The DFR Compliance Playbook: What Every Police Department Needs Before Launching a Drone as First Responder (DFR) Program

A police chief evaluating Drone as First Responder today faces a regulatory landscape that did not exist eighteen months ago. The FAA Reauthorization Act of 2024 added a statutory definition of public safety organization, which is now used in both the FAA Part 107 public safety shielded-operations pathway and the Part 91 PAO/PSO waiver process. The Federal Communications Commission's (FCC's) December 2025 addition of foreign-produced Unmanned Aerial Systems (UAS) and critical components to the Covered List has changed how departments should evaluate new equipment. Chula Vista Police Department crossed 25,000 DFR missions in May 2026, providing the strongest public benchmark for agencies evaluating launch.

This guide is for the chief, deputy chief, city manager, or public safety executive and policy makers evaluating launch. It covers the FAA authority you need, what equipment you can prudently buy, which state and local rules can create liability, and the policy framework that determines whether your city council approves the program or shelves it. The structure follows the decision sequence the work actually requires.

Is DFR right for your department?

DFR is not just a drone program. It is a dispatch, airspace, procurement, privacy, and governance program with drones attached. Departments that buy hardware first and write policy after can run into trouble with the FAA, with city councils, with public records requests, with technical stacks, and with civil litigation. Departments that succeed treat the aircraft as one component of a larger operational system.

The operational case is now well documented. Chula Vista Police Department launched the first DFR program in the United States on October 22, 2018. As of May 8, 2026, the program had flown more than 25,000 missions, the drone had arrived before patrol on 17,170 calls, aircraft had played a role in 4,138 arrests, and 4,629 calls had been resolved without patrol officers needing to respond. About one in five missions were cleared without a ground unit. The reported average response time when the drone arrived before patrol was 96.98 seconds.

Chula Vista serves roughly 285,000 residents across about 52 square miles and does not operate its own dedicated helicopter unit. That profile makes Chula Vista a useful benchmark for many mid-sized U.S. police departments evaluating whether DFR can improve response time and resource allocation. The benchmark should still be tested against your own call profile, airspace, staffing model, launch-site geography, community expectations, and state law.

Which FAA authority do you actually need

The most common mistake is treating all public-safety drone operations as if they must fit within a single Part 107 model. Part 107 can support many public safety operations, and the FAA maintains a separate Part 107 Public Safety Organization-Shielded Operations waiver for qualifying public safety entities, especially entities that do not qualify as public aircraft operators. But a municipal police department seeking to operate drones as public aircraft should evaluate the Part 91 Public Aircraft Operations and Public Safety Operations (PAO/PSO) Certificate of Waiver or Authorization (CoW/A) pathway.

The Part 91 PAO/PSO 91.113 waiver process is available only to entities that meet both criteria. They must be Public Aircraft Operators under 49 USC 40102(a)(41), and they must also meet the public safety organization definition codified at 49 USC 44806(e). A city police department will usually satisfy the public safety organization definition, but public aircraft status depends on the legal status of the aircraft, the governmental function being performed, ownership or exclusive-use arrangements, and whether the operation is for a commercial purpose under 49 USC 40125.

Do not assume that outside counsel must sign or issue the FAA eligibility letter. The FAA checklist requires a letter certifying that the organization meets the legal definition in Public Law 118-63, section 926(e), and it requires the applicant, through the Responsible Person, to certify PAO/PSO eligibility. The FAA also cautions applicants to seek competent legal counsel to determine eligibility for public aircraft. The safer formulation is that the agency should prepare the required FAA eligibility letter, with review by aviation counsel recommended, because an incorrect PAO determination can compromise the waiver application and operations.

The BVLOS path under the Part 91 PAO/PSO waiver

The FAA's Part 91 PAO/PSO waiver process is described in the FAA Public Aircraft/Public Safety Operations CoW/A FAQ and the PAO-PSO 91 BVLOS 200 ft Waiver Checklist. The FAA's Public Safety Organization-Shielded Operations guide is a separate Part 107 pathway. It should not be described as the guide that introduced the Part 91 BVLOS waiver.

For qualified PAO/PSO entities, the Part 91 waiver has a 48-month validity period and permits Visual Line of Sight (VLOS) and BVLOS operations with FAA-specified mitigations. It replaces the Tactical BVLOS and First Responder BVLOS Concept of Operations (COAs) for qualified PAO/PSO entities seeking BVLOS authority. It can also be used instead of legacy VLOS-only Blanket and Jurisdictional COAs when an agency wants both VLOS and BVLOS authority in a single instrument. VLOS-only Blanket and Jurisdictional COAs remain available through the FAA's COA Application Processing System (CAPS) and can still be renewed. The older Tactical BVLOS and First Responder BVLOS instruments remain valid until canceled or expired for existing holders, but new applications and renewals are no longer accepted for those BVLOS instruments.

There are generally two Part 91 PAO/PSO BVLOS variants. The first relies on obstruction shielding and generally limits BVLOS operations to 200 feet Above Ground Level (AGL), or to specified obstruction-shielded altitudes. The second relies on acceptable electronic detect-and-avoid systems that are FCC-approved for aviation use and compliant with American Society for Testing and Materials (ASTM) or Radio Technical Commission for Aeronautics (RTCA) standards, with systems capable of detecting cooperative and non-cooperative manned traffic.

The Part 91 waiver is not airspace-free, and the airspace rule is different from the Part 107 PSO-SO guide. Under the FAA FAQ, the Part 91 PAO/PSO CoW/A includes limited airspace authorization up to the UAS Facility Map grid height at Low Altitude Authorization and Notification Capability enabled airports, or 200 feet AGL, whichever is lower. Separate FAA Air Traffic Organization authorization through CAPS or the Certificate of Authorization in FAADroneZone (CADZ) is needed for routine operations above the UAS Facility Map (UASFM) grid height, above 400 feet AGL in uncontrolled airspace, in controlled airspace where UASFM grids do not apply, or in prohibited, restricted, special-use, or Temporary Flight Restriction (TFR) airspace. Emergency deviations generally require the Special Governmental Interest process through the FAA Systems Operations Support Center.

Application practice should also be stated precisely. Eligible applicants should request the PAO/PSO 91.113 waiver packet by email at [email protected], then submit the completed FAA Form 7711-2, the required PAO/PSO eligibility letter, a detailed concept of operations or operation description, the completed PAO-PSO checklist signed by the Responsible Person, and any additional supporting materials required for operations outside the standard mitigations or for a detect-and-avoid (DAA)-based request.

What you can actually buy

On December 22, 2025, the FCC added all foreign-manufactured UAS and foreign-produced UAS critical components to the Covered List. The action followed a National Security Determination issued the previous day by an executive-branch interagency body. This was a category-based addition tied to place of production, not only an entity-by-entity listing.

The practical distinction matters. Covered foreign-produced UAS and critical components generally cannot receive new FCC equipment authorizations. That restriction can block new deployments, model changes, or upgrades that require a new or amended authorization. The FCC materials summarized by major communications-law firms state that the December 2025 update does not prohibit the import, sale, or use of device models the FCC previously authorized, and it does not affect a drone already lawfully purchased or acquired. Existing fleets should therefore be described as unaffected by the listing itself, not as permanently immune from later FCC action. The FCC has separately created a process that could limit continued importation or marketing of previously authorized covered equipment if later national security findings support that step.

Section 1709(a)(1) of the FY2025 National Defense Authorization Act specifically identifies DJI Technologies and Autel Robotics, along with subsidiaries, affiliates, partners, joint ventures, and entities with technology-sharing or licensing arrangements with those named entities. The National Security Determination also treats foreign-produced critical components broadly, including associated software and components such as data transmission devices, communications systems, flight controllers, ground control stations, navigation systems, sensors and cameras, batteries and battery management systems, and motors.

For new public safety procurements, the practical baseline should be Blue UAS status, a specific Department of War or Department of Homeland Security determination that the UAS or component does not present the described risk, domestic-end-product status while applicable, and compliance with any state procurement or grant restrictions. The Department of War determination issued in January 2026 stated that UAS and critical components on the Defense Contract Management Agency Blue UAS list do not currently present the unacceptable risks described in the determination, and that certain domestic end products are exempt through January 1, 2027. State and local agencies are not always legally required to buy only from the Blue UAS list, but procurement language that ignores Covered List status, component origin, state restrictions, cybersecurity controls, and grant terms is now risky.

State and local rules that will trip you up

Federal authority governs airspace and aviation safety. State law governs privacy, evidence, public records, data retention, procurement, and agency conduct. A department that obtains all federal authorizations can still violate state privacy law or create evidentiary issues if it captures imagery outside state-law limits.

Three patterns recur across jurisdictions. First, evidence-gathering by drone may require a warrant unless a statutory exception applies. Florida Statute 934.50 is a useful example. Law enforcement may not use a drone to gather evidence or other information except under the listed exceptions, including a judicial warrant, imminent-danger or exigent circumstances, missing-person searches, traffic-management support, crime-scene or crash-scene evidence collection, and other statutory categories. Evidence obtained in violation of the Florida Act is not admissible in a Florida criminal prosecution.

Second, crowd-monitoring rules can be highly state-specific. Florida allows law enforcement to use a drone for an aerial perspective of a crowd of 50 or more people only when the agency has required policies and procedures, and the agency head provides written authorization maintained on file. Do not generalize that California or other states use the same 50-person threshold unless you have checked the current statute or local ordinance. Departments should build state-specific crowd authorization procedures rather than importing Florida's threshold by default.

Third, the federal aviation authority should not be treated as a complete shield against state privacy, evidence, procurement, or public records obligations. A DFR program should be designed on the assumption that federal airspace approvals and state-law privacy controls operate at the same time unless counsel has confirmed a specific preemption defense for a specific claim.

The policy and oversight framework that determines council approval

The departments that survive city council scrutiny are the ones with the framework on paper before the first flight. Six documents are the minimum: a written use policy specifying when drones may be dispatched and for what purposes; a data retention and release schedule; a public records handling protocol; warrant protocols with documented exigent-circumstances criteria; agency-head authorization procedures for crowd monitoring where state law requires them; and a public-facing transparency mechanism.

The transparency mechanism is the most underrated of the six. Chula Vista publishes recent drone flight data and uses software to track departmental drone flights. The department states that its policy prohibits general surveillance or patrol operations, and that DFR is used during active responses to emergency or other calls for police assistance. That combination of public policy, flight-data disclosure, and limits on general surveillance is the defensible model. Departments that try to launch DFR without a published transparency mechanism often end up arguing about it after the fact.

The pre-launch compliance checklist

The work below is sequenced in the order it generally should happen. Some items can run in parallel, including procurement evaluation while the FAA packet is in progress, but later items should not be treated as complete until the relevant legal and policy prerequisites are closed.

1. Confirm the department is a public safety organization under 49 USC 44806(e) and determine whether the operation qualifies as Public Aircraft Operations under 49 USC 40102(a)(41) and 49 USC 40125.
2. Have the Responsible Person prepare the required PAO/PSO eligibility letter, with aviation counsel review recommended.
3. Request the current FAA PAO/PSO 91.113 waiver packet from [email protected].
4. Prepare the FAA Form 7711-2 waiver application.
5. Prepare the concept of operations or detailed operation description, including launch sites, operating area, dispatch triggers, BVLOS need, altitude profile, airspace, ground-risk mitigations, and communications procedures.
6. Complete the applicable PAO-PSO 91 BVLOS checklist, including Responsible Person initials and signature. Use the 200 ft obstruction-shielded checklist for the low-technology pathway and the DAA checklist for routine higher-altitude BVLOS requests.
7. Submit the completed packet to the FAA with all required supporting documents.
8. If controlled-airspace operations are needed, confirm whether the Part 91 waiver's limited airspace authorization covers the intended UASFM grid altitude. For routine operations above UASFM limits, above 400 feet AGL in Class G, in airspace where UASFM does not apply, or in special-use, TFR, restricted, or prohibited airspace, apply for the separate FAA Air Traffic Organization authorization through CAPS/CADZ or use the SGI process for qualifying emergencies.
9. Evaluate procurement against FCC Covered List status, Blue UAS or Department of War or Department of Homeland Security determination status, domestic-end-product status through January 1, 2027 where applicable, state procurement law, grant restrictions, cybersecurity controls, and component-origin representations.
10. For existing DJI, Autel, or other foreign-produced inventory, confirm the specific model's prior FCC equipment authorization, state-law usability, cybersecurity requirements, supportability, and any later FCC action before treating it as usable.
11. Draft the written use policy specifying dispatch triggers, prohibited uses, decision authority, recording rules, and mission approval workflow.
12. Establish data retention, release, evidence storage, audit, and public records protocols.
13. Document warrant protocols and exigent-circumstances criteria for evidence-gathering operations.
14. Establish agency-head authorization procedures for crowd monitoring where state law requires them.
15. Stand up a public-facing transparency mechanism, at minimum a flight log or dashboard showing launch reason, date, general location or map, duration, and outcome, subject to legitimate investigative and privacy redactions.
16. Present the full FAA, procurement, privacy, data, and transparency framework to city council or the appropriate governing body before the first operational DFR flight.
17. Confirm Standard Remote ID compliance for aircraft used under the waiver unless the FAA has authorized an exception in writing.
18. Establish documented training and proficiency requirements for remote pilots, teleoperators, visual observers where used, supervisors, evidence personnel, and public records staff.

Conclusion

The regulatory framework for DFR is more navigable in 2026, but it remains complex. The Part 91 PAO/PSO waiver consolidates key BVLOS and VLOS public-safety operating authorities for qualified entities, with a 48-month validity period and specific airspace and equipage limitations. It does not make DFR a special category of flight rules, nor does it eliminate state privacy, evidence, procurement, or public records obligations.

The procurement question has also become clearer, though not easier. The December 2025 FCC action means new deployments must be evaluated against Covered List status, equipment authorization limits, Blue UAS or specific Department of War or Department of Homeland Security determinations, state restrictions, component origin, and cybersecurity requirements. The operational case is documented across eight years of Chula Vista data and a growing roster of follow-on programs, but each department still has to prove the case against its own calls, airspace, budget, and community expectations.

What has not changed is the order of the work. Eligibility, counsel review, FAA waiver, airspace, procurement, policy, transparency, governing-body approval, training, then launch. Departments that respect that order launch defensible operating programs. Departments that take shortcuts may find themselves grounded by the FAA, challenged under state law, or defending their program before a city council that did not see the full framework in advance.