By default, Part 107 says no: you may not fly over a human being unless that person is directly participating in the operation (such as the remote pilot, a person manipulating the controls, a visual observer, or a crew member needed for the operation's safety), is located under a covered structure that can provide reasonable protection from a falling small unmanned aircraft, or is inside a stationary vehicle offering that same protection. Every other case must satisfy one of four operational categories set out in subpart D of Part 107 (the section of the federal aviation rules dedicated to flight over people). The FAA sorts these into four tiers: lighter, lower-risk aircraft qualify for the simpler categories, while heavier or higher-risk aircraft need more stringent approval before they can fly over anyone. Category 1 is the simplest: it covers any aircraft weighing 0.55 pounds or less on takeoff, including everything on board or attached, with no exposed rotating parts that would lacerate skin, such as unshielded propellers or rotors.

Categories 2 and 3 admit heavier aircraft that have been declared compliant — meaning the applicant has filed a record with the FAA stating the aircraft meets the Category 2 or Category 3 design and injury-severity requirements — through a declaration of compliance. The applicant is the person who designed, produced, or modified the aircraft — not necessarily the pilot flying it. Without an FAA-accepted declaration on file, the aircraft cannot legally fly over people in Category 2 or Category 3, no matter how qualified the pilot is. But an accepted declaration is necessary, not sufficient: the aircraft must also display a label identifying it as eligible for the declared category. Confirming that label before flight is the remote pilot's job, not the applicant's — the remote pilot in command (the person legally responsible for the flight) must verify the correct category label is present and legible before operating over people. If a Category 2 or Category 3 label is damaged, destroyed, or missing, the remote pilot in command must relabel the aircraft — legibly, prominently, permanently affixed, in English — before conducting any operation over people. Category 2 and 3 rely on the applicant's own declaration of compliance, whereas Category 4 requires the FAA itself to issue an airworthiness certificate under Part 21 — a mechanism the FAA controls directly rather than one the applicant declares. Once its eligibility, declaration, and label are in order, Category 2 permits flight over people everywhere except open-air assemblies; over an open-air assembly, sustained flight is permitted only if the Remote ID conditions of § 89.110 or § 89.115(a) are met. Category 3, by contrast, may never fly over an open-air assembly at all, with no exception. Elsewhere, Category 3 may pass over people only under one of two conditions: at a closed- or restricted-access site where everyone has been given notice a drone may fly overhead, or by never sustaining flight over anyone who isn't directly participating in the operation or already protected under a covered structure or stationary vehicle.

One restriction runs through the lighter categories too. Because the stakes are highest over dense outdoor gatherings, Categories 1, 2, and 4 still prohibit sustained flight over open-air assemblies unless the operation also meets the Remote ID conditions at § 89.110 or § 89.115(a) — the two Remote ID broadcast rules explained below under Remote ID in this section. Which one applies depends on your aircraft type, but both require continuous broadcast of your drone's location and identity throughout the flight. Part 107 doesn't itself define "open-air assembly"; the restriction is written to reach people gathered outdoors, and the FAA applies it to the facts of a given site rather than by a fixed threshold in the rule — the agency has pointed to dense gatherings such as concerts, sporting events, parades, or festivals as typical examples. Because the rule fixes no numerical threshold, treat any dense gathering of people outdoors as potentially covered and stay on the conservative side. Category 3, by contrast, forbids flying over an open-air assembly outright, with no Remote ID exception available. So a 0.55-pound aircraft with no exposed blades doesn't get a free pass over a crowd just because it clears the weight threshold — the gradient tracks one variable: how badly the aircraft could hurt the person under it, and dense outdoor gatherings raise those stakes for every category short of Category 3.

Separately, the aircraft itself must be on the books — and here new commercial pilots hit the single most common trap in the hobby-to-work transition. Recreational flying is governed by a separate federal law (49 U.S.C. 44809), which includes a small-drone registration exemption for aircraft at 0.55 pounds or less flown exclusively for recreational purposes — an exemption that does not apply to commercial flying. Part 48 — the FAA's aircraft registration rule — covers everything else, and it requires that any aircraft flown for commercial purposes be registered, whatever it weighs. Registration costs $5.00 per aircraft, expires after 3 years unless renewed, and the assigned unique identifier — usually the registration number, or the aircraft’s own serial number if authorized by the Administrator — must be legibly displayed on an external surface of the aircraft. The logic is accountability: registration lets an aircraft found somewhere it should not be trace back to an owner.

Since September 16, 2023, a drone flown under Part 107 must also identify itself in flight. Remote ID — a broadcast of the aircraft's identity and position — can be satisfied three ways. Most commercial pilots either fly a standard Remote ID aircraft — a model with built-in remote-identification equipment that broadcasts automatically from takeoff to shutdown (§ 89.110), with no visual-line-of-sight condition attached to that broadcast requirement — or add a broadcast module to an older aircraft, which under § 89.115(a) must stay within visual line of sight throughout the flight. Visual line of sight (VLOS) means being able to see the aircraft with your own eyes throughout the entire flight. The third option — flying inside an FRIA (FAA-recognized identification area), a specific geographic area the FAA has approved, without broadcast Remote ID equipment — only helps if an approved site happens to be near where you operate; the aircraft must still be registered, and you must keep it in sight throughout the flight. An FRIA is approved after a community-based organization or educational institution applied for it; inside its boundaries, standard Remote ID broadcast equipment isn't required, but you and the aircraft must stay within the FRIA's boundaries. If the broadcast fails in flight, you must land the aircraft as soon as practicable — as soon as you safely can. The requirement attaches to aircraft registered or required to be registered — which, under Part 107, is all of them.