Commission Implementing Regulation (EU) 2019/1383 of 8 July 2019 amending and correcting Regulation (EU) No 1321/2014 as regards safety management systems in continuing airworthiness management organisations and alleviations for general aviation aircraft concerning maintenance and continuing airworthiness management (Text with EEA relevance.)

(c) Where the organisation holds one or more additional organisation certificates within the scope of Regulation (EU) 2018/1139 and its delegated and implementing acts, the management system may be integrated with that required under the additional certificate(s) held.

(d) Notwithstanding point (c), for air carriers licensed in accordance with Regulation (EC) No 1008/2008, the management system provided for in this Annex shall be an integrated part of the operator's management system.

(a) As part of its management system, the organisation shall establish an internal safety reporting scheme to enable the collection and evaluation of such occurrences to be reported under point CAMO.A.160.

(b) The scheme shall also enable the collection and evaluation of those errors, near misses, and hazards reported internally that do not fall under point (a).

(c) Through this scheme, the organisation shall: (1) identify the causes of and contributing factors to any errors, near misses, and hazards reported and address them as part of safety risk management in accordance with point (a)(3) of point CAMO.A.200; (2) ensure evaluation of all known, relevant information relating to errors, the inability to follow procedures, near misses, and hazards, and a method to circulate the information as necessary.

(d) The organisation shall provide access to its internal safety reporting scheme to any subcontracted organisation.

(e) The organisation shall cooperate on safety investigations with any other organisation having a significant contribution to the safety of its own continuing airworthiness management activities.

(a) The organisation shall ensure that when contracting maintenance or when subcontracting any part of its continuing airworthiness management activities: (1) these activities conform to the applicable requirements; and (2) any aviation safety hazards associated with such contracting or subcontracting are considered as part of the organisation's management system.

(b) When the organisation subcontracts any part of its continuing airworthiness management activities to another organisation, the subcontracted organisation shall work under the approval of the organisation. The organisation shall ensure that the competent authority is given access to the subcontracted organisation, to determine continued compliance with the applicable requirements.

The organisation shall provide suitable office accommodation at appropriate locations for the personnel specified in point CAMO.A.305.

(a) Continuing airworthiness management records (1) The organisation shall ensure that records required by points M.A.305, ML.A.305 and, if applicable point M.A.306, are retained. (2) The organisation shall record all details of work carried out. (3) If the organisation has the privilege referred to in point (e) of point CAMO.A.125, it shall retain a copy of each airworthiness review certificate and recommendation issued or, as applicable, extended, together with all supporting documents. In addition, the organisation shall retain a copy of any airworthiness review certificate that it has extended under the privilege referred to in point (d)(4) of point CAMO.A.125. (4) If the organisation has the privilege referred to in point (f) of point CAMO.A.125, it shall retain a copy of each permit to fly issued in accordance with the provisions of point 21.A.729 of Annex I (Part-21) to Regulation (EU) No 748/2012. (5) The organisation shall retain a copy of all records referred to in points (a)(2) to (a)(4) until 3 years after the responsibility for the aircraft in accordance with points M.A.201 or ML.A.201 has been permanently transferred to another person or organisation. (6) Where the organisation terminates its operation, all retained records shall be transferred to the owner of the aircraft.

(b) Management system, contracting and subcontracting records (1) The organisation shall ensure that the following records are retained: (i) records of management system key processes as defined in point CAMO.A.200; (ii) contracts, both for contracting and subcontracting, as defined in point CAMO.A.205; (2) Management system records, as well as any contracts pursuant to point CAMO.A.205, shall be kept for a minimum period of 5 years.

(c) Personnel records (1) The organisation shall ensure that the following records are retained: (i) records of qualification and experience of personnel involved in continuing airworthiness management, compliance monitoring and safety management; (ii) records of qualification and experience of all airworthiness review staff, as well as staff issuing recommendations and permits to fly. (2) The records of all airworthiness review staff, staff issuing recommendations and staff issuing permits to fly shall include details of any appropriate qualification held together with a summary of the relevant continuing airworthiness management experience and training and a copy of the authorisation. (3) Personnel records shall be kept as long as the person works for the organisation, and shall be retained until 3 years after the person has left the organisation.

(d) The organisation shall establish a system of record-keeping that allows adequate storage and reliable traceability of all activities developed.

(e) The format of the records shall be specified in the organisation's procedures.

(f) Records shall be stored in a manner that ensures protection from damage, alteration and theft.

(a) The organisation shall provide the competent authority with a CAME and, where applicable, any referenced associated manuals and procedures, containing all of the following information: (1) a statement signed by the accountable manager confirming that the organisation will at all times work in accordance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, and with the approved CAME. When the accountable manager is not the chief executive officer of the organisation, then such chief executive officer shall countersign the statement; (2) the organisation's safety policy as defined in point (a)(2) of point CAMO.A.200; (3) the organisation's scope of work relevant to the terms of approval; (4) a general description of the manpower resources and of the system in place to plan the availability of staff as required by point (d) of point CAMO.A.305; (5) the title(s) and name(s) of person(s) referred to in points (a)(3) to (a)(5), (b)(2) and (f) of point CAMO.A.305; (6) the duties, accountabilities, responsibilities and authorities of the persons nominated under points (a)(3) to (a)(5), (b)(2), (e) and (f) of point CAMO.A.305; (7) an organisation chart showing the associated chains of accountability and responsibility between all the person(s) referred to in points (a)(3) to (a)(5), (b)(2), (e) and (f) of point CAMO.A.305, and related to point (a)(1) of point CAMO.A.200; (8) a list of staff authorised to issue airworthiness review certificates or recommendations referred to in point (e) of point CAMO.A.305, specifying, where applicable, the staff authorised to issue permits to fly in accordance with point (c) of point CAMO.A.125; (9) a general description and location of the facilities; (10) the description of the internal safety reporting scheme as required by point CAMO.A.202; (11) the procedures specifying how the organisation ensures compliance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, including in particular: (i) the documentation of management system key processes as required by point CAMO.A.200; (ii) procedures defining how the organisation controls any contracted and subcontracted activities as required by point CAMO.A.205 and point (c) of point CAMO.A.315); (iii) continuing airworthiness management, airworthiness review and permit to fly procedures, as applicable; (iv) the procedure defining the scope of changes not requiring prior approval and describing how such changes will be managed and notified, as required by point (b) of point CAMO.A.115 and point (c) of point CAMO.A.130; (v) the CAME amendment procedures. (12) the list of approved aircraft maintenance programmes for those aircraft for which a continuing airworthiness management contract exists in accordance with point M.A.201 or ML.A.201; (13) the list of maintenance contracts in accordance with point (c) of point CAMO.A.315; (14) the list of currently approved alternative means of compliance.

(b) The initial issue of the CAME shall be approved by the competent authority. It shall be amended as necessary to remain an up-to-date description of the organisation.

(c) Amendments to the CAME shall be managed as defined in the procedure referred to in point (11)(iv). Any amendments not included in the scope of this procedure, as well as amendments related to the changes listed in point (a) of point CAMO.A.130, shall be approved by the competent authority.

(a) The organisation shall appoint an accountable manager, who has corporate authority for ensuring that all continuing airworthiness management activities can be financed and carried out in accordance with Regulation (EU) 2018/1139 and delegated and implementing acts adopted on the basis thereof. The accountable manager shall: (1) ensure that all necessary resources are available to manage continuing airworthiness in accordance with this Annex, Annex I (Part-M) and Annex Vb (Part-ML), as applicable, to support the organisation approval certificate; (2) establish and promote the safety policy specified in point CAMO.A.200; (3) nominate a person or group of persons with the responsibility of ensuring that the organisation always complies with the applicable continuing airworthiness management, airworthiness review and permit to fly requirements of this Annex, Annex I (Part-M) and Annex Vb (Part-ML); (4) nominate a person or group of persons with the responsibility for managing the compliance monitoring function as part of the management system; (5) nominate a person or group of persons with the responsibility for managing the development, administration, and maintenance of effective safety management processes as part of the management system; (6) ensure that the person or group of persons nominated in accordance with points (a)(3) to (a)(5) and (b)(2) of point CAMO.A.305 have direct access to keep him/her properly informed on compliance and safety matters; (7) demonstrate a basic understanding of this Regulation.

(b) For organisations also approved as air carriers licensed in accordance with Regulation (EC) No 1008/2008, the accountable manager shall in addition: (1) be the person appointed as accountable manager for the air carrier as required by point (a) of point ORO.GEN.210 of Annex III (Part-ORO) to Regulation (EU) No 965/2012; (2) nominate a person responsible for the management and supervision of continuing airworthiness, who shall not be employed by an organisation approved in accordance with Annex II (Part-145) under contract to the operator, unless specifically agreed by the competent authority.

(c) The person or persons nominated in accordance with points (a)(3) to (a)(5) and (b)(2) of point CAMO.A.305 shall be able to demonstrate relevant knowledge, background and satisfactory experience related to aircraft continuing airworthiness management and demonstrate a working knowledge of this Regulation. Such person(s) shall be ultimately responsible to the accountable manager.

(d) The organisation shall have a system in place to plan the availability of staff to ensure that the organisation has sufficient appropriately qualified staff to plan, perform, supervise, inspect and monitor the organisation's activities in accordance with the terms of approval.

(e) To be approved to carry out airworthiness reviews or recommendations in accordance with point (e) of point CAMO.A.125 and, if applicable, to issue permits to fly in accordance with point (f) of point CAMO.A.125, the organisation shall have airworthiness review staff qualified and authorised in accordance with point CAMO.A.310.

(f) For organisations extending airworthiness review certificates in accordance with point (d)(4) of point CAMO.A.125, the organisation shall nominate persons authorised to do so.

(g) The organisation shall establish and control the competency of personnel involved in compliance monitoring, safety management, continuing airworthiness management, airworthiness reviews or recommendations, and, if applicable, issuing permits to fly, in accordance with a procedure and to a standard agreed by the competent authority. In addition to the necessary expertise related to the job function, competency must include an understanding of safety management and human factors principles appropriate to the person's function and responsibilities in the organisation.

(a) Airworthiness review staff issuing airworthiness review certificates or recommendations in accordance with point (e) of point CAMO.A.125 and, if applicable, issuing permits to fly in accordance with point (f) of point CAMO.A.125 shall have: (1) at least 5 years of experience in continuing airworthiness; (2) acquired an appropriate licence in compliance with Annex (III) Part-66 or an aeronautical degree or a national equivalent; (3) received formal aeronautical maintenance training; (4) held a position within the approved organisation with appropriate responsibilities.

(b) Notwithstanding points (a)(1), (a)(3) and (a)(4), the requirement laid down in point (a)(2) may be replaced with 5 years of experience in continuing airworthiness additional to those already required by point (a)(1).

(c) Airworthiness review staff nominated by the organisation can only be issued an authorisation by that organisation when formally accepted by the competent authority after satisfactory completion of an airworthiness review under the supervision of the competent authority, or under the supervision of the organisation's authorised airworthiness review staff, in accordance with a procedure approved by the competent authority as part of the CAME.

(d) The organisation shall ensure that aircraft airworthiness review staff can demonstrate appropriate, recent continuing airworthiness management experience.

(a) The organisation shall ensure that all continuing airworthiness management is carried out in accordance with Section A, Subpart C of Annex I (Part-M), or Section A Subpart C of Annex Vb (Part-ML), as applicable.

(b) For every aircraft managed, the organisation shall in particular: (1) ensure that an aircraft maintenance programme including any applicable reliability programme, as required by point M.A.302 or ML.A.302 as applicable, is developed and controlled; (2) for aircraft not used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, provide a copy of the aircraft maintenance programme to the owner or operator responsible in accordance with point M.A.201 or ML.A.201 as applicable; (3) ensure that data used for any modification and repairs complies with points M.A.304 or ML.A.304 as applicable; (4) for all complex motor-powered aircraft or aircraft used by air carriers licensed in accordance with Regulation (EC) No 1008/2008, establish a procedure to assess non-mandatory modifications and/or inspections and decide on their application, making use of the organisation's safety risk management process as required by point (a)(3) of point CAMO.A.200; (5) ensure that the aircraft, engine(s), propeller(s) and components thereof are taken to an appropriately approved maintenance organisation referred to in Subpart F of Annex I (Part-M), Annex II (Part-145) or Annex Vd (Part-CAO) whenever necessary; (6) order maintenance, supervise activities, and coordinate related decisions to ensure that any maintenance is carried out properly and is appropriately released for the determination of aircraft airworthiness.

(c) Where the organisation is not appropriately approved in accordance with Subpart F of Annex I (Part-M), Annex II (Part-145) or Annex Vd (Part-CAO) it shall, in consultation with the operator, manage the written maintenance contracts required by points (e)(3), (f)(3), (g)(3) and (h)(3) of M.A.201 or point ML.A.201 to ensure that: (1) all maintenance is ultimately carried out by an appropriately approved maintenance organisation; (2) the functions required under points (a)(2), (a)(3), (a)(6) and (a)(7) of point M.A.301 or point ML.A.301, as applicable, are clearly specified.

(d) Notwithstanding point (c), the contract may be in the form of individual work orders addressed to the maintenance organisation in the case of: (1) an aircraft requiring unscheduled line maintenance; (2) component maintenance, including engine and propeller maintenance, as applicable.

(e) The organisation shall ensure that human factors and human performance limitations are taken into account during continuing airworthiness management, including all contracted and subcontracted activities.

When the organisation approved in accordance with point (e) of point CAMO.A.125 performs airworthiness reviews, they shall be performed in accordance with point M.A.901 of Annex I (Part-M) or point ML.A.903 of Annex Vb (Part-ML), as applicable.

The organisation shall hold and use applicable current maintenance data in accordance with point M.A.401 of Annex I (Part-M) for the performance of continuing airworthiness tasks referred to in point CAMO.A.315. This data may be provided by the owner or the operator, subject to an appropriate contract being established with such an owner or operator. In such case, the continuing airworthiness management organisation shall only keep such data for the duration of the contract, except when otherwise required by point (a) of point CAMO.A.220.

SECTION B

AUTHORITY REQUIREMENTS

This Section establishes the administrative and management system requirements to be followed by the competent authority in charge of the implementation and enforcement of Section A of this Annex.

The competent authority shall provide all legislative acts, standards, rules, technical publications, and related documents to relevant personnel in order to allow them to perform their tasks and to discharge their responsibilities.

(a) The Agency shall develop Acceptable Means of Compliance (“AMC”) that may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

(b) Alternative means of compliance may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts

(c) The competent authority shall establish a system to consistently evaluate that all alternative means of compliance used by itself or by organisations under its oversight allow for the establishment of compliance with Regulation (EU) No 2018/1139 and its delegated and implementing acts.

(d) The competent authority shall evaluate all alternative means of compliance proposed by an organisation in accordance with point CAMO.A.120 by analysing the documentation provided and, if considered necessary, conducting an inspection of the organisation. When the competent authority finds that the alternative means of compliance are in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts, it shall without undue delay: (1) notify the applicant that the alternative means of compliance may be implemented and, if applicable, amend the approval or certificate of the applicant accordingly; (2) notify the Agency of their content, including copies of all relevant documentation.

(e) When the competent authority itself uses alternative means of compliance to achieve compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts it shall: (1) make them available to all organisations and persons under its oversight; (2) without undue delay notify the Agency. The competent authority shall provide the Agency with a full description of the alternative means of compliance, including any revisions to procedures that may be relevant, as well as an assessment demonstrating that they comply with Regulation (EU) 2018/1139 and its delegated and implementing acts.

(a) The competent authority shall, without undue delay, notify the Agency in case of any significant problems with the application of Regulation (EU) 2018/1139 and its delegated and implementing acts.

(b) The competent authority shall provide the Agency with safety-significant information stemming from the occurrence reports it has received pursuant to point CAMO.A.160.

(a) Without prejudice to Regulation (EU) No 376/2014 and Commission Implementing Regulation (EU) 2015/1018 (^*5), the competent authority shall implement a system to appropriately collect, analyse, and disseminate safety information.

(b) The Agency shall implement a system to appropriately analyse any relevant safety information received, and without undue delay provide to Member States and the Commission any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to a safety problem involving products, parts, appliances, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.

(c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the safety problem.

(d) Measures taken under point (c) shall immediately be notified to all persons or organisations which need to comply with them under Regulation (EU) 2018/1139 and and its delegated and implementing acts. The competent authority shall also notify those measures to the Agency and, when combined action is required, the other Member States concerned.

(a) The competent authority shall establish and maintain a management system, including as a minimum: (1) documented policies and procedures to describe its organisation, means and methods to comply with Regulation (EU) 2018/1139 and its delegated and implementing acts. The procedures shall be kept up to date, and serve as the basic working documents within that competent authority for all related tasks; (2) a sufficient number of personnel to perform its tasks and discharge its responsibilities. A system shall be in place to plan the availability of personnel, in order to ensure the proper completion of all tasks; (3) personnel qualified to perform their allocated tasks and have the necessary knowledge, experience, initial and recurrent training to ensure continuing competency; (4) adequate facilities and office accommodation to perform the allocated tasks; (5) a function to monitor compliance of the management system with the relevant requirements and adequacy of the procedures including the establishment of an internal audit process and a safety risk management process. Compliance monitoring shall include a feedback system of audit findings to the senior management of the competent authority to ensure implementation of corrective actions as necessary; (6) a person or group of persons ultimately responsible to the senior management of the competent authority for the compliance monitoring function.

(b) The competent authority shall, for each field of activity, including management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).

(c) The competent authority shall establish procedures for participation in a mutual exchange of all necessary information and assistance with other competent authorities concerned, including all findings raised and follow-up actions taken as a result of oversight of persons and organisations exercising activities in the territory of a Member State, but certified by the competent authority of another Member State or the Agency.

(d) A copy of the procedures related to the management system and their amendments shall be made available to the Agency for the purpose of standardisation and to the organisations subject to this Regulation, if so requested.

(a) Tasks related to the initial certification, or continuing oversight of persons, or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts may be allocated by Member States only to qualified entities. When allocating tasks, the competent authority shall ensure that it has: (1) put a system in place to initially and continuously assess that the qualified entity complies with Annex VI “Essential requirements for qualified entities” to Regulation (EU) 2018/1139. This system and the results of the assessments shall be documented; (2) established a documented agreement with the qualified entity, approved by both parties at the appropriate management level, which clearly defines: (i) the tasks to be performed; (ii) the declarations, reports, and records to be provided; (iii) the technical conditions to be met in performing such tasks; (iv) the related liability coverage; (v) the protection given to information acquired in carrying out such tasks.

(b) The competent authority shall ensure that the internal audit process and safety risk management process required by point (a)(5) of point CAMO.B.200 covers all certification, or continuing oversight tasks performed on its behalf.

(a) The competent authority shall have a system in place to identify changes that affect its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts. This system shall enable it to take action as appropriate to ensure that its management system remains adequate and effective.

(b) The competent authority shall update its management system to reflect any change to Regulation (EU) 2018/1139 and its delegated and implementing acts in a timely manner, so as to ensure effective implementation.

(c) The competent authority shall notify the Agency of changes affecting its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts.

(a) The competent authority shall establish a system of record-keeping that allows adequate storage, accessibility, and reliable traceability of: (1) the management system's documented policies and procedures; (2) training, qualification, and authorisation of its personnel; (3) the allocation of tasks, covering the elements required by point CAMO.B.205, as well as the details of tasks allocated; (4) certification processes and continuing oversight of certified organisations, including: (i) the application for an organisation certificate; (ii) the competent authority's continuing oversight programme, including all assessment, audit and inspection records; (iii) the organisation certificate, including any changes thereto; (iv) a copy of the oversight programme listing the dates when audits are due and when audits were carried out; (v) copies of all formal correspondence; (vi) details of findings, corrective actions, date of action closure, any exemption and enforcement actions; (vii) any assessment, audit and inspection reports issued by another competent authority pursuant to point (d) of point CAMO.B.300; (viii) copies of all organisation CAMEs or manuals and amendments thereto; (ix) copies of any other document approved by the competent authority; (5) the evaluation and notification to the Agency of alternative means of compliance proposed by organisations, and the assessment of alternative means of compliance used by the competent authority itself; (6) safety information and follow-up measures in accordance with point CAMO.B.125; (7) the use of flexibility provisions in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

(b) The competent authority shall maintain a list of all organisation certificates it issued.

(c) All records referred to in points (a) and (b) shall be kept for a minimum period of 5 years subject to applicable data protection law.

(d) All records referred to in points (a) and (b) shall be made available upon request to a competent authority of another Member State or the Agency.

(a) The competent authority shall verify: (1) compliance with the requirements applicable to organisations prior to the issue of an organisation certificate, as applicable; (2) continued compliance with the applicable requirements of organisations it has certified; (3) implementation of appropriate safety measures mandated by the competent authority as defined in points (c) and (d) of point CAMO.B.135.

(b) This verification shall: (1) be supported by documentation specifically intended to provide personnel responsible for safety oversight with guidance to perform their functions; (2) provide the organisations concerned with the results of safety oversight activity; (3) be based on assessments, audits and inspections, including unannounced inspections; (4) provide the competent authority with the evidence needed in case further action is required, including the measures provided for in point CAMO.B.350 “Findings and corrective actions”.

(c) The scope of oversight defined in points (a) and (b) shall take into account the results of past oversight activities and the safety priorities.

(d) Where organisation facilities are located in more than one State, the competent authority as defined in point CAMO.A.105 may agree to have oversight tasks performed by the competent authority(ies) of the Member State(s) where facilities are located, or by the Agency for facilities located in a third country. Any organisation subject to such agreement shall be informed of its existence and of its scope.

(e) For oversight performed at facilities located in another State, the competent authority as defined in point CAMO.A.105 shall inform the competent authority of such State, or the Agency for facilities of organisations having their principal place of business in a third country, before performing any on-site audit or inspection of such facilities.

(f) The competent authority shall collect and process any information deemed useful for oversight, including for unannounced inspections.

(a) The competent authority shall establish and maintain an oversight programme covering the oversight activities required by point CAMO.B.300.

(b) The oversight programme shall be developed taking into account the specific nature of the organisation, the complexity of its activities, the results of past certification and/or oversight activities, and shall be based on the assessment of associated risks. It shall include within each oversight planning cycle: (1) assessments, audits and inspections, including unannounced inspections and, as applicable: (i) management system assessments and process audits; (ii) product audits of a relevant sample of aircraft managed by the organisation; (iii) sampling of airworthiness reviews performed; (iv) sampling of permits to fly issued; (2) meetings convened between the accountable manager and the competent authority to ensure both remain informed of significant issues.

(c) For organisations certified by the competent authority, an oversight planning cycle not exceeding 24 months shall be applied.

(d) Notwithstanding point (c), the oversight planning cycle may be extended up to 36 months if the competent authority has established that during the previous 24 months: (1) the organisation has demonstrated an effective identification of aviation safety hazards and management of associated risks; (2) the organisation has continuously demonstrated under point CAMO.A.130 that it has full control over all changes; (3) no level 1 findings have been issued; (4) all corrective actions have been implemented within the time period accepted or extended by the competent authority as defined in point CAMO.B.350. Notwithstanding point (c), the oversight planning cycle may be further extended to a maximum of 48 months if, in addition to the conditions provided in points (1) to (4) of the first subparagraph, the organisation has established, and the competent authority has approved, an effective continuous reporting system to the competent authority on the safety performance and regulatory compliance of the organisation itself.

(e) The oversight planning cycle may be reduced if there is any evidence that the safety performance of the organisation has decreased.

(f) The oversight programme shall include records of the dates when audits, inspections and meetings are due, and when such audits, inspections and meetings have been carried out.

(g) At the completion of each oversight planning cycle, the competent authority shall issue a recommendation report on the continuation of the approval reflecting the results of oversight.

(a) Upon receiving an application for the initial issue of a certificate for an organisation, the competent authority shall verify the organisation's compliance with the applicable requirements.

(b) A meeting with the accountable manager of the organisation shall be convened at least once during the investigation for initial certification to ensure that he/she fully understands the significance of the certification process and the reason for signing the statement of the organisation to comply with the procedures specified in the CAME.

(c) The competent authority shall record all findings, closure actions (actions required to close a finding) and recommendations.

(d) The competent authority shall confirm in writing all the findings raised during the verification to the organisation. For initial certification, all findings must be corrected to the satisfaction of the competent authority before the certificate can be issued.

(e) When satisfied that the organisation complies with the applicable requirements, the competent authority shall: (1) issue the certificate as established in Appendix I “EASA Form 14” to this Annex; (2) formally approve the CAME.

(f) The certificate reference number shall be included on the EASA Form 14 certificate in a manner specified by the Agency.

(g) The certificate shall be issued for an unlimited duration. The privileges, scope of the activities that the organisation is approved to conduct, including any limitations as applicable, shall be specified in the terms of approval attached to the certificate.

(h) To enable the organisation to implement changes without prior competent authority approval in accordance with point (c) of point CAMO.A.130, the competent authority shall approve the relevant CAME procedure defining the scope of such changes and describing how such changes will be managed and notified.

(a) Upon receiving an application for a change that requires prior approval, the competent authority shall verify the organisation's compliance with the applicable requirements before issuing the approval.

(b) The competent authority shall establish the conditions under which the organisation may operate during the change unless the competent authority determines that the organisation's certificate needs to be suspended.

(c) When satisfied that the organisation complies with the applicable requirements, the competent authority shall approve the change.

(d) Without prejudice to any additional enforcement measures, when the organisation implements changes requiring prior approval without having received competent authority approval pursuant to point (c), the competent authority shall suspend, limit or revoke the organisation's certificate.

(e) For changes not requiring prior approval, the competent authority shall assess the information provided in the notification sent by the organisation in accordance with point (c) of point CAMO.A.130 to verify compliance with the applicable requirements. In case of any non-compliance, the competent authority shall: (1) notify the organisation about the non-compliance and request further changes; (2) in case of level 1 or level 2 findings, act in accordance with point CAMO.B.350.

(a) The competent authority shall have a system to analyse findings for their safety significance.

(b) A level 1 finding shall be issued by the competent authority when any significant non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, with the organisation's procedures and manuals, or with the terms of an approval or certificate which lowers safety or seriously endangers flight safety.

The level 1 findings shall include: (1) failure to give the competent authority access to the organisation's facilities as defined in point CAMO.A.140 during normal operating hours and after two written requests; (2) obtaining or maintaining the validity of the organisation certificate by falsification of submitted documentary evidence; (3) evidence of malpractice or fraudulent use of the organisation certificate; (4) the lack of an accountable manager.

(c) A level 2 finding shall be issued by the competent authority when any non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, with the organisation's procedures and manuals, or with the terms of an approval or certificate which may lower safety or endanger flight safety.

(d) When a finding is detected during oversight or by any other means, the competent authority shall, without prejudice to any additional action required by Regulation (EU) 2018/1139 and its delegated and implementing acts, communicate the finding to the organisation in writing, and request corrective action to address the non-compliance(s) identified. Where a finding directly relates to an aircraft, the competent authority shall inform the State in which the aircraft is registered. (1) In the case of level 1 findings, the competent authority shall take immediate and appropriate action to prohibit or limit activities and, if appropriate, it shall take action to revoke the certificate or to limit or suspend it in whole or in part, depending upon the extent of the level 1 finding until successful corrective action has been taken by the organisation. (2) In the case of level 2 findings, the competent authority shall: (i) grant the organisation a corrective action implementation period appropriate to the nature of the finding, that in any case initially shall not be more than 3 months. It shall commence from the date of the written communication of the finding to the organisation, requesting corrective action to address the non-compliance identified. At the end of this period, and subject to the nature of the finding and past safety performance of the organisation, the competent authority may extend the 3-month period subject to a satisfactory corrective action plan agreed by the competent authority; (ii) assess the corrective action and implementation plan proposed by the organisation, and if the assessment concludes that they are sufficient to address the non-compliance(s), accept these. (3) Where an organisation fails to submit an acceptable corrective action plan, or to perform the corrective action within the time period accepted or extended by the competent authority, the finding shall be raised to a level 1 finding and action taken as laid down in point (d)(1). (4) The competent authority shall record all findings it has raised or that have been communicated to it in accordance with point (e) and, where applicable, the enforcement measures it has applied, as well as all corrective actions and date of action closure for findings.

(e) Without prejudice to any additional enforcement measures, when the authority of a Member State acting under the provisions of point (d) of point CAMO.B.300 identifies any non-compliance with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts by an organisation certified by the competent authority of another Member State or the Agency, it shall inform that competent authority and provide an indication of the level of finding.

The competent authority shall:

(a) suspend a certificate on reasonable grounds in the case of potential safety threat;

(b) suspend, revoke or limit a certificate pursuant to point CAMO.B.350;

(c) suspend certificate in case the competent authority's inspectors are unable over a period of 24 months to discharge their oversight responsibilities through on-site audit(s) due to the security situation in the State where the facilities are located.

Appendix I

Continuing Airworthiness Management Organisation Certificate - EASA Form 14

’

ANNEX VIII

‘ANNEX Vd

(Part-CAO)

CAO.1   General

For the purpose of this Annex (Part-CAO):

(1) the competent authority shall be: (a) for organisations having their principal place of business in a Member State, the authority designated by that Member State; (b) for organisations having their principal place of business in a third country, the Agency.

(2) “owner” means the person responsible for the continuing airworthiness of the aircraft, including the following persons: (i) the registered owner of the aircraft; (ii) the lessee in the case of a leasing contract; (iii) the operator.

SECTION A

ORGANISATION REQUIREMENTS

This Annex establishes the requirements to be met by a combined airworthiness organisation (CAO) in order to be issued, upon application, an approval for the maintenance and continuing airworthiness management of aircraft and components for installation thereon, and to continue carrying out those activities, where such aircraft are not classified as complex motor-powered aircraft and are not listed in the air operator certificate of an air carrier licensed in accordance with Regulation (EC) No 1008/2008.

CAOs shall apply for the issuance of, or change to, a CAO approval to the competent authority in a form and manner established by that authority.

(a) Alternative means of compliance to the Accepted Means of Compliance adopted by the Agency may be used by an organisation to demonstrate compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

(b) When an organisation wishes to use alternative means of compliance, it shall, prior to using it, provide the competent authority with a full description of those alternative means of compliance. That description shall include an assessment demonstrating compliance of alternative means of compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts. The organisation may use those alternative means of compliance subject to prior approval by the competent authority, and upon receipt of the notification as provided for in point CAO.B.017.

(a) The CAO shall specify the approved scope of work in its combined airworthiness exposition (CAE), as provided for in point CAO.A.025. (1) For aeroplanes of more than 2 730  kg maximum take-off mass (MTOM) and for helicopters of more than 1 200  kg MTOM or certified for more than 4 occupants, the scope of work shall indicate the particular aircraft types. Changes to this scope of work shall be approved by the competent authority in accordance with point (a) of point CAO.A.105 and point (a) of point CAO.B.065. (2) For complete turbine engines, the scope of work shall indicate the engine manufacturer or group or series or type or the maintenance task(s). Changes to this scope of work shall be approved by the competent authority in accordance with point (a) of point CAO.A.105 and point (a) of point CAO.B.065. (3) A CAO which employs only one person for both planning and carrying out of all maintenance tasks cannot hold privileges for the maintenance of: (a) aeroplanes equipped with a turbine engine (in the case of aircraft-rated organisations); (b) helicopters equipped with a turbine engine or with more than one piston engine (in the case of aircraft-rated organisations); (c) complete piston engines of 450 HP and above (in the case of engine-rated organisations); and (d) complete turbine engines (in the case of engine-rated organisations). (4) For aircraft other than those mentioned in point (1), for components different from complete turbine engines and for non-destructive testing (NDT)-specialised services, the scope of work shall be controlled by the CAO in accordance with the procedure set out in point (a)(11) of point CAO.A.025. For maintenance of components different from complete engines, the scope of work shall be classified in accordance with the following system ratings: (i) C1: air conditioning and pressurisation; (ii) C2: auto flight; (iii) C3: communications and navigation; (iv) C4: doors and hatches; (v) C5: electrical power and lights; (vi) C6: equipment; (vii) C7: engine; (viii) C8: flight controls; (ix) C9: fuel; (x) C10: helicopter and rotors; (xi) C11: helicopter transmission; (xii) C12: hydraulic power; (xiii) C13: indicating and recording system; (xiv) C14: landing gear; (xv) C15: oxygen; (xvi) C16: propellers; (xvii) C17: pneumatic and vacuum systems; (xviii) C18: protection from ice/rain/fire; (xix) C19: windows; (xx) C20: structural; (xxi) C21: water ballast; and (xxii) C22: propulsion augmentation. Organisations obtaining an approval in accordance with this Annex on the basis of an existing organisation approval issued in accordance with Subpart G or Subpart F of Annex I (Part-M) or Annex II (Part-145) in accordance with paragraph 4 of Article 4, shall include in the scope of work all the necessary details to ensure that the privileges are identical to the ones included in the existing approval.

(b) The CAO approval shall be issued on the basis of the template set out in Appendix I to this Annex.

(c) A CAO may fabricate, in conformity with maintenance data, a restricted range of parts for use in the course of undergoing work within its own facilities, as indicated in their CAE.

(a) The CAO shall provide a manual containing at least the following information: (1) a statement signed by the accountable manager confirming that the organisation will at all times work in accordance with the requirements of this Annex and the CAE; (2) the CAE's scope of work; (3) the title(s) and name(s) of the person(s) referred to in points (a) and (b) of point CAO.A.035; (4) an organisation chart showing the chains of responsibility between the person(s) referred to in points (a) and (b) of CAO.A.035; (5) a list of certifying staff with their scope of approval, if such staff exist; (6) a list of staff responsible for the development and approval of aircraft maintenance programmes (AMPs) with their scope of approval, if such staff exist; (7) a list of airworthiness review staff with their scope of approval, if such staff exist; (8) a list of staff responsible for the issuance of permits to fly, if such staff exist; (9) a general description and location of the facilities; (10) procedures specifying how the CAO shall ensure compliance with the requirements of this Annex; (11) the CAE amendment procedure, as provided for in point (b) of point CAO.A.105.

(b) The initial CAE shall be approved by the competent authority.

(c) Amendments to the CAE shall be handled in accordance with point CAO.A.105.

The CAO shall ensure that all necessary facilities, including adequate office accommodation are provided for it to be able to carry out all the planned work.

In addition, where the scope of approval of the organisation includes maintenance activities, the CAO shall ensure that:

(a) specialised workshops, hangars and bays provide adequate protection from contamination and the environment;

(b) secure storage facilities are provided for components, equipment, tools and material, under conditions ensuring that unserviceable components and materials are segregated from all other components, material, equipment and tools, that the manufacturer's instructions for storage are complied with and that access to the storage facilities is restricted to authorised personnel.

(a) The CAO shall appoint an accountable manager, who shall have an authority for ensuring that all activities of the organisation can be financed so that those activities are carried out in accordance with the requirements of this Annex.

(b) The accountable manager shall nominate a person or group of persons who shall be responsible for ensuring that the CAO is always in compliance with the requirements of this Annex. Those person(s) shall ultimately be responsible to the accountable manager.

(c) All persons referred to in point (b) shall have the relevant knowledge, background and experience related to continuing airworthiness management or maintenance, as appropriate for their functions.

(d) The CAO shall have sufficient appropriately qualified staff for it to be able to carry out the planned work. The CAO shall be entitled to use temporarily subcontracted staff.

(e) The CAO shall assess and record the qualification of all personnel.

(f) Personnel who carry out specialised tasks, such as welding, or non-destructive testing (“NDT”) inspection other than colour contrast inspections shall be qualified in accordance with an officially-recognised standard

(a) Certifying staff shall comply with the requirements of Article 5. They shall only exercise their privileges to release maintenance if the CAO has ensured: (1) that these certifying staff meet the requirements of point (b) of point 66.A.20 of Annex III (Part-66) except when paragraph 6 of Article 5 refers to a national regulation of a Member State, in which case, they shall meet the requirements of such a regulation; (2) that these certifying staff have an adequate understanding of the relevant aircraft or aircraft component(s) to be maintained, or both, as well as of the organisation procedures required to perform such maintenance.

(b) By derogation from point (a), in unforeseen circumstances where an aircraft is grounded at a location other than the main base where no appropriate certifying staff are available, the CAO contracted to provide maintenance support may issue a one-off certification authorisation, alternatively: (1) to one of their employees holding type qualifications for aircraft of similar technology, construction and systems; (2) to any person with no less than 3 years of maintenance experience and holding a valid ICAO aircraft maintenance licence rated for the aircraft type requiring certification, provided that there is no organisation approved in accordance with this Annex at that location and that the contracted CAO obtains and holds on file evidence of the experience and licence of that person. The issuance of a one-off certification authorisation shall be reported by the CAO to the competent authority within 7 days of the issuance. The CAO issuing the one-off certification authorisation shall ensure that any such maintenance that could affect flight safety is rechecked.

(c) By derogation from point (a), the CAO may use certifying staff qualified in accordance with the following requirements when providing maintenance support to operators involved in commercial operations, subject to appropriate procedures to be approved as part of the CAE: (1) for a repetitive preflight airworthiness directive (AD) which specifically states that the flight crew may carry out such an AD, the CAO may issue a limited certifying-staff authorisation to the pilot-in-command on the basis of the flight crew licence held, provided that the CAO ensures that sufficient practical training has been carried out by the pilot-in-command so he/she can accomplish the AD to the required standard; (2) in the case of aircraft operating away from a supported location, the CAO may issue a limited certifying-staff authorisation to the pilot-in-command, on the basis of the flight crew licence held, provided that the organisation ensures that sufficient practical training has been carried out so that such a commander can accomplish the task to the required standard.

(d) The CAO shall record the details concerning certifying staff and maintain an up-to-date list of all certifying staff, together with details on their scope of approval, as part of the organisation's exposition.

(a) In order for it to be approved to carry out airworthiness reviews and, if applicable, to issue permits to fly, a CAO shall have appropriate airworthiness review staff who shall comply with all of the following requirements: (1) they acquired experience in continuing airworthiness of at least 1 year for sailplanes and balloons and of at least 3 years for all other aircraft; (2) they hold an appropriate licence issued in accordance with Article 5 of this Regulation or an aeronautical degree or equivalent or experience in continuing airworthiness in addition to the referred to in point (1) of at least 2 years for sailplanes and balloons and at least 4 years for all other aircraft; (3) they acquired appropriate aeronautical-maintenance training.

(b) Before the CAO issues an authorisation to an airworthiness review staff to perfom airworthiness review, the CAO shall nominate the person who will perform an airworthiness review of an aircraft under supervision of the competent authority or under the supervision of a person already authorised as airworthiness review staff of the CAO. If this supervision is satisfactory, the competent authority shall formally accept the staff to become airworthiness review staff.

(c) The CAO shall ensure that its airworthiness review staff can demonstrate appropriate recent continuing airworthiness experience.

(d) Each airworthiness review staff shall be identified in the CAE in a list that contains the airworthiness review authorisation referred in point (b).

(e) The CAO shall maintain a record of all its airworthiness review staff, which shall include details of any appropriate qualification and a summary of relevant continuing airworthiness experience and training of the person concerned, as well as a copy of his or her authorisation. It shall retain that record for a period of at least 2 years after the date at which the person concerned no longer works for the CAO.

(a) The CAO shall: (1) hold the equipment and tools specified in the maintenance data provided for in point CAO.A.055, or verified equivalents as listed in the CAE, as necessary for day-to-day maintenance within the scope of the organisation's approval; (2) have a procedure to ensure that it has access to all other equipment and tools necessary to carry out its work, used only on an occasional basis, where needed.

(b) The CAO shall ensure that the tools and equipment it uses are controlled and calibrated to an officially recognised standard. It shall keep records of such calibrations and the standards used and comply with point CAO.A.090.

(c) The CAO shall inspect, classify and appropriately segregate all incoming components in accordance with points M.A.501 and M.A.504 of Annex I (Part-M) or with points ML.A.501 and ML.A.504 of Annex Vb (Part-ML), as applicable.

(a) The CAO shall hold and use applicable current maintenance data specified in point M.A.401 of Annex I (Part-M) or in point ML.A.401 of Annex Vb (Part-ML), as applicable, in the performance of maintenance, including modifications and repairs. However, in the case of customer-provided maintenance data, it shall only be required to hold such data when the work is in progress.

(b) Before the commencement of maintenance, a written work order shall be agreed between the CAO and the person or organisation requesting maintenance, in a manner that clearly establishes the maintenance to be carried out.

When performing maintenance, the CAO shall comply with all of the following requirements:

(a) ensure that any person performing maintenance is qualified in accordance with the requirements of this Annex;

(b) ensure that the area in which maintenance is carried out is well organised and clean (no dirt or contamination);

(c) use the methods, techniques, standards and instructions specified in the maintenance data and work orders referred to in point CAO.A.055;

(d) use the tools, equipment and material specified in point CAO.A.050;

(e) ensure that maintenance is performed in accordance with any environmental limitations specified in the maintenance data referred to in point CAO.A.055;

(f) ensure that proper facilities are used in case of inclement weather or lengthy maintenance;

(g) ensure that the risk of multiple errors during maintenance and the risk of errors being repeated in identical maintenance tasks are minimised;

(h) ensure that an error-capturing method is implemented after the performance of any critical maintenance task;

(i) perform a general verification after completion of maintenance in order to ensure that the aircraft or component is clear of all tools, equipment and any extraneous parts and material and that all access panels removed have been refitted;

(j) ensure that all maintenance performed is properly recorded and documented.

At the completion of any aircraft maintenance carried out in accordance with this Annex, an aircraft CRS shall be issued in accordance with point M.A.801 of Annex I (Part-M) or point ML.A.801 of Annex Vb (Part-ML), as applicable.

(a) At the completion of all component maintenance in accordance with this Annex, a component CRS shall be issued in accordance with point M.A.802 of Annex I (Part-M) or point ML.A.802 of Annex Vb (Part-ML), as applicable. An EASA Form 1 shall be issued in accordance with Appendix II to Annex I (Part-M), except as provided for in points (b) or (d) of point M.A.502 of Annex I (Part-M) and point ML.A.502 of Annex Vb (Part-ML) and for components fabricated in accordance with point (c) of point CAO.A.020.

(b) The EASA Form 1 referred to in point (a) may be generated from a computer database.

(a) All continuing airworthiness management shall be carried out in accordance with the requirements of Subpart C of Annex I (Part-M) or Subpart C of Annex Vb (Part-ML), as applicable.

(b) For every aircraft managed, the CAO shall: (1) develop and control the AMP for the aircraft managed and: (i) in the case of aircraft complying with Annex Vb (Part-ML), approve the AMP and its amendments, or (ii) in the case of aircraft complying with Annex I (Part-M), present the AMP and its amendments to the competent authority for approval, unless the approval is covered by an indirect approval procedure in accordance with point (c) of point M.A.302 of Annex I (Part-M); (2) provide a copy of the AMP to the owner; (3) ensure that data used for any modification and repairs complies with points M.A.304 or ML.A.304, as applicable; (4) ensure that all maintenance is performed in accordance with the AMP and released in accordance with Section A, Subpart H of Annex I (Part-M), Section A of Annex II (Part-145) or Section A, Subpart H of Annex Vb (Part-ML), as applicable; (5) ensure that all applicable ADs and all operational directives with a continuing airworthiness impact are implemented; (6) ensure that all defects discovered during maintenance or reported are corrected by an appropriately approved maintenance organisation or by independent certifying staff; (7) ensure that the aircraft is brought for maintenance to an appropriately approved organisation or to independent certifying staff, whenever necessary; (8) coordinate the scheduled maintenance, application of ADs, replacement of service-life-limited parts and component inspection in order to ensure the work is carried out properly; (9) manage and archive all continuing-airworthiness records and, if applicable, the aircraft technical log; (10) ensure that the mass-and-balance statement reflects the current status of the aircraft.

The CAO shall hold and use applicable current maintenance data specified in point M.A.401 of Annex I (Part-M) or point ML.A.401 of Annex Vb (Part-ML), as applicable, for the performance of the continuing airworthiness management tasks referred to in points CAMO.A.315 and CAO.A.075, respectively. This data may be provided by the owner, subject to an contract as referred in points (h)(2), (i)(1), (e) or (f) of point M.A.201, in which case the CAO only needs to hold such data for the duration of the contract, unless where it is to retain the data pursuant to point (b) of point CAO.A.090.

The CAO shall perform any airworthiness reviews in accordance with point M.A.903 of Annex I (Part-M) or point ML.A.903 of Annex Vb (Part-ML), as applicable.

(a) The CAO shall retain the following records: (1) the maintenance records necessary to demonstrate that all requirements of this Annex have been met for the issuance of the CRS, including the subcontractor's release documents; the CAO shall provide a copy of each CRS to the owner of the aircraft, together with a copy of any specific repair or modification data used for the repairs or modifications carried out; (2) the continuing airworthiness management records required by any of the following: (i) point M.A.305 and, if applicable, point M.A.306 of Annex I (Part-M); (ii) point ML.A.305 of Annex Vb (Part-ML); (3) where the CAO has the privilege referred to in point (c) of point CAO.A.095, it shall retain a copy of each airworthiness review certificate (ARC) issued in accordance with point (a) of point ML.A.901 of Annex Vb (Part-ML) and recommendation issued or, as applicable, extended, together with all supporting documents; (4) where the CAO has the privilege referred to in point (d) of point CAO.A.095, it shall retain a copy of each permit to fly issued in accordance with point 21.A.729 of Annex I (Part-21) to Regulation (EU) No 748/2012.

(b) The CAO shall retain a copy of the records described in point (a)(1), and any associated maintenance data, for a period of 3 years from the date at which it released to service the aircraft or aircraft component to which the work relates.

(c) The CAO shall retain a copy of the records referred to in points (a)(2) to (a)(4) for a period of 2 years from the date at which the aircraft has been permanently withdrawn from service.

(d) All records shall be stored in a manner that ensures protection from damage, alteration and theft.

(e) All computer hardware used for backup of the maintenance records shall be stored in a different location from that containing those data and in an environment that ensures that they remain in good condition.

(f) Where the continuing airworthiness management of an aircraft is transferred to another organisation or person, all the records retained under points (a)(2) to (a)(4) shall be transferred to that organisation or person. From the moment of the transfer, points (b) and (c) shall apply to that organisation or person.

(g) Where the CAO terminates its operation, all retained records shall be transferred as follows: (1) the records referred to in point (a)(1) shall be transferred to the last owner or customer of the respective aircraft or component or shall be stored as specified by the competent authority; (2) the records referred to in point (a)(2) to (a)(4) shall be transferred to the owner of the aircraft.

The CAO shall have the following privileges:

(a) Maintenance (1) Maintain any aircraft or component for which it is approved at the locations specified in the approval certificate and the CAE. (2) Arrange for the performance of specialised services at another organisation appropriately qualified under the control of the CAO, in accordance with the appropriate procedures set out in the CAE and approved by the competent authority. (3) Maintain any aircraft or component for which it is approved at any location, where the need of such maintenance arises either from the unserviceability of the aircraft or the need for supporting occasional maintenance, in accordance with the conditions specified in the CAE. (4) Issue certificates of release to service upon completion of maintenance, in accordance with point CAO.A.065 or CAO.A.070.

(b) Continuing airworthiness management (1) Manage the continuing airworthiness of any aircraft for which it is approved. (2) Approve the AMP, in accordance with point (b)(2) of point ML.A.302, for aircraft managed in accordance with Annex Vb (Part-ML). (3) Carry out limited continuing airworthiness tasks with any contracted organisation working under their quality system, as listed on the approval certificate. (4) Extend, in accordance with point (f) of point M.A.901 of Annex I (Part-M) or point (c) of point ML.A.901 of Annex Vb (Part-ML), an ARC that has been issued by the competent authority, another CAO or a CAMO.

(c) Airworthiness review: (1) A CAO with its principal place of business in one of the Member States, the approval of which includes the privileges referred to in point (b), may be approved to carry out airworthiness reviews in accordance with point M.A.901 of Annex I (Part-M) or point ML.A.903 of Annex Vb (Part-ML), as applicable, and: (i) issue the related ARC or recommendation for the issuance of the ARC; (ii) extend the validity of an existing ARC. (2) A CAO with its principal place of business in one of the Member States, the approval of which includes the privileges referred to in point (a), may be approved to carry out airworthiness reviews in accordance with point ML.A.903 of Annex Vb (Part-ML) and issue the related ARC.

(d) Permit to fly A CAO with its principal place of business in one of the Member States, the approval of which includes the privileges referred to in point (c), may be approved to issue a permit to fly in accordance with point (d) of point 21.A.711 of Annex I (Part-21) to Regulation (EU) No 748/2012 for those aircraft for which it can issue the ARC when it attests conformity with the approved flight conditions, in accordance with an adequate procedure provided for in the CAE.

(e) A CAO may be approved for one or more privileges.

(a) To ensure that the CAO continues to meet the requirements of this Annex, this organisation shall establish a quality system and designate a quality manager.

(b) The quality system shall monitor the carrying out of the activities of the organisation covered by this Annex. It shall monitor in particular: (1) that all those activities are performed in accordance with the approved procedures; (2) that all contracted maintenance tasks are carried out in accordance with the contract; (3) that the organisation continues to comply with the requirements of this Annex.

(c) The records of that monitoring shall be retained for at least the previous 2 years.

(d) Where the organisation holding a CAO approval is additionally approved in accordance with an Annex other than this Annex, the quality system may be combined with that required by the other Annex.

(e) A CAO shall be considered as a small CAO when one of the following condition is met: (1) The scope of the CAO does only contain aircraft covered by Part-ML. (2) The CAO does not exceed 10 full-time equivalent staff involved in maintenance. (3) The CAO does not exceed 5 full-time equivalent staff involved in continuing airworthiness management.

(f) In the case of a small CAO, the quality system may be replaced by regular organisational reviews, subject to the approval of the competent authority. In that case, the CAO shall not contract continuing airworthiness management tasks to other parties.

(a) In order to enable the competent authority to determine continued compliance with this Part, the approved maintenance organisation shall notify it of any proposal to carry out any of the following changes, before such changes take place:

(1) changes affecting the information contained in the approval certificate laid down in Appendix I and the terms of approval of this Annex; (2) changes of the persons referred to in points CAO.A.035(a) and (b); (3) changes in the aircraft types covered by the scope of work referred to in point (a)(1) of point CAO.A.020 in the case of aeroplanes of more than 2 730  kg maximum take-off mass (MTOM) and in the case of helicopters of more than 1 200  kg MTOM or certified for more than 4 occupants; (4) changes in the scope of work referred to in point (a)(2) of CAO.A.020 in the case of complete turbine engines; (5) changes in the control procedure set out in point (b) of this point.

(b) Any other changes in locations, facilities, equipment, tools, material, procedures, scope of work and staff shall be controlled by the CAO through a control procedure provided for in the CAE. The CAO shall submit a description of those changes and the corresponding CAE amendments to the competent authority within 15 days from the day on which the change took place.

(a) An approval shall be issued for an unlimited duration and shall remain valid subject to: (1) the organisation remaining in compliance with the requirements of this Annex, in particular how the findings are handled in accordance with point CAO.A.115; (2) the competent authority being granted access to the organisation to determine continued compliance with the requirements of this Annex; (3) the competent authority not having surrendered or revoked the approval.

(b) Upon surrender or revocation of the approval, the organisation shall return the approval certificate to the competent authority.

(a) A Level 1 finding is any significant non-compliance with Part-CAO requirements which lowers the safety standard and seriously hazards flight safety.

(b) A Level 2 finding is any non-compliance with the Part-CAO requirements which may lower the safety standard and possibly hazard flight safety.

(c) After receiving a notification of a finding in accordance with point CAO.B.060, the CAO shall adopt a corrective action plan and demonstrate to the satisfaction of the competent authority that it has taken the necessary corrective action to address the finding within the time period set by that authority.

SECTION B

AUTHORITY REQUIREMENTS

This Section establishes the administrative requirements to be met by the competent authorities in connection to the requirements for organisations set out in Section A.

(a) The Agency shall develop Acceptable Means of Compliance (“AMC”) that may be used to demonstrate compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

(b) Alternative means of compliance may be used to demonstrate compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts

(c) The competent authority shall establish a system to consistently evaluate that all alternative means of compliance used by organisations under its oversight allow for the establishment of compliance with Regulation (EU) No 2018/1139 and its delegated and implementing acts.

(d) The competent authority shall evaluate all alternative means of compliance proposed by an organisation in accordance with point CAO.A.017 by analysing the documentation provided and, if considered necessary, conducting an inspection of the organisation. When the competent authority finds that the alternative means of compliance are in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts, it shall without undue delay: (1) notify the applicant that the alternative means of compliance may be used and, if applicable, amend the approval or certificate of the applicant accordingly; (2) notify the Agency of their content, including copies of all relevant documentation.

(a) The competent authority shall establish a system of record-keeping that allows adequate traceability of the process to keep the records for issuing, continuing, changing, suspending or revoking each issued certificate.

(b) The records of the competent authority for the oversight of organisations approved in accordance with this Annex shall include, as a minimum: (1) the application for an organisation approval; (2) the organisation approval certificate, including any changes thereto; (3) a copy of the audit programme of the organisation, listing the dates at which audits were carried out and when they are due; (4) the continuing-oversight records, including all audit records, as provide for in point CAO.B.055; (5) all findings, actions required to close the findings and recommendations; (6) copies of all relevant correspondence with the organisation; (7) details of any exemption in accordance with point CAO.B.035 and enforcement actions; (8) any report from other competent authorities relating to the oversight of the organisation; (9) CAE and its amendments; (10) copies of any other document approved by the competent authority.

(c) The retention period for the records listed under point (b) shall be at least 5 years.

(d) All records shall be made available to the competent authority of another Member State or the Agency, upon request.

(a) Where necessary for the performance of their tasks under this Regulation, the competent authorities shall exchange information.

(b) In the case of a potential safety threat involving several Member States, the competent authorities concerned shall assist each other in carrying out the necessary oversight action.

The competent authority shall conduct the necessary inspections and investigations in order to verify and ensure that the organisations for which it is responsible in accordance with point CAO.1 meets the requirements of Section A of this Annex.

Where a Member State grants an exemption from the requirements of this Annex in accordance with paragraph 2 of Article 71 of Regulation (EU) 2018/1139, the competent authority shall record the exemption. It shall retain those records as provided for in point (b)(6) of point CAO.B.020.

Where facilities of the CAO are located in more than one Member State, the initial certification procedure and continued oversight of the approval shall be carried out in cooperation with the competent authorities designated by the Member States in whose territory the other facilities are located.

(a) Where it has been established that the organisation meets the requirements laid down in points (a) and (b) of CAO.A.035, the competent authority shall formally notify the applicant about the acceptance of the personnel.

(b) The competent authority shall ensure that the procedures specified in the CAE comply with Section A, and that the accountable manager has signed the commitment statement referred to in point (a)(1) of CAO.A.025.

(c) The competent authority shall verify that the organisation complies with Section A.

(d) The competent authority shall convene a meeting with the accountable manager at least once during the investigation for approval to ensure that he or she fully understand the significance of the approval and the statement referred to in point (a)(1) of CAO.A.025

(e) All findings in accordance with point CAO.B.060 shall be confirmed in writing to the applicant organisation.

(g) Before issuing the approval the competent authority shall close all be findings after the organisation has corrected them.

(h) By derogation from points (a) to (g) and from point (a) of point CAO.B.50, for organisations applying for a an approval in accordance with this Annex on the basis of an existing organisation approval issued in accordance with Subpart F or Subpart G of Annex I (Part-M) or Annex II (Part-145), in accordance with point (4) of Article 4, the competent authority shall: (1) issue an approval in accordance with this Annex using the EASA Form 3-CAO laid down in Appendix I to this Annex; (2) within 2 years from the date at which it issued the approval referred to in point (1), verify that the organisation concerned complies with the requirements of this Annex for the privileges held.

(a) Where the competent authority has established that the applicant complies with CAO.B.45, it shall issue the certificate, using the EASA Form 3-CAO template laid down in Appendix I and specifying the terms of approval.

(b) The competent authority shall include the reference number of the CAO as specified in the EASA Form 3-CAO template laid down in Appendix I.

(a) The competent authority shall establish and keep up-to-date, an oversight programme, specifying all CAOs to which it has issued a certificate and the dates at which it has audited and is scheduled to audit those CAOs.

(b) The competent authority shall audit, at, periods not exceeding 24 months each CAO to which it has issued an approval. Those audits shall concentrate, in particular, on the changes to the organisation notified to it in accordance with the procedure specified in point (b) of point CAO.A.105.

(c) A relevant sample of the aircraft managed by the CAO, if the organisation is approved to do so, shall be surveyed at every 24-month period. The size of the sample shall be decided by the competent authority based on the result of prior audits and earlier product surveys.

(d) The competent authority shall confirm in writing any finding during those audits to the CAO.

(e) The competent authority shall record any findings during those audits, any actions required to close the findings and any recommendations issued.

(f) The competent authority shall convey a meeting with the accountable manager of the CAO at least once every 24 months.

(a) When during audits or by any other means, evidence is found showing non-compliance to the Part-CAO requirements, the competent authority shall take the following actions:

(1) for Level 1 findings, immediate action shall be taken by the competent authority to revoke, limit or suspend in whole or in part, depending upon the extent of the Level 1 finding, the CAO approval, until successful corrective action has been taken by the organisation; and (2) for Level 2 findings, the competent authority shall grant a corrective action period of no more than 3 months, appropriate to the nature of the finding — in certain circumstances, at the end of this first period and subject to the nature of the finding, the competent authority can extend this 3-month period subject to a satisfactory corrective action plan.

(b) Action shall be taken by the competent authority to suspend in whole or in part the approval in case of failure to comply within the timescale set out by the competent authority.

(a) Upon receiving an application for a change in accordance with point (a) of point CAO.A.105, the competent authority shall verify the organisation's compliance with the applicable requirements before issuing the approval of the change.

(b) The competent authority may indicate the conditions under which the CAO shall operate during the change unless the competent authority determines that the organisation's certificate shall be suspended because of the nature or extent of the changes.

(c) For changes not requiring prior approval, the competent authority shall assess during the oversight activities that the CAO complies with the approved control procedure provided for in point (b) of point CAO.A.105 and complies with the applicable requirements.

The competent authority shall:

(a) suspend an approval on reasonable grounds in the case of a potential safety threat; or

(b) suspend, revoke or limit an approval pursuant to point CAO.B.060.

Appendix I

Combined airworthiness organisation (CAO) certificate – EASA Form 3-CAO

(a) Within the approval class(es) and rating(s) established by the competent authority, the scope of work specified in the CAE defines the exact limits of approval. It is therefore essential that the approval class(es) and rating(s) and the organisations scope of work are matching.

(b) An aircraft rating, in relation to the maintenance privileges, means that the CAO may carry out maintenance on the aircraft and any component (including engines), in accordance with aircraft maintenance data or, if agreed by the competent authority, in accordance with component maintenance data, only whilst such components are fitted to the aircraft. Nevertheless, such aircraft-rated CAO may temporarily remove a component for maintenance in order to improve access to that component except when such removal creates the need for additional maintenance not eligible for the requirements of point (b). This will be subject to a control procedure in the CAE to be approved by the competent authority.

(c) An engine rating (turbine, piston or electrical) means that the CAO may carry out maintenance on the uninstalled engine and engine components, in accordance with engine maintenance data or, if agreed by the competent authority, in accordance with component maintenance data, only whilst such components are fitted to the engine. Nevertheless, such engine-rated CAO may temporarily remove a component for maintenance in order to improve access to that component except when such removal creates the need for additional maintenance not eligible for the requirements of point (c). An engine-rated CAO may also carry out maintenance on an installed engine during base and line maintenance subject to a control procedure in the CAE to be approved by the competent authority.

(d) A component rating (other-than-complete engines) means that the CAO may carry out maintenance on uninstalled components (excluding complete engines) intended for fitment to the aircraft or engine. This CAO may also carry out maintenance on an installed component (other-than-complete engines) during base and line maintenance or at an engine maintenance facility subject to a control procedure in the CAE to be approved by the competent authority.

(e) An non-destructive testing (NDT) rating is a self-contained rating not necessarily related to a specific aircraft, engine or other component. The NDT rating is only necessary for a CAO that carries out NDT as a particular task for another organisation. A CAO approved with an aircraft, engine or component rating may carry out NDT on products they are maintaining subject to the CAE containing NDT procedures, without the need for an NDT rating.

’

(^*1) Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations (OJ L 224, 21.8.2012, p. 1).’;

(^*2) Council Regulation (EEC) No 3922/91 of 16 December 1991 on the harmonization of technical requirements and administrative procedures in the field of civil aviation (OJ L 373, 31.12.1991, p. 4).’;

(¹) Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18).

(^*3) Commission Implementing Regulation (EU) 2018/1976 of 14 December 2018 laying down detailed rules for the operation of sailplanes pursuant to Regulation (EU) 2018/1139 of the European Parliament and of the Council (OJ L326, 20.12.2018, p. 64).

(^*4) Regulation (EU) 2015/1018 of 29 June 2015 laying down a list classifying occurrences in civil aviation to be mandatorily reported according to Regulation (EU) No 376/2014 of the European Parliament and of the Council (OJ L 163, 30.6.2015, p. 1).

(^*5) Regulation (EU) 2015/1018 of 29 June 2015 laying down a list classifying occurrences in civil aviation to be mandatorily reported according to Regulation (EU) No 376/2014 of the European Parliament and of the Council (OJ L 163, 30.6.2015, p. 1).