Legalize
Legalize / European Union / Regulation

Commission Regulation (EU) No 1321/2014 of 26 November 2014 on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks Text with EEA relevance

Type Regulation
Publication 2014-12-17
Last updated 2026-08-07
State In force
Department European Commission
Source EUR-Lex
articles 9
Reform history JSON API
  • (c) It shall contain, as a minimum the following information:
  • (1) the aircraft registration, type and serial number;
  • (2) the aircraft owner's or registered lessee's name or company details including the address;
  • (3) details of the contracted CAMO or CAO, including the address;
  • (4) the type of operation.

- (d) It shall state the following:

‘The owner entrusts the CAMO or CAO with the management of the continuing airworthiness of the aircraft, the development and approval of a maintenance programme, and the organisation of the maintenance of the aircraft according to said maintenance programme. According to the present contract, both signatories undertake to follow the respective obligations of this contract. The owner declares, to the best of its knowledge, that all the information given to the CAMO or CAO concerning the continuing airworthiness of the aircraft is and will be accurate, and that the aircraft will not be altered without prior approval of the CAMO or CAO. In case of any non-conformity with this contract, by either of the signatories, the contract will become null. In such a case, the owner will retain full responsibility for every task linked to the continuing airworthiness of the aircraft, and the owner will inform the competent authoritie(s) of the Member State of registry within 2 weeks about the termination of the contract.’

  • (e) When an owner contracts a CAMO or CAO in accordance with point ML.A.201, the obligations of each party shall be assigned as follows:
  • (1) Obligations of CAMO or CAO:
  • (i) have the aircraft type included in its terms of approval;
  • (ii) respect all the conditions listed below with regard to maintaining the continuing airworthiness of the aircraft:
  • (A) develop and approve the AMP for the aircraft;
  • (B) once it has been approved, provide the owner with a copy of the AMP, as well as a copy of the justifications for any deviations from the DAH's recommendations;
  • (C) organise a bridging inspection using the aircraft's prior AMP;
  • (D) organise that all maintenance is carried out by an approved maintenance organisation or, if permitted, by independent certifying staff;
  • (E) organise that all applicable ADs are applied;
  • (F) organise that all defects discovered during maintenance, airworthiness reviews or reported by the owner are corrected by an approved maintenance organisation or, if permitted, by independent certifying staff;
  • (G) coordinate scheduled maintenance, the application of ADs, the replacement of service-life-limited parts, and component inspection requirements;
  • (H) inform the owner each time the aircraft must be brought to an approved maintenance organisation or, if permitted, to independent certifying staff;
  • (I) manage and archive all technical records;
  • (iii) organise the approval of any modification to the aircraft in accordance with Annex I to Regulation (EU) No 748/2012 (Part 21) or, as applicable, Annex Ib (Part 21 Light) before this modification is embodied; In the case of an aircraft subject to a declaration of design compliance, organise the declaration of compliance for any modification in accordance Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012 before it is embodied;
  • (iv) organise the approval of any repair to the aircraft in accordance with Annex I (Part 21) or, as applicable, Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012 (Part 21) before this repair is carried out. In the case of an aircraft subject to a declaration of design compliance, organise the declaration of compliance for any repair in accordance Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012 before it is carried out;
  • (v) inform the competent authority of the Member State of registry whenever the aircraft is not presented by the owner for maintenance as requested by the contracted CAMO or CAO;
  • (vi) inform the competent authority of the Member State of registry whenever the present contract has not been respected;
  • (vii) ensure that the airworthiness review of the aircraft is carried out, when necessary, and ensure that the ARC is issued;
  • (viii) send within 10 days a copy of any ARC issued or extended to the competent authority of the Member State of registry;
  • (ix) carry out all occurrence reporting mandated by applicable regulations;
  • (x) inform the competent authority of the Member State of registry whenever the present contract is denounced by either party.
  • (2) Obligations of the owner:
  • (i) have a general understanding of the AMP;
  • (ii) have a general understanding of this Annex;
  • (iii) present the aircraft for maintenance as directed by the contracted CAMO or CAO;
  • (iv) not modify the aircraft without first consulting the contracted CAMO or CAO;
  • (v) inform the contracted CAMO or CAO of all maintenance exceptionally carried out without the knowledge and control of the contracted CAMO or CAO;
  • (vi) report to the contracted CAMO or CAO through the logbook all defects found during operations;
  • (vii) inform the competent authority of the Member State of registry whenever the present contract is denounced by either party;
  • (viii) inform the competent authority of the Member State of registry and the contracted CAMO or CAO whenever the aircraft is sold;
  • (ix) carry out all occurrence reporting mandated by applicable regulations;
  • (x) inform on a regular basis the contracted CAMO or CAO about the aircraft flying-hours and any other utilisation data, as agreed with the contracted CAMO or CAO;
  • (xi) enter the CRS in the logbooks, as mentioned in point ML.A.803(c), when performing pilot-owner maintenance;
  • (xii) inform the contracted CAMO or CAO no later than 30 days after completion of any Pilot-owner maintenance task.
  • (f) When an owner or operator contracts a CAMO or CAO in accordance with point ML.A.201 of this Annex, the obligations of each party in respect of mandatory and voluntary occurrence reporting in accordance with Regulation (EU) No 376/2014 shall be clearly specified.

Appendix II

Limited pilot-owner maintenance

In addition to the requirements laid down in this Annex, the pilot-owner shall comply with the following basic principles before it carries out any maintenance task:

(a) Competence and responsibility

  • (1) The pilot-owner shall always be responsible for any maintenance he performs.
  • (2) The pilot-owner shall hold satisfactory level of competence to perform the task. It is the responsibility of a pilot-owner to familiarise himself with the standard maintenance practices for his aircraft and with the AMP.

(b) Tasks

The Pilot-owner may carry out simple visual inspections or operations to check the airframe, engines, systems and components for general condition, obvious damage and normal operation.

A maintenance task shall not be released by the pilot-owner if any of the following conditions occurs:

  • (1) it is a critical maintenance task;
  • (2) it requires the removal of major components o r a major assembly;

- (3) it is carried out in compliance with an AD or an airworthiness limitation item (ALI) unless specifically allowed in the AD or the ALI;

  • (4) it requires the use of special tools or calibrated tools (except for torque wrench and crimping tool);
  • (5) it requires the use of test equipment or special testing (e.g. non-destructive testing (NDT), system tests or operational checks for avionics equipment);

- (6) it is composed of any unscheduled special inspections (e.g. heavy-landing check);

- (7) it affects systems essential for the instrumental flight rules (IFR) operations;

  • (8) it is a complex maintenance task in accordance with Appendix III, or it is a component maintenance task in accordance with point (a) or (b) of point ML.A.502;
  • (9) it is part of the 100-h/annual check (for those cases the maintenance task is combined with the airworthiness review performed by maintenance organisations or independent certifying staff).

The criteria referred to in points (1) to (9) cannot be overridden by less restrictive instructions issued in accordance with the AMP referred to in point ML.A.302.

Any task described in the aircraft flight manual (or other operational manuals), for example preparing the aircraft for flight (assembling the sailplane wings, or performing a preflight inspection, or assembling a basket, burner, fuel cylinders and an envelope combination for a balloon, etc.), is not considered a maintenance task and, therefore, does not require a CRS. Nevertheless, the person assembling those parts is responsible for ensuring that those parts are eligible for installation and in a serviceable condition.

(c) Performance and records of the pilot-owner maintenance tasks

The maintenance data, as specified in point ML.A.401, must always be available during the conduct of pilot-owner maintenance and must be complied with. Details of the data referred to in the conduct of pilot-owner maintenance must be included in the CRS in accordance with point (d) of point ML.A.803.

The pilot-owner must inform the contracted CAMO or CAO (if such contract exists) about the completion of the pilot-owner maintenance tasks no later than 30 days after completion of these tasks in accordance with point (a) of point ML.A.305.

Appendix III

Complex maintenance tasks not to be released by the pilot-owner

All of the following constitutes the complex maintenance tasks which, according to Appendix II, shall not be carried out by the pilot-owner. Those tasks shall be released either by an approved maintenance organisation or by independent certifying staff:

  • (a) the modification, repair or replacement by riveting, bonding, laminating, or welding of any of the following airframe parts:
  • (1) a box beam;
  • (2) a wing stringer or chord member;
  • (3) a spar;
  • (4) a spar flange;
  • (5) a member of a truss type beam;
  • (6) the web of a beam;
  • (7) a keel or chine member of a flying boat hull or a float;
  • (8) a corrugated sheet compression member in a wing or tail surface;
  • (9) a wing main rib;
  • (10) a wing or tail surface brace strut;
  • (11) an engine mount;
  • (12) a fuselage longeron or frame;
  • (13) a member of a side truss, horizontal truss or bulkhead;
  • (14) a seat support brace or bracket;
  • (15) a seat rail replacement;
  • (16) a landing-gear strut or brace strut;
  • (17) an axle;
  • (18) a wheel; and
  • (19) a ski or ski pedestal, excluding the replacement of a low-friction coating;

- (b) the modification or repair of any of the following parts:

  • (1) aircraft skin or the skin of an aircraft float if the work requires the use of a support, jig or fixture;
  • (2) aircraft skin that is subject to pressurisation loads if the damage to the skin measures more than 15 cm (6 in.) in any direction;
  • (3) a load-bearing part of a control system, including a control column, pedal, shaft, quadrant, bell crank, torque tube, control horn and forged or cast bracket, but excluding:
  • (i) the swaging of a repair splice or cable fitting; and
  • (ii) the replacement of a push-pull tube end fitting that is attached by riveting;
  • (4) any other structure not listed in point (a) that a manufacturer has identified as primary structure in their maintenance manual, structural repair manual or instructions for continuing airworthiness;
  • (c) the performance of all of the following maintenance on a piston engine:
  • (1) dismantling and subsequent reassembling of a piston engine other than:
  • (i) to obtain access to the piston/cylinder assemblies; or
  • (ii) to remove the rear accessory cover to inspect and/or replace oil pump assemblies, where such work does not involve the removal and refitment of internal gears;
  • (2) dismantling and subsequent reassembling of reduction gears;
  • (3) welding and brazing of joints, other-than-minor weld repairs to exhaust units carried out by a suitably approved or authorised welder but excluding component replacement;
  • (4) the disturbing of individual parts of units which are supplied as bench-tested units except for the replacement or adjustment of items normally replaceable or adjustable in service;
  • (ca) the performance of maintenance on the power plant that would require disassembly of engine(s), main batteries or fuel cell(s), other than removing them from the aircraft and reinstalling them back (including removal/installation of engine bearings);
  • (cb) the performance of maintenance on high-pressure reservoirs and components belonging to high-pressure lines/systems related to the power plant;
  • (d) the balancing of a propeller, except:
  • (1) for the certification of static balancing where required by the maintenance manual; and
  • (2) dynamic balancing on installed propellers using electronic balancing equipment where permitted by the maintenance manual or other approved airworthiness data;
  • (e) any additional task that requires:
  • (1) specialised tooling, equipment or facilities; or
  • (2) significant coordination procedures because of the extensive duration of the tasks and the involvement of several persons.

Appendix IV

Airworthiness Review Certificate - EASA Form 15c

  • NOTE: persons and organisations performing the airworthiness review in combination with the 100-h/annual inspection may use the reverse side of this form in order to issue the CRS referred to in point ML.A.801 corresponding to the 100-h/annual inspection.

AIRWORTHINESS REVIEW CERTIFICATE (ARC) (for aircraft complying with Part-ML)

ARC reference: …

Pursuant to Regulation (EU) 2018/1139 of the European Parliament and of the Council:

[NAME OF THE COMPETENT AUTHORITY]

hereby certifies that:

  • □ it has performed an airworthiness review, in accordance with point ML.A.903 of Annex Vb to Commission Regulation (EU) No 1321/2014, of the following aircraft:

[or]

  • □ the following new aircraft:

Aircraft manufacturer: … Aircraft manufacturer designation: …

Aircraft registration: … Aircraft serial number: …

(and) is considered airworthy at the time of the review.

Date of issue: … Expiry date: …

Airframe flight hours (FHs) on the date of the review (*): …

Signed: … Authorisation No (if applicable): …

[OR]

[NAME OF APPROVED ORGANISATION, ADDRESS and APPROVAL REFERENCE] (**)

[or]

[FULL NAME OF THE CERTIFYING STAFF AND PART-66 LICENCE NUMBER (OR NATIONAL EQUIVALENT)] (**)

hereby certifies that it has performed an airworthiness review, in accordance with point ML.A.903 of Annex Vb to Commission Regulation (EU) No 1321/2014, of the following aircraft:

Aircraft manufacturer: … Aircraft manufacturer designation: …

Aircraft registration: … Aircraft serial number: …

and is considered airworthy at the time of the review.

Date of issue: … Expiry date: …

Airframe flight hours (FHs) on the date of review (*): …

Name and signature: … Authorisation No (if applicable): …

=================================================================================

First extension: The Airworthiness Review Certificate has been extended in accordance with point ML.A.902 of Annex Vb (Part-ML) to Regulation (EU) No 1321/2014.

Date of issue: … Expiry date: …

Airframe flight hours (FHs) on the date of issue (*): …

Signed: … Authorisation No: …

Name of approved organisation: … Approval reference: …

=================================================================================

Second extension: The Airworthiness Review Certificate has been extended in accordance with point ML.A.902 of Annex Vb (Part-ML) to Regulation (EU) No 1321/2014.

Date of issue: … Date of expiry: …

Airframe flight hours (FH) on the date of issue (*): …

Signed: … Authorisation No: …

Name of approved organisation: … Approval reference: …

- (*)Except for balloons and airships.
  • (**)The issuer of the Form may tailor it to their need by deleting the name, the certifying statement, the reference to the subject aircraft and the issuance details that are not relevant for their use.
When the Form is issued in a language other than English, it shall include an English translation.

EASA Form 15c, Issue 5.

ANNEX Vc

(Part-CAMO)

| | |

| --- | --- | | CONTENTS | CONTENTS | | SECTION A — ORGANISATION REQUIREMENTS | SECTION A — ORGANISATION REQUIREMENTS | | CAMO.A.005 | Scope | | CAMO.A.105 | Competent authority | | CAMO.A.115 | Application for an organisation certificate | | CAMO.A.120 | Means of compliance | | CAMO.A.125 | Terms of approval and privileges of the organisation | | CAMO.A.130 | Changes to the organisation | | CAMO.A.135 | Continued validity | | CAMO.A.140 | Access | | CAMO.A.150 | Findings | | CAMO.A.155 | Immediate reaction to a safety problem | | CAMO.A.160 | Occurrence reporting | | CAMO.A.200 | Management system | | | | | CAMO.A.200A | Information security management system | | | | | CAMO.A.202 | Internal safety reporting scheme | | CAMO.A.205 | Contracting and subcontracting | | CAMO.A.215 | Facilities | | CAMO.A.220 | Record-keeping | | CAMO.A.300 | Continuing airworthiness management exposition (CAME) | | CAMO.A.305 | Personnel requirements | | CAMO.A.310 | Airworthiness review staff qualifications | | CAMO.A.315 | Continuing airworthiness management | | CAMO.A.320 | Airworthiness review | | CAMO.A.325 | Continuing airworthiness management data | | SECTION B — AUTHORITY REQUIREMENTS | SECTION B — AUTHORITY REQUIREMENTS | | CAMO.B.005 | Scope | | CAMO.B.115 | Oversight documentation | | CAMO.B.120 | Means of compliance | | CAMO.B.125 | Information to the Agency | | CAMO.B.135 | Immediate reaction to a safety problem | | | | | CAMO.B.135A | Immediate reaction to an information security incident or vulnerability with an impact on aviation safety | | | | | CAMO.B.200 | Management system | | | | | CAMO.B.205 | Allocation of tasks | | | | | CAMO.B.210 | Changes in the management system | | CAMO.B.220 | Record-keeping | | CAMO.B.300 | Oversight principles | | CAMO.B.305 | Oversight programme | | CAMO.B.310 | Initial certification procedure | | CAMO.B.330 | Changes | | | | | CAMO.B.330A | Changes to the information security management system | | | | | CAMO.B.350 | Findings and corrective actions | | CAMO.B.355 | Suspension, limitation and revocation | | | | | Appendix I — | Continuing Airworthiness Management Organisation Certificate - EASA Form 14 | | | |

SECTION A

ORGANISATION REQUIREMENTS

CAMO.A.005   Scope

This Section establishes the requirements to be met by an organisation to qualify for the issue or continuation of a certificate for the management of continuing airworthiness of an aircraft and of components for installation.

CAMO.A.105   Competent authority

For the purpose of this Annex, the competent authority shall be:
  • (a) for organisations having their principal place of business in a territory for which a Member State is responsible under the Chicago Convention, one of the following:
  • (i) the authority designated by that Member State where that organisation’s principal place of business is located, if the approval is not included in an air operator certificate or if the CAMO is contracted in accordance with M.A.201(ea);
  • (ii) the authority designated by the Member State of the operator, if the approval is included in an air operator certificate;
  • (iii) the authority designated by a Member State other than (i) or (ii), if the responsibility has been reallocated to that Member State in accordance with Article 64 of Regulation (EU) 2018/1139;
  • (iv) the Agency if the responsibility has been reallocated to the Agency in accordance with Articles 64 or 65 of Regulation (EU) 2018/1139;
  • (b) the Agency if the organisation’s principal place of business is located outside a territory for which a Member State is responsible under the Chicago Convention.

CAMO.A.115   Application for an organisation certificate

  • (a) The application for a certificate or an amendment to an existing certificate in accordance with this Annex shall be made in a form and manner established by the competent authority, taking into account the applicable requirements of Annex I (Part-M), Annex Vb (Part-ML) and this Annex.
  • (b) Applicants for an initial certificate pursuant to this Annex shall provide the competent authority with:
  • (1) the results of a pre-audit performed by the organisation against the applicable requirements provided for in Annex I (Part-M), Annex Vb (Part-ML) and this Annex;
  • (2) documentation demonstrating how they will comply with the requirements established in this Regulation. Such documentation shall include, as provided for in point CAMO.A.130, a procedure describing how changes not requiring prior approval will be managed and notified to the competent authority.

CAMO.A.120   Means of compliance

  • (a) Alternative means of compliance to the AMC adopted by the Agency may be used by an organisation to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.
- (b) When an organisation wishes to use an alternative means of compliance, it shall, prior to using it, provide the competent authority with a full description of the alternative means of compliance. The description shall include any revisions to manuals or procedures that may be relevant, as well as an assessment demonstrating compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

The organisation may use these alternative means of compliance subject to prior approval by the competent authority, and upon receipt of the notification as provided for in point CAMO.B.120.

CAMO.A.125   Terms of approval and privileges of the organisation

  • (a) The approval is indicated on the certificate, which is included in Appendix I, and is issued by the competent authority.
  • (b) Notwithstanding point (a), for air carriers licensed in accordance with Regulation (EC) No 1008/2008, the approval shall be part of the air operator certificate issued by the competent authority for the aircraft operated except when, in accordance with point M.A.201(ea) of Annex I (Part-M), the CAMO is contracted by operators forming part of a single air carrier business grouping.
- (c) The scope of work shall be specified in the continuing airworthiness management exposition (CAME) in accordance with point CAMO.A.300.
  • (d) An organisation approved in accordance with this Annex may:
  • (1) manage the continuing airworthiness of aircraft, except those used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, as listed on the certificate;
  • (2) manage the continuing airworthiness of aircraft used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, when listed both on its certificate and on the air operator certificate or when M.A.201(ea) applies;
  • (3) arrange to carry out limited continuing airworthiness tasks with any subcontracted organisation, working under its management system, as listed on the certificate;
  • (4) extend the validity of an existing airworthiness review certificate in accordance with point M.A.902(a) of Annex I (Part-M) or point ML.A.902(a) of Annex Vb (Part-ML), as applicable, subject to the conditions set out in point M.A.902(b) of Annex I (Part-M) or point ML.A.902(b) of Annex Vb (Part-ML), as applicable.
  • (5) approve the AMP, in accordance with point (b)(2) of point ML.A.302, for aircraft managed in accordance with Annex Vb (Part-ML).
  • (e) An organisation approved in accordance with this Annex and having its principal place of business in a Member State may additionally be approved to carry out airworthiness reviews in accordance with point M.A.903 of Annex I (Part-M) or point ML.A.903 of Annex Vb (Part-ML), as applicable, and:
  • (1) issue the related airworthiness review certificate under the conditions set out in point M.A.901(b)(1) of Annex I (Part-M) or in accordance with point ML.A.901(b) of Annex Vb (Part-ML), as applicable;
  • (2) issue a recommendation for the issuance of an airworthiness review certificate to the competent authority of the Member State of registry, under the conditions set out in point M.A.901(b)(2) of Annex I (Part-M).
  • (f) An organisation holding the privileges referred to in point (e) of this point may additionally be approved to issue a permit to fly in accordance with point 21.A.711(d) of Annex I (Part 21) to Regulation (EU) No 748/2012 for the aircraft for which the organisation is approved to carry out the airworthiness review, when the organisation attests conformity with the approved flight conditions, subject to an adequate procedure in the CAME referred to in point CAMO.A.300 of this Annex. In addition, in the case of aircraft used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, or for aircraft above 2 730 kg MTOM, that permit to fly may be issued provided that:
  • (i) the conditions referred to in points M.A.902(b)(1) and M.A.902(b)(2) are met;
  • (ii) the continuing airworthiness of the aircraft is managed by the CAMO issuing the permit to fly.
  • (g) An organisation holding the privileges referred to in point (e) may additionally, for the aircraft for which the organisation is approved to carry out the airworthiness review, and subject to an adequate procedure in the CAME referred to in point CAMO.A.300, be approved to:
  • (1) develop an evaluation programme in accordance with point 21.A.174(d)(3) of Annex I (Part 21) or, as applicable, point 21L.A.143(h)(3) of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012;
  • (2) conduct the investigations activities proposed in the evaluation programme and issue the evaluation report in accordance with point 21.A.174(d)(4) of Annex I (Part 21) or, as applicable, point 21L.A.143(h)(4) of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012. Tasks referred to in the first paragraph, points (1) and (2), shall be performed by staff who are approved to carry out airworthiness review for that aircraft.
CAMO.A.130   Changes to the organisation
  • (a) The following changes to the organisation shall require prior approval:
  • (1) changes that affect the scope of the certificate or the terms of approval of the organisation;
  • (2) changes to personnel nominated in accordance with points (a)(3) to (a)(5) and (b)(2) of point CAMO.A.305;
  • (3) changes to the reporting lines between the personnel nominated in accordance with points (a)(3) to (a)(5) and (b)(2) of point CAMO.A.305, and the accountable manager;
  • (4) the procedure as regards changes not requiring prior approval referred to in point (c).
  • (b) For any changes requiring prior approval in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts, the organisation shall apply for and obtain an approval issued by the competent authority. The application shall be submitted before any such change takes place, in order to enable the competent authority to determine continued compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts and to amend, if necessary, the organisation certificate and related terms of approval attached to it. The organisation shall provide the competent authority with any relevant documentation. The change shall only be implemented upon receipt of formal approval by the competent authority in accordance with point CAMO.B.330. The organisation shall operate under the conditions established by the competent authority during such changes, as applicable.
  • (c) All changes not requiring prior approval shall be managed and notified to the competent authority as defined in the procedure referred to in point (b) of point CAMO.A.115 and approved by the competent authority in accordance with point (h) of point CAMO.B.310.
CAMO.A.135   Continued validity
  • (a) The organisation's certificate shall remain valid subject to compliance with all of the following conditions:
  • (1) the organisation remaining in compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts, taking into account the provisions related to the handling of findings as specified under point CAMO.B.350;
  • (2) the competent authority being granted access to the organisation as specified in point CAMO.A.140;
  • (3) the certificate not being surrendered or revoked.
  • (b) For air carriers licensed in accordance with Regulation (EC) No 1008/2008, termination, suspension or revocation of the air operator certificate automatically invalidates the organisation certificate in relation to the aircraft registrations specified in the air operator certificate, unless otherwise explicitly stated by the competent authority.
- (c) Notwithstanding point (b), when the CAMO is contracted by operators forming part of a single air carrier business grouping in accordance with point M.A.201(ea) of Annex I (Part-M), the termination, suspension or revocation of the air operator certificate does not automatically invalidate the CAMO’s certificate. In this case, the contract in accordance with Appendix I to Annex I (Part-M) to this Regulation becomes void.
  • (d) Upon revocation or surrender, the organisation certificate shall be returned to the competent authority without delay.

CAMO.A.140   Access

For the purpose of determining compliance with the relevant requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, the organisation shall grant access at any time to any facility, aircraft, document, records, data, procedures or any other material relevant to its activity subject to certification, whether it is contracted/subcontracted or not, to any person authorised by one of the following authorities:

- (a) the competent authority defined in point CAMO.A.105;
  • (b) the authority acting under the provisions of point (d) of point CAMO.B.300 or point (e) of point CAMO.B.300.

CAMO.A.150   Findings

  • (a) After receipt of notification of findings according to point CAMO.B.350, the organisation shall:
  • (1) identify the root cause or causes of and contributing factors to the non-compliance;
  • (2) define a corrective action plan;
  • (3) demonstrate corrective action implementation to the satisfaction of the competent authority.
  • (b) Actions referred to in points (a)(1), (a)(2) and (a)(3) shall be performed within the period agreed with that competent authority as defined in point CAMO.B.350.
CAMO.A.155   Immediate reaction to a safety problem

The organisation shall implement:

  • (a) any safety measures mandated by the competent authority in accordance with point CAMO.B.135;
  • (b) any relevant mandatory safety information issued by the Agency.

CAMO.A.160   Occurrence reporting

  • (a) As part of its management system, the organisation shall establish and maintain an occurrence reporting system, including mandatory and voluntary reporting. For organisations that have their principal place of business in a Member State, a single system may be established to meet the requirements of Regulation (EU) No 376/2014 and its delegated and implementing acts and of Regulation (EU) 2018/1139 and its delegated and implementing acts.
  • (c) The organisation shall also report any such event or condition that affects an aircraft or component, as applicable:
  • (1) to the owner or operator of that aircraft, when such event or condition was identified while managing the continuing airworthiness in accordance with point M.A.201 of Annex I (Part-M) or point ML.A.201 of Annex Vb (Part-ML), as applicable;
  • (2) to the person or organisation that is responsible for the continuing airworthiness of that aircraft in accordance with point M.A.201 of Annex I (Part-M) or point ML.A.201 of Annex Vb (Part-ML), as applicable, when such event or condition was identified while carrying out continuing airworthiness activities requested by that person or organisation.
- (d) For organisations that do not have their principal place of business in a Member State:
  • (1) the initial mandatory report shall:
  • (i) appropriately safeguard the confidentiality of the identity of the reporter and of the persons mentioned in the report;
  • (ii) be made as soon as practicable, but in any case, within 72 hours after the organisation has become aware of the occurrence unless exceptional circumstances prevent that;
  • (iii) be made in a form and manner established by the competent authority;
  • (iv) contain all pertinent information about the condition known to the organisation;
  • (2) where relevant, a follow-up report that provides details of the actions that the organisation intends to take to prevent similar occurrences in the future shall be made as soon as those actions have been identified; those follow-up reports shall:
  • (i) be sent to the entities referred to in points (b) and (c) to which the initial report was sent;
  • (ii) be made in a form and manner established by the competent authority.

CAMO.A.200   Management system

  • (a) The organisation shall establish, implement, and maintain a management system that includes:
  • (1) clearly defined lines of responsibility and accountability throughout the organisation, including a direct safety accountability of the accountable manager;
  • (2) a description of the overall philosophies and principles of the organisation with regard to safety, referred to as the safety policy;
  • (3) the identification of aviation safety hazards entailed by the activities of the organisation, their evaluation and the management of associated risks, including taking actions to mitigate the risks and verify their effectiveness;
  • (4) maintaining personnel trained and competent to perform their tasks;
  • (5) documentation of all management system key processes, including a process for making personnel aware of their responsibilities and the procedure for amending this documentation;
  • (6) a function to monitor compliance of the organisation with the relevant requirements. Compliance monitoring shall include a feedback system of findings to the accountable manager to ensure effective implementation of corrective actions as necessary;
  • (7) any additional requirements that are laid down in this Regulation.
  • (b) The management system shall correspond to the size of the organisation and the nature and complexity of its activities, taking into account the hazards and associated risks inherent in these activities.
  • (c) Where the organisation holds one or more additional organisation certificates within the scope of Regulation (EU) 2018/1139 and its delegated and implementing acts, the management system may be integrated with that required under the additional certificate(s) held.
  • (d) Notwithstanding point (c), for air carriers licensed in accordance with Regulation (EC) No 1008/2008, the management system provided for in this Annex shall be an integrated part of the operator's management system.
- (e) When, in accordance with point M.A.201(ea) of Annex I (Part-M), a contract is concluded between a CAMO and operators forming part of a single air carrier business grouping, the CAMO shall ensure that its management system is harmonised with the management systems of the operators forming part of that business grouping.

CAMO.A.200A   Information security management system

In addition to the management system referred to in point CAMO.A.200, the organisation shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

CAMO.A.202   Internal safety reporting scheme
  • (a) As part of its management system, the organisation shall establish an internal safety reporting scheme to enable the collection and evaluation of such occurrences to be reported under point CAMO.A.160.
- (b) The scheme shall also enable the collection and evaluation of those errors, near misses, and hazards reported internally that do not fall under point (a).
  • (c) Through this scheme, the organisation shall:
  • (1) identify the causes of and contributing factors to any errors, near misses, and hazards reported and address them as part of safety risk management in accordance with point (a)(3) of point CAMO.A.200;
  • (2) ensure evaluation of all known, relevant information relating to errors, the inability to follow procedures, near misses, and hazards, and a method to circulate the information as necessary.
  • (d) The organisation shall provide access to its internal safety reporting scheme to any subcontracted organisation.
  • (e) The organisation shall cooperate on safety investigations with any other organisation having a significant contribution to the safety of its own continuing airworthiness management activities.

CAMO.A.205   Contracting and subcontracting

  • (a) The organisation shall ensure that when contracting maintenance or when subcontracting any part of its continuing airworthiness management activities:
  • (1) these activities conform to the applicable requirements; and
  • (2) any aviation safety hazards associated with such contracting or subcontracting are considered as part of the organisation's management system.
  • (b) When the organisation subcontracts any part of its continuing airworthiness management activities to another organisation, the subcontracted organisation shall work under the approval of the organisation. The organisation shall ensure that the competent authority is given access to the subcontracted organisation, to determine continued compliance with the applicable requirements.
CAMO.A.215   Facilities

The organisation shall provide suitable office accommodation at appropriate locations for the personnel specified in point CAMO.A.305.

CAMO.A.220   Record-keeping

  • (a) Continuing airworthiness management records
  • (1) The organisation shall ensure that records required by points M.A.305, ML.A.305 and, if applicable point M.A.306, are retained.
  • (2) The organisation shall record all details of work carried out.
  • (3) The organisation shall retain a copy of each airworthiness review certificate and recommendation that are issued, as applicable, together with the airworthiness review report.
  • (4) The organisation shall retain a copy of each evaluation programme and evaluation report that are issued in accordance with the provisions of point 21.A.174(d) of Annex I (Part 21) or, as applicable, point 21L.A.143(h) of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012.
  • (5) The organisation shall retain a copy of each permit to fly that is issued, and the related documents, in accordance with the provisions of point 21.A.5(c)(2) of Annex I (Part 21) or, as applicable, point 21L.A.7(c) of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012 for a period of 5 years from the date on which the permit to fly was issued.
  • (6) The organisation shall retain a copy of all records referred to in points (2), (3) and (4) of this point for a period of 3 years after the continuing airworthiness management of the aircraft in accordance with point M.A.201 of Annex I (Part-M) or point ML.A.201 of Annex Vb (Part-ML), as applicable, has been transferred to another person or organisation.
  • (7) If the organisation issuing the airworthiness review certificate, recommendation, evaluation programme/report or permit to fly is different from the organisation managing the continuing airworthiness of the aircraft, the issuing organisation shall retain a copy of all records referred to in points (3), (4) and (5) and all supporting documents for a period of 5 years from the date on which the airworthiness review certificate, recommendation, evaluation programme/report or permit to fly was issued.
  • (8) When the organisation ceases operations, all retained records shall be transferred to the owner of the aircraft.
- (b) Management system, contracting and subcontracting records
  • (1) The organisation shall ensure that the following records are retained:
  • (i) records of management system key processes as defined in point CAMO.A.200;
  • (ii) contracts, both for contracting and subcontracting, as defined in point CAMO.A.205;
  • (2) Management system records, as well as any contracts pursuant to point CAMO.A.205, shall be kept for a minimum period of 5 years.
  • (c) Personnel records
  • (1) The organisation shall ensure that the following records are retained:
  • (i) records of qualification and experience of personnel involved in continuing airworthiness management, compliance monitoring and safety management;
  • (ii) records of qualification and experience of all airworthiness review staff, as well as staff issuing recommendations and permits to fly.
  • (2) The records of all airworthiness review staff, staff issuing recommendations and staff issuing permits to fly shall include details of any appropriate qualification held together with a summary of the relevant continuing airworthiness management experience and training and a copy of the authorisation.
  • (3) Personnel records shall be kept as long as the person works for the organisation, and shall be retained until 3 years after the person has left the organisation.
  • (d) The organisation shall establish a system of record-keeping that allows adequate storage and reliable traceability of all activities developed.
  • (e) The format of the records shall be specified in the organisation's procedures.
  • (f) Records shall be stored in a manner that ensures protection from damage, alteration and theft.

CAMO.A.300   Continuing airworthiness management exposition (CAME)

  • (a) The organisation shall provide the competent authority with a CAME and, where applicable, any referenced associated manuals and procedures, containing all of the following information:
  • (1) a statement signed by the accountable manager confirming that the organisation will at all times work in accordance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, and with the approved CAME. When the accountable manager is not the chief executive officer of the organisation, then such chief executive officer shall countersign the statement;
  • (2) the organisation's safety policy as defined in point (a)(2) of point CAMO.A.200;
  • (3) the organisation's scope of work relevant to the terms of approval;
  • (4) a general description of the manpower resources and of the system in place to plan the availability of staff as required by point (d) of point CAMO.A.305;
  • (5) the title(s) and name(s) of person(s) referred to in points (a)(3) to (a)(5), (b)(2) and (f) of point CAMO.A.305;
  • (6) the duties, accountabilities, responsibilities and authorities of the persons nominated under points (a)(3) to (a)(5), (b)(2), (e) and (f) of point CAMO.A.305;
  • (7) an organisation chart showing the associated chains of accountability and responsibility between all the person(s) referred to in points (a)(3) to (a)(5), (b)(2), (e) and (f) of point CAMO.A.305, and related to point (a)(1) of point CAMO.A.200;
  • (8) a list of the staff authorised to issue airworthiness review certificates or recommendations as referred to in point CAMO.A.305(e), specifying, where applicable, the staff authorised to issue permits to fly in accordance with point CAMO.A.125(f) as well as the staff authorised to develop an evaluation programme and conduct the corresponding investigation activities in accordance with point CAMO.A.125(g);
  • (9) a general description and location of the facilities;
  • (10) the description of the internal safety reporting scheme as required by point CAMO.A.202;
  • (11) the procedures specifying how the organisation ensures compliance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, including in particular:
  • (i) the documentation of management system key processes as required by point CAMO.A.200;
  • (ii) procedures defining how the organisation controls any contracted and subcontracted activities as required by point CAMO.A.205 and point (c) of point CAMO.A.315);
  • (iii) continuing airworthiness management, airworthiness review, evaluation programme and permit to fly procedures, as applicable;
  • (iv) the procedure defining the scope of changes not requiring prior approval and describing how such changes will be managed and notified, as required by point (b) of point CAMO.A.115 and point (c) of point CAMO.A.130;
  • (v) the CAME amendment procedures.
  • (12) the list of approved aircraft maintenance programmes for those aircraft for which a continuing airworthiness management contract exists in accordance with point M.A.201 or ML.A.201;
  • (13) the list of maintenance contracts in accordance with point (c) of point CAMO.A.315;
  • (14) the list of currently approved alternative means of compliance.
  • (b) The initial issue of the CAME shall be approved by the competent authority. It shall be amended as necessary to remain an up-to-date description of the organisation.
  • (c) Amendments to the CAME shall be managed as defined in the procedures referred to in points (a)(11)(iv) and (a)(11)(v). Any amendments not included in the scope of the procedure referred to in point (a)(11)(iv), as well as amendments related to the changes listed in point CAMO.A.130(a), shall be approved by the competent authority.
CAMO.A.305   Personnel requirements
  • (a) The organisation shall appoint an accountable manager, who has corporate authority for ensuring that all continuing airworthiness management activities can be financed and carried out in accordance with Regulation (EU) 2018/1139 and delegated and implementing acts adopted on the basis thereof. The accountable manager shall:
  • (1) ensure that all necessary resources are available to manage continuing airworthiness in accordance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, to support the organisation approval certificate;
  • (2) establish and promote the safety policy specified in point CAMO.A.200;
  • (3) nominate a person or group of persons with the responsibility of ensuring that the organisation always complies with the applicable continuing airworthiness management, airworthiness review and permit to fly requirements of this Annex, Annex I (Part-M) and Annex Vb (Part-ML);
  • (4) nominate a person or group of persons with the responsibility for managing the compliance monitoring function as part of the management system;
  • (5) nominate a person or group of persons with the responsibility for managing the development, administration, and maintenance of effective safety management processes as part of the management system;
  • (6) ensure that the person or group of persons nominated in accordance with points (a)(3) to (a)(5) and (b)(2) of point CAMO.A.305 have direct access to keep him/her properly informed on compliance and safety matters;
  • (7) demonstrate a basic understanding of this Regulation.
  • (b) For organisations also approved as air carriers licensed in accordance with Regulation (EC) No 1008/2008, the accountable manager shall in addition:
  • (1) be the person appointed as accountable manager for the air carrier as required by point (a) of point ORO.GEN.210 of Annex III (Part-ORO) to Regulation (EU) No 965/2012;
  • (2) nominate a person responsible for the management and supervision of continuing airworthiness, who shall not be employed by an organisation approved in accordance with Annex II (Part-145) under contract to the operator, unless specifically agreed by the competent authority.
  • (ba) If involved in continuing airworthiness management activities related to a contract established in accordance with point M.A.201(ea), the person or persons nominated in accordance with point (a)(3) of point CAMO.A.305 shall not be employed by an organisation approved in accordance with Annex II (Part-145) under contract to the CAMO, unless specifically agreed by the competent authority.
  • (c) The person or persons nominated in accordance with points (a)(3) to (a)(5) and (b)(2) of point CAMO.A.305 shall be able to demonstrate relevant knowledge, background and satisfactory experience related to aircraft continuing airworthiness management and demonstrate a working knowledge of this Regulation. Such person(s) shall be ultimately responsible to the accountable manager.
- (d) The organisation shall have a system in place to plan the availability of staff to ensure that the organisation has sufficient appropriately qualified staff to plan, perform, supervise, inspect and monitor the organisation's activities in accordance with the terms of approval.
  • (e) To be approved to carry out airworthiness reviews or recommendations in accordance with point (e) of point CAMO.A.125 and, if applicable, to issue permits to fly in accordance with point (f) of point CAMO.A.125, the organisation shall have airworthiness review staff qualified and authorised in accordance with point CAMO.A.310.
  • (f) For organisations extending airworthiness review certificates in accordance with point (d)(4) of point CAMO.A.125, the organisation shall nominate persons authorised to do so.
  • (g) The organisation shall establish and control the competency of personnel involved in compliance monitoring, safety management, continuing airworthiness management, airworthiness reviews or recommendations, and, if applicable, issuing permits to fly, in accordance with a procedure and to a standard agreed by the competent authority. In addition to the necessary expertise related to the job function, competency must include an understanding of safety management and human factors principles appropriate to the person's function and responsibilities in the organisation.

CAMO.A.310   Airworthiness review staff qualifications

  • (a) In order to be approved to carry out airworthiness reviews and, if applicable, to issue permits to fly, the organisation shall have airworthiness review staff that comply with all the following requirements:
  • (1) they have acquired at least 5 years of experience in continuing airworthiness;
  • (2) they hold an appropriate licence in compliance with Annex III (Part-66), or an aeronautical degree or national equivalent;
  • (3) they have received formal aeronautical maintenance training;
  • (4) they have a position within the approved organisation with appropriate responsibilities.
- (b) Notwithstanding points (a)(1), (a)(3) and (a)(4), the requirement laid down in point (a)(2) may be replaced with 5 years of experience in continuing airworthiness additional to those already required by point (a)(1).
  • (c) Before the organisation issues an airworthiness review authorisation to a candidate, that person shall perform an airworthiness review under the supervision of the competent authority or under the supervision of a person that is already authorised as airworthiness review staff by the organisation, in accordance with a procedure approved by the competent authority. If that airworthiness review under supervision is satisfactory, the competent authority shall formally accept that person to become airworthiness review staff.
- (d) The organisation shall ensure that airworthiness review staff can demonstrate appropriate recent continuing airworthiness management experience.

CAMO.A.315   Continuing airworthiness management

- (a) The organisation shall ensure that all continuing airworthiness management is carried out in accordance with Section A, Subpart C of Annex I (Part-M), or Section A Subpart C of Annex Vb (Part-ML), as applicable.

- (b) For every aircraft managed, the organisation shall in particular:

  • (1) ensure that an aircraft maintenance programme including any applicable reliability programme, as required by point M.A.302 or ML.A.302 as applicable, is developed and controlled;
  • (2) for aircraft not used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, provide a copy of the aircraft maintenance programme to the owner or operator responsible in accordance with point M.A.201 or ML.A.201 as applicable;
  • (3) ensure that data used for any modification and repairs complies with points M.A.304 or ML.A.304 as applicable;
  • (4) for all complex motor-powered aircraft or aircraft used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, establish a procedure to assess non-mandatory modifications and/or inspections and decide on their application, making use of the organisation's safety risk management process as required by point (a)(3) of point CAMO.A.200;
  • (5) ensure that the aircraft, engine(s), propeller(s) and components thereof are taken to an appropriately approved maintenance organisation referred to in Subpart F of Annex I (Part-M), Annex II (Part-145) or Annex Vd (Part-CAO) whenever necessary;
  • (6) order maintenance, supervise activities, and coordinate related decisions to ensure that any maintenance is carried out properly and is appropriately released for the determination of aircraft airworthiness.
- (c) Where the organisation is not appropriately approved in accordance with Subpart F of Annex I (Part-M), Annex II (Part-145) or Annex Vd (Part-CAO) it shall, in consultation with the operator, manage the written maintenance contracts required by points (e)(3), (f)(3), (g)(3) and (h)(3) of M.A.201 or point ML.A.201 to ensure that:
  • (1) all maintenance is ultimately carried out by an appropriately approved maintenance organisation;
  • (2) the functions required under points (b), (c), (f) and (g) of point M.A.301 of Annex I (Part-M) or point ML.A.301 of Annex Vb (Part-ML), as applicable, are clearly specified.
  • (d) Notwithstanding point (c), the contract may be in the form of individual work orders addressed to the maintenance organisation in the case of:
  • (1) an aircraft requiring unscheduled line maintenance;
  • (2) component maintenance, including engine and propeller maintenance, as applicable.
- (e) The organisation shall ensure that human factors and human performance limitations are taken into account during continuing airworthiness management, including all contracted and subcontracted activities.

CAMO.A.320   Airworthiness review

When the organisation approved in accordance with point CAMO.A.125(e) of this Annex carries out airworthiness reviews, they shall be carried out in accordance with point M.A.903 of Annex I (Part-M) or point ML.A.903 of Annex Vb (Part-ML), as applicable.

CAMO.A.325   Continuing airworthiness management data

The organisation shall hold and use applicable current maintenance data in accordance with point M.A.401 of Annex I (Part-M) or point ML.A.401 of Annex Vb (Part-ML), as applicable, for the performance of continuing airworthiness tasks referred to in point CAMO.A.315 of this Annex (Part-CAMO). That data may be provided by the owner or the operator, subject to an appropriate contract being established with such an owner or operator. In such case, the continuing airworthiness management organisation shall only keep such data for the duration of the contract, except when otherwise required by point CAMO.A.220(a).

SECTION B

AUTHORITY REQUIREMENTS

CAMO.B.005   Scope

This Section establishes the administrative and management system requirements to be followed by the competent authority in charge of the implementation and enforcement of Section A of this Annex.

CAMO.B.115   Oversight documentation

The competent authority shall provide all legislative acts, standards, rules, technical publications, and related documents to relevant personnel in order to allow them to perform their tasks and to discharge their responsibilities.

CAMO.B.120   Means of compliance

- (a) The Agency shall develop Acceptable Means of Compliance (‘AMC’) that may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.
  • (b) Alternative means of compliance may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts
  • (c) The competent authority shall establish a system to consistently evaluate that all alternative means of compliance used by itself or by organisations under its oversight allow for the establishment of compliance with Regulation (EU) No 2018/1139 and its delegated and implementing acts.
  • (d) The competent authority shall evaluate all alternative means of compliance proposed by an organisation in accordance with point CAMO.A.120 by analysing the documentation provided and, if considered necessary, conducting an inspection of the organisation. When the competent authority finds that the alternative means of compliance are in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts, it shall without undue delay:
  • (1) notify the applicant that the alternative means of compliance may be implemented and, if applicable, amend the approval or certificate of the applicant accordingly;
  • (2) notify the Agency of their content, including copies of all relevant documentation.
  • (e) When the competent authority itself uses alternative means of compliance to achieve compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts it shall:
  • (1) make them available to all organisations and persons under its oversight;
  • (2) without undue delay notify the Agency. The competent authority shall provide the Agency with a full description of the alternative means of compliance, including any revisions to procedures that may be relevant, as well as an assessment demonstrating that they comply with Regulation (EU) 2018/1139 and its delegated and implementing acts.
CAMO.B.125   Information to the Agency
  • (a) The competent authority of the Member State shall notify the Agency in case of any significant problems with the implementation of Regulation (EU) 2018/1139 and its delegated and implementing acts within 30 days from the time the authority became aware of the problems.
  • (b) Without prejudice to Regulation (EU) No 376/2014 and its delegated and implementing acts, the competent authority shall provide the Agency as soon as possible with any safety-significant information stemming from the occurrence reports stored in the national database pursuant to Article 6(6) of Regulation (EU) No 376/2014.
  • (c) The competent authority of the Member State shall provide the Agency as soon as possible with safety-significant information stemming from the information security reports it has received pursuant to point IS.I.OR.230 of Annex II (Part-IS.I.OR) to Implementing Regulation (EU) 2023/203.

CAMO.B.135   Immediate reaction to a safety problem

- (a) Without prejudice to Regulation (EU) No 376/2014 and Commission Implementing Regulation (EU) 2015/1018 ([^E0024]), the competent authority shall implement a system to appropriately collect, analyse, and disseminate safety information.
  • (b) The Agency shall implement a system to appropriately analyse any relevant safety information received, and without undue delay provide to Member States and the Commission any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to a safety problem involving products, parts, appliances, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.
  • (c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the safety problem.
  • (d) Measures taken under point (c) shall immediately be notified to all persons or organisations which need to comply with them under Regulation (EU) 2018/1139 and and its delegated and implementing acts. The competent authority shall also notify those measures to the Agency and, when combined action is required, the other Member States concerned.

CAMO.B.135A   Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

  • (a) The competent authority shall implement a system to appropriately collect, analyse, and disseminate information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State to increase the coordination and compatibility of reporting schemes.
- (b) The Agency shall implement a system to appropriately analyse any relevant safety-significant information received in accordance with point CAMO.B.125(c), and without undue delay provide the Member States and the Commission with any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to an information security incident or vulnerability with a potential impact on aviation safety involving products, parts, non-installed equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.
  • (c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the potential impact on aviation safety of the information security incident or vulnerability.
  • (d) Measures taken in accordance with point (c) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority of the Member State shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.

CAMO.B.200   Management system

- (a) The competent authority shall establish and maintain a management system, including as a minimum:
  • (1) documented policies and procedures to describe its organisation, means and methods to comply with Regulation (EU) 2018/1139 and its delegated and implementing acts. The procedures shall be kept up to date, and serve as the basic working documents within that competent authority for all related tasks;
  • (2) a sufficient number of personnel to perform its tasks and discharge its responsibilities. A system shall be in place to plan the availability of personnel, in order to ensure the proper completion of all tasks;
  • (3) personnel qualified to perform their allocated tasks and have the necessary knowledge, experience, initial and recurrent training to ensure continuing competency;
  • (4) adequate facilities and office accommodation to perform the allocated tasks;
  • (5) a function to monitor compliance of the management system with the relevant requirements and adequacy of the procedures including the establishment of an internal audit process and a safety risk management process. Compliance monitoring shall include a feedback system of audit findings to the senior management of the competent authority to ensure implementation of corrective actions as necessary;
  • (6) a person or group of persons ultimately responsible to the senior management of the competent authority for the compliance monitoring function.
  • (b) The competent authority shall, for each field of activity, including management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).
  • (c) The competent authority shall establish procedures for participation in a mutual exchange of all necessary information and assistance with other competent authorities concerned, including all findings raised and follow-up actions taken as a result of oversight of persons and organisations exercising activities in the territory of a Member State, but certified by the competent authority of another Member State or the Agency.
  • (d) A copy of the procedures related to the management system and their amendments shall be made available to the Agency for the purpose of standardisation and to the organisations subject to this Regulation, if so requested.
- (e) In addition to the requirements contained in point (a), the management system established and maintained by the competent authority shall comply with Annex I (Part-IS.AR) to Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

CAMO.B.205   Allocation of tasks

  • (a) Tasks related to the initial certification, or continuing oversight of persons, or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts may be allocated by Member States only to qualified entities. When allocating tasks, the competent authority shall ensure that it has:
  • (1) put a system in place to initially and continuously assess that the qualified entity complies with Annex VI ‘Essential requirements for qualified entities’ to Regulation (EU) 2018/1139. This system and the results of the assessments shall be documented;
  • (2) established a documented agreement with the qualified entity, approved by both parties at the appropriate management level, which clearly defines:
  • (i) the tasks to be performed;
  • (ii) the declarations, reports, and records to be provided;
  • (iii) the technical conditions to be met in performing such tasks;
  • (iv) the related liability coverage;
  • (v) the protection given to information acquired in carrying out such tasks.
  • (b) The competent authority shall ensure that the internal audit process and safety risk management process required by point (a)(5) of point CAMO.B.200 covers all certification, or continuing oversight tasks performed on its behalf.
  • (c) With regard to the certification and oversight of the organisation’s compliance with point CAMO.A.200A, the competent authority may allocate tasks to qualified entities in accordance with point (a), or to any relevant authority responsible for information security or cybersecurity within the Member State. When allocating tasks, the competent authority shall ensure that:
  • (1) all aspects related to aviation safety are coordinated and taken into account by the qualified entity or relevant authority;
  • (2) the results of the certification and oversight activities performed by the qualified entity or relevant authority are integrated in the overall certification and oversight files of the organisation;
  • (3) its own information security management system established in accordance with point CAMO.B.200(e) covers all the certification and continuing oversight tasks performed on its behalf.
CAMO.B.210   Changes in the management system
  • (a) The competent authority shall have a system in place to identify changes that affect its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts. This system shall enable it to take action as appropriate to ensure that its management system remains adequate and effective.
  • (b) The competent authority shall update its management system to reflect any change to Regulation (EU) 2018/1139 and its delegated and implementing acts in a timely manner, so as to ensure effective implementation.
  • (c) The competent authority shall notify the Agency of changes affecting its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts.

CAMO.B.220   Record-keeping

  • (a) The competent authority shall establish a system of record-keeping that allows adequate storage, accessibility, and reliable traceability of:
  • (1) the management system's documented policies and procedures;
  • (2) training, qualification, and authorisation of its personnel;
  • (3) the allocation of tasks, covering the elements required by point CAMO.B.205, as well as the details of tasks allocated;
  • (4) certification processes and continuing oversight of certified organisations, including:
  • (i) the application for an organisation certificate;
  • (ii) the competent authority's continuing oversight programme, including all assessment, audit and inspection records;
  • (iii) the organisation certificate, including any changes thereto;
  • (iv) a copy of the oversight programme listing the dates when audits are due and when audits were carried out;
  • (v) copies of all formal correspondence;
  • (vi) details of findings, corrective actions, date of action closure, any exemption and enforcement actions;
  • (vii) any assessment, audit and inspection reports issued by another competent authority pursuant to point (d) of point CAMO.B.300;
  • (viii) copies of all organisation CAMEs or manuals and amendments thereto;
  • (ix) copies of any other document approved by the competent authority;
  • (5) the evaluation and notification to the Agency of alternative means of compliance proposed by organisations, and the assessment of alternative means of compliance used by the competent authority itself;
  • (6) safety information and follow-up measures in accordance with point CAMO.B.125;
  • (7) the use of flexibility provisions in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts.
  • (b) The competent authority shall maintain a list of all organisation certificates it issued.
  • (c) All records referred to in points (a) and (b) shall be kept for a minimum period of 5 years subject to applicable data protection law.
  • (d) All records referred to in points (a) and (b) shall be made available upon request to a competent authority of another Member State or the Agency.
CAMO.B.300   Oversight principles
  • (a) The competent authority shall verify:
  • (1) compliance with the requirements applicable to organisations prior to the issue of an organisation certificate, as applicable;
  • (2) continued compliance with the applicable requirements of organisations it has certified;
  • (3) implementation of appropriate safety measures mandated by the competent authority as defined in points (c) and (d) of point CAMO.B.135.

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.