ISO 21384 Certification in Saudi Arabia – UAS Requirements, GACA Compliance & Audit- Get certified with SCS

https://scscertification.com/contactus.php

Commercial drone operations in Saudi Arabia are moving well beyond photography and simple aerial surveys. Drones are now used for construction progress monitoring, infrastructure inspection, mapping, surveying, mining, energy projects, agriculture, logistics support and industrial asset inspections.

That expansion creates a practical management challenge. A company may have capable aircraft and experienced pilots, yet still lack a consistent system for planning flights, assessing operational risks, controlling equipment, managing incidents and demonstrating that its procedures are followed in practice.

This is where ISO 21384 certification in Saudi Arabia can add value.

ISO 21384-3:2026 is the current edition of the international standard covering operational procedures for commercial uncrewed aircraft systems (UAS). The 2026 edition was published in August 2026 and replaces the withdrawn 2023 edition. It applies to commercial UAS operations regardless of their size, application or location.

For Saudi organizations, however, ISO certification should not be confused with authorization to operate a drone. GACA requirements remain a separate regulatory matter. A well-prepared UAS operator therefore needs to look at both sides: the management and operational discipline expected by ISO 21384 and the aviation requirements applicable in Saudi Arabia.

What Is ISO 21384 Certification in Saudi Arabia?

ISO 21384 certification demonstrates that an organization's commercial UAS operations have been assessed against the applicable requirements of the ISO 21384 framework.

The emphasis is operational rather than simply technical. The question is not only whether a company owns suitable drones. It is whether the company has a controlled way of conducting commercial UAS activities.

For example, consider a construction company in Riyadh using drones to document work progress across several sites. A mature operating system would need to address matters such as who approves the flight, how the operating area is assessed, whether the aircraft is suitable for the task, who is competent to conduct the operation, how abnormal situations are handled and what happens to the information collected during the flight.

The exact controls required for certification depend on the organization's activities and certification scope. A survey company conducting routine VLOS work will not necessarily have the same operational profile as an energy contractor conducting complex inspections or a project organization using BVLOS operations.

That difference is important when preparing for an ISO 21384 audit.

ISO 21384-3:2026: What Has Changed for Saudi UAS Operators?

The current edition is ISO 21384-3:2026.

ISO describes the standard as covering safe commercial UAS operations, including the external safety-critical service providing the command and control (C2) link. The standard is applicable to commercial UAS regardless of size, application or location.

The 2026 edition is particularly relevant for organizations reviewing procedures that were developed against older versions of the standard. ISO's published lifecycle information confirms that ISO 21384-3:2023 has been withdrawn and replaced by ISO 21384-3:2026.

For a Saudi operator, this means an older procedure manual should not simply be carried forward without review.

A useful transition exercise is to compare the organization's existing operational procedures with the current edition, identify changes affecting the certification scope, update controlled documents and then test whether employees actually follow those revised procedures.

The objective should be operational consistency rather than producing a large collection of documents solely for an auditor.

ISO 21384 Certification and GACA Requirements Are Not the Same

One of the most important points for businesses searching for ISO 21384 certification in Saudi Arabia is the distinction between international certification and aviation regulation.

GACA regulates UAS operations in the Kingdom through its applicable regulatory framework. GACAR Part 107, for example, governs UAS operations in the Open and Specific Categories and addresses organizations and remote pilots involved in those operations.

The GACA framework can involve permits, approvals, operational conditions and other regulatory requirements depending on the category and nature of the operation.

ISO 21384 has a different purpose. It provides an operational framework for safe commercial UAS activities.

Therefore:

• ISO 21384 certification does not replace GACA authorization.

• GACA authorization does not automatically mean an organization is ISO 21384 certified.

• Drone registration is different from ISO certification.

• A permit to operate is different from certification to an ISO management or operational standard.

• Compliance with one requirement should not be presented as evidence of compliance with the other.

A company planning certification should therefore map its ISO requirements and GACA obligations separately and then identify where the two systems need to work together.

What Are the Main ISO 21384 Requirements for Saudi Companies?

The requirements applicable to a particular company depend on its UAS operation and certification scope. In practical terms, preparation normally requires a close look at how the organization plans, controls and reviews its commercial drone activities.

Operational planning

A UAS operation should be planned before the aircraft is launched.

The planning process may need to consider the purpose of the flight, operating area, environmental conditions, airspace considerations, aircraft limitations, personnel involved, communications and foreseeable operational risks.

For a company performing repeated construction surveys, this could mean having a standard planning process that is applied at every project rather than allowing individual pilots to decide everything independently.

Risk assessment

Risk should be considered in relation to the actual operation.

A drone inspection carried out over an isolated industrial area presents a different risk profile from a flight close to populated areas, infrastructure or other airspace users.

ISO 21384 preparation should therefore be connected to the organization's real operating scenarios. Generic risk registers that never influence flight planning provide little evidence of effective control.

Saudi operators should also consider the applicable GACA category, authorization conditions and operational restrictions when establishing their risk controls.

Personnel competence

The organization needs confidence that people involved in UAS activities are capable of performing their assigned responsibilities.

This can include pilots, observers, operational managers, maintenance personnel, data-processing personnel and others whose work can affect the operation.

Training records alone may not tell the whole story. Competence can also be demonstrated through evaluations, practical experience, authorization records, refresher training and evidence that personnel understand the company's operational procedures.

Aircraft and equipment control

Aircraft should be managed as operational assets rather than simply treated as purchased equipment.

A company may need records covering identification, configuration, maintenance, inspections, defects, batteries, software or firmware controls and other equipment-specific information relevant to its operation.

For an operator managing a fleet across multiple Saudi project locations, asset control becomes particularly important. The organization needs to know which aircraft are available, their condition and whether they are suitable for the planned task.

Emergency and abnormal situations

A UAS operation should not depend on everyone knowing instinctively what to do when something goes wrong.

Organizations should establish appropriate procedures for foreseeable emergency or abnormal situations. The nature of those procedures will depend on the operation.

Possible scenarios may include loss of command and control, unexpected weather, navigation problems, equipment malfunction, loss of communication, battery-related problems, an incident involving people or property, or an unauthorized change to the planned operation.

Procedures should be practical enough to use under pressure.

Incident and near-miss management

A mature UAS operation learns from more than actual accidents.

Near misses, equipment failures, unexpected operational conditions and procedural deviations can reveal weaknesses before they develop into a serious event.

An ISO 21384 audit may therefore look beyond whether the organization has an incident form. It is more useful to demonstrate that incidents are reported, investigated appropriately, corrective actions are assigned and lessons are incorporated into operational controls.

Saudi Regulatory Considerations for UAS Operations

Companies seeking ISO 21384 certification in Saudi Arabia should review the aviation regulations that apply to their actual operations.

GACAR Part 107 provides the regulatory framework for UAS operations in Saudi Arabia and distinguishes between Open and Specific Categories. The Specific Category involves authorization and considers mitigation measures identified through operational risk assessment.

This can have a direct effect on an organization's operational procedures.

For example, an operator carrying out a complex inspection project should not design its ISO procedures in isolation from the regulatory conditions attached to the operation. Flight planning, authorization checks, personnel responsibilities and operational records may need to work together.

GACA requirements can change, and individual operations can have different regulatory conditions. Organizations should therefore use the current GACA requirements applicable to their operation rather than relying on an old internal checklist or information copied from another operator.

Drone Registration and ISO 21384 Certification

Drone registration and ISO 21384 certification should be treated as two separate activities.

Registration concerns the aircraft and the regulatory framework governing its use. ISO 21384 certification concerns the organization's commercial UAS operational system within the agreed certification scope.

A company can therefore need to address regulatory registration or authorization while separately preparing its management and operational controls for ISO certification.

Keeping these records separate makes audits easier and reduces the risk of treating a government approval as evidence of conformity to an international standard.

Data Protection When Drones Capture Images in Saudi Arabia

Drone operations often involve cameras, video, mapping systems or other sensors. That creates a second compliance question when people can be identified from the information collected.

Saudi Arabia's Personal Data Protection Law defines personal data broadly and expressly includes photographs and videos of individuals where the person can be identified.

This matters for commercial UAS operators.

A construction contractor may capture workers during a progress survey. A security-related inspection may capture people near an industrial facility. A mapping project may collect images of vehicles, buildings or other environments in which individuals can be identified.

The organization should therefore determine whether personal data is being processed and establish appropriate controls for collection, access, retention, use and disclosure.

PDPL compliance is not an ISO 21384 requirement in itself. It is a separate Saudi legal consideration that may intersect with the organization's UAS operations.

What Does an ISO 21384 Audit in Saudi Arabia Look At?

An ISO 21384 audit is not simply a document review.

Auditors may examine how the organization's procedures work in practice and whether employees can demonstrate that those procedures are being followed.

For example, an auditor may review a sample UAS operation and trace it through planning, authorization, personnel assignment, equipment checks, flight records, incident reporting and post-operation activities.

The strength of the system becomes clearer when records tell a consistent story.

A procedure may say that pre-flight checks are mandatory, but the organization should be able to show evidence that those checks are actually performed.

Similarly, a company may have a training procedure, but its competence records should support the people currently performing UAS-related tasks.

ISO 21384 Internal Audit Checklist for Saudi Companies

Before the certification audit, an internal audit can be used to identify gaps.

A practical internal review can examine questions such as:

• Are the organization's commercial UAS activities clearly defined?

• Does the certification scope accurately reflect actual operations?

• Are operational responsibilities assigned?

• Are pilots and other relevant personnel competent for their duties?

• Are aircraft and critical equipment controlled?

• Are operational risks assessed for relevant activities?

• Are flight planning procedures consistently applied?

• Are emergency and abnormal-operation procedures available and understood?

• Are incidents and near misses recorded and reviewed?

• Are corrective actions followed through to completion?

• Are required operational records retained?

• Are regulatory obligations identified and kept current?

• Are data protection considerations addressed where drone imagery involves identifiable individuals?

• Does management review operational performance and recurring issues?

The checklist should be adapted to the company's actual operation. A small aerial photography company and a large industrial inspection contractor should not be expected to maintain identical controls.

ISO 21384 Certification in Riyadh

Riyadh is an important market for commercial drone operations across construction, engineering, infrastructure, surveying, real estate, media and professional services.

For organizations operating multiple projects around Riyadh, consistency can become more difficult as teams and subcontractors increase.

An ISO 21384 system can provide a structured way to control operational procedures across projects.

A construction company, for example, may use drones for progress photography, quantity verification and site documentation. Instead of allowing every project team to develop its own approach, the organization can establish a common operational framework while allowing project-specific risk controls where necessary.

ISO 21384 Certification in Jeddah

Jeddah presents a different operating environment, with applications across construction, infrastructure, logistics, coastal development, surveying and commercial projects.

Companies using drones across multiple sites should consider how their operational procedures account for changing project conditions.

The certification scope should reflect what the organization actually does rather than what it hopes to do in the future.

This is especially relevant when a company moves from simple VLOS operations into more complex activities. Procedures, competence arrangements and regulatory controls may need to develop with the operation.

ISO 21384 Certification in Dammam and the Eastern Province

The Eastern Province has strong relevance for industrial, energy, oil and gas, petrochemical, logistics and infrastructure-related UAS applications.

In these environments, drone work can involve inspections of difficult-to-access assets or large industrial areas.

A company providing drone inspection services to industrial clients may therefore need a more structured approach to equipment control, operational planning, personnel competence, site coordination, emergency arrangements and information management.

For businesses in Dammam, Jubail and surrounding industrial areas, ISO 21384 certification can be particularly useful when clients want evidence that UAS operations are managed systematically rather than relying solely on individual pilot experience.

ISO 21384 Certification for NEOM and Large Development Projects

Large development projects can create a different operational challenge because UAS activities may involve several contractors, large geographical areas and changing site conditions.

An organization working on a major development project may need to coordinate its drone activities with project procedures, client requirements and applicable aviation controls.

ISO 21384 certification can support a standardized operational framework, but it should not be presented as automatic approval to operate within a particular development area.

Site-specific permissions, airspace restrictions, client requirements and GACA obligations remain separate matters.

Industries That Can Benefit From ISO 21384 Certification in Saudi Arabia

ISO 21384 can be relevant to a wide range of commercial UAS activities.

Construction and infrastructure

Drones are increasingly useful for progress monitoring, surveying, inspection and documentation.

The operational challenge is often consistency. When several pilots work across multiple projects, the company needs confidence that essential procedures are followed regardless of who is operating the aircraft.

Oil, gas and petrochemical operations

Industrial inspections can involve assets that are difficult, costly or hazardous to access manually.

UAS procedures need to fit the industrial environment, including site controls, operational planning, equipment condition and coordination with the client or facility.

Mining

Mining operations can cover large areas and may use drones for surveying, stockpile measurement, mapping and site monitoring.

The operating environment can be remote, which makes planning, communications, equipment reliability and emergency procedures particularly relevant.

Energy and utilities

UAS can support inspection and monitoring of infrastructure such as power facilities and other utility assets.

Organizations providing these services may use ISO 21384 to demonstrate a consistent operational approach to commercial clients.

Surveying, GIS and mapping

Surveying companies can use drones to collect aerial data for engineering, planning, mapping and development projects.

For these businesses, operational control and data-handling practices need to work together. A technically accurate survey is of limited value if the flight was poorly planned or the supporting records cannot demonstrate how the operation was controlled.

Logistics and transport

Commercial UAS applications in logistics are developing rapidly, although the regulatory and operational conditions can be more complex than conventional aerial photography.

Organizations considering advanced operations should assess the applicable GACA requirements before defining their operating model.

Agriculture

Agricultural drone activities can involve mapping, crop monitoring and other commercial applications.

The appropriate operational controls will depend on the aircraft, mission, environment and services being provided.

Media and commercial photography

Media companies and professional aerial photography businesses may have relatively straightforward UAS operations, but they still need controlled procedures when the activity is conducted commercially.

Where people are captured in images, Saudi data protection considerations may also become relevant.

Who Should Consider ISO 21384 Certification in Saudi Arabia?

The standard can be relevant to organizations that commercially operate UAS or provide commercial UAS-related services.

Typical examples include:

• Drone service companies

• UAS inspection companies

• Surveying and mapping organizations

• Construction companies using drones operationally

• Engineering and infrastructure companies

• Energy and utility contractors

• Mining organizations

• Industrial inspection providers

• Agricultural drone service providers

• Aerial photography and media companies

• Organizations developing structured UAS operations for large projects

The strongest business case usually exists where drone activities are repeated, operationally significant, subject to client scrutiny or carried out across multiple projects.

ISO 21384 and Saudi Tender Requirements

Certification can also become relevant during commercial procurement.

Some clients may ask suppliers to demonstrate formal management systems, operational controls, competence arrangements or recognized certifications as part of supplier qualification.

However, companies should avoid assuming that ISO 21384 certification automatically qualifies them for every Saudi tender.

Tender requirements are determined by the client, project and procurement process.

The sensible approach is to review the actual tender specification and then determine whether ISO 21384 certification supports one of the stated requirements.

How Much Does ISO 21384 Certification Cost in Saudi Arabia?

There is no single fixed price for ISO 21384 certification.

The cost can vary according to factors such as:

• Number and complexity of UAS operations

• Organization size

• Number of operational locations

• Number of personnel involved

• Certification scope

• Existing documentation and operational controls

• Audit duration

• Readiness of the organization

• Complexity of the UAS activities

A company with one operating location and a small commercial drone team may require a very different audit effort from an organization managing multiple projects and complex industrial UAS operations.

For that reason, a meaningful quotation should be based on the actual scope rather than a generic per-certificate price.

How Long Does ISO 21384 Certification Take?

The timeline depends on organizational readiness and certification scope.

A company that already has controlled UAS procedures, competent personnel, operational records and established internal audit practices may be able to prepare more efficiently than an organization building its system from the beginning.

A typical preparation sequence can include:

1. Defining the certification scope.

2. Reviewing existing UAS procedures.

3. Identifying gaps against the applicable ISO 21384 requirements.

4. Addressing operational and documentation gaps.

5. Implementing the revised procedures.

6. Conducting an internal audit.

7. Correcting identified nonconformities.

8. Completing the certification audit.

9. Closing applicable findings and completing the certification process.

The important point is that implementation should come before the audit. A manual written immediately before an audit is unlikely to demonstrate a mature operating system.

How to Prepare for ISO 21384 Certification in Saudi Arabia

Start with the operation rather than the paperwork.

Map the UAS activities your company actually performs. Identify who plans the flights, who approves them, who operates the aircraft, who maintains equipment, who reviews incidents and who is responsible for regulatory coordination.

Then examine several completed operations.

Look at the records. Were the risks considered? Was the correct aircraft used? Was the pilot competent for the task? Were required checks completed? Were operational deviations recorded? Was the information collected handled appropriately?

This exercise often reveals gaps that a document-only review misses.

The next step is to formalize the controls that need improvement, train relevant personnel and verify that the procedures work in real operations.

An internal audit should then be used as a final readiness check before the certification audit.

ISO 21384 Certification With SCS

SCS can support organizations seeking ISO 21384 certification in Saudi Arabia by helping them understand the certification scope, assess operational readiness and prepare the necessary system for audit.

The preparation should be tailored to the organization's UAS activities rather than built around a generic checklist.

For a Saudi construction company, the focus may be project-based operational control. For an industrial inspection provider, equipment, personnel and site coordination may receive greater attention. A surveying company may have different operational and information-management priorities.

A properly defined scope makes the certification process more useful because it reflects the activities the organization actually wants assessed.

Why ISO 21384 Can Strengthen a Saudi UAS Operation

The value of certification is not limited to having a certificate available for a tender or customer qualification exercise.

A well-implemented operational system can give management a clearer view of how UAS work is being performed across the business.

It can also help standardize procedures when new pilots join, when the company expands to another location or when multiple project teams use the same UAS fleet.

For customers, documented operational controls can provide additional confidence when they are outsourcing aerial inspection, mapping, surveying or monitoring work.

The result depends on implementation. A certificate supported by inactive procedures has considerably less practical value than a system that employees use as part of their normal work.

ISO 21384 Certification vs GACA Authorization in Saudi Arabia

The difference can be summarized simply:

ISO 21384 certification concerns conformity of applicable commercial UAS operational procedures with the ISO standard.

GACA authorization or permitting concerns the legal and regulatory conditions for conducting UAS operations in Saudi Arabia.

UAS registration concerns regulatory identification and registration requirements applicable to the aircraft and operation.

These are related, but they are not interchangeable.

A company preparing for commercial drone operations should therefore maintain a clear compliance map showing which requirement comes from ISO 21384, which comes from GACA and which comes from other Saudi legislation or contractual requirements.

Get ISO 21384 Certified in Saudi Arabia with SCS

If your organization operates commercial drones for construction, inspection, surveying, mapping, energy, mining, infrastructure, agriculture or other professional applications, the first step is to understand whether your current UAS operating system is ready for ISO 21384 certification.

SCS can help you assess the certification scope, identify operational gaps and prepare your organization for the certification process.

Get in touch with SCS to discuss your ISO 21384 certification requirements in Saudi Arabia.

https://scscertification.com/contactus.php