Short answer
There is no single EU licence for a commercial satellite or launch. Projects normally need national space authorisation and supervision, registration arrangements and launch approvals. Treaties allocate responsibility between states; licences, insurance, contracts and civil law allocate much of the operator's exposure.
Radio spectrum is a separate workstream. Satellite networks require International Telecommunication Union filing and coordination through a national administration, plus the applicable national authorisation or individual right of use under the EU electronic-communications framework. Neither a spectrum right nor an orbital filing replaces permission to launch or operate.
Drones are more harmonised. EU aviation law divides operations into the open, specific and certified categories, with requirements increasing with risk. Registration, pilot competence, remote identification, geographical zones and U-space services can apply.
Space-derived data can engage the GDPR, intellectual-property and database rights, contracts, cybersecurity rules, export controls and sanctions. Copernicus generally follows a free, full and open policy, but security and third-party restrictions remain possible. The proposed EU Space Act would harmonise parts of this landscape, but it remained an ongoing legislative proposal on 31 July 2026 and is not current licensing law.
Treat authorisation as a stack, not a single permit
A satellite project can involve the operator's home state, one or more launching states, the state responsible for the radio filing, and the ground-station state. A launch contract does not settle which state will register the object or accept international responsibility.
The compliance map should identify the spacecraft operator, mission control, launch provider and site, frequencies and ground stations, payload, orbit, re-entry plan and any dual-use function.
Satellites and launches remain anchored in national authorisation
Article VI of the makes states internationally responsible for national activities in outer space, including private activity. It also supplies the legal reason for national licensing systems:
“The activities of non-governmental entities in outer space … shall require authorization and continuing supervision by the appropriate State Party.” —
The treaty does not create a company application form. The relevant Member State implements it through national space law and licence conditions. Common requirements include capability, mission safety, debris mitigation, insurance, incident reporting, registration, transfer of control and continuing supervision. Details differ by state.
Articles VII and VIII separately address launching-state liability and jurisdiction or control over registered objects. The supports national and UN registration. Before signing a launch contract, the parties should determine which state or states may qualify as launching states, which registry will be used, and who must supply launch, orbit and status information.
Spectrum and orbital coordination form a parallel approval track
The ITU framework coordinates satellite network filings to prevent harmful interference. Operators work through a national administration; they do not obtain an orbital resource through a private filing. Coordination, notification and bringing into use require time and evidence.
Within the EU, , the European Electronic Communications Code, structures national general authorisations and individual spectrum rights. Where rights are limited, Article 55 requires objective, transparent, non-discriminatory and proportionate criteria and procedures. Conditions can address efficient use, interference, coverage, fees, transfer and international obligations. The supports EU harmonisation of technical conditions.
The practical rule is separation: an ITU filing does not authorise a ground station under national law; a national frequency right does not authorise a launch; and a space-operation licence does not guarantee interference-free spectrum. The project schedule should track all three.
EU programme rules govern Union systems, not every private mission
establishes the EU Space Programme and the EU Agency for the Space Programme. It governs Galileo, EGNOS, Copernicus, space situational awareness and GOVSATCOM, including procurement, asset ownership and security accreditation. The Security Accreditation Board must decide independently.
establishes the Union Secure Connectivity Programme, commonly associated with IRIS². Its secure governmental communications, infrastructure, procurement and security conditions matter to participating contractors and service providers. Neither regulation is a universal commercial-space licence: contractual participation in an EU programme and national authority to operate are distinct.
Drone permissions depend on operational risk
supplies the aviation-law basis. governs operations, while addresses unmanned-aircraft systems and third-country operators.
“UAS operations in the ‘open’ category shall not be subject to any prior operational authorisation.” —
The open category remains regulated. Prescriptive limits, registration, pilot competence, aircraft class, remote identification and geographical zones may still control the flight.
The specific category generally requires a risk-assessed operational authorisation, unless a standard-scenario declaration or another recognised route applies. A light UAS operator certificate can confer privileges. High-risk certified operations can require aircraft and operator certification and pilot licensing.
In designated U-space airspace, adds mandatory digital services such as network identification, geo-awareness, flight authorisation and traffic information. Privacy, security and conventional air-traffic obligations continue alongside them.
, in force since 27 July 2026, also amended Regulation 2018/1139 so that specified implementing rules for aviation AI safety components take the AI Act's high-risk requirements into account. This does not make every AI-enabled drone high-risk: the intended safety function, aviation product rules and applicable conformity route must be identified.
Liability has public-international and private-law layers
The imposes absolute launching-state liability for damage caused on the Earth's surface or to aircraft in flight. Damage elsewhere to another space object, or persons or property aboard it, is fault-based. Treaty claims operate between states and do not replace every private claim or national remedy.
Operators can also face licence indemnities and contract, product, tort, collision, debris or environmental claims. Contracts should allocate insurance, cross-waivers, registration support and incident evidence without assuming they alter treaty responsibility. Drone liability and insurance remain substantially national; verify local rules on injury, property, privacy and nuisance.
Space-derived data brings privacy, security and control rules
Earth-observation imagery is not automatically personal data, but the GDPR applies when data identifies or can reasonably be linked to a person. Location histories, identifiable vehicles, household activity and combined datasets can cross that threshold. Controllers then need a lawful basis, transparency, minimisation, retention controls, security and a valid route for international transfers.
In Österreichische Post, , the Court held that a GDPR infringement alone is insufficient for compensation under Article 82: damage and a causal link are also required. That is a general data-protection ruling, not a space-law exemption.
Commercial rights also depend on copyright, database rights, trade secrets and licences. Regulation 2021/696 generally makes Copernicus data freely and openly available, but permits conditions and justified security limitations; third-party inputs may have separate terms.
, NIS2, expressly includes the space sector within its entity-based cybersecurity framework and can also reach communications providers, subject to scope, size and national implementation. Security measures, incident reporting and supply-chain controls should be mapped by entity, not inferred merely from the asset being in orbit. The , EU sanctions and national security controls can restrict technical data, encryption, components, destinations and assistance.
The proposed EU Space Act is not yet binding law
The Commission's would create a more harmonised framework for the safety, resilience and environmental sustainability of space activities. The legislative procedure remained ongoing on the review date. Businesses can use the proposal for horizon scanning, but should not describe its proposed registration, authorisation or technical requirements as obligations already in force.
A workable compliance file
Maintain one matrix listing every entity, state, asset and service against space authorisation, launch approval, registration, ITU filing, spectrum and ground-station rights, export control, cybersecurity, data governance, insurance and contracts. Record the authority, dependency, evidence owner, renewal and incident trigger. For drones, add the category, zone, credentials, aircraft class, authorisation or declaration, and U-space records.
Conclusion
EU space and drone compliance is layered. National law governs satellite and launch permission; spectrum and orbital coordination run separately; programme rules govern Union systems; and drones use a harmonised risk-based framework. A project is ready only when those permissions and the applicable liability, security, export and data rules are reconciled.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.