The European Commission has published an update to its civil aviation occurrence reporting framework, extending mandatory reporting requirements to cover uncrewed aircraft systems, U-space operations, and information security events for the first time. The new measure, Commission Implementing Regulation (EU) 2026/1821, amends the existing Implementing Regulation (EU) 2015/1018, which lays out the categories of civil aviation occurrences that organizations and individuals are legally required to report.
Until now, the EU’s mandatory occurrence reporting list was built primarily around traditional crewed aviation events. The update adds specific categories tied to drone operations and the broader U-space framework, the EU’s system for managing low-altitude uncrewed traffic. Under the new rules, operators must report incidents such as a UAS operation that exceeds the operational volume authorized under its permit or the privileges of a Light UAS operator certificate, as well as cases of inadequate operational planning, including failures in contingency procedures, operational volume management, or tactical mitigation performance requirements, that endangered another aircraft or person. The regulation also formally brings Part-IS occurrences, meaning information security incidents falling under EASA’s existing information security management framework, into the mandatory reporting structure, while removing certain aviation security occurrences from the list entirely.
The update reflects the EU’s ongoing effort to keep its occurrence reporting architecture aligned with how the aviation ecosystem has actually changed. When the original 2015 regulation was written, uncrewed aircraft operations at meaningful scale and the U-space concept were not yet significant features of European airspace. Both have since expanded considerably, and the regulatory reporting structure had not kept pace with categories specific to that growth. By explicitly naming UAS and U-space occurrence types, the Commission is signaling that incidents involving drones are expected to be captured with the same rigor as incidents involving crewed aircraft, rather than treated as a separate, lower-priority reporting stream.
The inclusion of Part-IS occurrences in this same update is notable because it formally links information security incidents to the same mandatory reporting infrastructure used for safety occurrences more broadly. Part-IS, the EU’s information security management framework for aviation organizations, has been phasing in compliance deadlines across different categories of operators since 2025. Folding Part-IS occurrences into the general occurrence reporting regulation means organizations already building information security management systems under Part-IS now have a clearer regulatory expectation that qualifying cyber and information security events flow into the same reporting channel used for safety data, rather than sitting in a separate or informal process.
For aviation organizations operating in or into the EU, the practical implication is that occurrence reporting programs, and the systems and training that support them, need to be reviewed to ensure they capture the newly specified UAS, U-space, and Part-IS categories. Organizations that already have mature safety reporting cultures will likely find this a matter of expanding existing intake criteria rather than building new infrastructure from scratch, but those still maturing their Part-IS compliance may find this an added prompt to formalize how information security events get identified, classified, and escalated internally.
Takeaway: By folding drone operations, U-space occurrences, and information security incidents into the same mandatory reporting framework used for traditional safety events, EU regulators are treating these as core aviation safety concerns rather than niche or emerging issues, a signal that aviation organizations should expect this kind of integration to continue as digital and uncrewed systems become a larger share of the airspace.
Source: Unmanned Airspace - European Union updates incident mandatory reporting mechanism, extending drones and U-space coverage