What is a drone COA? Certificates of Authorization explained

A drone COA is a Certificate of Waiver or Authorization, an approval the FAA issues to qualifying public agencies so they can operate drones as public aircraft under conditions tailored to their missions. It is not a pilot license and it is not something a private company can hold for general use; it is an agency-level authorization that police, fire, emergency management, and similar public bodies use to fly in ways ordinary rules would not allow. Understanding what a drone COA is starts with understanding who it is for and what it permits.

This article covers what a COA authorizes, who qualifies for one, how it compares to flying under Part 107, and what holding one asks of an agency in return. The short version is that a COA trades more paperwork and reporting for more operational freedom, and it exists for public operators rather than commercial ones, a distinction that decides which path even applies to you.

What a COA authorizes

A COA authorizes what the FAA calls Public Aircraft Operations, a category defined in federal statute for aircraft operated by a government entity for a governmental function. Rather than a fixed set of privileges, a COA describes a particular agency, the operations it is authorized to conduct, the areas it may fly in, and the conditions that apply. The FAA is, in effect, telling that agency it may operate drones for these purposes, in these places, under these terms.

That structure is what gives a COA its flexibility. An agency can be authorized for routine access to controlled airspace, for emergency provisions that would otherwise require a separate request, and for operations tailored to its mission. A COA also lets a qualifying agency self-certify its own pilots, meaning the individual operators need not each hold a separate FAA pilot certificate, though many agencies choose to have them anyway. Some agencies also hold emergency provisions that let them stand up a flight quickly when a life is at risk, an authority that would be impractical to request one operation at a time as the emergency itself unfolds.

Who qualifies for one

COAs are for public operators, not commercial ones, and that line is firm. Qualifying bodies are government agencies conducting governmental functions: police departments, fire services, emergency medical and emergency management agencies, public universities, and similar public entities. The operation has to be a genuine public aircraft operation, which is why the FAA is careful that agencies do not run commercial-style missions under a COA's lighter constraints.

A private company or an individual cannot obtain a general-use COA. For commercial drone work, the path is Part 107, with waivers for operations that go beyond its standard limits. This is the distinction that decides which route even applies: if you are a business flying for hire, the COA question is not yours to answer, and Part 107 is the framework you build on.

How a COA compares to Part 107

The two paths solve different problems. Part 107 certifies an individual remote pilot and lets that pilot fly small drones within a standard set of limits, with waivers available for specific deviations. It is generally the faster way to start, because a pilot can earn the certificate by passing a test rather than waiting on an agency application. A COA authorizes an agency and opens operations, such as routine controlled-airspace access and emergency provisions, that Part 107 would require separate waivers to reach. In other words, Part 107 is built around a certified pilot and a fixed rulebook, while a COA is built around a qualified agency and a negotiated set of terms.

A public agency can hold both, and many do, but it cannot operate as both at the same time for a given flight. The FAA's guidance on holding both a Part 107 certificate and a COA confirms that the two carry different requirements and are used for different operations. The trade is straightforward: Part 107 is quicker and lighter, a COA is more flexible and more demanding, and an agency often uses Part 107 to begin flying while its COA application works through review.

What holding a COA asks in return

The freedom a COA grants comes with an ongoing burden. Agencies operating under a COA typically owe the FAA regular reporting on their operations, often monthly, and every flight has to stay inside the terms the COA describes. A COA also does not, on its own, waive Title 14 regulations or any state or local law, so an agency remains responsible for resolving conflicts with rules outside the authorization itself. Airspace approval is not the same as permission from a property owner or relief from a local ordinance, and an agency has to secure those separately where they apply.

That makes recordkeeping central rather than incidental. An agency has to be able to show that a given operation stayed within its authorized area and conditions, which pilot flew it, and which aircraft carried it out, and to assemble the reporting the COA requires without reconstructing it from memory. When each operation is tied to the authorization it flew under as it happens, the monthly report is a readout rather than a research project, and an agency can demonstrate that its flying stayed inside the authorization that covers it.

Common mistakes in drone COA compliance

Assuming a private company can get a COA. A general-use COA is for public agencies conducting governmental functions. A business flying for hire uses Part 107 and its waivers, not a COA.

Reading a COA as a blanket license. A COA authorizes specific operations in defined areas under set conditions. Flying outside those terms is unauthorized, no matter what the COA allows elsewhere.

Believing a COA waives all other law. A COA does not by itself set aside Title 14 regulations or state and local rules. An agency still has to resolve conflicts with laws outside the authorization.

Underestimating the reporting burden. COAs typically carry ongoing reporting obligations to the FAA. An agency that treats the approval as a one-time event falls behind on the duties that keep it valid.

Letting operations drift from the authorization. The value of a COA depends on staying inside its terms. Without a record tying each flight to its authorization, an agency cannot easily show it did.

FAQ

Do individual pilots need a Part 107 certificate if their agency has a COA?

Not necessarily. A qualifying agency can self-certify its pilots under a COA, so operators need not each hold a Part 107 certificate. Many agencies still have their pilots earn one, because it signals training and eases operations that cross into Part 107.

Can an agency hold both a COA and Part 107 at once?

Yes. An agency can hold both, but it cannot operate as both simultaneously for a given flight, because the two carry different requirements. A common approach is to fly under Part 107 while a COA application is still in review.

How long does a COA take to get compared to Part 107?

A Part 107 certificate can be earned by passing a test, so it is generally fast. A COA involves an agency application and review that can take considerably longer, which is why agencies often start under Part 107 first.

Does a COA let an agency ignore state and local drone laws?

No. A COA authorizes operations with the FAA but does not waive Title 14 regulations or state and local law. An agency remains responsible for complying with rules outside the authorization and for resolving any conflicts with them.

Closing thought

A drone COA is best understood as a public-agency authorization that trades added paperwork and reporting for operational freedom that Part 107 alone does not provide. It is not a license a business can hold, it is specific to the operations it names, and it leaves other law in force. For the agencies it fits, the payoff is real, and so is the duty to stay inside its terms and report on them.

If your agency operates under a COA and has to keep its flying inside the authorization, FlybyOps was built for the operational record problem at the center of regulated drone work. A project and job hierarchy with map-based scoping, a pilot registry with certification and currency tracking, a document vault that tracks authorizations and their expirations, and an append-only audit log are all part of how the platform keeps a public agency's operations inside the authorization that covers them.