Drone Delivery, BVLOS Operations, Privacy, Liability and Insurance
Introduction
A parcel ordered through an e-commerce platform and delivered a few hours later not by a courier but by an autonomous drone is no longer merely a science-fiction scenario. Unmanned aircraft can potentially transport pharmaceuticals, medical samples, emergency supplies and small consumer parcels while creating an entirely new logistics infrastructure alongside conventional road transportation.
For Türkiye, a particularly important development occurred with the publication of the new Unmanned Aircraft Systems Instruction — SHT-İHA — on 30 July 2026. The new framework expressly addresses cargo operations, BVLOS flights, autonomous operations, UAS corridors, remote identification and digital unmanned-aircraft traffic management. Commercial drone delivery is therefore no longer merely an unregulated future possibility; Türkiye has begun establishing a specific regulatory architecture for it.
The scope of SHT-İHA is exceptionally broad. It covers the import, sale, licensing, registration, airworthiness and operation of UAS, together with software certification, control systems, pilot qualifications, commercial operations, safety and air traffic services. Significantly, the Instruction expressly identifies Law No. 6698 on Personal Data Protection, Law No. 5809 on Electronic Communications and Law No. 7223 on Product Safety and Technical Regulations among its legal foundations.
Is Commercial Drone Delivery Legally Possible in Türkiye?
In principle, yes, but the regulatory system does not allow an ordinary commercial operator simply to purchase drones and commence unrestricted urban parcel delivery.
The 2026 framework introduces P0, P1 and P2 pilot levels. P0 is principally intended for non-commercial operations, while P1 covers commercial operations conducted within visual line of sight. P2 represents the most extensive operational level.
Most importantly for logistics businesses, P2 expressly covers BVLOS operations, autonomous operations and cargo/transport activities, together with other high-risk operations such as flights over crowds, passenger carriage and dangerous-goods transport.
A large-scale urban drone-delivery network should therefore be regarded not merely as an ordinary commercial drone operation but as a sophisticated P2 aviation operation.
Furthermore, a P2 licence by itself is not sufficient. P2 operations must be carried out within an appropriately authorised ultralight aircraft operator or general aviation operator, depending on the characteristics and weight of the aircraft. The operator must satisfy the applicable business and licensing requirements through the KDM-ERP system.
The drone-delivery company of the future may consequently resemble a hybrid of an aviation undertaking, logistics company and technology operator.
BVLOS: The Key to Economically Viable Drone Delivery
The economic feasibility of commercial drone delivery depends heavily on Beyond Visual Line of Sight — BVLOS — operations.
If every drone must continuously remain within the direct visual line of sight of an individual pilot, the system cannot realistically scale to thousands of daily deliveries. Mass delivery requires remote supervision, networked aircraft and operations extending considerably beyond the visual range of the pilot.
The new SHT-İHA directly addresses this challenge. BVLOS operations fall within P2, and Türkiye has introduced a specific concept of UAS corridors for long-distance, BVLOS and autonomous operations. SHGM may establish structured airspace corridors in coordination with relevant public bodies. The horizontal and vertical boundaries, entry and exit points, permitted directions, capacities and separation criteria for such corridors are to be digitally published through İHATTYS.
This could eventually allow logistics structures built around warehouses, dedicated drone corridors, neighbourhood distribution points and final-delivery locations.
Nevertheless, access to a UAS corridor does not constitute an unrestricted right to operate. Flights within such corridors are classified as P2 operations and require the relevant operational authorisation.
Autonomous Delivery Operations
The next technological stage involves drones capable of carrying out delivery missions with limited or no real-time intervention by a human pilot.
SHT-İHA expressly recognises autonomous operations. Such flights may be performed only under P2 and with operational authorisation from SHGM. Operators must document the mission profile, emergency scenarios and the circumstances under which human intervention will become available in their operations manual.
The Instruction goes even further by expressly addressing AI-supported autonomous systems. SHGM is expected to regulate the detailed use of such systems through a separate instruction. Until that specific regulatory framework is enacted, AI-supported operations may take place only under controlled authorisation, subject to P2 licensing, geofencing and registration requirements. Long-range BVLOS autonomous operations must use the UAS-corridor system.
This provision is particularly important for any future Amazon-style fully automated delivery network.
İHATTYS and Digital UAS Traffic Management
A city in which thousands of drones transport parcels cannot rely solely on conventional pilot-to-controller aviation practices.
The new framework therefore establishes İHATTYS — the Unmanned Aircraft Tracking and Traffic Management System. It is intended to provide central monitoring of registered UAS, manage flight permissions, publish restricted airspace information, detect potential traffic conflicts and manage UAS corridors.
P2 operators must notify İHATTYS before each flight of their intended route or operational coordinates, altitude, departure time and estimated completion time. They must also comply with conflict warnings and any cancellation or route-modification instructions issued through the system.
Drone traffic management will therefore increasingly become a digital and algorithmically coordinated airspace system, rather than one based exclusively on individual pilot decisions.
Remote ID, Geofencing and Remote Termination of Flights
Commercial delivery creates an obvious enforcement problem: authorities must be able to identify which operator owns and controls an aircraft flying above a city.
The 2026 framework therefore requires registered unmanned aircraft, subject to specified exceptions, to have a remote identification system. Geofencing is also intended to prevent aircraft from leaving their authorised operational envelope.
The regulatory framework goes further by requiring integrated software capable of responding to instructions delivered through İHATTYS, including narrowing the flight envelope, changing routes, landing and terminating the flight. Software certification also becomes part of the UAS compliance regime.
Modern drone regulation is therefore becoming as much about software certification, cybersecurity and digital traffic infrastructure as it is about traditional pilot licensing.
Privacy, Cameras and the Turkish Data Protection Law
One of the most significant legal issues associated with drone delivery concerns privacy.
Navigation systems may use cameras, lidar, thermal sensors or AI-based image-recognition technologies. While travelling to a delivery location, a drone may capture identifiable individuals, vehicle registration numbers, gardens, balconies or apartment entrances.
The argument that a camera is used solely for navigation does not automatically exclude Turkish data-protection rules. The Turkish Personal Data Protection Authority treats identifiable camera recordings as personal-data processing and requires an appropriate legal basis, proportionality and compliance with data-processing principles.
This issue is particularly significant because SHT-İHA itself expressly relies on Law No. 6698 and permits UAS geographical restrictions to be established for privacy-related reasons.
Commercial operators should therefore adopt a privacy-by-design approach. Navigation systems should avoid unnecessary storage of identifiable images, retain data only for justified periods, restrict access and provide the necessary information to data subjects where legally required. The Turkish Personal Data Protection Authority has similarly emphasised proportionality, limited retention, access controls and transparency in camera-processing activities.
Depending on the circumstances, particularly intrusive recording may also raise criminal-law issues relating to the violation of private life under Article 134 of the Turkish Criminal Code. SHGM itself separately reminds drone owners and pilots to respect privacy and private life.
Who Is Liable if a Delivery Drone Falls on a Person?
This question illustrates one of the most complicated features of future drone litigation.
Suppose a 15-kilogram delivery drone loses control and injures a pedestrian. The cause may be pilot error, inadequate maintenance, defective aircraft design, a battery failure, defective autonomous software or the failure of the communication link.
Consequently, liability may potentially involve several different actors.
Under the new SHT-İHA, the remote pilot is responsible for safe operation and the safety of other aircraft and persons on the ground. For P2 operations, the authorised operator also bears regulatory responsibility for ensuring that operations comply with the Instruction, the operations manual and relevant aviation rules.
In parallel, the general tort principles of Article 49 of the Turkish Code of Obligations may apply where unlawful and culpable conduct causes bodily injury or property damage.
Where the accident results from defective hardware or software, product-safety and product-liability considerations may become relevant. The 2026 UAS framework itself connects market surveillance and product conformity with Law No. 7223 on Product Safety and Technical Regulations.
Drone accidents may therefore generate litigation involving the operator, pilot, manufacturer, software provider, maintenance provider and other technical actors within the same factual chain.
Insurance
Insurance is another fundamental component of commercial drone delivery.
SHGM explains that the Regulation on Third-Party Liability Insurance for Civil Aircraft applies to unmanned aircraft and governs insurance against damage caused to third parties.
Such insurance is particularly relevant where a drone injures a pedestrian, damages a vehicle or building, or causes another form of ground damage.
A professional delivery network may, however, require a much broader insurance structure. In addition to third-party aviation liability, operators may consider hull insurance for the aircraft itself, cargo insurance for transported goods, cyber insurance for hacking and systems failures and product-liability insurance for manufacturers or software providers.
The emergence of fleets consisting of hundreds or thousands of connected drones may also create a new type of systemic aviation risk: a single defective software update or cyberattack could simultaneously affect an entire fleet. Insurance markets may therefore increasingly need to treat autonomous drone fleets differently from isolated aircraft.
What Happens if the Parcel Is Lost?
Damage caused by the drone to a third party and loss of the parcel carried by the drone are legally distinct issues.
Where a drone falls onto a pedestrian, third-party liability is at issue. Where a valuable smartphone disappears during delivery, the dispute primarily concerns the contractual carriage relationship.
The Turkish Civil Aviation Act contains provisions governing carriage of cargo by air, including rules on the air waybill under Article 110.
Modern delivery structures may nevertheless involve several different companies: an e-commerce marketplace, a logistics provider and an authorised drone operator. Contracts should therefore determine who qualifies as the carrier, when custody of the parcel begins and ends, when delivery is legally completed and who bears the risk if the drone delivers the package to the wrong location.
These questions may become particularly important where a drone deposits a package into a smart locker, on a rooftop or at another automated delivery point without direct human handover.
Dangerous Goods
Some of the most socially valuable drone-delivery applications involve healthcare, including medicines, blood products and laboratory samples.
However, certain cargo may also constitute dangerous goods. Lithium batteries, chemicals and biological materials can generate additional aviation-safety obligations.
The 2026 SHT-İHA expressly classifies dangerous-goods operations among high-risk P2 activities.
An ordinary consumer parcel and a drone carrying hazardous material should therefore not be expected to operate under identical regulatory conditions.
EU Influence on the Turkish Model
The 2026 SHT-İHA expressly states that the Turkish framework was prepared with reference to EU Implementing Regulation 2019/947, Delegated Regulation 2019/945 and ICAO Doc 10019.
Under the EU framework, higher-risk UAS activities outside the ordinary open category commonly fall within the “specific” category and require operational authorisation. BVLOS operations are therefore generally addressed through a risk-based authorisation structure.
Türkiye has not simply reproduced the EU model. Instead, the 2026 framework creates its own P0-P1-P2 licence structure, İHATTYS platform and dedicated UAS corridors. Nevertheless, Remote ID, geofencing, operational authorisation and digital traffic-management concepts demonstrate significant structural convergence with European UAS regulation.
The Future Regulatory Structure of Drone Delivery in Türkiye
The new SHT-İHA represents a major step, but large-scale urban drone delivery will likely require further regulatory development.
Dedicated delivery corridors, legally recognised landing and delivery sites, apartment and condominium landing zones, urban noise limits, centralised fleet operations, multi-drone command systems, algorithmic liability, cybersecurity standards, dangerous-goods procedures and specialised insurance products are likely to become increasingly important.
This is not merely speculation detached from the present legal framework. The 2026 Instruction already anticipates a separate regulatory regime for AI-supported autonomous systems, establishes İHATTYS as a central traffic-management architecture and introduces dedicated corridors for long-distance BVLOS operations. Those features strongly indicate the direction in which Türkiye’s UAS regulatory system is developing.
Conclusion
Commercial drone delivery in Türkiye is no longer operating in a complete legal vacuum. The 30 July 2026 SHT-İHA has created much of the initial regulatory architecture for professional drone cargo operations.
P2 licensing, BVLOS operations, autonomous flight, UAS corridors, İHATTYS, Remote ID, geofencing, software certification and authorised operator structures are likely to form the backbone of future commercial drone-delivery systems.
Yet compliance will extend far beyond aviation regulation. A commercial drone-delivery company will simultaneously need to consider data protection, privacy, product liability, carriage contracts, third-party liability, insurance, electronic communications, cybersecurity and consumer law.
Drone delivery should therefore not be regarded merely as traditional cargo transportation moved from the road into the air. It represents a new legal field at the intersection of aviation law, technology law, data-protection law and logistics law.
No Responses