06 The service, and who should run it
Status: DRAFT v1.1, 2026-08-19. v1.0 of this document assumed a UK company limited by guarantee. That is one option, not a decision. This version sets out what the service is, the properties any operating body must have, the realistic options for who runs it, and how we would choose. The principle that survives every option: the standard and the neutral infrastructure are kept separate from any reference implementation and its IP.
1. Purpose of the service
To build and maintain, for the UAS community, industry, general aviation and the regulator:
- The SigNet reporting standard: a typed schema for exposure, occurrence and periodic safety data in the CAA's own hazardous-event and barrier vocabulary, with evidence levels on every key claim.
- The assurance layer of an SMS as a hosted service: hazard library, standard SPI set, occurrence workflow, monthly aggregates, lessons bulletins.
- Neutral data brokerage: receive, anonymise at source, aggregate, and deliver worked signal to members and the regulator.
- Independent evidence custody: periodic signed chain-head deposits from member ledgers, so a member's evidence is verifiable against the service (ADR-0007, L5).
- In time, a conformance and certification scheme for platforms and components against the standard, run by a body that does not build them.
2. Properties any operating body must have
| Property | Why it matters | Test |
|---|---|---|
| Neutrality | Operators will feed infrastructure they have a governance stake in, not a competitor's platform; a body that certifies manufacturers cannot be one | No manufacturer, UTM vendor or operator controls it; conflicts declared and recused |
| Durability | A reporting standard is only useful if it outlives a grant cycle and a founder | Income not dependent on one funder; documented succession |
| Credibility with the regulator and ANSP | The CAA and NATS must be able to cite it and sit as observers without endorsing a company | Published governance, amendment process, audit |
| Data governance | Members must trust anonymisation and custody absolutely | Anonymisation at source, cell floors, published retention, member withdrawal right |
| Openness of the standard | The schema must be free to implement by anyone | Open licence on the schema; change process open to all members |
| Separation from implementation | The reference implementation and its IP must be able to live elsewhere | Arm's-length licence; the body owns the standard, not the code |
3. Options for who runs it
| Option | What it looks like | For | Against | Open questions |
|---|---|---|---|---|
| A. New UK not-for-profit (company limited by guarantee) | Purpose-built standards body; members are operators, manufacturers, GA, institutions as observers | Cleanest neutrality story; standard for standards bodies (the BSI PAS route fits); can be publicly funded; can pay staff | Has to be stood up from nothing; needs a board, members and income before it is credible; founder conflict must be designed out at incorporation | Who sits on the first board; whether a CIC is a better fit; timing relative to any IP filings |
| B. Hosted by an existing industry body (an association such as ARPAS-UK, or a sector working group) | The association owns the standard and contracts the service; we build and operate it under contract | Instant membership and credibility; no new entity; the association already talks to the CAA | Association priorities and capacity; the service may be one agenda item among many; commercial members of the association have interests | Whether the association would take ownership of a data service and its liabilities; how the build contract is let |
| C. Hosted by a public body (CAA, NATS, or a Future-of-Flight programme) | The regulator or ANSP runs the broker and custody; we contribute the standard and implementation | Maximum authority; solves the "who does the regulator trust" question by construction | Regulators are slow to adopt member-built tooling; a regulator-run broker changes the just-culture dynamic (operators report to oversight, not to a neutral intermediary); NATS is an ANSP, not a UAS SMS host | Whether the CAA's own data-request work (the forum action) wants an external seed at all; procurement route |
| D. Commercial entity with a neutrality charter | A company runs the service under published rules: open standard, independent advisory board, no manufacturer ownership, published pricing | Fastest to stand up; funded by members and services; one entity to deal with | Weakest neutrality story; a standard run by a company that also sells implementations is hard for rivals to feed; public funding mostly closed | Whether a charter and an independent board are enough for the CAA and NATS to sit as observers |
| E. Hybrid (most likely end state) | Standard owned by A or B; service operated under contract by a commercial entity (D) that also holds the reference implementation | Separates what must be neutral (the standard, custody, brokerage rules) from what can be commercial (build, run, support); the "Red Hat" pattern | Two entities to govern; licence and contracts must be arm's length and published | Which of A or B holds the standard; how the operator is selected and re-selected |
What is not on the table: a manufacturer, including any airframe work of our own, inside the body that certifies manufacturers; a closed schema; a service that assesses or approves members' safety.
4. How we would choose
- Talk to the regulator and ANSP first (the 9 July forum contacts, the UTM consultation): if the CAA wants an external seed corpus and a neutral broker, B or E becomes likely; if it intends to run the data request itself, C reshapes everything.
- Ask the industry body whether it would own the standard (B); the answer decides whether A is needed at all.
- Keep the implementation separable whatever happens (E is compatible with A, B and C).
- Decide the legal form last, with counsel, after 1 and 2, and after any IP filings (an assignment before filing damages chain of title).
Until then: the service runs as a demonstrator, invite-only, at no charge, with the governance obligations in 01 held by one named person and declared as such.
5. Governance we would want under any option
- Board or steering group with an independent chair; operator, GA, manufacturer and airworthiness/ANSP voices; the founder as an executive, not a controller.
- Safety committee of member representatives plus observers; reviews aggregates and lessons; recommends hazard-library and SPI changes.
- Standard amendment: proposals public; 30-day comment; safety committee recommendation; ratification; major versions need a member vote.
- Data governance: anonymisation at source; pseudonymous ids held by a custody officer only; raw records never leave the service; aggregates only above a cell-size floor; members may withdraw raw data; legal duties (AAIB, court) honoured and notified.
- Independence from any contractor (including partners who may build or host parts of the service), any manufacturer, and any UTM vendor; contracts tendered and published in summary.
- Founder conflict, under every option where the founder is paid by the body and owns the commercial entity supplying it: declared interests, remuneration set by a committee the founder does not sit on, inter-entity licence documented and arm's length, recusal.
6. Services, and their maturity
| Service | What it is | Today | First release |
|---|---|---|---|
| S1 Schema stewardship | Publish and version the reporting schema (reporting-v0); accept change requests; publish conformance tests | Draft v0, examples, validator | Public v0.1 with the CAA consultation response |
| S2 Hazard library | 02 Hazard library cloned per platform class, maintained from member occurrences | Seeded (28 rows) | v1 after first member review |
| S3 SPI service | Compute the standard SPIs from a member's ledger export or submitted records; return their values, the anonymised cohort distribution, and alerts | Defined (17 SPIs); computed by hand | Signet.SMS export + service endpoint |
| S4 Occurrence workflow | Open, classify (HE, phase, barrier story), link evidence, close; MOR reminder | Process written (05 Part A) | Web form + API on the schema |
| S5 Broker | Pseudonymous submitter ids, anonymisation at source, monthly aggregates to members and the regulator | Not built | Minimal: signed submissions to a mailbox + monthly published aggregate |
| S6 Custody | Members deposit signed ledger chain heads; service timestamps and countersigns; public verification | Not built (ADR-0007 L5 decided) | Simple append-only deposit log, published |
| S7 Conformance and certification | Test suites and audits against the standard; "SigNet-certified" mark | Not started | After the standard has a year of data behind it |
| S8 GA services | CAP 795-aligned light SMS template; exposure and occurrence reporting in the same schema; shared airspace picture (ADR-0009) where corridors meet GA | Not started | Template + schema only, then picture |
7. Membership
| Class | Who | Rights | Obligations |
|---|---|---|---|
| Operator member | UAS operators, any size | Full services; vote; safety committee seat (rotating) | Report on the schema; keep the member minimum (01 section 8); pay fee scaled to fleet |
| Manufacturer / integrator member | Airframe, FC, module, software suppliers | Schema input; conformance when available; vote on standard amendments only | Conformance fees; no seat on certification decisions about themselves |
| GA member | Clubs, schools, aerodromes, individual pilots | S8; reporting; committee seat | Report on the schema; nominal fee |
| Institutional observer | CAA, NATS, AAIB, insurers, academic | Read aggregates; advise; no vote | None |
| Founding member | Us | Same as operator member, plus the declared conflict handling in section 5 | First submitter from day one; seed data (section 6) |
8. The seed corpus: our simulated evidence
No member has flown yet. The standard still needs data to be shaped against, so we seed it with the v1 reference-implementation corpus (the v1 final evidence report): 313,298 simulated flights, 2,669,463 ledger events, over a London corridor model, 2026-07-23 to 07-26. Clearly labelled simulated, it is used for four things and nothing else:
- Exercise the schema end to end: emit
periodic_summaryandoccurrencerecords from the ledger, find the fields that are awkward or missing, fix the schema before a human ever fills it in. First worked record: the example record periodic_summary_v1_sim. - Propose baselines, not targets: divert 0.33%, emergency landing 0.26%, critical
forced descent 0.011%, gate denials 208 over 313k requests. Live targets are set
after the first 100 real member flights; the simulated values are the opening
hypothesis and are marked as such in every record (
simulated: true). - Show the regulator the output: what a month of the standard looks like, in their HE/barrier vocabulary, before asking them to define the data request. It is easier to correct a worked example than a blank schema.
- Find the weak evidence: the corpus shows which claims in the hazard library are L1 (self-reported SoC, firmware identity, human consent) and which are L4, so the integrity roadmap is argued from data rather than assertion.
What the simulated corpus is not used for: any claim about real-world safety, any SORA submission, any certification decision.
9. Funding (under any option)
| Stream | Role |
|---|---|
| Membership fees (operators scaled by fleet, manufacturers, GA nominal) | Durable core |
| Conformance and certification fees | Durable, once S7 exists |
| Public funding (Innovate UK, Future Flight, DfT, RIO, DASA where sovereign-infrastructure framing applies) | Build-out, never core running cost |
| Contracted services to an ANSP or the regulator (custody, aggregates) | Possible, must not compromise neutrality |
| Founder salary | Market rate from the operating body, set by a remuneration committee; any upside sits in a separate commercial entity |
10. What the service does not do
- Operate aircraft for hire.
- Sell or run a UTM, a USSP or a CIS. It is the evidence and assurance layer beside them.
- Certify its own products, or products of any body it shares directors with.
- Hold raw member data longer than its retention policy, or release it identifiably.
- Claim that data proves safety. It produces evidence for the bodies whose job it is to judge.
11. First twelve months
| Quarter | Milestone |
|---|---|
| Q3 2026 | Schema v0.1 public with the CAA consultation response; seed corpus run through it; float Part B with the BVLOS Ops Forum and NATS |
| Q4 2026 | Decide the operating option (section 4) with the regulator and industry body consulted; interim steering group; any IP filings beforehand; first two external operator members recruited; S5 minimal broker |
| Q1 2027 | Signet.SMS export live; S3 SPI service for members; first monthly aggregate; GA template |
| Q2 2027 | S6 custody live; first member review of hazard library; schema v1.0 |