ICAO Annex 19 sets the global SMS standard, which States implement through national rules. In the United States, 14 CFR Part 5 covers Part 121, Part 135, section 91.147, and specified Part 21 organisations, with different implementation dates. EASA addresses safety management through requirements tied to the organisation and its approval.
One framework, three layers of rules
Safety management system obligations arrive in layers. ICAO writes the international standard, national and regional authorities turn it into law, and operators implement it as working processes and records. The layers use the same four-component framework of safety policy and objectives, safety risk management, safety assurance, and safety promotion, explained in the companion guide, What is an aviation SMS?
What differs by jurisdiction is who is covered, by when, and under which instrument. This page summarizes the three regimes most airline teams need to reconcile.
Which requirements apply to your operation?
| Organisation | Instrument | Coverage and timing |
|---|---|---|
| ICAO member States | Annex 19; Doc 9859 guidance | States implement SMS standards for covered service providers. Amendment 1 applies now; Amendment 2 becomes applicable on 26 November 2026. |
| FAA Part 121 | 14 CFR sections 5.1 and 5.7 | Existing certificate holders had to meet the revised requirements by 28 May 2025. New applicants implement SMS during certification. |
| FAA Part 135 and section 91.147 | Part 5 and FAA implementation timelines | Operators authorised before 28 May 2024 must implement SMS and declare compliance by 28 May 2027. New applicants have certification or LOA requirements; transitional applicant categories need separate review. |
| Specified FAA Part 21 organisations | Sections 5.11–5.15 | Certain type/production certificate holders and licensing arrangements are covered. Existing qualifying organisations generally have a 28 May 2027 deadline; new applications and agreements have separate timelines. |
| EASA operators within Part-ORO | ORO.GEN.005 and ORO.GEN.200 | Management-system duties follow the activities within Part-ORO and scale to their nature and complexity. |
| Part-CAMO and Part-145 approved organisations | CAMO.A.200 and 145.A.200 | Management-system requirements follow the approval. Part-145 SMS requirements applied from 2 December 2022; its existing-approval transition ended 2 December 2024. |
See how Aurora keeps reporting, risk, and corrective-action evidence connected ↗
ICAO Annex 19 and Doc 9859
Annex 19 brings State safety programme responsibilities and service-provider SMS standards into one framework. Its second edition has applied since 7 November 2019. Amendment 2, reflected in the third edition, becomes applicable on 26 November 2026. The ICAO amendment timeline distinguishes effectiveness from applicability; Doc 9859 provides implementation guidance.
Operators trace their concrete duties to their responsible authority. Covered service-provider categories include international commercial air transport operators, approved training organisations exposed to aircraft-operation safety risks, relevant maintenance organisations, and air traffic services providers.
FAA: 14 CFR Part 5
The 2024 revision expanded the original Part 121 requirements. The date depends on the certificate, authorisation, application stage, and activity. Use the FAA implementation timeline alongside the current Part 5 text.
For Part 135, the FAA distinguishes operators certificated before 28 May 2024 from new applicants. Its guidance also identifies transitional applicants, including certain cases already in the initial certification phase or on the applicant list. Section 91.147 applicants have LOA-related requirements. Do not apply the 2027 date to every new application.
Part 21 coverage is specific: section 5.11 addresses production certificate holders who are the holder or licensee of the type certificate for the same product, while section 5.15 addresses qualifying licensing arrangements. New cases under sections 5.13 and 5.15(c) have a 36-month implementation period measured from implementation-plan submission.
Part 5 is not the complete U.S. SMS landscape. Airport SMS requirements are governed separately under Part 139.
EASA: the integrated management system
Part-ORO expresses these obligations through management-system requirements. ORO.GEN.200 addresses accountabilities, safety risks, competent personnel, documentation, and compliance monitoring. Applicability follows ORO.GEN.005; the system is proportionate to the organisation and its activities. See the Air Operations rules.
Approved continuing airworthiness management organisations and Part-145 maintenance organisations have their own requirements under CAMO.A.200 and 145.A.200. The Part-145 transition for existing approvals ended on 2 December 2024. The EASA transition letter describes that implementation scope.
What this means for operators
Whichever regime applies, authorities audit the same substance: documented policy and accountabilities, working hazard reporting, risk assessments with owned controls, safety performance monitoring, management of change, and evidence that corrective actions close. A practical preparation sequence is a gap analysis against the twelve framework elements, an implementation plan with owners and dates, and a record structure an auditor can follow end to end.
Tooling is a means, not the obligation. The rules require processes and evidence, not a specific product. Where linked, auditable records are the bottleneck, FlightAtom’s airline SMS software overview shows how Aurora keeps occurrence reports, risk, audits and corrective action plans, investigations, regulatory change, and emergency response connected in one governed system of record. For structured vendor comparison, use the airline operations software evaluation guide.
Official references and scope
Confirm requirements and dates against current official material and your authority. These are the primary sources for this page.
- Federal Register: Safety Management Systems final rule: the 26 April 2024 rule text, applicability, and compliance dates (89 FR 33068).
- 14 CFR Part 5: the current consolidated U.S. SMS regulation.
- ICAO Safety Management: Annex 19 context and the Safety Management Manual (Doc 9859).
- EASA FAQ: management system vs SMS: why EASA rules use the integrated management system concept.
- EASA: SMS implementation for Part-145 organisations: transition material for Regulation (EU) 2021/1963.
Aviation SMS requirements FAQs
When is the FAA SMS deadline for Part 135 operators?
Operators certificated under Part 135 before May 28, 2024 must implement SMS and declare compliance by May 28, 2027. New applicants and transitional applications follow different certification timelines. Check section 5.9 and the FAA implementation guidance for the applicable category.
Does ICAO Annex 19 apply directly to airlines?
No. Annex 19 sets standards for States, which implement them through national rules. An operator meets SMS obligations through its own authority, such as the FAA under 14 CFR Part 5 or an EASA member state under the air operations rules.
Does EASA require an SMS for airlines?
Operators within Part-ORO must meet the management-system requirements in ORO.GEN.200, including safety risk management and compliance monitoring. Applicability follows ORO.GEN.005, with the system proportionate to the organisation and its activities.
What is 14 CFR Part 5?
14 CFR Part 5 is the FAA regulation defining SMS requirements in the United States. It codifies the four SMS components and applies to Part 121 air carriers and, under the 2024 final rule, to Part 135 operators, Part 91.147 air tour operators, and certain Part 21 certificate holders.
Is SMS software required for compliance?
No. The rules define processes, records, and accountability, not tools. Software supports compliance when it keeps hazard reports, risk assessments, audits, investigations, and corrective actions connected and traceable, but the operator remains responsible for the SMS itself.
Preparing for an SMS deadline or audit?
Bring your gap analysis, reporting channels, and record structure. FlightAtom can map where a FlightAtom product, or an existing system should remain authoritative for each SMS record.