INDUSTRY FACT FILE · DRONES, ROBOTICS & AUTONOMOUS SYSTEMS

Industry Overview: Drones, Robotics and Autonomous Systems in India

Who builds, flies and runs India's drones, robots and autonomous systems, the rules that apply, who buys cybersecurity in the sector and why each segment needs its own approach.

India has set out to become a global drone hub by 2030 and has rebuilt its rules to get there. The Ministry of Civil Aviation notified the Drone Rules 2021 on 25 August 2021, replacing a heavier regime with one based, in its own words, on trust, self-certification and non-intrusive monitoring: the number of forms fell from 25 to 5, the types of fee from 72 to 4, coverage rose from drones of 300 kg to 500 kg, and registration, unique identification numbers (UINs), remote pilot certificates and permissions moved onto DGCA's Digital Sky platform with an interactive green, yellow and red zone airspace map. The Certification Scheme for Unmanned Aircraft Systems followed on 26 January 2022, under which certification bodies approved through the Quality Council of India test drone models and DGCA issues type certificates. On 9 February 2022 the Directorate General of Foreign Trade prohibited the import of drones in built, semi-knocked-down and completely knocked-down form, with exceptions for research and development, defence and security, while leaving components free to import, and a production-linked incentive scheme of ₹120 crore over three financial years, approved in September 2021, rewards domestic manufacture of drones and drone components. The rules now sit under the Bharatiya Vayuyan Adhiniyam 2024, which replaced the Aircraft Act 1934 from 1 January 2025, and in September 2025 the Ministry released a draft Civil Drone (Promotion and Regulation) Bill for public consultation that would give drones their own primary legislation.

Adoption has followed. The government told the Rajya Sabha that 30,450 drones had been registered with UINs and 23,410 remote pilot certificates issued by DGCA-authorised training organisations as of 28 February 2025. Drone surveys under the SVAMITVA scheme had covered about 3.20 lakh villages and 68,122 square kilometres by April 2025, the Union Cabinet approved the ₹1,261 crore Namo Drone Didi scheme in November 2023 to provide drones to 15,000 women's self-help groups for spraying services, and survey, inspection and delivery operators fly for utilities, infrastructure owners, mines, farms and hospitals. Robotics is growing alongside: the International Federation of Robotics reports that a record 9,120 industrial robots were installed in India in 2024, making it the sixth-largest market in the world, with an operational stock of 52,570 units, while warehouse automation firms deploy autonomous mobile robots, sorters and goods-to-person systems for e-commerce and logistics, and service robots appear in hospitals, hotels and offices.

Every one of these machines is a computer that moves. A drone combines a flight controller and its firmware, radio links for command, telemetry and video, satellite navigation and other sensors, a ground control app on a phone, tablet or laptop, and increasingly a fleet cloud that plans missions, pushes updates and stores imagery. A robot cell or mobile robot fleet adds controllers, middleware such as the Robot Operating System (ROS), fleet management servers, warehouse management integrations and vendor support tunnels. Weaknesses in these layers have been demonstrated publicly. In September 2025 researchers disclosed a flaw in the Bluetooth setup interface of several commercial quadruped and humanoid robot models, built on hard-coded keys, that allowed nearby attackers to run code with full privileges and could in principle spread from robot to robot; the maker acknowledged the vulnerabilities and promised fixes. Security research on ROS has long noted that its first generation had no built-in authentication or encryption, and that the security extensions of ROS 2 depend on careful configuration. Satellite navigation is also under pressure: DGCA issued an advisory circular on GNSS interference in November 2023, and on 1 December 2025 the Civil Aviation Minister told the Rajya Sabha that flights had reported GPS spoofing near Delhi's airport and that GNSS interference reports were also being received from Kolkata, Amritsar, Mumbai, Hyderabad, Bengaluru and Chennai.

Trust in the supply chain has become a commercial and security question in its own right. Reuters reported in August 2023 that India had barred makers of military drones from using components made in China, citing concerns about vulnerabilities in communications, cameras, radio transmission and software. In January 2024 CISA and the FBI issued guidance to US critical infrastructure operators on the data risks of Chinese-manufactured drones, and on 22 December 2025 the US Federal Communications Commission added foreign-produced drones and critical drone components to its Covered List, which blocks new equipment authorisations while leaving previously authorised models in use. For Indian makers, these moves are both an export opportunity and a demand for evidence: buyers increasingly ask where components and software come from, where data flows and how updates are secured. Indian cyber obligations apply as well. CERT-In's Directions require incidents to be reported within six hours and ICT logs to be kept for 180 days, CERT-In's audit guidelines of July 2025 cover risk-based audits including OT, the DPDP Act applies to the people captured in imagery and to pilot and customer data, and exporters to Europe face the Cyber Resilience Act and the cybersecurity requirements of the Radio Equipment Directive, which have applied to internet-connected radio equipment since 1 August 2025.

Figure 1: India's drone, robotics and autonomous systems ecosystem.

• The Ministry of Civil Aviation sets drone policy, the Drone Rules and incentive schemes, and DGCA runs Digital Sky, registration, remote pilot training approvals, type certificates and safety oversight, including the GNSS interference circular.
• The Quality Council of India owns the certification scheme for drones, and approved certification bodies test models before DGCA issues type certificates; DGFT administers the import policy for drones.
• The Airports Authority of India manages airspace and air traffic control, and the Wireless Monitoring Organisation has been tasked with tracing sources of GNSS interference; state police and security agencies act on unauthorised or hostile drone use.
• CERT-In receives incident reports and issues advisories and audit guidelines; MeitY frames IT and data policy, and the Data Protection Board enforces the DPDP Act.
• Drone and component makers, operators, remote pilot training organisations, robotics and warehouse automation firms and fleet software providers design, fly and run the systems; utilities, farms, factories, logistics firms and government departments depend on them.
• Cloud and connectivity providers, chipset and radio suppliers, mapping and analytics vendors and system integrators sit inside almost every deployment, and their weaknesses become the operator's incidents.

Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For drone, robotics and autonomous systems businesses we deliver firmware and device security reviews of flight and robot controllers, including secure boot, update signing and hardware interface testing; security testing of command, control, telemetry and video links, Bluetooth and Wi-Fi pairing and LTE or satellite connectivity; VAPT of ground control apps and pilot devices, fleet management clouds, mission and partner APIs and over-the-air update pipelines; authorised navigation resilience testing in controlled environments, coordinated with the customer and any required regulatory permissions, focused on how systems detect and respond to interference; OT and robot cell assessments aligned with IEC 62443, including AMR fleets, ROS exposure and vendor remote access; supply chain and component provenance reviews; CERT-In empanelled audits; ISO 27001 readiness; DPDP programmes for imagery and pilot data; 24x7 managed SOC for fleet clouds and telemetry; and incident response and forensics for drone, robot and fleet incidents. Each proposal confirms auditor eligibility and independence against CERT-In's and the client's requirements. Codec Networks does not develop or supply interference equipment, and it does not provide aviation safety, airworthiness or type certification services.

Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, regulatory, aviation safety or export control advice. Obligations differ by activity (manufacturing, import, operation, training, software or robotics integration), drone category and type certificate, airspace and permissions, the customers and countries served, listing status, contracts and the data each organisation handles; confirm them against the official Ministry of Civil Aviation, DGCA, QCI, DGFT, CERT-In, MeitY and Data Protection Board instruments, any rules made under the draft Civil Drone (Promotion and Regulation) Bill if enacted, and your agreements. Navigation resilience testing is described only as authorised testing in controlled environments, coordinated with the customer and any required regulatory permissions. Incident references are summarised from official statements and widely reported events.