BVLOS Drone Insurance Cyber Liability Endorsement UK

Why Standard Aviation Liability Wordings Leave a BVLOS Gap

Most aviation liability policies are written on wordings developed for manned aircraft, where the primary loss drivers are physical collision, bodily injury, and property damage. BVLOS drone operations introduce a materially different risk architecture: the pilot-in-command is geographically separated from the aircraft, command authority travels over a radio or cellular data link, and mission-critical decisions may be delegated to onboard autonomy software. Each of those dependencies is a potential cyber vector.

Standard aviation wordings typically contain a cyber exclusion drawn from the Lloyd's Market Association aviation cyber exclusion series—AVN38B is the long-established aviation war and allied perils clause that has historically addressed electronic interference, while more recent LMA wordings in the cyber exclusion series address broader cyber acts and cyber incidents. Whichever clause is in force, the practical effect is the same: loss, damage, liability, or expense arising from a cyber act or cyber incident is removed from cover. For a BVLOS operator whose aircraft loses positive control because of a spoofed GPS signal or a compromised ground-control-station feed, that exclusion can void the entire liability section at the moment it matters most.

The CAA's Specific Category framework, set out under UK Retained Regulation (EU) 2019/947, requires operators to hold third-party liability insurance commensurate with the operational risk. Under the Specific Category framework, that risk is characterised by the SORA Ground Risk Class and Air Risk Class outputs, which together determine the residual risk level and inform the liability limit requirements set in the Operational Authorisation. The framework does not prescribe cyber cover explicitly, but an insurer invoking a cyber exclusion after a data-link-induced loss event will argue the liability arose from a cyber incident—leaving the operator exposed and potentially in breach of their Operational Authorisation conditions.

What a Cyber Liability Endorsement for BVLOS Covers

A properly drafted cyber endorsement reinstates coverage that the base policy excludes and adds affirmative first-party and third-party cyber insuring agreements tailored to unmanned aircraft operations. The scope should be negotiated line by line against the operator's specific Operational Authorisation, payload type, and data-handling obligations.

Third-party liability extensions typically cover bodily injury or property damage caused by a cyber-induced loss of control event, including scenarios where a threat actor interferes with the command-and-control link, spoofs navigation data, or injects malicious instructions into the flight-management system. This is the coverage most directly relevant to CAA Specific Category compliance and to the liability limits derived from the operator's SORA Ground Risk Class and Air Risk Class.

First-party extensions address the operator's own losses: hull damage resulting from a cyber-triggered fly-away or crash, costs to restore corrupted mission software or ground-control-station configurations, and business interruption where a cyber incident grounds a fleet pending forensic investigation. For operators running persistent infrastructure inspection or corridor survey contracts, that business interruption exposure can be material.

• Reinstatement of the cyber exclusion on the base aviation liability wording
• Third-party liability for bodily injury and property damage arising from cyber-induced loss of control
• Hull damage cover where the proximate cause is a cyber act (spoofing, jamming-induced crash, malicious firmware)
• Data breach and privacy liability for payload data (thermal imagery, LiDAR point clouds, video) captured over third-party land
• Crisis management and forensic response costs following a confirmed cyber incident
• Business interruption cover for grounded fleet pending investigation or software remediation

Regulatory Triggers: CAA, UK GDPR, and NIS Regulations

Three distinct regulatory regimes can be triggered by a single BVLOS cyber incident in Great Britain. Understanding which applies—and in what sequence—determines both the operator's notification obligations and the insurer's coverage response.

The CAA requires operators holding a Specific Category Operational Authorisation to notify the regulator of occurrences that meet the threshold set in the UK occurrence reporting framework for aviation. A cyber-induced loss of control that results in an unplanned landing, a fly-away, or a near-miss with manned aviation is almost certainly a reportable occurrence. Failure to report can jeopardise the Operational Authorisation itself, and brokers should ensure the operator has a documented incident-response procedure that captures this obligation.

Where the drone payload captures personal data—faces, vehicle registrations, property interiors—UK GDPR applies. A breach of that data, whether through exfiltration during flight or compromise of post-mission storage, triggers a 72-hour notification obligation to the ICO. The cyber endorsement's data breach insuring agreement should respond to the legal defence and notification costs that follow. Separately, operators providing services to critical national infrastructure sectors may fall within the scope of the UK Network and Information Systems (NIS) Regulations 2018. Under those Regulations, the competent authority varies by sector—the Department for Science, Innovation and Technology (DSIT) holds cross-sector oversight responsibility, while sector-specific regulators such as Ofgem (energy) or the Environment Agency (water) act as competent authorities for operators in their respective sectors. Drone operators serving CNI clients should confirm with their legal advisers which competent authority applies to their specific service and what incident-reporting thresholds are in force.

Underwriting Factors That Shape Endorsement Terms

Underwriters assessing a BVLOS cyber endorsement submission look beyond the aircraft specification. The ground-control-station architecture, the command-and-control link technology (proprietary radio, LTE, satellite), the degree of onboard autonomy, and the operator's cyber hygiene practices all influence whether cover is offered and on what terms.

Several factors tend to drive endorsement premiums and deductibles upward: high hull values on complex inspection platforms, use of open-source autopilot firmware that has not been independently security-assessed, operations over or near critical national infrastructure, and BVLOS corridors where the command link relies on public cellular networks without additional encryption. Conversely, factors that support broader terms and lower deductibles include holding Cyber Essentials Plus certification, operating an encrypted command-and-control link with documented key-management procedures, and maintaining a written Cyber Security Management System that is reviewed at defined intervals. Operators who can demonstrate these controls at submission stage give underwriters the evidence needed to price the risk accurately rather than loading for uncertainty.

The SORA Ground Risk Class and Air Risk Class outputs from the operator's risk assessment are direct underwriting inputs: a higher combined residual risk level indicates greater potential severity of a cyber-induced loss event and will be reflected in the liability limit requirements and endorsement terms. Brokers should present the SORA outputs clearly in the submission rather than leaving underwriters to infer them from the Operational Authorisation document alone. For operators holding a bespoke Operational Authorisation, the CAA's Operational Safety Case is a key document that underwriters will want to review—it sets out the hazard analysis, risk mitigations, and residual risk acceptance that underpin the authorisation, and it provides the clearest picture of what a cyber failure mode could produce in operational terms.

Operators flying under a UK CAA Predefined Risk Assessment—such as UK-PDRA-01, which covers specific categories of lower-risk BVLOS operations in defined airspace conditions—will generally present a more standardised risk profile than bespoke OA holders. Underwriters are familiar with the UK-PDRA framework and can assess those submissions more efficiently, which typically translates to faster indicative terms.

Structuring the Placement: Broker Workflow

The endorsement can be placed in one of three ways: as an extension to the existing aviation hull and liability programme, as a standalone cyber policy with an aviation-operations carve-in, or as a blended product where the MGA underwrites both the aviation and cyber elements on a single policy document. The blended approach eliminates the coverage-gap arguments that arise when two separate insurers dispute whether a loss is primarily aviation or primarily cyber in nature.

Brokers should begin by auditing the base aviation wording for the precise cyber exclusion language in force. The Lloyd's aviation cyber exclusion series has evolved over time, and some older wordings—including those referencing AVN38B in its original form—address electronic warfare and interference but may not capture the full scope of modern cyber acts as defined in more recent market wordings. Once the exclusion is identified, the endorsement must be drafted to reinstate exactly what the exclusion removes, plus add the affirmative first-party insuring agreements the operator requires.

A complete submission to the BVLOS Insure facility should include the operator's current Operational Authorisation or PDRA reference, the SORA Ground Risk Class and Air Risk Class, the Operational Safety Case for bespoke OA holders, a summary of the command-and-control link architecture, the hull schedule with replacement values, and the completed cyber supplemental questionnaire. Where a submission is complete at first presentation, brokers can expect indicative terms to be returned within a small number of working days; incomplete submissions will extend that timeline. Brokers should confirm regulatory notification obligations with the operator before binding, so that the incident-response procedure is in place from day one of cover.

• Obtain and review the base aviation policy wording—identify the exact cyber exclusion clause reference
• Confirm whether the operator's Operational Authorisation imposes any specific insurance conditions
• Obtain the SORA Ground Risk Class and Air Risk Class outputs for the underwriting submission
• For bespoke OA holders, obtain the CAA Operational Safety Case document
• Complete the BVLOS Insure cyber supplemental questionnaire with the operator
• Agree endorsement structure: extension, standalone, or blended single-policy
• Confirm regulatory notification obligations with the operator before binding

Fleet and Multi-Site Operators: Additional Considerations

Operators running mixed fleets—combining Open Category aircraft with Specific Category BVLOS platforms—should ensure the cyber endorsement is scoped exclusively to the BVLOS operations. Blanket fleet endorsements that inadvertently extend cyber cover to Open Category flights can create aggregation issues and complicate claims handling.

Multi-site operators, particularly those providing services across Great Britain and into Northern Ireland or the Crown Dependencies, should note that the CAA's regulatory remit does not extend uniformly across all territories. Jersey, Guernsey, and the Isle of Man each have their own aviation authorities and may require separate insurance evidence. The cyber endorsement wording should specify the territorial scope precisely to avoid disputes about whether an incident at a non-GB site is covered.

Frequently asked questions

Does a standard CAA Specific Category liability policy already cover cyber-induced loss of control?

Not reliably. Most aviation liability policies incorporate a cyber exclusion drawn from the Lloyd's Market Association aviation cyber exclusion series—AVN38B and its successors in the LMA cyber wording series are the most commonly encountered. Whichever clause is in force, a BVLOS operation that suffers loss of positive control due to GPS spoofing, command-link compromise, or malicious firmware injection could trigger that exclusion, leaving the operator without third-party liability cover at the point of loss. A cyber liability endorsement affirmatively reinstates that cover and should be treated as a standard component of any Specific Category BVLOS programme.

Which operators are eligible for a BVLOS cyber liability endorsement through BVLOS Insure?

Eligibility is open to commercial drone operators holding a valid CAA Specific Category Operational Authorisation or operating under a recognised UK CAA Predefined Risk Assessment such as UK-PDRA-01. The endorsement is also available to operators in the process of obtaining authorisation where a conditional placement is required for the application. Operators must be able to provide their SORA Ground Risk Class and Air Risk Class outputs, a hull schedule, and details of their command-and-control link architecture. Bespoke OA holders should also provide their Operational Safety Case. Open Category operations are not eligible for this endorsement.

What information does a broker need to submit for a cyber endorsement quote?

A complete submission should include: the operator's current Operational Authorisation reference or PDRA designation; the SORA Ground Risk Class and Air Risk Class; the Operational Safety Case for bespoke OA holders; a description of the command-and-control link technology (proprietary radio, LTE, satellite, or hybrid); the hull schedule with replacement values for each BVLOS platform; the existing aviation policy wording so the cyber exclusion clause can be identified; and a completed cyber supplemental questionnaire covering network architecture, patch management, encryption practices, and any relevant security certifications such as Cyber Essentials Plus. Complete submissions at first presentation support the fastest possible turnaround on indicative terms.

Does the cyber endorsement respond to UK GDPR data breach obligations arising from payload data?

Yes, where the endorsement includes a data breach and privacy liability insuring agreement. BVLOS payloads—thermal cameras, optical sensors, LiDAR—frequently capture personal data as a by-product of the primary mission. If that data is exfiltrated during flight or compromised in post-mission storage, UK GDPR requires notification to the ICO within 72 hours of the operator becoming aware of the breach. The endorsement's data breach section should cover ICO notification costs, legal defence, and any regulatory investigation expenses. Brokers should confirm this insuring agreement is explicitly included and not subject to a separate sub-limit that would leave the operator underinsured.

What regulatory reporting obligations arise after a cyber incident on a BVLOS flight?

Potentially three. First, the CAA occurrence reporting framework may require notification if the cyber incident caused or contributed to an unplanned landing, fly-away, or proximity event with manned aviation—failure to report can jeopardise the Operational Authorisation. Second, if personal data captured by the payload was compromised, UK GDPR requires ICO notification within 72 hours. Third, operators providing services to sectors covered by the UK NIS Regulations 2018 may have additional incident-reporting duties to their competent authority—DSIT holds cross-sector oversight, with sector regulators such as Ofgem or the Environment Agency acting as competent authorities in their respective domains. The cyber endorsement should respond to the legal and notification costs arising from all three regimes, and brokers should ensure the operator understands their reporting obligations before a loss occurs.

Can the cyber endorsement be added mid-term to an existing BVLOS hull and liability programme?

Yes. Mid-term endorsements are available where the base policy is in force and the insurer agrees to the addition. The endorsement will typically attach from the date of binding and will not apply retrospectively to incidents that occurred before that date. Brokers should review the base policy's cyber exclusion clause before requesting the mid-term addition to confirm the endorsement language is drafted to reinstate exactly what the exclusion removes. Where the base policy is held with a different insurer, a standalone cyber policy with an aviation-operations carve-in may be the more practical route.