Not included:
Safety certification, emergency-response certification, cybersecurity assessment, legal opinion, compliance certification, regulatory review, field deployment, hardware work, drone operations, or full implementation unless separately scoped.