An aviation safety management system (SMS) is a formal, organization-wide approach to managing safety risk. Defined by ICAO Annex 19, it is built from four components: safety policy and objectives, safety risk management, safety assurance, and safety promotion, expanded into twelve elements covering hazard reporting, risk assessment, performance monitoring, change management, and safety training.
From investigating accidents to managing risk
Traditional aviation safety was reactive: something went wrong, it was investigated, and rules were adjusted. An SMS shifts the organization toward proactive and predictive safety management. Hazards are reported and assessed before they cause harm, risk controls are chosen deliberately, and safety performance is monitored continuously against defined objectives.
ICAO standardized this approach in Annex 19, first applicable in 2013 and updated in a second edition applicable from 7 November 2019, supported by the Safety Management Manual (Doc 9859). Annex 19 Amendment 2 becomes applicable on 26 November 2026. National authorities implement those standards through their own rules, such as 14 CFR Part 5 in the United States and the management system requirements in the EASA air operations rules. The aviation SMS requirements guide compares those regimes and their deadlines.
An SMS is not a manual on a shelf, a single safety officer, or a piece of software. It is the set of accountabilities, processes, and records through which an operator actually finds hazards, decides what risk is acceptable, and verifies that its controls work.
The four components and twelve elements
The ICAO SMS framework organizes an SMS into four components and twelve elements. Regulators that require SMS, including the FAA, structure their rules around the same four components.
| Component | Elements | What it covers |
|---|---|---|
| 1. Safety policy and objectives | Management commitment; safety accountability and responsibilities; appointment of key safety personnel; coordination of emergency response planning; SMS documentation | Leadership commits to safety in writing, names an accountable executive, assigns responsibilities, plans emergency response coordination, and documents the SMS. |
| 2. Safety risk management | Hazard identification; safety risk assessment and mitigation | Hazards are captured from reports, audits, and data; associated risks are analyzed, assessed against acceptability criteria, and mitigated with tracked controls. |
| 3. Safety assurance | Safety performance monitoring and measurement; the management of change; continuous improvement of the SMS | Safety performance indicators are monitored, operational changes are assessed for risk before adoption, and the SMS itself is audited and improved. |
| 4. Safety promotion | Training and education; safety communication | Personnel are trained for their SMS roles and safety information, lessons, and reporting expectations are communicated across the organization. |
In day-to-day operation these elements show up as concrete records: occurrence and hazard reports, a risk register, audit findings and corrective action plans, investigation files, management-of-change assessments, safety performance indicators, and training and communication evidence. An auditor assessing an SMS is largely assessing whether those records exist, connect, and close.
Compare the requirements for your operation or explore the reporting-to-closure workflow in Aurora.
From a report to a reviewed outcome
Illustrative example: a staff member reports uncertainty about which revision of a ground-handling instruction is current.
| Step | Record someone can review |
|---|---|
| Report the concern | Record the observation, affected instruction, and available supporting evidence. |
| Assess the risk | The responsible team documents possible consequences, existing controls, its assessment, and its decision. |
| Assign the response | An authorised owner records the agreed document-control action, responsibilities, and completion evidence. |
| Check effectiveness | A later review checks whether staff can identify the current instruction and whether similar reports continue. |
| Share the learning | Relevant staff receive the approved clarification, linked to the original report and review. |
This example shows how the record stays connected. Operational decisions, risk acceptance, and reporting duties remain with the responsible organisation. The FAA SMS components explain the relationship between risk management, assurance, and safety promotion.
Who must implement an SMS
SMS obligations reach operators through their national or regional authority. The FAA's 2024 rule expanded SMS requirements beyond Part 121 operators.
| Framework | Instrument | Applies to |
|---|---|---|
| ICAO | Annex 19 and Doc 9859 | States, which require SMS of service providers including international commercial air transport operators. |
| FAA (United States) | 14 CFR Part 5 | Part 121 air carriers, and, under the 2024 final rule, Part 135 operators, Part 91.147 air tour operators, and certain Part 21 certificate holders. |
| EASA (European Union) | ORO.GEN.200, CAMO.A.200, 145.A.200 | Operators within Part-ORO, approved continuing airworthiness management organisations, and Part-145 approved maintenance organisations, through their applicable management-system requirements. |
Deadlines depend on the operator category. For example, Part 135 operators certificated before 28 May 2024 must implement SMS and declare compliance by 28 May 2027; new applicants have different certification timelines. The requirements comparison covers each regime and date in detail.
Where SMS software fits
No authority mandates a specific tool, and a small operation can run a compliant SMS on paper. What regulators do expect is that hazards, risk decisions, audits, investigations, and corrective actions are recorded, connected, and traceable. As reporting volume grows, software can help teams keep the evidence linked and accessible for review.
Evaluated well, SMS software is judged on the same things an auditor checks: whether a report can be followed to its risk assessment, the risk to its controls and owners, an audit finding to its corrective action and closure evidence, and a change to its assessment. FlightAtom’s airline SMS software overview describes that workflow, and Aurora is FlightAtom’s aviation SMS/QMS system of record for occurrence reporting, risk, audits and corrective action plans, investigations, regulatory change, management of change, and emergency response. For structured vendor comparison, use the airline operations software evaluation guide.
Official references and scope
These sources define and explain SMS requirements. They do not certify any product, and applicable requirements depend on the operator and its authority.
- ICAO Safety Management: Annex 19 context, the Safety Management Manual (Doc 9859), and implementation material for States and service providers.
- FAA: SMS Explained: the FAA’s overview of SMS components and how they are applied in the United States.
- 14 CFR Part 5: the current U.S. regulation defining SMS requirements.
- EASA Safety Management System: the European approach to safety management within an integrated management system.
Aviation SMS FAQs
What does SMS stand for in aviation?
In aviation, SMS stands for safety management system: a systematic, organization-wide approach to managing safety risk that combines safety policy, safety risk management, safety assurance, and safety promotion under accountable leadership.
What are the four components of an aviation SMS?
ICAO Annex 19 defines four components: safety policy and objectives, safety risk management, safety assurance, and safety promotion. The framework expands these into twelve elements, from management commitment through safety communication.
Is an SMS mandatory for airlines?
Broadly, yes. ICAO Annex 19 requires States to have applicable service providers, including international commercial operators, implement SMS. The United States requires SMS under 14 CFR Part 5, and EASA member states apply equivalent management system requirements to air operators.
What is the difference between an SMS and a QMS?
A quality management system monitors conformity with procedures and standards, while a safety management system identifies hazards and manages safety risk in operations. Many operators integrate both so audit findings, risk records, and corrective actions share one governed workflow.
Do you need software to run an aviation SMS?
No regulation requires specific software. Regulators expect defined processes, records, and evidence, which a small operation can keep manually. Software becomes valuable when reports, risk registers, audits, investigations, and corrective actions must stay linked and auditable at scale.
Map your SMS records before comparing tools
Bring your reporting channels, risk register, audit program, and corrective action workflow. FlightAtom can map where a FlightAtom product, or an existing system should remain authoritative for each record.