.8. The table provided in Section S.4.2 of this AMC (SORA Main Body) assumes the following critical areas for each characteristic dimension.
| Maximum characteristic dimension (m) | 1 | 3 | 8 | 20 | 40 |
|---|---|---|---|---|---|
| Critical area (m2) | 6.5 | 65 | 650 | 6 500 | 65 000 |
Table B.8 — Critical areas associated with the maximum characteristic dimension (non-mitigated) UAS designers that claim a mitigation by reducing the critical area shall use the values above as the baseline for comparison to show the appropriate mitigation. If a UAS operator or a UAS designer has used the modifications according to Annex F Edition 2.545 in Step #2, or has used the automatic critical area assessment tool available on the EASA website, to show a corrected critical area for its UAS and matched the corrected critical area to a column in Table B.8, then this table value is used as the baseline against which the mitigation is assessed. If a UAS operator or a UAS designer has used the modifications according to Annex F Edition 2.545 in Step #2 to show both a corrected critical area and a matching population density, then this custom critical area value is used as the baseline against which the mitigation is assessed, and the custom population density value should be used as a limitation in the UAS operation.
| LEVEL of INTEGRITY | |||
|---|---|---|---|
| Medium1 | High | ||
| M2 — Effects of UA impact dynamics are reduced | Criterion #1 (Technical design) | (a) The effects of impact dynamics and immediate post-impact hazards2, the critical area or the combination of these are reduced such that the risk to population is reduced by an approximate 1 order of magnitude (90 %)3. (b) When applicable, in case of malfunctions, failures or a combination of these that could lead to a crash, the UAS contains all the elements required for the activation of the mitigation4. (c) When applicable, any failure or malfunction of the proposed mitigation itself (e.g. inadvertent activation) does not adversely affect the safety of the operation. | Same as ‘medium’. In addition: (a) When applicable, the activation of the mitigation is automated4,5,6. (b) The effects of impact dynamics and immediate post-impact hazards2, the critical area or the combination of these are reduced such that the risk to the population is reduced by an approximate 2 orders of magnitude (99 %)3. |
| Comments | 1 MoC to Light-UAS.2512 is an acceptable means to comply with the ‘medium’ level of robustness for M2. Moreover, it provides additional explanation of the M2 criteria. 2 Examples of immediate post-impact hazards include fires and release of high-energy debris. 3 Latest research on UAS impacts estimatesinjuries using the Abbreviated Injury Scale (AIS) developed for automotive impact tests and test dummies. An impact that has a 30 % chance of causing injury of AIS level 3 injury or greater is estimated to have a 10 % probability of death. Note that the SORA methodology only considers fatalities. It does not provide guidance on the injury levels / thresholds beyond which an injury should be considered as a fatality. Further guidance on how to evaluate impact severity measurement may be found for example in Ranges of Injury Risk Associated with Impact from Unmanned Aircraft Systems DOI: 10.1007/s10439-017-1921-6, ASSURE UAS reports A14 and A4 on UAS Ground Collision Severity Evaluation. 4 For ‘medium’ robustness, the UAS designer is expected to address only probable malfunctions, failures and their combinations. No single failure should lead simultaneously to a loss of control of the operation and a reduction of the effectiveness of the M2 mitigation. 5 An automated activation may be required when reaction time is critical or when the operator cannot determine the need for activation. 6 The UAS designer may nevertheless implement an additional manual activation function. | ||
| Criterion #2 (Procedures) | Any piece of equipment used to reduce the effect of the UA impact dynamics is installed, operated and maintained in accordance with the UAS/mitigation designer instructions. | ||
| Comments | N/A | ||
| Criterion #3 (Training) | When the use of the mitigation requires action from the remote crew, then the UAS operator should provide appropriate training to the remote crew. The UAS operator should ensure that the personnel (internal or external) responsible for the installation and maintenance of the mitigations are qualified for the task. | ||
| Comments | N/A | ||
Table B.1 — Level of integrity assessment criteria for M2 mitigation
| LEVEL of ASSURANCE | ||||
|---|---|---|---|---|
| Medium | High | |||
| M2 — Effects of UA impact dynamics are reduced | Criterion #1 (Technical design) | The UAS designer has supporting evidence to claim that the required level of integrity and reliability is achieved. This is typically done by means of testing, analysis, simulation1, inspection, design review or through operational experience. A UAS with a C0 or C1 class mark or with an MTOM lower or equal to 900 g and a maximum speed of 19 m/s fulfils the assurance criterion 1. The UAS designer may provide a statement of compliance with MoC to Light-UAS.25122 by providing the supporting evidence defined in it. | The UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer. | |
| Comments | 1 When simulation is used, the validity of the targeted environment used in the simulation needs to be justified. 2 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-mitigation-means-m2-ref-amc | |||
| Criterion #2 (Procedures) | (a) Procedures are validated against standards that are considered adequate by the competent authority of the Member State and/or in accordance with means of compliance acceptable to that authority. (b) The adequacy of the operator’s procedures is justified through: (i) dedicated flight tests; or (ii) simulation, provided that the representativeness of the simulation means is proven for the intended purpose with positive results; (iii) any other means acceptable to the competent authority of the MS. (c) The UAS/mitigation designer provides the instructions necessary for the correct operation of the mitigations. | (a) the DVR covers the operating instructions of the mitigations; (b) the competent authority of the Member State or an entity that is designated by the competent authority verifies that the procedures developed by the UAS operator are acceptable. | ||
| Comments | UAS operators may directly use the procedures provided by the UAS/mitigation designer and rely on the adequacy verification performed by them. AMC2 UAS.SPEC.030(3)(e) ‘Operational procedures for medium and high levels of robustness’ is considered an acceptable means of compliance. | |||
| Criterion #3 (Training) | (a) Training syllabus is available. (b) The UAS operator provides theoretical and practical training for the remote crew. (c) Personnel responsible for installation and maintenance of the mitigations have completed relevant training. | Same as ‘medium’. In addition, the competent authority of the Member State or an entity that is designated by the competent authority: (a) validates the training syllabus; (b) verifies the remote crew competencies. | ||
| Comments | N/A | |||
Table B.10 — Level of assurance assessment criteria for M2 mitigation
IR — Regulations (EU) 2019/947 and 2019/945 · ED Decision 2025/018/R · UAS Easy Access Rules · EAR revision 29 Jun 2026