ARO.GEN.115 Oversight documentation
Regulation (EU) No 965/2012
The competent authority shall provide all legislative acts, standards, rules, technical publications and related documents to relevant personnel in order to allow them to perform their tasks and to discharge their responsibilities.
ARO.GEN.120 Means of compliance
Regulation (EU) 2019/1384
(a) The Agency shall develop acceptable means of compliance (AMC) that may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.
(b) Alternative means of compliance may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.
(c) The competent authority shall establish a system to consistently evaluate whether the alternative means of compliance used by itself or by organisations and persons under its oversight comply with Regulation (EU) 2018/1139 and its delegated and implementing acts. That system shall include procedures to limit, revoke or amend approved alternative means of compliance, if it has been demonstrated by the competent authority that those alternative means of compliance do not comply with Regulation (EU) 2018/1139 and delegated and implementing acts adopted on its basis.
(d) The competent authority shall evaluate all alternative means of compliance proposed by an organisation in accordance:
(1) with point ORO.GEN.120(b) of Annex III (Part-ORO) to this Regulation;
(2) for balloons with point BOP.ADD.010 of Annex II (Part-BOP) to Commission Regulation (EU) 2018/39540 Commission Regulation (EU) 2018/395 of 13 March 2018 laying down detailed rules for the operation of balloons pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 71, 14.3.2018, p. 10).; or
(3) for sailplanes with point SAO.DEC.100(c) of Annex II (Part-SAO) to Commission Implementing Regulation (EU) 2018/197641 Commission Implementing Regulation (EU) 2018/1976 of 14 December 2018 laying down detailed rules for the operation of sailplanes pursuant to Regulation (EU) 2018/1139 of the European Parliament and of the Council (OJ L 326, 20.12.2018, p. 64).;
by analysing the documentation provided and, if considered necessary, conducting an inspection of the organisation.
When the competent authority finds that the alternative means of compliance are in accordance with the Implementing Rules, it shall without undue delay:
(1) notify the applicant that the alternative means of compliance may be implemented and, if applicable, amend the approval, specialised operation authorisation or certificate of the applicant accordingly; and
(2) notify the Agency of their content, including copies of all relevant documentation.
(e) When the competent authority itself uses alternative means of compliance to achieve compliance with Regulation (EC) No 216/2008 and its Implementing Rules it shall:
(1) make them available to all organisations and persons under its oversight; and
(2) without undue delay notify the Agency.
The competent authority shall provide the Agency with a full description of the alternative means of compliance, including any revisions to procedures that may be relevant, as well as an assessment demonstrating that the Implementing Rules are met.
AMC1 ARO.GEN.120(d)(3) Means of compliance
ED Decision 2014/025/R
GENERAL
The information to be provided to other Member States following approval of an alternative means of compliance should contain a reference to the Acceptable Means of Compliance (AMC) to which such means of compliance provides an alternative, as well as a reference to the corresponding Implementing Rule, indicating as applicable the subparagraph(s) covered by the alternative means of compliance.
AMC1 ARO.GEN.120(e) Means of compliance
ED Decision 2017/006/R
DEMONSTRATION OF COMPLIANCE
In order to demonstrate that the implementing rules are met, a risk assessment should be completed and documented. The result of this risk assessment should demonstrate that an equivalent level of safety to that established by the acceptable means of compliance (AMC) adopted by the Agency is reached.
GM1 ARO.GEN.120 Means of compliance
ED Decision 2014/025/R
GENERAL
Alternative means of compliance used by a competent authority or by organisations under its oversight may be used by other competent authorities or organisations only if processed again in accordance with ARO.GEN.120(d) and (e).
ARO.GEN.125 Information to the Agency
Regulation (EU) 2023/203
(a) The competent authority shall without undue delay notify the Agency in case of any significant problems with the implementation of Regulation (EC) No 216/2008 and its Implementing Rules.
(b) The competent authority shall provide the Agency with safety-significant information stemming from the occurrence reports it has received.
(c) The competent authority of the Member State shall provide the Agency as soon as possible with safety-significant information stemming from the information security reports it has received pursuant to point IS.I.OR.230 of Annex II (Part-IS.I.OR) to Implementing Regulation (EU) 2023/203.
[applicable from 22 February 2026 — Implementing Regulation (EU) 2023/203]
ARO.GEN.135 Immediate reaction to a safety problem
Regulation (EU) 2019/1384
(a) Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council42 Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18)., the competent authority shall implement a system to appropriately collect, analyse and disseminate safety information.
(b) The Agency shall implement a system to appropriately analyse any relevant safety information received and without undue delay provide to Member States and the Commission any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to a safety problem involving products, parts, appliances, persons or organisations subject to Regulation (EC) No 216/2008 and its Implementing Rules.
(c) Upon receiving the information referred to in (a) and (b), the competent authority shall take adequate measures to address the safety problem.
(d) Measures taken under (c) shall immediately be notified to all persons or organisations which need to comply with them under Regulation (EC) No 216/2008 and its Implementing Rules. The competent authority shall also notify those measures to the Agency and, when combined action is required, the other Member States concerned.
ARO.GEN.135A Immediate reaction to an information security incident or vulnerability with an impact on aviation safety
Regulation (EU) 2023/203
(a) The competent authority shall implement a system to appropriately collect, analyse, and disseminate information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State to increase the coordination and compatibility of reporting schemes.
(b) The Agency shall implement a system to appropriately analyse any relevant safety-significant information received in accordance with point ARO.GEN.125(c), and without undue delay provide the Member States and the Commission with any information, including recommendations or corrective actions to be taken, necessary for them to react in a timely manner to an information security incident or vulnerability with a potential impact on aviation safety involving products, parts, non-installed equipment, persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts.
(c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the potential impact on aviation safety of the information security incident or vulnerability.
(d) Measures taken in accordance with point (c) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority of the Member State shall also notify those measures to the Agency and, when combined action is required, the competent authorities of the other Member States concerned.
[applicable from 22 February 2026 — Implementing Regulation (EU) 2023/203]