An aviation safety management system (SMS) is a formal, organization-wide approach to managing safety risk. Defined by ICAO Annex 19, it is built from four components — safety policy and objectives, safety risk management, safety assurance, and safety promotion — expanded into twelve elements covering hazard reporting, risk assessment, performance monitoring, change management, and safety training.
From investigating accidents to managing risk
Traditional aviation safety was reactive: something went wrong, it was investigated, and rules were adjusted. An SMS shifts the organization toward proactive and predictive safety management. Hazards are reported and assessed before they cause harm, risk controls are chosen deliberately, and safety performance is monitored continuously against defined objectives.
ICAO standardized this approach in Annex 19, first applicable in 2013 and updated in a second edition applicable from 7 November 2019, supported by the Safety Management Manual (Doc 9859). National authorities implement those standards through their own rules, such as 14 CFR Part 5 in the United States and the management system requirements in the EASA air operations rules. The aviation SMS requirements guide compares those regimes and their deadlines.
An SMS is not a manual on a shelf, a single safety officer, or a piece of software. It is the set of accountabilities, processes, and records through which an operator actually finds hazards, decides what risk is acceptable, and verifies that its controls work.
The four components and twelve elements
The ICAO SMS framework organizes an SMS into four components and twelve elements. Regulators that require SMS, including the FAA, structure their rules around the same four components.
| Component | Elements | What it covers |
|---|---|---|
| 1. Safety policy and objectives | Management commitment; safety accountability and responsibilities; appointment of key safety personnel; coordination of emergency response planning; SMS documentation | Leadership commits to safety in writing, names an accountable executive, assigns responsibilities, plans emergency response coordination, and documents the SMS. |
| 2. Safety risk management | Hazard identification; safety risk assessment and mitigation | Hazards are captured from reports, audits, and data; associated risks are analyzed, assessed against acceptability criteria, and mitigated with tracked controls. |
| 3. Safety assurance | Safety performance monitoring and measurement; the management of change; continuous improvement of the SMS | Safety performance indicators are monitored, operational changes are assessed for risk before adoption, and the SMS itself is audited and improved. |
| 4. Safety promotion | Training and education; safety communication | Personnel are trained for their SMS roles and safety information, lessons, and reporting expectations are communicated across the organization. |
In day-to-day operation these elements show up as concrete records: occurrence and hazard reports, a risk register, audit findings and corrective action plans, investigation files, management-of-change assessments, safety performance indicators, and training and communication evidence. An auditor assessing an SMS is largely assessing whether those records exist, connect, and close.
Who must implement an SMS
SMS obligations reach operators through their national or regional authority. The scope has widened steadily; the most recent major expansion is the FAA rule extending SMS beyond scheduled airlines.
| Framework | Instrument | Applies to |
|---|---|---|
| ICAO | Annex 19 and Doc 9859 | States, which require SMS of service providers including international commercial air transport operators. |
| FAA (United States) | 14 CFR Part 5 | Part 121 air carriers, and, under the 2024 final rule, Part 135 operators, Part 91.147 air tour operators, and certain Part 21 certificate holders. |
| EASA (European Union) | ORO.GEN.200, CAMO.A.200, 145.A.200 | Air operators, continuing airworthiness management organisations, and maintenance organisations through integrated management system requirements. |
Deadlines matter here: Part 135 operators and Part 91.147 air tour operators in the United States must have an SMS with a declaration of compliance filed by 28 May 2027. The requirements comparison covers each regime and date in detail.
Where SMS software fits
No authority mandates a specific tool, and a small operation can run a compliant SMS on paper. What regulators do expect is that hazards, risk decisions, audits, investigations, and corrective actions are recorded, connected, and traceable. As reporting volume grows, keeping that evidence linked by hand becomes the practical bottleneck, which is why most airlines adopt dedicated SMS software.
Evaluated well, SMS software is judged on the same things an auditor checks: whether a report can be followed to its risk assessment, the risk to its controls and owners, an audit finding to its corrective action and closure evidence, and a change to its assessment. FlightAtom’s airline SMS software overview describes that workflow, and Aurora is FlightAtom’s aviation SMS/QMS system of record for occurrence reporting, risk, audits and corrective action plans, investigations, regulatory change, management of change, and emergency response. For structured vendor comparison, use the airline operations software evaluation guide.
Official references and scope
These sources define and explain SMS requirements. They do not certify any product, and applicable requirements depend on the operator and its authority.
- ICAO Safety Management: Annex 19 context, the Safety Management Manual (Doc 9859), and implementation material for States and service providers.
- FAA: SMS Explained: the FAA’s overview of SMS components and how they are applied in the United States.
- 14 CFR Part 5: the current U.S. regulation defining SMS requirements.
- EASA Safety Management System: the European approach to safety management within an integrated management system.
Aviation SMS FAQs
What does SMS stand for in aviation?
In aviation, SMS stands for safety management system: a systematic, organization-wide approach to managing safety risk that combines safety policy, safety risk management, safety assurance, and safety promotion under accountable leadership.
What are the four components of an aviation SMS?
ICAO Annex 19 defines four components: safety policy and objectives, safety risk management, safety assurance, and safety promotion. The framework expands these into twelve elements, from management commitment through safety communication.
Is an SMS mandatory for airlines?
Broadly, yes. ICAO Annex 19 requires States to have applicable service providers, including international commercial operators, implement SMS. The United States requires SMS under 14 CFR Part 5, and EASA member states apply equivalent management system requirements to air operators.
What is the difference between an SMS and a QMS?
A quality management system monitors conformity with procedures and standards, while a safety management system identifies hazards and manages safety risk in operations. Many operators integrate both so audit findings, risk records, and corrective actions share one governed workflow.
Do you need software to run an aviation SMS?
No regulation requires specific software. Regulators expect defined processes, records, and evidence, which a small operation can keep manually. Software becomes valuable when reports, risk registers, audits, investigations, and corrective actions must stay linked and auditable at scale.
Map your SMS records before comparing tools
Bring your reporting channels, risk register, audit program, and corrective action workflow. FlightAtom can map where Aurora, a connected add-on, or an existing system should remain authoritative for each record.