A drone over an industrial site is not a gadget. In Malaysian airspace it is an aircraft, and flying one for commercial work without the right certification, permit, and insurance is not a grey area. It is illegal, and enforcement has moved from theory to practice.
The Regulator and the Rulebook
The Civil Aviation Authority of Malaysia, CAAM, is the sole regulator of drones in the country, operating under the Ministry of Transport. If a flight happens in Malaysian airspace, CAAM sets the terms, and its enforcement posture has hardened into what the industry now describes as a no permit, no fly stance. Inspectors coordinate with the police, and the days of quietly flying a commercial job under the radar are ending.
One point catches out operators arriving from elsewhere. Malaysia has no small-drone exemption. In many Western countries a sub-250-gram drone can be flown recreationally with little paperwork. Malaysia has no such carve-out. For commercial work, authorisation is required regardless of how small the aircraft is. A palm-sized inspection drone and a large survey platform sit under the same basic obligation to be authorised before they fly.
The legal foundation has historically been the Civil Aviation Regulations 2016, Part XVI. CAAM is in the middle of replacing that framework with a new, purpose-built, risk-based UAS regulation aligned with international ICAO standards. Because that transition is live through 2026, specific rule citations and processes are shifting. Everything in this article reflects the framework as it stands in 2026, and any operator should confirm the current requirement directly with CAAM before a job rather than assume last year’s process still applies.
The Three Things Every Commercial Flight Needs
Cutting through the acronyms, a legal commercial drone operation in Malaysia rests on three pillars: a certified pilot, an authorised flight, and a compliant aircraft. Miss any one and the operation is not legal, however good the drone or the pilot.
A certified pilot (RCoC-B): Every commercial remote pilot must hold a Remote Pilot Certificate of Competency (Basic), earned by passing CAAM theory and practical assessments. Flying commercially without it is illegal regardless of drone size or location.
An authorised flight (ATF): Each commercial operation needs an Authorisation to Fly permit from CAAM, applied for well ahead of the job with a flight plan, risk assessment, and supporting documents.
A compliant aircraft: The drone must carry SIRIM approval to meet local safety standards, use radio frequencies permitted by MCMC, and, where required, be registered with CAAM and display weatherproof CAAM-UAS registration marks.
The pilot certificate and the aircraft registration are separate things, and this trips people up. Registering the hardware does not license the person, and certifying the pilot does not authorise the machine. A legal operation needs both a certified pilot and, where the rules require it, a registered and compliant aircraft. Historically, registration applied to drones above 20 kilograms, which had to display marks in the CAAM-UAS format. That threshold is changing as CAAM expands mandatory registration under its new traffic-management system, so treating a sub-20-kilogram drone as automatically exempt from registration is no longer safe.
Registering the hardware does not license the person, and certifying the pilot does not authorise the machine. A legal operation needs both.
The 14-Day Rule That Governs Your Schedule
The Authorisation to Fly is the permit that most directly shapes how a commercial drone job is planned. As of 30 March 2026, a standard ATF application must reach CAAM at least 14 working days before the intended date of operation, a step up from the previous 10-day window. Late or incomplete applications are rejected outright.
For anyone commissioning inspection or survey work, that number belongs in the project schedule, not in a last-minute scramble. Fourteen working days is close to three calendar weeks once weekends and public holidays are counted, and complex jobs near controlled airspace take longer. An operator who promises to fly your site next week without an existing permit is either bending the rules or setting you up for a cancelled mobilisation. The permit itself is time-boxed too. It is issued for the specific operating dates in the application and is valid for a limited window, commonly up to three months, not as an open-ended licence to keep flying.
Where and How You Are Allowed to Fly
Standard, lower-risk operations come with firm boundaries. Flights are limited to a maximum altitude of around 400 feet, roughly 120 metres, above ground level. They must stay within visual line of sight of the pilot or a visual observer, and they must happen in daylight. Cross any of those lines, higher, out of sight, or after dark, and the operation moves into a higher-risk category that needs additional approval.
Airspace matters just as much as altitude. Operators must stay clear of airports and heliports, with CAAM requiring air traffic control clearance to fly within roughly five kilometres of one (guidance is commonly cited as 4.5 kilometres, so confirm the exact figure for your site). On top of that sit restricted zones, temporary no-fly areas declared for events or VIP movements, and region-specific rules. Operations in the high-security zones around Kuala Lumpur and Putrajaya need extra clearances from the police and government security office. In East Malaysia, flying in Sarawak requires additional authorisation from the state authorities. None of this is visible from the cockpit, which is why local knowledge is part of the job.
When the Job Is Higher-Risk
Much of the industrial inspection work drones are prized for sits at the demanding end of the framework, not the simple end. Inspecting a flare stack, surveying a long pipeline, or working close to tall structures can push an operation beyond standard limits, and CAAM treats those cases as needing extra scrutiny.
The Agencies Behind a Single Permit
A drone permit in Malaysia is rarely a conversation with one body. Aerial photography or mapping can require survey-and-mapping security clearance. Equipment approval runs through SIRIM, and the radio link runs through MCMC. Security zones bring in the police and the government security office. CAAM sits at the centre, but the paperwork can touch several desks.
CAAM: The lead regulator, issuing pilot certificates and flight authorisations.
SIRIM: Certifies that the drone meets local equipment safety standards.
MCMC: Regulates the radio frequencies the drone and controller use.
JUPEM (Survey & Mapping): Security clearance for aerial imaging and mapping.
Police and security offices: Additional clearances for high-security zones like Kuala Lumpur and Putrajaya.
CAAM is working to simplify this through the UAS Traffic Management System, a digital hub that links these agencies and is intended to replace much of the manual, form-by-email process with online registration, permitting, and airspace monitoring. As that system comes fully online, expect real-time digital tracking and remote identification to become standard expectations rather than optional extras. Its exact go-live status is worth checking directly with CAAM, since the rollout has been staged.
What This Means If You Are Hiring a Drone Operator
For an asset owner or project team, the tightening of these rules is quietly good news, because it makes vetting a contractor straightforward. A drone flying over your site without proper authorisation is not just the operator’s problem. If an incident happens on your premises during an unauthorised flight, the liability reaches the site owner and the client, not only the pilot.
The due-diligence questions are simple and any legitimate operator will answer them without hesitation. Ask to see the pilot’s RCoC-B certificate. Ask for the specific ATF permit covering your site and your dates, not a generic claim of being licensed. Ask for proof of public liability insurance, which is required for commercial operations. Ask whether the aircraft is SIRIM-approved and, where applicable, CAAM-registered. An operator who hesitates on any of these is telling you something important.
A drone flying over your site without proper authorisation is not just the operator’s problem. If an incident happens during an unauthorised flight, the liability reaches the site owner and the client.
The wider point is that the Malaysian drone industry is maturing, and the regulatory framework is drawing a clear line between operators who work inside it and those who do not. For serious industrial inspection, survey, and monitoring work, the compliant operators are the only ones worth engaging, because they are the only ones who will still be flying, and insurable, when enforcement catches up with everyone else.
Frequently Asked Questions
Does a small sub-250g drone need a permit in Malaysia?
For commercial use, yes. Malaysia does not have the sub-250-gram recreational exemption found in some Western countries. Commercial operations require a certified pilot and CAAM authorisation regardless of the drone’s weight, so even a very small inspection drone flown for paid work needs the proper certificate and permit.
What is the difference between registering a drone and certifying a pilot?
They are two separate requirements. Registration applies to the aircraft and, where required, means CAAM issues a registration number that must be marked on the drone. Certification applies to the person: every commercial remote pilot must hold an RCoC-B. You need both where the rules require them. Registering the hardware does not give you legal permission to fly it commercially.
How far in advance must I apply for an ATF permit?
As of 30 March 2026, a standard Authorisation to Fly application must be submitted to CAAM at least 14 working days before the intended operation, up from the previous 10-day requirement. Late or incomplete applications are rejected, and complex operations near controlled airspace can take longer, so build the lead time into your project schedule.
Is insurance mandatory for commercial drone work?
Public liability insurance is required for commercial operations and forms part of a complete ATF application. Beyond the legal requirement, it protects both the operator and the client if something goes wrong during a flight over a live site.
What should I check before hiring a drone contractor?
Ask for the pilot’s RCoC-B certificate, the specific ATF permit covering your site and dates, proof of public liability insurance, and confirmation that the aircraft is SIRIM-approved and registered where required. A reputable operator will provide all of these on request. Hesitation is a warning sign, and an unauthorised flight over your site can create liability for you as well as the operator.
Sources: CAAM, Unmanned Aircraft System (UAS) · CAAM, UAS for Aviation Professionals · CAAM Civil Aviation Directives 6011 (Agricultural and Special UAS Project) · Civil Aviation (Fees and Charges) Regulations 2016. Rules are in transition through 2026; verify current requirements with CAAM before operating.
