ICAO Annex 19 sets the global SMS standard, which States implement through national rules. In the United States, 14 CFR Part 5 already requires SMS for Part 121 airlines and, under the April 2024 final rule, extends it to Part 135 operators, Part 91.147 air tour operators, and certain Part 21 certificate holders by 28 May 2027. EASA requires the same functions through its integrated management system rules.
One framework, three layers of rules
Safety management system obligations arrive in layers. ICAO writes the international standard, national and regional authorities turn it into law, and operators implement it as working processes and records. The layers use the same four-component framework — safety policy and objectives, safety risk management, safety assurance, and safety promotion — explained in the companion guide, What is an aviation SMS?
What differs by jurisdiction is who is covered, by when, and under which instrument. This page summarizes the three regimes most airline teams need to reconcile.
ICAO Annex 19 and Doc 9859
ICAO consolidated safety management standards into Annex 19 to the Chicago Convention, first applicable in November 2013. The second edition, applicable since 7 November 2019, integrates State safety programme (SSP) responsibilities with the SMS framework for service providers. The Safety Management Manual (Doc 9859) provides the implementation guidance most authorities and operators work from.
Annex 19 does not bind operators directly. It requires each State to establish an SSP and, through it, to require SMS of service providers — including international commercial air transport operators, approved training organizations, maintenance organizations, and air navigation service providers. Operators therefore always trace their concrete SMS obligation to a national or regional rule.
FAA: 14 CFR Part 5
The FAA codified SMS in 14 CFR Part 5 in 2015, initially requiring Part 121 air carriers to implement an SMS by 2018. On 26 April 2024 the FAA published a revised final rule (89 FR 33068), effective 28 May 2024, that significantly widens Part 5’s reach.
| Who | Requirement | Key date |
|---|---|---|
| Part 121 air carriers | SMS required under the original 2015 rule | In force; compliance was required by 2018 |
| Part 135 operators | Implement an SMS and submit a declaration of compliance | 28 May 2027 |
| Part 91.147 air tour operators | Implement an SMS and submit a declaration of compliance | 28 May 2027 |
| Certain Part 21 type and production certificate holders | Phased milestones under the 2024 rule | SMS implementation no later than 28 May 2027 |
The practical consequence: more than two thousand charter, commuter, and air tour operators that never ran a formal SMS must stand one up, document it, and declare compliance by the May 2027 deadline. The rule scales requirements for smaller operations, including single-pilot operators, but the four components still apply.
EASA: the integrated management system
EASA rules deliver the ICAO SMS framework without using the label “SMS.” Air operators must run a management system under ORO.GEN.200 of the Air Operations regulation, which contains the SMS functions — hazard identification, safety risk management, safety performance monitoring — alongside compliance monitoring. EASA has stated the term “management system” was chosen deliberately so organizations can integrate safety, compliance, security, and quality management rather than run parallel systems.
The same integrated approach extends across domains: continuing airworthiness management organisations under CAMO.A.200 (Regulation (EU) 2019/1383), and maintenance organisations under 145.A.200, where Regulation (EU) 2021/1963 introduced SMS requirements applicable from 2 December 2022, with existing organisations required to close the transition by 2 December 2024. For European operators the question is rarely a new deadline; it is demonstrating, under audit, that the management system genuinely performs the Annex 19 functions.
The three regimes side by side
| Regime | Instrument | Applies to | Status and key dates |
|---|---|---|---|
| ICAO | Annex 19 (second edition) and Doc 9859 | States, which require SMS of service providers | Second edition applicable since 7 November 2019 |
| FAA | 14 CFR Part 5 | Part 121, Part 135, Part 91.147 operators, certain Part 21 holders | Part 121 since 2018; expanded scope by 28 May 2027 |
| EASA | ORO.GEN.200, CAMO.A.200, 145.A.200 | Air operators, CAMOs, maintenance organisations | In force; Part-145 transition ended 2 December 2024 |
What this means for operators
Whichever regime applies, authorities audit the same substance: documented policy and accountabilities, working hazard reporting, risk assessments with owned controls, safety performance monitoring, management of change, and evidence that corrective actions close. A practical preparation sequence is a gap analysis against the twelve framework elements, an implementation plan with owners and dates, and a record structure an auditor can follow end to end.
Tooling is a means, not the obligation — the rules require processes and evidence, not a specific product. Where linked, auditable records are the bottleneck, FlightAtom’s airline SMS software overview shows how Aurora keeps occurrence reports, risk, audits and corrective action plans, investigations, regulatory change, and emergency response connected in one governed system of record. For structured vendor comparison, use the airline operations software evaluation guide.
Official references and scope
Confirm requirements and dates against current official material and your authority. These are the primary sources for this page.
- Federal Register: Safety Management Systems final rule: the 26 April 2024 rule text, applicability, and compliance dates (89 FR 33068).
- 14 CFR Part 5: the current consolidated U.S. SMS regulation.
- ICAO Safety Management: Annex 19 context and the Safety Management Manual (Doc 9859).
- EASA FAQ: management system vs SMS: why EASA rules use the integrated management system concept.
- EASA: SMS implementation for Part-145 organisations: transition material for Regulation (EU) 2021/1963.
Aviation SMS requirements FAQs
When is the FAA SMS deadline for Part 135 operators?
Part 135 certificate holders and Part 91.147 air tour operators must implement an SMS and submit a declaration of compliance to the FAA by May 28, 2027, three years after the revised 14 CFR Part 5 rule became effective on May 28, 2024.
Does ICAO Annex 19 apply directly to airlines?
No. Annex 19 sets standards for States, which implement them through national rules. An operator meets SMS obligations through its own authority, such as the FAA under 14 CFR Part 5 or an EASA member state under the air operations rules.
Does EASA require an SMS for airlines?
EASA air operations rules require a management system under ORO.GEN.200 that contains the ICAO SMS functions, including hazard identification, safety risk management, and compliance monitoring. EASA deliberately uses the term management system rather than SMS to support an integrated approach.
What is 14 CFR Part 5?
14 CFR Part 5 is the FAA regulation defining SMS requirements in the United States. It codifies the four SMS components and applies to Part 121 air carriers and, under the 2024 final rule, to Part 135 operators, Part 91.147 air tour operators, and certain Part 21 certificate holders.
Is SMS software required for compliance?
No. The rules define processes, records, and accountability, not tools. Software supports compliance when it keeps hazard reports, risk assessments, audits, investigations, and corrective actions connected and traceable, but the operator remains responsible for the SMS itself.
Preparing for an SMS deadline or audit?
Bring your gap analysis, reporting channels, and record structure. FlightAtom can map where Aurora, a connected add-on, or an existing system should remain authoritative for each SMS record.