21.B.430 Initial certification procedure

Regulation (EU) 2022/201

(a) Upon receiving an application for the initial issue of a design organisation approval, the competent authority shall verify the applicant’s compliance with the applicable requirements,

(b) A meeting with the head of the design organisation shall be convened at least once during the investigation for initial certification to ensure that this person understands their role and accountability.

(c) The competent authority shall record all the findings issued, closure actions as well as recommendations for the issue of the design organisation approval.

(d) The competent authority shall confirm to the applicant in writing all the findings raised during the verification. For initial certification, all findings must be corrected to the satisfaction of the competent authority before the design organisation approval can be issued.

(e) When satisfied that the applicant complies with the applicable requirements, the competent authority shall issue the design organisation approval.

(f) The certificate reference number shall be included in the design organisation approval in a manner specified by the Agency.

(g) The certificate shall be issued for an unlimited period of time. The privileges and the scope of the activities that the design organisation is approved to perform, including any limitations as applicable, shall be specified in the terms of approval attached to the design organisation approval.

21.B.431 Oversight principles

Regulation (EU) 2022/201

The competent authority shall verify whether certified organisations continue to comply with the applicable requirements

(a) The verification shall:

1. be supported by documentation specifically intended to provide personnel responsible for oversight with guidance to perform their functions;

2. provide the organisations concerned with the results of oversight activities;

3. be based on assessments, audits, inspections and, if needed, unannounced inspections;

4. provide the competent authority with the evidence needed in case further action is required, including the measures provided for in point 21.B.433.

(b) The competent authority shall establish the scope of the oversight set out in point (a) taking into account the results of past oversight activities and the safety priorities.

(c) The competent authority shall collect and process any information deemed necessary for performing oversight activities.

21.B.432 Oversight programme

Regulation (EU) 2022/201

(a) The competent authority shall establish and maintain an oversight programme covering the oversight activities required to comply with point 21.B.431(a).

(b) The oversight programme shall take into account the specific nature of the organisation, the complexity of its activities, the results of past certification or oversight activities, or both, and it shall be based on the assessment of the associated risks. It shall include, within each oversight planning cycle:

1. assessments, audits and inspections, including, where appropriate:

(i) management system assessments and process audits;

(ii) product audits of a relevant sample of the design and certification of the products, parts and appliances that are within the scope of work of the organisation;

(iii) sampling of the work performed;

(iv) unannounced inspections;

2. meetings convened between the head of the design organisation and the competent authority to ensure that both parties remain informed of all significant issues.

(c) The oversight planning cycle shall not exceed 24 months.

(d) Notwithstanding point (c), the oversight planning cycle may be extended to 36 months if the competent authority has established that during the previous 24 months:

1. the organisation has demonstrated that it can effectively identify aviation safety hazards and manage the associated risks;

2. the organisation has continuously demonstrated compliance with point 21.A.247 and has full control over all changes to the design management system;

3. no level 1 findings have been issued;

4. all corrective actions have been implemented within the time period that was accepted or extended by the competent authority as provided for in point 21.B.433(d).

Notwithstanding point (c), the oversight planning cycle may be further extended to a maximum of 48 months if, in addition to the conditions laid down in points (d)(1) to (d)(4), the organisation has established, and the competent authority has approved, an effective continuous system for reporting to the competent authority on the safety performance and regulatory compliance of the organisation itself.

(e) The oversight planning cycle may be reduced if there is evidence that the safety performance of the organisation has decreased.

(f) The oversight programme shall include records of the dates when assessments, audits, inspections and meetings are due, and when assessments, audits, inspections and meetings have been effectively carried out.

(g) At the completion of each oversight planning cycle, the competent authority shall issue a recommendation report on the continuation of the approval, reflecting the results of the oversight.

21.B.433 Findings and corrective actions; observations

Regulation (EU) 2022/201

(a) The competent authority shall have a system in place to analyse findings for their safety significance.

(b) A level 1 finding shall be issued by the competent authority when a non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, with the organisation’s procedures and manuals, or with the design organisation’s certificate including the terms of approval, which may lead to uncontrolled non-compliances and to a potential unsafe condition.

The level 1 findings shall also include:

1. any failure to grant the competent authority access to the organisation’s facilities referred to in point 21.A.9 during normal operating hours and after two written requests;

2. obtaining the design organisation approval or maintaining its validity by falsification of the submitted documentary evidence;

3. any evidence of malpractice or fraudulent use of the design organisation approval;

4. failure to appoint a head of the design organisation pursuant to point 21.A.245(a).

(c) A level 2 finding shall be issued by the competent authority when any non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, with the organisation’s procedures and manuals, or with the certificate including the terms of approval, which is not classified as a level 1 finding.

(d) When a finding is detected during oversight or by any other means, the competent authority shall, without prejudice to any additional action required by Regulation (EU) 2018/1139 and its delegated and implementing acts, communicate in writing the finding to the organisation and request corrective action to address the non- compliance(s) identified. Where a level 1 finding directly relates to a product, the competent authority shall inform the competent authority of the Member State in which the aircraft is registered.

1. If there are any level 1 findings, the competent authority shall:

(i) grant the organisation a corrective action implementation period that is appropriate to the nature of the finding and that in any case shall not be more than 21 working days. That period shall commence from the date of the written communication of the finding to the organisation requesting corrective action to address the non-compliance(s) identified;

(ii) assess the corrective action plan and implementation plan proposed by the organisation, and if it concludes that they are sufficient to address the non-compliance(s), accept them;

(iii) if the organisation fails to submit an acceptable corrective action plan, or fails to perform the corrective action within the time period accepted by the competent authority, take immediate and appropriate action to prohibit or limit the activities of the organisation involved and, if appropriate, take action to revoke the design organisation approval or to limit or suspend it in whole or in part, depending upon the extent of the level 1 finding, until successful corrective action has been taken by the organisation.

2. If there are any level 2 findings, the competent authority shall:

(i) grant the organisation a corrective action implementation period that is appropriate to the nature of the finding, and that in any case shall initially not be more than 3 months. That period shall commence from the date of the written communication of the finding requesting corrective action. At the end of this period, and subject to the nature of the finding, the competent authority may extend the 3‑month period provided that a corrective action plan has been agreed by the competent authority;

(ii) assess the corrective action and the implementation plan proposed by the organisation, and if it concludes that they are sufficient to address the non-compliance(s), accept them;

(iii) if the organisation fails to submit an acceptable corrective action plan, or fails to perform the corrective action within the time period accepted or extended by the competent authority, the finding shall be raised to level 1 and action shall be taken as laid down in point (d)(1).

(e) The competent authority may issue observations for any of the following cases not requiring level 1 or level 2 findings:

1. for any item whose performance has been assessed to be ineffective;

2. when it has been identified that an item has the potential to cause a non-compliance under points (b) or (c);

3. when suggestions or improvements are of interest for the overall safety performance of the organisation.

The observations issued under this point shall be communicated in writing to the organisation and recorded by the competent authority.

21.B.435 Changes in the design management system

Regulation (EU) 2022/201

(a) Upon receiving an application for a significant change to the design management system, the competent authority shall verify the organisation’s compliance with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, before issuing the approval.

(b) The competent authority shall establish the conditions under which the organisation may operate during the change unless the competent authority determines that the design organisation approval needs to be suspended.

(c) When it is satisfied that the organisation complies with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, the competent authority shall approve the change.

(d) Without prejudice to any additional enforcement measures, if the organisation implements a significant change to the design management system without having received the approval of the competent authority pursuant to point (c), the competent authority shall consider the need to suspend, limit or revoke the organisation’s certificate.

(e) For non-significant changes to the design management system, the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles set forth in point 21.B.431. If any non-compliance is found, the competent authority shall notify the organisation, request further changes and act in accordance with point 21.B.433.

SUBPART K — PARTS AND APPLIANCES

Administrative procedures established by the Agency shall apply