I built a system that can autonomously detect threats, dispatch drones, and triage alerts. Then I asked it the most basic compliance question: "Why did you make that call?" It couldn't answer. That's when I realized how unprepared most fleet software is for what's coming.
The FAA is about to publish the first permanent rules for flying drones beyond visual line of sight. No more one-off waivers. No more 6-month approval cycles. A standard path that any operator can follow.
Everyone is talking about hardware. Detect-and-avoid systems, Remote ID, lighting. That stuff matters, but it's the easier half of the problem.
The harder half is software. Documentation. Operational systems. That's where most operators will get stuck.
The fleet math that should worry you
A single drone on a single mission is reliable. Call it 95% success rate.
Now scale that to 20 drones running simultaneously. The probability that every mission succeeds: 0.95 raised to the 20th power.
Two out of three fleet operations will have at least one failure. Not because the hardware is bad. That's just how compound probability works at scale.
Part 108 forces you to answer a question most operators haven't thought about: when that failure happens, does your system catch it, adapt, document what happened, and notify the right person? Or does someone find out the next morning?
Three things the regulation demands that most drone software can't do
1. A living safety management system
Part 108 requires an SMS. Same safety framework commercial airlines use. Not a binder you file once and forget about, but a system that continuously captures hazards, near-misses, and anomalies. It has to produce documentation proving your mitigations actually work.
Your software needs to be logging structured safety data from day one. Operators who start now will have months of history by enforcement time. Operators who wait will be building their safety case from scratch under a deadline.
2. Auditable decision trails for every autonomous action
When a drone diverts from its route or aborts a mission, a regulator will ask why. "The software decided" isn't an answer. You need to show the sensor data that triggered it, the rule that applied, the action taken, the outcome, and who was notified.
I found this gap in my own system. The agent could detect a threat and reason about what to do, but when I tried to trace back exactly why it made a specific call, the answer was scattered across three different log files. That's not auditable. That's a liability.
Every autonomous decision needs a chain of evidence a non-technical auditor can follow from trigger to outcome.
3. Organizational context at decision time
Part 108 requires defined roles: an Operations Supervisor and a Flight Coordinator for every operation. Your software needs to know who holds these roles, who's on shift at 3 AM, and what happens if the primary contact doesn't respond.
This one surprised me. Most fleet platforms know everything about the drones and nothing about the people operating them. The system can dispatch a drone but has no idea who to call about what it found. That gap is bigger than it sounds.
What to do in the next 6 months
The final rule will probably include a compliance window. Use it.
Audit your decision documentation. Pick any autonomous action your system took last week. Can you reconstruct exactly why it happened from system records alone? If the answer is no, that's your first priority.
Start capturing structured operational data now. Every flight, every anomaly, every near-miss, every maintenance action. The format matters less than the habit. You can't build 6 months of safety history the week before an audit.
Map your people, not just your drones. Who is responsible for each site? Who is on-call? What happens if they don't respond? If this lives in someone's head or a spreadsheet, you're not ready.
Test your fleet at scale in simulation. If you've never run 10+ drones simultaneously and watched what breaks, do that before the regulation forces you to find out in production.
The competitive window
Part 108 turns commercial drones from a manual, permission-based industry into a scalable, autonomous one. The market will grow fast. It won't grow evenly.
Operators who already have safety systems running, decision trails logging, and organizational structures in place will get certified first. They'll land the enterprise contracts and set the standards everyone else has to meet. And the compliance history they build won't be something latecomers can catch up on quickly. You can't fast-forward 12 months of operational safety data.
The hardware is ready. The regulation is almost ready.
Are your operations?