Commission Regulation (EU) No 1321/2014 of 26 November 2014 on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks Text with EEA relevance

• (a) Competence and responsibility
• 1. The Pilot-owner is always responsible for any maintenance that he performs.
• 1. Before carrying out any Pilot-owner maintenance tasks, the Pilot-owner must satisfy himself that he is competent to do the task. It is the responsibility of Pilot-owners to familiarize themselves with the standard maintenance practices for their aircraft and with the aircraft maintenance programme. If the Pilot-owner is not competent for the task to be carried out, the task cannot be released by the Pilot-owner.
• 1. The Pilot-owner (or his contracted CAMO or CAO) is responsible for identifying the Pilot-owner tasks according to these basic principles in the maintenance programme and for ensuring that the document is updated in a timely manner.
• 1. The approval of the maintenance programme has to be carried out in accordance with point M.A.302.

• (b) Tasks The Pilot-owner may carry out simple visual inspections or operations to check for general condition and obvious damage and normal operation of the airframe, engines, systems and components. Maintenance tasks shall not be carried out by the Pilot-owner when the task:
• 1. is a critical maintenance task
• 1. requires the removal of major components or major assembly and/or;
• 1. is carried out in compliance with an Airworthiness Directive or an Airworthiness Limitation Item, unless specifically allowed in the AD or the ALI and/or;
• 1. requires the use of special tools, calibrated tools (except torque wrench and crimping tool) and/or;
• 1. requires the use of test equipments or special testing (e.g. NDT, system tests or operational checks for avionic equipment) and/or;
• 1. is composed of any unscheduled special inspections (e.g. heavy landing check) and/or;
• 1. is effecting systems essential for the IFR operations and/or;
• 1. is listed in Appendix VII to this Annex or is a component maintenance task in accordance with points M.A.502(a), (b), (c) or (d). ————— The criteria 1 to 8 cannot be overridden by less restrictive instructions issued in accordance with ‘M.A.302(d) Maintenance Programme. Any task described in the aircraft flight manual as preparing the aircraft for flight (Example: assembling the glider wings or pre-flight), is considered to be a pilot task and is not considered a Pilot-owner maintenance task and therefore does not require a Certificate of Release to Service.

• (c) Performance of the maintenance Pilot-owner tasks and records The maintenance data as specified in point M.A.401 must be always available during the conduct of Pilot-owner maintenance and must be complied with. Details of the data referred to in the conduct of Pilot-owner maintenance must be included in the Certificate of Release to Service in accordance with point M.A.803(d). The Pilot-owner must inform the approved continuing airworthiness management organisation responsible for the continuing airworthiness of the aircraft (if applicable) not later than 30 days after completion of the Pilot-owner maintenance task in accordance with point M.A.305(a).

ANNEX II

(Part-145)

CONTENTS	CONTENTS
145.1	Competent authority
	SECTION A – TECHNICAL AND ORGANISATION REQUIREMENTS
145.A.10	Scope
145.A.15	Application for an organisation certificate
145.A.20	Terms of approval and scope of work
145.A.25	Facility requirements
145.A.30	Personnel requirements
145.A.35	Certifying staff and support staff
145.A.37	Airworthiness review staff
145.A.40	Equipment and tools
145.A.42	Components
145.A.45	Maintenance data
145.A.47	Production planning
145.A.48	Performance of maintenance
145.A.50	Certification of maintenance
145.A.55	Record-keeping
145.A.60	Occurrence reporting
145.A.65	Maintenance procedures
145.A.70	Maintenance organisation exposition (MOE)
145.A.75	Privileges of the organisation
145.A.85	Changes to the organisation
145.A.90	Continued validity
145.A.95	Findings
145.A.120	Means of compliance
145.A.140	Access
145.A.155	Immediate reaction to a safety problem
145.A.200	Management system
145.A.200A	Information security management system
145.A.202	Internal safety reporting scheme
145.A.205	Contracting and subcontracting
	SECTION B – AUTHORITY REQUIREMENTS
145.B.005	Scope
145.B.115	Oversight documentation
145.B.120	Means of compliance
145.B.125	Information to the Agency
145.B.135	Immediate reaction to a safety problem
145.B.135A	Immediate reaction to an information security incident or vulnerability with an impact on aviation safety
145.B.200	Management system
145.B.205	Allocation of tasks
145.B.210	Changes in the management system
145.B.220	Record-keeping
145.B.300	Oversight principles
145.B.305	Oversight programme
145.B.310	Initial certification procedure
145.B.330	Changes – organisations
145.B.330A	Changes to the information security management system
145.B.350	Findings and corrective actions; observations
145.B.355	Suspension, limitation and revocation
Appendix I	– Authorised Release Certificate – EASA Form 1
Appendix II	– Class and rating system for the terms of approval of Part-145 maintenance organisations
Appendix III	– Maintenance organisation certificate – EASA Form 3-145
Appendix IV	– Conditions for the use of staff not qualified in accordance with Annex III (Part-66) referred to in points 145.A.30(j)1 and 2

145.1   Competent authority

For the purpose of this Annex, the competent authority shall be:

• 1. for organisations that have their principal place of business in a territory for which a Member State is responsible under the Convention on International Civil Aviation, signed in Chicago on 7 December 1944 (‘the Chicago Convention’), the authority designated by that Member State, or by another Member State in accordance with Article 64 of Regulation (EU) 2018/1139, or the Agency if the responsibility has been reallocated to the Agency in accordance with Articles 64 or 65 of Regulation (EU) 2018/1139; or

• 1. for organisations that have their principal place of business outside a territory for which a Member State is responsible under the Chicago Convention, the Agency.

SECTION A   TECHNICAL AND ORGANISATION REQUIREMENTS

145.A.10   Scope

• This Section establishes the requirements to be met by an organisation to qualify for the issue or continuation of an approval certificate for the maintenance of aircraft and components.

145.A.15   Application for an organisation certificate

• (a) An application for a certificate or an amendment to an existing certificate in accordance with this Annex shall be made in a form and manner established by the competent authority, taking into account the applicable requirements of Annex I (Part-M), Annex Vb (Part-ML) and this Annex.

• (b) Applicants for an initial certificate pursuant to this Annex shall provide the competent authority with:
• 1. the results of a pre-audit performed by the organisation against the applicable requirements provided for in Annex I (Part-M), Annex Vb (Part-ML) and this Annex;
• 1. documentation demonstrating how they will comply with the requirements established in this Regulation.

145.A.20   Terms of approval and scope of work

• (a) The organisation’s scope of work shall be specified in the maintenance organisation exposition (MOE) in accordance with point 145.A.70.

• (b) The organisation shall comply with the terms of approval attached to the organisation certificate issued by the competent authority, and with the scope of work specified in the MOE.

145.A.25   Facility requirements

The organisation shall ensure that:

• (a) Facilities are provided appropriate for all planned work, ensuring in particular, protection from the weather elements. Specialised workshops and bays are segregated as appropriate, to ensure that environmental and work area contamination is unlikely to occur.
• 1. For base maintenance of aircraft, aircraft hangars are both available and large enough to accommodate aircraft on planned base maintenance;
• 1. For component maintenance, component workshops are large enough to accommodate the components on planned maintenance.

• (b) Office accommodation is provided for the management of the planned work referred to in point (a), and certifying staff so that they can carry out their designated tasks in a manner that contributes to good aircraft maintenance standards.

• (c) The working environment including aircraft hangars, component workshops and office accommodation is appropriate for the task carried out and in particular special requirements observed. Unless otherwise dictated by the particular task environment, the working environment must be such that the effectiveness of personnel is not impaired:
• 1. temperatures must be maintained such that personnel can carry out required tasks without undue discomfort.
• 1. dust and any other airborne contamination are kept to a minimum and not be permitted to reach a level in the work task area where visible aircraft/component surface contamination is evident. Where dust/other airborne contamination results in visible surface contamination, all susceptible systems are sealed until acceptable conditions are re-established.
• 1. lighting is such as to ensure each inspection and maintenance task can be carried out in an effective manner.
• 1. noise shall not distract personnel from carrying out inspection tasks. Where it is impractical to control the noise source, such personnel are provided with the necessary personal equipment to stop excessive noise causing distraction during inspection tasks.
• 1. where a particular maintenance task requires the application of specific environmental conditions different to the foregoing, then such conditions are observed. Specific conditions are identified in the maintenance data.
• 1. the working environment for line maintenance is such that the particular maintenance or inspection task can be carried out without undue distraction. Therefore where the working environment deteriorates to an unacceptable level in respect of temperature, moisture, hail, ice, snow, wind, light, dust/other airborne contamination, the particular maintenance or inspection tasks must be suspended until satisfactory conditions are re-established.

• (d) Secure storage facilities are provided for components, equipment, tools and material. Storage conditions ensure segregation of serviceable components and material from unserviceable aircraft components, material, equipment and tools. The conditions of storage are in accordance with the manufacturer's instructions to prevent deterioration and damage of stored items. Access to storage facilities is restricted to authorised personnel.

145.A.30   Personnel requirements

• (a) The organisation shall appoint an accountable manager that has corporate authority to ensure that all maintenance activities of the organisation can be financed and carried out in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts. The accountable manager shall:
• 1. ensure that all necessary resources are available to accomplish maintenance in accordance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, to support the organisation certificate;
• 1. establish and promote the safety policy specified in point 145.A.200(a)(2);
• 1. demonstrate a basic understanding of this Regulation.

• (b) The accountable manager shall nominate a person or group of persons representing the management structure for the maintenance functions and with the responsibility to ensure that the organisation works in accordance with the MOE and approved procedures. It shall be made clear in the procedures who deputises for a particular person in the case of lengthy absence of that person.

• (c) The accountable manager shall nominate a person or group of persons with the responsibility to manage the compliance monitoring function as part of the management system.

• (ca) The accountable manager shall nominate a person or group of persons with the responsibility to manage the development, administration and maintenance of effective safety management processes as part of the management system.

• (cb) The person or group of persons nominated in accordance with points (b), (c) and (ca) shall have a responsibility to the accountable manager and direct access to him/her to keep him/her properly informed on compliance and safety matters.

• (cc) The person or persons nominated in accordance with points (b), (c) and (ca) shall be able to demonstrate relevant knowledge, background and satisfactory experience related to aircraft or component maintenance and demonstrate a working knowledge of this Regulation.

• (d) The organisation shall have a maintenance man-hour plan to ensure it has sufficient and appropriately qualified staff to plan, perform, supervise, inspect and monitor the organisation’s activities in accordance with the terms of approval. In addition, the organisation shall have a procedure to reassess the work intended to be carried out when the actual staff availability is reduced compared to the planned staffing level for a particular work shift or period.

• (e) The organisation shall establish and control the competency of the personnel involved in any maintenance, airworthiness reviews, safety management and compliance monitoring in accordance with a procedure and to a standard agreed with the competent authority. In addition to the necessary expertise related to the job function, the competency of the personnel must include an understanding of the application of safety management principles, including human factors and human performance issues, which is appropriate to their function and responsibilities in the organisation.

• (f) The organisation shall ensure that personnel who carry out or control a continued-airworthiness non-destructive test of aircraft structures or components, or both, are appropriately qualified for the particular non-destructive test in accordance with the European or equivalent standard recognised by the Agency. Personnel who carry out any other specialised task shall be appropriately qualified in accordance with officially recognised standards. By derogation from this point, personnel referred to in point (g), points (h)(1) and (h)(2), qualified in category B1, B3 or L in accordance with Annex III (Part-66), may carry out and/or control colour contrast dye penetrant tests.

• (g) Any organisation maintaining aircraft, except where stated otherwise in point (j), shall in the case of aircraft line maintenance, have appropriate aircraft-rated certifying staff qualified as category B1, B2, B2L, B3 and L, as appropriate, in accordance with Annex III (Part-66) and point 145.A.35. In addition such organisations may also use appropriately task-trained certifying staff holding the privileges set out in points 66.A.20(a)(1) and 66.A.20(a)(3)(ii) and qualified in accordance with Annex III (Part-66) and point 145.A.35 to carry out minor scheduled line maintenance and simple defect rectification. The availability of such certifying staff shall not replace the need for category B1, B2, B2L, B3 and L certifying staff, as appropriate.

• (h) Any organisation maintaining aircraft, except where stated otherwise in point (j), shall:
• 1. in the case of base maintenance of complex motor-powered aircraft, have appropriate aircraft-type-rated certifying staff, qualified as category C in accordance with Annex III (Part-66) and point 145.A.35. In addition, the organisation shall have sufficient aircraft-type-rated staff qualified as category B1 and B2, as appropriate, in accordance with Annex III (Part-66) and point 145.A.35 to support the category C certifying staff.
• (i) Category B1 and B2 support staff shall ensure that all relevant tasks or inspections have been carried out to the required standard before the category C certifying staff issues the certificate of release to service.
• (ii) The organisation shall maintain a register of any such category B1 and B2 support staff.
• (iii) The category C certifying staff shall ensure that compliance with point (i) has been met and that all work required by the customer has been accomplished during the particular base maintenance check or work package, and shall also assess the impact of any work not carried out, with a view to either requiring its accomplishment or agreeing with the operator to defer such work to another specified check or time limit.
• 1. in the case of base maintenance of aircraft other than complex motor-powered aircraft, have one of the following:
• (i) appropriate aircraft-rated certifying staff, qualified as category B1, B2, B2L, B3 and L, as appropriate, in accordance with Annex III (Part-66) and point 145.A.35;
• (ii) appropriate aircraft-rated certifying staff, qualified in category C or L5, as applicable, and assisted by support staff, as set out in point 145.A.35(a)(1);

• (i) Component certifying staff shall be qualified in accordance with Article 5(6) and point 145.A.35.

• (j) By way of derogation from points (g) and (h), in relation to the obligation to comply with Annex III (Part-66), the organisation may use certifying staff and support staff that are qualified in accordance with the following provisions:
• 1. For base maintenance carried out at a location outside a territory for which a Member State is responsible under the Chicago Convention, the certifying staff and support staff may be qualified in accordance with the national aviation regulations of the State in which the base maintenance facility is located, subject to the conditions specified in Appendix IV to this Annex.
• 1. For line maintenance carried out at a line station located outside a territory for which a Member State is responsible under the Chicago Convention, the certifying staff may be qualified, subject to the conditions specified in Appendix IV to this Annex, in accordance with the following alternative conditions:
• — national aviation regulations of the State in which the line station is located,
• — national aviation regulations of the State in which the organisation’s principal place of business is located.
• 1. For a repetitive pre-flight airworthiness directive which specifically states that the flight crew may carry out such airworthiness directive, the organisation may issue a limited certification authorisation to the pilot on the basis of the flight crew licence held. In that case, the organisation shall ensure that the pilot has carried out sufficient practical training ensuring that the pilot can accomplish the airworthiness directive.
• 1. If an aircraft is operated away from a supported location, the organisation may issue a limited certification authorisation to the pilot on the basis of the flight crew licence held, subject to being satisfied that the pilot has carried out sufficient practical training ensuring that the pilot can accomplish the specified task.
• 1. In the following unforeseen cases, where an aircraft is grounded at a location other than the main base where no appropriate certifying staff are available, the organisation contracted to provide maintenance support may issue a one-off certification authorisation:
• (i) to one of its employees holding equivalent type authorisations on aircraft of similar technology, construction and systems; or
• (ii) to any person with not less than five years maintenance experience and holding a valid ICAO aircraft maintenance licence rated for the aircraft type requiring certification provided there is no organisation appropriately approved under this Part at that location and the contracted organisation obtains and holds on file evidence of the experience and the licence of that person. All such cases as specified in this point must be reported to the competent authority within seven days after issuing such certification authorisation. The organisation issuing the one-off authorisation shall ensure that any such maintenance that could affect flight safety is re-checked by an appropriately approved organisation.

• (k) If the organisation performs airworthiness reviews and issues the corresponding airworthiness review certificate in accordance with point ML.A.903 of Annex Vb (Part-ML), it shall have airworthiness review staff that are qualified and authorised in accordance with point 145.A.37.

145.A.35   Certifying staff and support staff

• (a) In addition to the requirements of points 145.A.30(g) and (h), the organisation shall ensure that certifying staff and support staff have an adequate understanding of the relevant aircraft or components, or both, to be maintained and of the associated organisation procedures. In the case of certifying staff, this shall be accomplished before the issue or reissue of the certification authorisation.
• 1. ‘Support staff’ means those staff holding an aircraft maintenance licence under Annex III (Part-66) in category B1, B2, B2L, B3 and/or L with the appropriate aircraft ratings, working in a base maintenance environment while not necessarily holding certification privileges.
• 1. ‘Relevant aircraft and/or components’, means those aircraft or components specified in the particular certification authorisation.
• 1. ‘Certification authorisation’ means the authorisation issued to certifying staff by the organisation and which specifies the fact that those staff may sign certificates of release to service within the limitations stated in such authorisation on behalf of the approved organisation.

• (b) Except for the cases listed in points 145.A.30(j) and 66.A.20(a)3(ii), the organisation may only issue a certification authorisation to certifying staff in relation to the basic categories or subcategories and, except for the category A licence, any type rating listed on the aircraft maintenance licence as required by Annex III (Part-66), subject to the licence remaining valid throughout the validity period of the authorisation and to the certifying staff remaining in compliance with Annex III (Part-66).

• (c) The organisation shall ensure that all certifying staff and support staff are involved in at least 6 months of actual relevant aircraft or component maintenance experience in any consecutive 2-year period. For the purpose of this point ‘involved in actual relevant aircraft or component maintenance’ means that the person has worked in an aircraft or component maintenance environment and has either exercised the privileges of the certification authorisation and/or has actually carried out maintenance on at least some of the aircraft type or aircraft group systems specified in the particular certification authorisation.

• (d) The organisation shall ensure that all certifying staff and support staff receive sufficient recurrent training in each 2-year period to ensure that they have up-to-date knowledge of relevant technologies, organisation procedures and safety management, including human factor issues.

• (e) The organisation shall establish a programme for recurrent training for certifying staff and support staff, including a procedure to ensure compliance with the relevant provisions of this point and a procedure to ensure compliance with Annex III (Part-66).

• (f) With the exception of the unforeseen cases specified in point 145.A.30(j)(5), the organisation shall assess all certifying staff for their competency, qualifications and capability to carry out their intended certifying duties in accordance with a procedure in the MOE prior to the issue or reissue of a certification authorisation under this Annex to such staff.

• (g) When the conditions of points (a), (b), (d), (f) and, where applicable, point (c) have been fulfilled by the certifying staff, the organisation shall issue a certification authorisation that clearly specifies the scope and limits of such authorisation. Continued validity of the certification authorisation is dependent upon continued compliance with points (a), (b), (d), and where applicable, (c).

• (h) The certification authorisation must be in a style that makes its scope clear to the certifying staff and any authorised person who may require to examine the authorisation. Where codes are used to define scope, the organisation shall make a code translation readily available. ‘Authorised person’ means the officials of the competent authorities, the Agency and the Member State who has responsibility for the oversight of the maintained aircraft or component.

• (i) The person or persons referred to in point 145.A.30(c) that are responsible for the compliance monitoring function shall also remain responsible for issuing certification authorisations to certifying staff. That personnel may nominate other persons to effectively issue or revoke certification authorisations in accordance with a procedure in the MOE.

• (j) The organisation shall provide certifying staff with a copy of their certification authorisation in either a documented or electronic format.

• (k) Certifying staff shall produce their certification authorisation to any authorised person within 24 hours.

• (l) The minimum age for certifying staff and support staff is 21 years.

• (m) The holder of a category A aircraft maintenance licence may only exercise certification privileges on a specific aircraft type following the satisfactory completion of the relevant category A aircraft task training carried out by an organisation appropriately approved in accordance with Annex II (Part-145) or Annex IV (Part-147). This training shall include practical hands on training and theoretical training as appropriate for each task authorised. Satisfactory completion of training shall be demonstrated by an examination or by workplace assessment carried out by the organisation.

• (n) The holder of a category B2 aircraft maintenance licence may only exercise the certification privileges described in point 66.A.20(a)(3)(ii) of Annex III (Part-66) following the satisfactory completion of:
• (i) the relevant category A aircraft task training; and
• (ii) 6 months of documented practical experience covering the scope of the authorisation that will be issued. The task training shall include practical hands on training and theoretical training as appropriate for each task authorised. Satisfactory completion of training shall be demonstrated by an examination or by workplace assessment. Task training and examination/assessment shall be carried out by the maintenance organisation issuing the certifying staff authorisation. The practical experience shall be also obtained within such maintenance organisation.

145.A.37   Airworthiness review staff

• (a) In order to be approved to carry out airworthiness reviews and to issue the corresponding airworthiness review certificates (ARC) for aircraft covered by Annex Vb (Part-ML), the organisation shall have airworthiness review staff that comply with all of the following requirements:
• (1) they have acquired experience in continuing airworthiness of at least 1 year for sailplanes and balloons and of at least 3 years for all other aircraft;
• (2) they hold a certifying staff authorisation for the corresponding aircraft;
• (3) they have acquired knowledge of Annex I (Part-M), Subpart C, or of Annex Vb (Part-ML), Subpart C;
• (4) they have acquired knowledge of the procedures of the maintenance organisation relevant to the airworthiness review and issue of the airworthiness review certificate.

• (b) Before the organisation issues an airworthiness review authorisation to a candidate, that person shall perform an airworthiness review under the supervision of the competent authority or under the supervision of a person that is already authorised as airworthiness review staff by the organisation. If this airworthiness review under supervision is satisfactory, the competent authority shall formally accept that person to become airworthiness review staff.

• (c) The organisation shall ensure that the airworthiness review staff can demonstrate appropriate recent continuing airworthiness experience.

145.A.40   Equipment and tools

• (a) The organisation shall have available and use the necessary equipment and tools to perform the approved scope of work.
• (i) Where the manufacturer specifies a particular tool or equipment, the organisation shall use that tool or equipment, unless the use of alternative tooling or equipment is agreed by the competent authority via procedures specified in the exposition.
• (ii) Equipment and tools must be permanently available, except in the case of any tool or equipment that is so infrequently used that its permanent availability is not necessary. Such cases shall be detailed in an exposition procedure.
• (iii) An organisation approved for base maintenance shall have sufficient aircraft access equipment and inspection platforms/docking as required for the proper inspection of the aircraft.

• (b) The organisation shall ensure that all tools, equipment and particularly test equipment, as appropriate, are controlled and calibrated according to an officially recognised standard at a frequency to ensure serviceability and accuracy. Records of such calibrations and traceability to the standard used shall be kept by the organisation.

145.A.42   Components

• (a) Classification of components. All components shall be classified into the following categories:
• (i) Components which are in a satisfactory condition, released on an EASA Form 1 or equivalent and marked in accordance with Subpart Q of Annex I (Part 21) or, as applicable, Subpart Q of Section A of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012, unless otherwise specified in point 21.A.307 of Annex I (Part 21) or point 21L.A.193 of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012, in point M.A.502 of Annex I (Part-M), in point ML.A.502 of Annex III (Part-ML), or in this Annex (Part-145).
• (ii) Unserviceable components which shall be maintained in accordance with this Regulation.
• (iii) Components categorised as unsalvageable because they have reached their mandatory life limitation or contain a non-repairable defect.
• (iv) Standard parts used on an aircraft, engine, propeller or other aircraft component when specified in the maintenance data and accompanied by evidence of conformity traceable to the applicable standard.
• (v) Material, both raw and consumable, used in the course of maintenance when the organisation is satisfied that the material meets the required specification and has appropriate traceability. All material shall be accompanied by documentation clearly relating to the particular material and containing a conformity to specification statement as well as the manufacturing and supplier source.

• (b) Components, standard parts and materials for installation
• (i) The organisation shall establish procedures for the acceptance of components, standard parts and materials for installation to ensure that components, standard parts and materials are in satisfactory condition and meet the applicable requirements of point (a).
• (ii) The organisation shall establish procedures to ensure that components, standard parts and materials shall only be installed on an aircraft or a component when they are in satisfactory condition, meet the applicable requirements of point (a) and the applicable maintenance data specifies the particular component, standard part or material.
• (iii) The organisation may fabricate a restricted range of parts to be used in the course of undergoing work within its own facilities, provided procedures are identified in the exposition.
• (iv) Components which are referred to in point (b)(2) of point 21.A.307 of Annex I (Part 21) or in point (b)(2) of point 21L.A.193 of Annex Ib (Part 21 Light) to Regulation (EU) No 748/2012 shall only be installed if considered eligible for installation by the aircraft owner on their own aircraft.

• (c) Segregation of components
• (i) Unserviceable and unsalvageable components shall be segregated from serviceable components, standards parts and materials.
• (ii) Unsalvageable components shall not be permitted to re-enter the component supply system, unless mandatory life limitation have been extended or a repair solution has been approved in accordance with Regulation (EU) No 748/2012.

145.A.45   Maintenance data

• (a) The organisation shall hold and use applicable current maintenance data which is necessary in the performance of maintenance, including modifications and repairs. ‘Applicable’ means relevant to any aircraft, component or process specified in the organisation’s terms of approval and in any associated capability list. In the case of maintenance data provided by the person or organisation requesting the maintenance, the organisation shall hold such data when the work is in progress, with the exception of the need to comply with point 145.A.55(a)(3).

• (b) Applicable maintenance data is the data specified in point M.A.401(b) of Annex I (Part-M) or in point ML.A.401(b) of Annex Vb (Part-ML), as applicable.

• (c) The organisation shall establish procedures to ensure that if inaccurate, incomplete or ambiguous procedure, practice, information or maintenance instruction is found in the maintenance data used by maintenance personnel, it is recorded as part of the internal safety reporting scheme referred to in point 145.A.202 and notified to the author of the maintenance data.

• (d) The organisation may only modify maintenance instructions in accordance with a procedure that is specified in the MOE. With respect to changes to maintenance instructions, the organisation shall demonstrate that they result in equivalent or improved maintenance standards, and shall inform the author of the maintenance instructions of such changes. For the purposes of this point, ‘maintenance instructions’ mean instructions on how to carry out a particular maintenance task; they exclude the engineering design of repairs and modifications.

• (e) The organisation shall provide a common work card or worksheet system to be used throughout the relevant parts of the organisation. In addition, the organisation shall either accurately transcribe the maintenance data referred to in points (b) and (d) onto such work cards or worksheets, or make precise reference to the particular maintenance task or tasks contained in that maintenance data. Work cards and worksheets may be computer generated and held in an electronic database that is adequately protected against unauthorised alteration, and for which there is a backup electronic database which shall be updated within 24 hours after an entry is made to the main electronic database. Complex or long maintenance tasks shall be transcribed onto the work cards or worksheets and subdivided into clear stages to ensure that there is a record of the accomplishment of the complete maintenance task. When the organisation provides maintenance services to an aircraft operator which requires its own work card or worksheet system to be used, then such work card or worksheet system may be used. In that case, the organisation shall establish a procedure to ensure that those work cards or worksheets are correctly completed.

• (f) The organisation shall ensure that all applicable maintenance data is readily available for use when required by maintenance personnel.

• (g) The organisation shall establish a procedure to ensure that maintenance data it controls is kept up to date. In the case of operator/customer controlled and provided maintenance data, the organisation shall be able to show that either it has written confirmation from the operator/customer that all such maintenance data is up to date or it has work orders specifying the amendment status of the maintenance data to be used or it can show that it is on the operator/customer maintenance data amendment list.

145.A.47   Production planning

• (a) The organisation shall have a system appropriate to the amount and complexity of work to plan the availability of all necessary personnel, tools, equipment, material, maintenance data and facilities in order to ensure the safe completion of the maintenance work.

• (b) As part of the management system, the planning of maintenance tasks, and the organising of shifts, shall take into account human performance limitations, including the threat of fatigue for maintenance personnel.

• (c) When it is required to hand over the continuation or completion of maintenance tasks for reasons of a shift or personnel changeover, relevant information shall be adequately communicated between outgoing and incoming personnel.

• (d) The organisation shall ensure that aviation safety hazards associated with external working teams carrying out maintenance at the organisation’s facilities are considered by the organisation’s management system.

145.A.48   Performance of maintenance

• (a) The organisation may only carry out maintenance on an aircraft or component for which it is approved when all the necessary facilities, equipment, tooling, material, maintenance data and personnel are available.

• (b) The organisation shall be responsible for the maintenance that is performed within the scope of its approval.

• (c) The organisation shall ensure that:
• (1) after the completion of the maintenance, a general verification is carried out to ensure that the aircraft or component is clear of all tools, equipment and any extraneous parts or material, and that all access panels that were removed have been refitted;
• (2) an error-capturing method is implemented after the performance of any critical maintenance task;
• (3) the risk of errors during maintenance and the risk of errors being repeated in identical maintenance tasks are minimised;
• (4) damage is assessed, and modifications and repairs are carried out using the data specified in point M.A.304 of Annex I (Part-M) or point ML.A.304 of Annex Vb (Part-ML), as applicable;
• (5) the assessment of aircraft defects is carried out in accordance with point M.A.403(b) of Annex I (Part-M) or ML.A.403(b) of Annex Vb (Part-ML), as applicable.

145.A.50   Certification of maintenance

• (a) A certificate of release to service shall be issued by appropriately authorised certifying staff on behalf of the organisation when that certifying staff has verified that all the maintenance that was ordered has been properly carried out by the organisation in accordance with the procedures specified in point 145.A.70, taking into account the availability and use of the maintenance data specified in point 145.A.45, and that there are no known non-compliances which endanger flight safety.

• (b) A certificate of release to service shall be issued before flight at the completion of any maintenance.

• (c) New defects or incomplete maintenance work orders identified during the maintenance shall be brought to the attention of the person or organisation responsible for the aircraft continuing airworthiness for the specific purpose of obtaining agreement to rectify such defects or completing the missing elements of the maintenance work order. In the case where that person or organisation declines to have such maintenance carried out under this point, point (e) is applicable.

• (d) A certificate of release to service shall be issued by appropriately authorised certifying staff on behalf of the organisation after the maintenance that was ordered has been carried out on a component whilst it was off the aircraft. The authorised release certificate ‘EASA Form 1’ referred to in Appendix II of Annex I (Part-M) constitutes the component certificate of release to service except if otherwise specified in point M.A.502 of Annex I (Part-M) or ML.A.502 of Annex Vb (Part-ML), as applicable. When an organisation maintains a component for its own use, the EASA Form 1 may not be necessary if the organisation’s internal release procedures in its MOE so provides.

• (e) By derogation to point (a), when the organisation is unable to complete all maintenance ordered, it may issue a certificate of release to service within the approved aircraft limitations. The organisation shall enter such fact in the aircraft certificate of release to service before the issue of such certificate.

• (f) By way of derogation from point 145.A.50(a) and point 145.A.42, when an aircraft is grounded at a location other than the main line station or main maintenance base due to the non-availability of a component with the appropriate release certificate, the organisation contracted for the maintenance of that aircraft may temporarily fit a component without the appropriate release certificate for a maximum of 30 flight hours or until the aircraft first returns to the main line station or main maintenance base, whichever is the sooner, subject to the agreement of the person or organisation responsible for the aircraft’s continuing airworthiness and subject to that component having a suitable release certificate but otherwise in compliance with all applicable maintenance and operational requirements. Such components shall be removed by the time limit provided for in the first sentence of this point unless an appropriate release certificate has been obtained in the meantime under points 145.A.50(a) and 145.A.42.

145.A.55   Record-keeping

• (a) Maintenance records
• (1) The organisation shall record the details of the maintenance work that is carried out within the scope of its approval. As a minimum, the organisation shall retain all the records that are necessary to prove that all the requirements have been met for the issue of the certificate of release to service, including, if any, subcontractor's release documents.
• (2) The organisation shall provide a copy of each certificate of release to service to the operator or customer, together with copies of the detailed maintenance records that are associated with the work carried out and that are necessary to demonstrate compliance with point M.A.305 of Annex I (Part-M) or ML.A.305 of Annex Vb (Part-ML), as applicable.
• (3) The organisation shall retain a copy of all detailed maintenance records (including certificates of release to service) and of any associated maintenance data for 3 years from the date when the aircraft or component to which the work relates was issued with a certificate of release to service.
• (4) If an organisation terminates its operation, it shall transfer all the retained maintenance records that cover the last 3 years to the last customer or owner of the respective aircraft or component, or shall store them in the manner specified by the competent authority.

• (b) Airworthiness review records
• (1) If an organisation has the privilege referred to in point 145.A.75(f), it shall retain a copy of each airworthiness review certificate that it has issued, together with all the supporting documents, and shall make those records available, upon request, to the owner of the aircraft.
• (2) The organisation shall retain a copy of all the records referred to in point (1) for 3 years after the issue of the airworthiness review certificate.
• (3) If an organisation terminates its operation, it shall transfer all the retained airworthiness review records that cover the last 3 years to the last owner or operator of the respective aircraft, or shall store them in the manner specified by the competent authority.

• (c) Management system, contracting and subcontracting records The organisation shall ensure that the following records are retained for a minimum period of 5 years:
• (i) records of management system key processes referred to in point 145.A.200;
• (ii) contracts, both for contracting and subcontracting, referred to in point 145.A.205.

• (d) Personnel records
• (1) The organisation shall ensure that the following records are retained:
• (i) records of the qualifications, training and experience of the personnel involved in maintenance, compliance monitoring and safety management;
• (ii) records of the qualifications, training and experience of all airworthiness review staff.
• (2) The records of all airworthiness review staff shall include details of any appropriate qualifications held, together with a summary of their relevant continuing airworthiness experience and training, and a copy of the airworthiness review authorisation issued to that staff by the organisation.
• (3) The records of all the certifying staff and support staff shall include the following:
• (i) the details of any aircraft maintenance licence held under Annex III (Part-66) or equivalent;
• (ii) the scope of the certification authorisations that were issued to that staff, where relevant;
• (iii) the particulars of the staff that held limited or one-off certification authorisations referred to in point 145.A.30(j).
• (4) Personnel records shall be kept for as long as a person works for the organisation, and shall be retained for at least 3 years after the person has left the organisation, or after an authorisation issued to that person has been withdrawn.
• (5) The organisation shall give to the staff referred to in points (2) and (3), upon their request, access to their personnel records as detailed in those points. In addition, upon their request, the maintenance organisation shall furnish each of them with a copy of their personnel records on leaving the organisation.

• (e) The organisation shall establish a record-keeping system that allows adequate storage and reliable traceability of all its activities.

• (f) The format of the records shall be specified in the organisation’s procedures.

• (g) The records shall be stored in a manner that ensures that they are protected from damage, alteration and theft.

145.A.60   Occurrence reporting

• (a) As part of its management system, the organisation shall establish and maintain an occurrence-reporting system, including mandatory and voluntary reporting. For organisations that have their principal place of business in a Member State, a single system may be established to meet the requirements of Regulation (EU) No 376/2014 and its implementing acts and of Regulation (EU) 2018/1139 and its delegated and implementing acts.

• (b) The organisation shall report to its competent authority and to the organisation responsible for the design of the aircraft or component:
• (i) any safety-related event or condition of an aircraft or component identified by the organisation which endangers or, if not corrected or addressed, could endanger an aircraft, its occupants or any other person; and
• (ii) in particular any accident or serious incident.

• (c) The organisation shall also report any such event or condition that affects an aircraft to the person or organisation that is responsible for the continuing airworthiness of that aircraft in accordance with point M.A.201 of Annex I (Part-M) or point ML.A.201 Annex Vb (Part-ML), as applicable. For events or conditions that affect aircraft components, the organisation shall report to the person or organisation that requested the maintenance.

• (d) For organisations that do not have their principal place of business in a Member State:
• (1) the initial mandatory reports shall:
• (i) appropriately safeguard the confidentiality of the identity of the reporter and of the persons mentioned in the report;
• (ii) be made as soon as practicable, but in any case within 72 hours after the organisation has become aware of the occurrence unless exceptional circumstances prevent this;
• (iii) be made in a form and manner established by the competent authority;
• (iv) contain all pertinent information about the condition known to the organisation;
• (2) where relevant, a follow-up report that provides details of the actions the organisation intends to take to prevent similar occurrences in the future shall be made as soon as those actions have been identified; those follow-up reports shall:
• (i) be sent to the entities referred to in points (b) and (c) to which the initial report was sent;
• (ii) be made in a form and manner established by the competent authority.

145.A.65   Maintenance procedures

• (a) The organisation shall establish procedures which ensure that human factors and good maintenance practices are taken into account during maintenance, including subcontracted activities, and which comply with the applicable requirements of this Annex, Annex I (Part-M) and Annex Vb (Part-ML). Such procedures shall be agreed with the competent authority.

• (b) The maintenance procedures established under this point shall:
• (1) ensure that a clear maintenance work order or contract has been agreed between the organisation and the person or organisation that requests the maintenance, to clearly establish the maintenance to be carried out so that the aircraft and components may be released to service in accordance with point 145.A.50;
• (2) cover all the aspects of carrying out the maintenance, including the provision and control of specialised services, and lay down the standards according to which the organisation intends to work.

145.A.70   Maintenance organisation exposition (MOE)

• (a) The organisation shall establish and maintain a maintenance organisation exposition (MOE) that includes, directly or by reference, all of the following:
• (1) a statement signed by the accountable manager confirming that the maintenance organisation will at all times work in accordance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, and with the approved MOE. If the accountable manager is not the chief executive officer of the organisation, then the chief executive officer shall countersign the statement;
• (2) the organisation’s safety policy and the related safety objectives referred to in point 145.A.200(a)(2);
• (3) the title(s) and name(s) of the person(s) nominated under points 145.A.30(b), (c) and (ca);
• (4) the duties and responsibilities of the persons nominated under points 145.A.30(b), (c) and (ca), including the matters on which they may deal directly with the competent authority on behalf of the organisation;
• (5) an organisation chart showing the accountability and associated lines of responsibility, established in accordance with point 145.A.200(a)(1), between all the persons referred to in points 145.A.30(a), (b), (c) and (ca);
• (6) a list of the certifying staff and, if applicable, support staff and airworthiness review staff with their scope of authorisation;
• (7) a general description of the manpower resources and of the system that is in place to plan the availability of staff, as required by point 145.A.30(d);
• (8) a general description of the facilities at each approved location;
• (9) a specification of the scope of work of the organisation that is relevant to the terms of approval as required by point 145.A.20;
• (10) the procedure that sets out the scope of changes not requiring prior approval and that describes how such changes will be managed and notified to the competent authority, as required by point 145.A.85(c);
• (11) the procedure for amending the MOE;
• (12) the procedures specifying how the organisation ensures compliance with this Annex;
• (13) a list of the commercial operators to which the organisation provides regular aircraft maintenance services, and the associated procedures;
• (14) where applicable, a list of the subcontracted organisations referred to in point 145.A.75(b);
• (15) a list of the approved locations including, where applicable, line maintenance locations referred to in point 145.A.75(d);
• (16) a list of the contracted organisations;
• (17) a list of the currently approved alternative means of compliance used by the organisation.

• (b) The initial issue of the MOE shall be approved by the competent authority. It shall be amended as necessary so that it remains an up-to-date description of the organisation.

• (c) Amendments to the MOE shall be managed as set out in the procedures referred to in points (a)(10) and (a)(11). Any amendments that are not included in the scope of the procedure referred to in point (a)(10), as well as any amendments related to the changes listed in point 145.A.85(a), shall be approved by the competent authority.

145.A.75   Privileges of the organisation

In accordance with the MOE, the organisation shall be entitled to carry out the following tasks:

• (a) Maintain any aircraft or component for which it is approved at the locations identified in the certificate and in the MOE;

• (b) Arrange for the maintenance of any aircraft or component for which it is approved at another subcontracted organisation that works under the management system of the organisation. This is limited to the work permitted under the procedures established in accordance with point 145.A.65 and it shall not include a base maintenance check of an aircraft, or a complete workshop maintenance check or overhaul of an engine or an engine module;

• (c) Maintain any aircraft or any component for which it is approved at any location subject to the need for such maintenance arising either from the unserviceability of the aircraft or from the necessity of supporting occasional line maintenance, subject to the conditions specified in the exposition;

• (d) Maintain any aircraft and/or component for which it is approved at a location identified as a line maintenance location capable of supporting minor maintenance and only if the organisation exposition both permits such activity and lists such locations;

• (e) Issue certificates of release to service in respect of completion of maintenance in accordance with point 145.A.50;

• (f) If specifically approved to do so for aircraft covered by Annex Vb (Part-ML) and if it has its principal place of business in one of the Member States, the organisation may perform airworthiness reviews and issue the corresponding airworthiness review certificates under the conditions specified in point ML.A.903 of Annex Vb (Part-ML).

145.A.85   Changes to the organisation

• (a) The following changes to the organisation shall require prior approval by the competent authority:
• (1) changes to the certificate, including the terms of approval of the organisation;
• (2) changes of the persons referred to in points 145.A.30(a), (b), (c) and (ca);
• (3) changes to the reporting lines between the personnel nominated in accordance with points 145.A.30(b), (c) and (ca), and the accountable manager;
• (4) the procedure as regards changes not requiring prior approval referred to in point (c);
• (5) additional locations of the organisation other than those that are subject to point 145.A.75(c).

• (b) For the changes referred to in point (a) and for all other changes requiring prior approval in accordance with this Annex, the organisation shall apply for and obtain an approval issued by the competent authority. The application shall be submitted before such changes take place in order to enable the competent authority to determine that there is continued compliance with this Annex and to amend, if necessary, the organisation certificate and the related terms of approval that are attached to it. The organisation shall provide the competent authority with any relevant documentation. The change shall only be implemented upon the receipt of a formal approval from the competent authority in accordance with point 145.B.330. The organisation shall operate under the conditions prescribed by the competent authority during such changes, as applicable.

• (c) All changes not requiring prior approval shall be managed and notified to the competent authority as set out in a procedure which is approved by the competent authority in accordance with point 145.B.310(h).

145.A.90   Continued validity

• (a) The organisation’s certificate shall remain valid, subject to compliance with all of the following conditions:
• (1) the organisation remaining in compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts, taking into account the provisions of point 145.B.350 of this Annex related to the handling of findings;
• (2) the competent authority being granted access to the organisation as specified in point 145.A.140;
• (3) the certificate not being surrendered by the organisation, or suspended or revoked by the competent authority under point 145.B.355.

• (b) Upon surrender or revocation, the certificate shall be returned to the competent authority without delay.

145.A.95   Findings and observations

• (a) After the receipt of a notification of findings in accordance with point 145.B.350, the organisation shall:
• (1) identify the root cause(s) of, and contributing factor(s) to, the non-compliance;
• (2) define a corrective action plan;
• (3) demonstrate the implementation of corrective action to the satisfaction of the competent authority.

• (b) The actions referred to in point (a) shall be performed within the period agreed with that competent authority in accordance with point 145.B.350.

• (c) The observations received in accordance with point 145.B.350(f) shall be given due consideration by the organisation. The organisation shall record the decisions taken in respect of those observations.

145.A.120   Means of compliance

• (a) An organisation may use any alternative means of compliance to establish compliance with this Regulation.

• (b) If an organisation wishes to use an alternative means of compliance, it shall, prior to using it, provide the competent authority with a full description. The description shall include any revisions to manuals or procedures that may be relevant, as well as an explanation indicating how compliance with this Regulation is achieved. The organisation may use those alternative means of compliance subject to prior approval from the competent authority.

145.A.140   Access

For the purpose of determining compliance with the relevant requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, the organisation shall ensure that access to any facility, aircraft, document, records, data, procedures or to any other material relevant to its activity subject to certification, whether it is subcontracted or not, is granted to any person authorised by one of the following authorities:

• (a) the competent authority defined in point 145.1;

• (b) the authority performing the oversight tasks in accordance with point 145.B.300(d).

145.A.155   Immediate reaction to a safety problem

The organisation shall implement:

• (a) any safety measures mandated by the competent authority in accordance with point 145.B.135;

• (b) any relevant mandatory safety information issued by the Agency.

145.A.200   Management system

• (a) The organisation shall establish, implement and maintain a management system that includes:
• (1) clearly defined accountability and lines of responsibility throughout the organisation, including a direct safety accountability of the accountable manager;
• (2) a description of the overall philosophies and principles of the organisation with regard to safety (‘the safety policy’), and the related safety objectives;
• (3) the identification of aviation safety hazards entailed by the activities of the organisation, their evaluation and the management of the associated risks, including taking actions to mitigate the risks and verify their effectiveness;
• (4) maintaining personnel trained and competent to perform their tasks;
• (5) documentation of all management system key processes, including a process for making personnel aware of their responsibilities and the procedure for amending that documentation;
• (6) a function to monitor the compliance of the organisation with the relevant requirements. Compliance monitoring shall include a feedback system of findings to the accountable manager to ensure the effective implementation of corrective actions as necessary.

• (b) The management system shall correspond to the size of the organisation and the nature and complexity of its activities, taking into account the hazards and the associated risks inherent in those activities.

• (c) If the organisation holds one or more additional organisation certificates within the scope of Regulation (EU) 2018/1139, the management system may be integrated with that required under the additional certificate(s) held.

145.A.200A   Information security management system

In addition to the management system referred to in point 145.A.200, the maintenance organisation shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

145.A.202   Internal safety reporting scheme

• (a) As part of its management system, the organisation shall establish an internal safety reporting scheme to enable the collection and evaluation of such occurrences that are to be reported under point 145.A.60.

• (b) The scheme shall also enable the collection and evaluation of those errors, near misses and hazards reported internally that do not fall under point (a).

• (c) Through that scheme, the organisation shall:
• (1) identify the causes of, and contributing factors to, the errors, near misses and hazards reported, and address them as part of its safety risk management process in accordance with point 145.A.200(a)(3);
• (2) ensure an evaluation of all known, relevant information relating to errors, near misses, hazards and the inability to follow procedures, and a method to circulate the information as necessary.

• (d) The organisation shall make arrangements to ensure the collection of safety issues related to subcontracted activities.

145.A.205   Contracting and subcontracting

• (a) The organisation shall ensure that when contracting or subcontracting any part of its maintenance activities:
• (1) the maintenance conforms to the applicable requirements;
• (2) any aviation safety hazard associated with such contracting or subcontracting is considered as part of the organisation’s management system.

• (b) If the organisation subcontracts any part of its maintenance activities to another organisation, the subcontracted organisation shall work under the scope of approval of the subcontracting organisation.

SECTION B

AUTHORITY REQUIREMENTS

145.B.005   Scope

This section establishes the conditions for conducting the certification, oversight and enforcement tasks as well as the administrative and management system requirements to be followed by the competent authority that is responsible for the implementation and enforcement of Section A.

145.B.115   Oversight documentation

The competent authority shall provide all the legislative acts, standards, rules, technical publications, and related documents to the relevant personnel in order to allow them to perform their tasks and to discharge their responsibilities.

145.B.120   Means of compliance

• (a) The Agency shall develop acceptable means of compliance (‘AMC’) that may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

• (b) Alternative means of compliance may be used to establish compliance with this Regulation.

• (c) Competent authorities shall inform the Agency of any alternative means of compliance used by organisations under their oversight or by themselves for establishing compliance with this Regulation.

145.B.125   Information to the Agency

• (a) The competent authority of the Member State shall notify the Agency in case of any significant problems with the implementation of Regulation (EU) 2018/1139 and its delegated and implementing acts within 30 days from the time the authority became aware of the problems.

• (b) Without prejudice to Regulation (EU) No 376/2014 and its delegated and implementing acts, the competent authority shall provide the Agency as soon as possible with any safety-significant information stemming from the occurrence reports stored in the national database pursuant to Article 6(6) of Regulation (EU) No 376/2014.

• (c) The competent authority of the Member State shall provide the Agency as soon as possible with safety-significant information stemming from the information security reports it has received pursuant to point IS.I.OR.230 of Annex II (Part-IS.I.OR) to Implementing Regulation (EU) 2023/203.

145.B.135   Immediate reaction to a safety problem

• (a) Without prejudice to Regulation (EU) No 376/2014 and its delegated and implementing acts, the competent authority shall implement a system to appropriately collect, analyse and disseminate safety information.

• (b) The Agency shall implement a system to appropriately analyse any relevant safety information received and, without undue delay, provide the relevant authority of the Member States and the Commission with any information, including recommendations or corrective actions to be taken, that is necessary for them to react in a timely manner to a safety problem involving products, parts, appliances, persons or organisations that are subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

• (c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the safety problem.

• (d) The competent authority shall immediately notify measures taken under point (c) to all persons or organisations which need to comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority shall also notify those measures to the Agency and, when combined action is required, to the other Member States concerned.

145.B.135A   Immediate reaction to an information security incident or vulnerability with an impact on aviation safety

• (a) The competent authority shall implement a system to appropriately collect, analyse, and disseminate information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State to increase the coordination and compatibility of reporting schemes.

• (b) The Agency shall implement a system to appropriately analyse any relevant safety-significant information received in accordance with point 145.B.125(c), and without undue delay provide the Member States and the Commission with any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to an information security incident or vulnerability with a potential impact on aviation safety involving products, parts, non-installed equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

• (c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the potential impact on aviation safety of the information security incident or vulnerability.

• (d) Measures taken in accordance with point (c) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority of the Member State shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.

145.B.200   Management system

• (a) The competent authority shall establish and maintain a management system, including as a minimum:
• (1) documented policies and procedures to describe its organisation, the means and methods for establishing compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts. The procedures shall be kept up to date, and serve as the basic working documents within that competent authority for all its related tasks;
• (2) a sufficient number of personnel to perform its tasks and discharge its responsibilities. A system shall be in place to plan the availability of personnel in order to ensure the proper completion of all tasks;
• (3) personnel that are qualified to perform their allocated tasks and that have the necessary knowledge and experience and receive initial and recurrent training to ensure continuing competency;
• (4) adequate facilities and office accommodation for personnel to perform their allocated tasks;
• (5) a function to monitor the compliance of the management system with the relevant requirements, and the adequacy of the procedures, including the establishment of an internal audit process and a safety risk management process. Compliance monitoring shall include a feedback system of audit findings to the senior management of the competent authority to ensure the implementation of corrective actions as necessary;
• (6) a person or group of persons having a responsibility to the senior management of the competent authority for the compliance monitoring function.

• (b) The competent authority shall, for each field of activity, including the management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).