C-DRONE GUIDE · 5 SEPTEMBER 2026
Flying a drone inside a port restricted area: ISPS security, clearance, access pass, price
It is the port mission that fails most often, and never for a technical reason: the remote pilot has the flight authorisation, the insurance and the operations manual — and is still stuck at the gatehouse because nobody applied for an access pass six weeks earlier. A terminal, a quay or a container yard is not merely airspace to be flown over: for the most part it is a restricted access zone under the French transport code, created by prefectural order pursuant to the ISPS Code and the EU regulation on ship and port facility security. Two regimes overlap, with no legal connection between them: one decides whether the drone may fly, the other decides whether the team may enter. Here is who authorises what, which administrative chain actually drives the intervention date, what the summer 2026 reform changes, and how a client builds a schedule that holds.
Published on 5 September 2026, reviewed on 11 September 2026 — regulations in force as of September 2026.
Two authorisations with no connection between them
A port site reads on two planes that must never be conflated. The first is aeronautical: it determines whether a drone may occupy the airspace above the quay. It depends on the operating category, the height, any nearby aerodrome — many major ports sit under a control zone, as detailed in our guide to drone missions inside an airport CTR — and on local restrictions possibly set by prefectural order. The second is a security regime, in the sense of security rather than safety: it determines who may physically enter the site, with what equipment, and when. An authorisation obtained on one of those planes produces strictly no effect on the other.
That second regime comes from the sea, not the air. After 2001 the International Maritime Organization inserted a chapter XI-2 into the SOLAS convention and adopted the ISPS Code (International Ship and Port Facility Security Code). The European Union made them binding through Regulation (EC) No 725/2004 of 31 March 2004 on enhancing ship and port facility security, published in the Official Journal of the European Union on 29 April 2004: Part A of the ISPS Code became mandatory, along with certain Part B provisions listed in its article 3(5). Directive 2005/65/EC of 26 October 2005 then extended that logic from the quay to the whole port. In French law the package is transposed into the fifth part of the transport code, book III, title III, chapter II, headed "Port security".
Three very concrete consequences follow for a client. First, the scheme works through security levels: level 1 covers minimum permanent measures, level 2 additional measures where risk is heightened, level 3 special measures where a threat is probable or imminent. A mission planned at level 1 may find itself, overnight and with no useful notice, in a port raised to level 2: screening rates change, escorting becomes compulsory, some slots disappear. Second, every port and every port facility has a security assessment and a security plan approved by the administration: those documents are not public, and it is their content — not any consultable general rule — that decides what is possible. Third, the administrative authority creates restricted access zones by order, within which security screening is carried out; entry requires a pass, and the spaces inside are kept under surveillance.
A study by Mohammad Danil Arifin published in 2024 in the International Journal of Marine Engineering Innovation and Research breaks the risk analysis required by the ISPS Code into three linked evaluations — threat, vulnerability, impact — applied facility by facility (see the study on Google Scholar). That structure explains why two neighbouring terminals in the same port answer the same access request differently: their assessments do not cover the same vulnerabilities.
Who authorises what: mapping the decision-makers
The first reflex that costs a month is to write "to the port". There is no single contact — there are at least four, and they do not hold the same powers.
- The departmental prefect — the State's representative — creates the restricted access zones by order, sets the specific access conditions and the screening rates applicable to each category of personnel, approves the security plans and issues individual security clearances. He does not issue badges.
- The port authority — for major seaports, a State public body: the Seine axis river-and-sea port (HAROPA PORT), the major seaports of Dunkirk, Nantes-Saint-Nazaire, La Rochelle, Bordeaux and Marseille, and the four overseas major ports of Guadeloupe, Martinique, French Guiana and Réunion — draws up the port security plan and appoints a port security officer. It manages access to the general port estate, not to a leased terminal.
- The port facility operator — since the 2008 port reform, cargo handling is carried out by private companies: the stevedore or industrial firm occupying the terminal is a separate legal entity from the port. It is that operator who issues the access pass, puts the access-control system and fencing in place, and briefs pass holders on the security rules applying inside the zone.
- The port facility security officer (PFSO) is the individual responsible for drawing up, implementing and maintaining the security plan for their facility. This is the operational entry point for any request. Several nearby facilities of similar characteristics within one port may, with the prefect's agreement, share a common lead security officer, a common assessment and a common plan.
To those four the order of 25 June 2026 on the territorial implementation of port security policy (Official Journal of 30 June 2026) added a departmental reference officer appointed by the prefect to supervise the application of measures and record breaches, plus a local port security committee issuing opinions on security plans and planned measures.
The operational rule that follows is simple: it is the client who approaches its port facility security officer, not the drone provider. An access pass is only issued to a person whose activity inside the zone is justified; that justification is the contract. A provider canvassing a major seaport alone gets, at best, a redirection to the relevant terminal operator, at worst no answer at all. The sequence that works: the client describes the mission to its PFSO, the PFSO states what the security plan allows and which documents to supply, the provider complies. Only then does the question of the aviation operating framework arise usefully, because it will depend on the slot and trajectory constraints imposed by security.
Security clearance and access pass: the real critical path
This is where the intervention date is decided. The transport code distinguishes two things that are routinely conflated, and that confusion is the leading cause of postponement:
- The security clearance is an individual administrative decision. It is issued by the departmental prefect following an administrative background check run by the police or gendarmerie, for five years, and is valid across the whole national territory. The check may be repeated at any time while the decision remains in force. This is the long step, and the only one no client can accelerate. Police, gendarmerie and customs officers are deemed to hold the clearance.
- The access pass is a badge issued by the port facility operator. A permanent pass presupposes a prior clearance: it is issued for the time needed to carry out the activity inside the zone, within the clearance's validity, and may not exceed five years. Where applicable it specifies the sectors of the zone its holder may enter — a "terminal" badge does not necessarily open the quay, still less a berth occupied by a ship. It is withdrawn as soon as one of the conditions for issuing it is no longer met, in particular at contract end.
For a one-off job — the case for the vast majority of drone missions — the operator may issue temporary passes, and a provisional pass valid for one renewable month to an applicant whose file is being processed. That is the realistic route for a campaign lasting a few days, provided the trade-offs are accepted: permanent escorting, reduced perimeter, imposed slots. One text to watch here: the order of 29 June 2026 cuts the number of possible renewals of a provisional pass from five to three with effect from 1 January 2027.
Two further items are typically discovered at the gatehouse. Vehicle access requires a vehicle pass displayed visibly, and is limited to justified operational needs: a van loaded with battery cases, markers and a ground station does not get in because its driver holds a personal badge. And personal access requires, at every entry, an identity document in addition to the pass: the badge alone is not enough. Wearing the pass visibly throughout the stay inside the zone is the constant rule.
This administrative cost is no French peculiarity. A study by Khalid Bichou published in 2004 in Maritime Economics & Logistics, one of the founding works on the subject, showed from the ISPS Code's very implementation that a port's compliance cost concentrates on organisational and procedural items rather than on equipment: compliance weighs on supply-chain flows and lead times far more than on the hardware bill (see the study on Google Scholar). For a drone mission the translation is direct: the most expensive item is not the flight hour, it is calendar time — and calendar time is booked, not bought.
Finally, an honest caveat: there is no single statutory lead time binding on all ports. Specific access conditions are set by the prefect, port by port, and detailed in each facility's security plan. Lead times quoted by one terminal do not apply to its neighbour. The only reliable approach is to have the applicable route and timescales confirmed in writing, at project start, by the security officer of the port facility concerned.
What the 2026 reform changes for a drone mission
The summer of 2026 saw French port security recast in a matter of weeks, driven by law no. 2025-532 of 13 June 2025 on countering drug trafficking, whose articles 54 and 64 were implemented by decree no. 2026-524 of 18 June 2026 on port security (Official Journal of 20 June 2026, in force from 1 July 2026). Four points bear directly on a company bringing a provider into a port.
- A new zone category. Alongside the historic restricted access zones, the decree frames controlled-access port zones. The practical consequence: a sector not classified as a restricted access zone can no longer be assumed freely enterable. The exact status of every sector crossed must now be asked about, including service roads and parking areas.
- Clarified vocabulary. The decree cleanly separates authorisation, approval and security clearance for individuals. An attachment headed "authorisation" in a file is therefore not a clearance, and approval — which concerns the people carrying out the security screening itself — serves a different purpose.
- Drones formally enter the security plan. The order of 29 June 2026 laying down various port security provisions (Official Journal of 2 July 2026) explicitly lists drones among the equipment and systems contributing to the surveillance of a port facility, alongside video surveillance systems, in article A. 5332-203 of the transport code. That is a change of status: the drone is no longer only the potential intruder the security plan must detect, it becomes a resource that plan may deploy — with the associated technical standards.
- Two deadlines to know. The same order gives operators four months from its entry into force to submit an updated security plan to the prefect, and two years to bring access passes into line with the new formats. In practice, a number of French ports are revising their access procedures right now: a route described by a contact in spring 2026 may no longer be the one applied in the autumn. The order of 8 July 2026 on security screening in ports and port facilities (Official Journal of 16 July 2026) also repealed the order of 4 June 2008 that had governed access and movement in restricted access zones for eighteen years. Any internal company documentation still citing that 2008 text needs revising.
This shift from drone-as-threat to drone-as-resource deserved documenting. A study by Michał Świeczkowski published in 2020 in the Rocznik Bezpieczeństwa Morskiego analysed precisely the technological response of port security to threats posed by unmanned aerial vehicles, stressing that port security arrangements had been designed for land and sea intrusions rather than airborne ones (see the study on Google Scholar). That is exactly the blind spot French rules began closing in 2026 — and it is also why an unannounced flight over a terminal triggers a security procedure, never a mild rebuke. On the defensive side, our guide to drone surveillance of a company site details what the law allows and forbids an operator wanting to use the tool itself.
Coactivity, slots and price: building a schedule that holds
Once access is settled, the most mundane and most dangerous part remains: a working terminal is one of the most hostile coactivity environments there is for a team on foot. Quay cranes travelling on rails, straddle carriers moving fast between rows, reach stackers, semi-trailers in constant rotation, and blind spots everywhere. The general principles — prevention plan, prior joint site inspection, a site-side safety lead — are those described in our guide to hosting a drone mission on an industrial site; the port context adds three specifics that must be settled before a date is fixed:
- The tempo is not yours, it is the ships' calls. A berth occupied by a container ship under commercial operations is not overflown: the slot is found between two calls, which sometimes means a few hours, at night or at the weekend. A landside works project is planned three weeks out; a quay slot is sometimes confirmed forty-eight hours out.
- Shutting down a zone has a price, and it is not in your quotation. Locking out a crane, closing a row or shutting a traffic lane costs the operator far more than the drone job itself. That is the argument that justifies the tool, and also why requests are tightly arbitrated. Our guide to port crane and gantry inspection by drone details what that kind of downtime represents.
- Escorting is the norm, not the exception. A team on a temporary or provisional pass moves accompanied by a representative of the entity that requested its intervention. That ties up one of the operator's people for the whole mission: build it into the client-side workload, and tell the provider, whose working tempo changes accordingly.
One last technical point, often forgotten: the equipment carried can itself be a security matter. A thermal camera, a high-resolution sensor or a video transmission station fall within lists of items whose introduction is checked at screening. The question to put to the PFSO is not only "can we come in?" but "with what, and what may we record?": some facilities restrict shooting directions or require a media review before the footage leaves the zone. That belongs in the contract, alongside the deliverables.
2026 orders of magnitude (excl. VAT). These are indicative: the price of a port mission depends mainly on its execution window and its administrative build-up, not on its technical content, which is comparable to a standard industrial job.
| Item | Order of magnitude (excl. VAT, 2026) |
|---|---|
| The flight itself — structure inspection or survey of a terminal sector, half-day | €400 to €800; full day: €700 to €1,400 |
| Port structure inspection with report (quay, crane, terminal building) | €900 to €2,500 per structure, tapering across a series |
| Aviation-side administrative preparation (aerodrome protocol, local restrictions) | €80 to €200 for a simple declaration, €300 to €800 for a complex protocol |
| Building the security-zone access file (documents, exchanges with the PFSO, follow-up) | billed on time spent by most providers; to be framed explicitly in the quotation |
| Night or weekend premium to hold a slot between two ship calls | usual surcharge; get it priced before blocking the date |
| Waiting or postponement attributable to security (move to level 2, extended call) | a standby clause is needed: this is the real financial risk of such missions |
The line worth remembering is none of those in the table. On a restricted-access-zone mission, the budget is decided by the calendar: an intervention prepared three months ahead, with an already-cleared team and a file opened by the client, costs what an ordinary industrial mission costs. The same intervention decided a fortnight out costs either far more — escorting, night work, a constrained slot — or nothing at all, because it does not happen. To scope a campaign on a quay, a container yard or a port structure inspection, or for a terminal container inventory, request a quote stating the port, the terminal operator, the status of the zone concerned and how far the security clearances have progressed.
Frequently asked questions
Is my flight authorisation enough to work on a port terminal?
No, and this is the industry's costliest misunderstanding. The aviation authorisation (open-category declaration, specific-category operational authorisation, protocol with the aerodrome operator if the port sits under a CTR) answers one question only: may the drone occupy this airspace? It says nothing about the right to pass the fence. Ground access to a designated port facility falls under the French transport code's port security chapter: you need an access pass issued by the facility operator, itself conditional on a prefectural security clearance for permanent access. The two processes are independent, handled by different people and run on different timelines.
How much time should I allow between order and flight?
There is no single statutory lead time: the facility security plan and the conditions set by the prefect govern, and they vary from port to port. In practice the administrative background check preceding a security clearance is the long step, and the one no client can speed up. Two strategies exist: either the job is one-off and is built around a temporary or provisional pass with permanent escorting, or the company plans ahead and has a team cleared on a lasting basis. The right answer is settled at project kick-off, by asking the port facility security officer — not three weeks before the wanted date.
Does a port see a drone as a threat or as a tool?
Both, and that is exactly what makes the case delicate. A port security plan is built to detect and neutralise intrusions, including airborne ones: an unannounced aircraft over a terminal triggers a procedure, not a conversation. But since the order of 29 June 2026, drones are also explicitly listed among the equipment and systems contributing to the surveillance of a port facility, alongside video surveillance. An announced, logged flight built into the security plan raises no objection in principle; it is the undeclared flight that does.
Who should file the application: the drone provider or the client?
The client, in almost every case. The access pass is issued by the port facility operator to a person whose activity inside the zone is justified; that justification comes from the contract, hence from the client. An outside provider knocking alone on a major seaport's door, with no order backed by a terminal operator, rarely gets anything but a redirection. The arrangement that works: the client approaches its port facility security officer, that officer opens the file, and the provider supplies the requested documents in the expected formats.