EU occurrence reporting rules now include information security

EU occurrence reporting rules now include information security

Commission Implementing Regulation (EU) 2026/1821 has updated the EU list of civil aviation occurrences subject to mandatory reporting. Alongside new provisions for UAS and U-space, it explicitly introduces information security occurrences across the relevant aviation domains.

The newly occurrence is listed as "Abnormal behaviour of a system due to an information security incident".

Examples include compromised information or data, malware infections and Distributed Denial-of-Service (DDoS) incidents.

This category now appears across aircraft operations, maintenance and repair, air navigation services, aerodromes and ground services, general aviation and UAS operations.

It is important to note that this does not mean that every cybersecurity event must be reported as a safety occurrence. The focus is on information security incidents that result in abnormal system behaviour and may affect the safe functioning of aviation systems, equipment or digital infrastructure.

Organisations should review their reporting arrangements and ensure effective coordination between operational, safety and information security personnel.

The Regulation entered into force on 17 August 2026.