The Transportation Security Administration has decided how it wants to hear from the drone industry on the security half of beyond-visual-line-of-sight operations: after the rule is already final, in rooms closed to the public, with every participant bound by a non-disclosure agreement.

That is the substance of a notice TSA published in the Federal Register on Sept. 4 (FR Doc. 2026-18124, 91 FR 56894-56895, Vol. 91 No. 171, RIN 1652-AA80). Signed Sept. 1 by Scott C. Gorton, TSA's acting assistant administrator for strategy, policy and engagement, the notice solicits representatives for what the agency calls "technical roundtables" on the security of unmanned aircraft systems operating beyond the visual line of sight. Requests to participate are due Oct. 19, 2026.

The roundtables are the implementation mechanism for TSA's companion to the FAA's Part 108, the long-awaited rule meant to normalize BVLOS flight. The FAA's portion has been under review at the White House Office of Information and Regulatory Affairs since July 10, 2026. TSA's portion, according to the notice, is still being finalized "in coordination with the FAA." Neither is out. Yet TSA is already booking the conversations that will shape its guidance on what compliance looks like.

What TSA Proposed, and What It Is Asking For Now

The security provisions trace back to the Aug. 7, 2025 joint TSA-FAA notice of proposed rulemaking, "Normalizing Unmanned Aircraft Systems Beyond Visual Line of Sight Operations" (90 FR 38212). TSA's share of that NPRM had two pieces: vetting of covered personnel, and a TSA-approved security program that certain Part 108 operators would be required to implement.

The Sept. 4 notice does not revisit either requirement. Instead, it looks past the final rule to the question of how operators will actually satisfy it. TSA says the roundtables will gather input on the organizational, structural, technological and physical security methods BVLOS operators already use today. The stated goal is to turn that input into "model language" and "model approaches" that operators can adopt to meet the security program requirements.

The agency is also signaling flexibility on one front. Per the notice, TSA "anticipates that some actions and procedures" operators currently follow under FAA waivers or exemptions "may adequately satisfy some of TSA's security program requirements." For companies that have spent years building security procedures to win BVLOS waivers, that is the closest thing to reassurance the notice offers: the work may count.

As Unmanned Airspace reported, the notice frames the intent plainly: "Wherever possible and appropriate, TSA intends for the individual inputs provided at the technical roundtables to inform model approaches that UAS BVLOS operators can use to meet security program requirements."

The Rules of the Room

What distinguishes this from an ordinary stakeholder listening session is the legal architecture around it. TSA is closing the roundtables to the public under 49 U.S.C. 114(r) and 44912(d), together with 49 CFR part 1520, the regulations governing Sensitive Security Information. The rationale is that the discussion will touch SSI and must be protected accordingly.

That choice sets the entry conditions. To take part, a person must:

  • Be validated as a representative of a BVLOS operator or an industry association;
  • Qualify as a "covered person" under 49 CFR 1520.7 and obtain TSA approval for SSI access;
  • Sign a non-disclosure agreement whose obligations continue after the events conclude; and
  • Fit within a cap of two participants per organization.

There is no public comment period attached to the notice. And the roundtables will not operate like a federal advisory committee that produces recommendations. In TSA's words, "These meetings will not seek consensus recommendations from participants." Each organization's input is treated as individual input, to be weighed by TSA on its own terms.

The format itself is still open. The notice says the sessions may be in-person with a virtual option, or virtual only. TSA also reserves the right to modify the registration period after the final rule publishes, which means the Oct. 19 deadline is a placeholder as much as a hard stop. Requests go to Kristine Adams at TSA, 6595 Springfield Center Drive, Springfield, VA 20598-6028, (571) 227-2062.

The Sequencing Problem

The most striking feature of the notice is its timing. The roundtables are explicitly scheduled to occur "following publication of the final rule." Operators are being asked to register now for meetings that cannot happen until a rule that does not yet exist becomes law.

Where that rule stands is a matter of public record only on the FAA side. According to DroneXL's reporting, the FAA's Part 108 final rule entered OIRA review on July 10, 2026. The last OIRA stakeholder meeting on the books is Sept. 16, and day 90 of the standard review clock falls on Oct. 8. TSA's companion rule, RIN 1652-AA80, was not separately listed on OIRA's pending-review list as of Sept. 4.

So the timeline the industry is looking at runs roughly like this: OIRA meetings on the FAA rule wrap up in mid-September; the standard review window closes in early October; roundtable requests are due Oct. 19; and at some point after the TSA rule publishes, the closed sessions convene to work out model compliance language. The order of operations is fixed: rule first, then the conversation about how to meet it.

Why It Matters

Part 108 has been the drone industry's most anticipated rulemaking for years, and the security program requirement is the part of it with the least public detail. The NPRM established that certain Part 108 operators would need a TSA-approved security program. It did not, and could not, tell operators what an approvable program looks like in practice. That detail is exactly what the roundtables are meant to produce, and it is being produced in a venue where the public cannot watch, participants cannot talk about what they heard, and no consensus product will emerge for the industry to rally around or contest.

For operators that get a seat, the calculus is straightforward: two people in the room is a chance to make sure the model language reflects how a real BVLOS operation actually secures its aircraft, ground stations and personnel, and a chance to argue that existing waiver-era procedures should carry over. TSA has already said it anticipates some of them may.

For everyone else, including operators that do not secure one of the limited seats, academics, and the press, the process is opaque by design. The SSI framework is a legitimate tool for protecting security-sensitive detail. It also means the substantive content of what TSA hears, and how it chooses to weigh individual inputs against each other, will not be visible outside the NDA perimeter.

The sequencing compounds this. Because the roundtables follow the final rule, whatever model approaches come out of them will be interpretations of text that is already binding. There is no public comment period on the notice itself, and the roundtables are not a rulemaking vehicle. The window in which the public could shape TSA's security requirements was the 2025 NPRM. What follows now is compliance guidance, developed privately.

Meanwhile, the FAA half of the package remains at OMB, with the standard 90-day review window running out in early October and no published rule. The industry is being asked to register for security discussions on a rule whose airspace and operational provisions are themselves not yet public. That is the state of BVLOS normalization in September 2026: one half of the rule stuck in review, the other half being finalized in coordination with it, and the security implementation details headed for rooms that operators must sign an NDA to enter.

What Operators Should Do Now

The practical takeaways from the notice are limited but concrete. Organizations that fly BVLOS under waivers or exemptions today, and industry associations that represent them, have until Oct. 19 to submit a request to participate, subject to TSA's ability to move that deadline once the rule publishes. Prospective participants should expect to be validated as representatives of a qualifying organization, cleared as covered persons under 49 CFR 1520.7, and asked to sign an NDA with obligations that outlast the meetings. Each organization gets at most two seats.

Operators should also take TSA at its word on the substance: the agency wants to hear about the organizational, structural, technological and physical security methods already in use, and it has said existing waiver-era procedures may satisfy some of its requirements. Documenting those procedures now, before the final rule and before the roundtables, is the most useful preparation the notice implies.

Sources