Ground Handling Regulations and Information Security

Ground Handling Regulations and Information Security

Commission Delegated Regulation (EU) 2025/22 has been published amending among others, the Delegated Regulation (EU) 2022/1645 (Part-IS) as regards requirements on information security for organisations providing ground handling services.

What is under the scope of the rules?

The scope of the new ground handling regulations covers all the activities that take place on the ground to prepare an aircraft and its passengers for departure and arrival. Those activities are:

• aircraft loading and unloading with cargo, mail, and baggage; 🛄

• passenger embarkation and disembarkation; 🚶

• coordination of the aircraft turnaround; 🔨

• de-icing and anti-icing; ⛄

• refuelling; ⛽

• aircraft cleaning; 🚮

• securing the aircraft on the ground during turnaround, pushback, and towing; 🚚

• other services including potable water servicing and toilet servicing 🚰

How is this relevant to information security and Part-IS? 

• Organisations subject to Delegated Regulation (EU) 2022/1645 such as the ground handling organisations and the organisations providing apron management services operate under a declaration regime. 📰

• This implies that their management system or any of its components do not need to be approved by their competent authorities. 📑  

• Consequently, information security provisions such as having the information security management manual (ISMM) or the (optional) process to manage changes approved by the competent authority are not applicable to them. 📔  

• The requirements related to these elements had to be amended to reflect this exemption for the declaring organisations. ✍

When will Part-IS be applicable to those organisations? 

For the cybersecurity requirements, a 6-year transition period was agreed to enable affected organisations to first prepare for the specific ground handling requirements and also to benefit from the lessons learned in the other aviation domains that should implement the new requirements at an earlier date (2026 for Regulation (EU) 2022/1645 and 2027 for Regulation (EU) 2023/203). Consequently, Part-IS requirements will be applicable to these organisation from 27 March 2031.