ATCO.AR.B.001 Management system
Regulation (EU) 2023/893
(a) The competent authority shall establish and maintain a management system, including as a minimum:
(1) documented policies and procedures to describe its organisation, means and methods to achieve compliance with Regulation (EC) No 216/2008 and this Regulation. The procedures shall be kept up to date and serve as the basic working documents within that competent authority for all related tasks;
(2) a sufficient number of personnel, including licensing and certification inspectors, to perform its tasks and discharge its responsibilities. Such personnel shall be qualified to perform their allocated tasks and have the necessary knowledge, experience, initial, on-the-job and recurrent training to ensure continuing competence. A system shall be in place to plan the availability of personnel in order to ensure the proper completion of all related tasks;
(3) adequate facilities and office accommodation to perform the allocated tasks;
(4) a function to monitor compliance of the management system with the relevant requirements and adequacy of the procedures, including the establishment of an internal audit process and a safety risk management process. Compliance monitoring shall include a feedback system of audit findings to the senior management of the competent authority to ensure implementation of corrective actions as necessary; and
(5) a person or group of persons ultimately responsible to the senior management of the competent authority for the compliance monitoring function.
(b) The competent authority shall, for each field of activity included in the management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).
(c) The competent authority shall establish procedures for the participation in the exchange of all necessary information and assistance with other competent authorities concerned, including information exchange on all findings raised and follow-up actions taken as a result of oversight of persons and organisations exercising activities in the territory of a Member State, but certified by the competent authority of another Member State or the Agency.
(d) A copy of the procedures related to the management system and their amendments shall be made available to the Agency for the purpose of standardisation.
[applicable until 3 August 2024 - Regulation (EU) 2015/340]
(a) The competent authority shall establish and maintain a management system, including as a minimum:
(1) documented policies and procedures to describe its organisation, means and methods to achieve compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts. The procedures shall be kept up to date and serve as the basic working documents within that competent authority for all related tasks;
(2) a sufficient number of personnel, including licensing and certification inspectors, to perform its tasks and discharge its responsibilities. Such personnel shall be qualified to perform their allocated tasks and have the necessary knowledge, experience, initial, on-the-job and recurrent training to ensure continuing competence. A system shall be in place to plan the availability of personnel in order to ensure the proper completion of all related tasks;
(3) adequate facilities and office accommodation to perform the allocated tasks;
(4) a function to monitor compliance of the management system with the relevant requirements and adequacy of the procedures, including the establishment of an internal audit process and a safety risk management process. Compliance monitoring shall include a feedback system of audit findings to the senior management of the competent authority to ensure implementation of corrective actions as necessary; and
(5) a person or group of persons ultimately responsible to the senior management of the competent authority for the compliance monitoring function.
(b) The competent authority shall, for each field of activity included in the management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).
(c) The competent authority shall establish procedures for participation in a mutual exchange of all necessary information and assistance with other competent authorities concerned, whether from within the Member State or in other Member States, including the following information exchange on:
(1) the relevant findings raised and follow-up actions taken as a result of oversight of persons and organisations exercising activities in the territory of a Member State, but certified by the competent authority of another Member State or the Agency; and
(2) information stemming from mandatory and voluntary occurrence reporting as required by point ATCO.OR.B.040.
(d) A copy of the procedures related to the management system and their amendments shall be made available to the Agency for the purpose of standardisation.
[applicable from 4 August 2024 - Implementing Regulation (EU) 2023/893]
(e) In addition to the requirements contained in point (a), the management system established and maintained by the competent authority shall comply with Annex I (Part-IS.AR) to Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.
[applicable from 22 February 2026 – Regulation (EU) 2023/203]
AMC1 ATCO.AR.B.001(a)(2) Management system
ED Decision 2023/011/R
TRAINING PROGRAMME AND RECURRENT TRAINING
(a) The competent authority should establish a training programme for its personnel and a plan for its implementation. The training programme should include, as appropriate to the role, current knowledge, experience and skills of the personnel, at least the following:
(1) organisation and structure of the aviation legislation;
(2) the Chicago Convention, its relevant annexes and documents, the applicable requirements of Regulation (EC) No 216/2008, its Implementing Rules and related Acceptable Means of Compliance, Certification Specifications and Guidance Material, as well as assessment methodology of the alternative means of compliance and the applicable national legislation;
[applicable until 3 August 2024 - ED Decision 2015/010/R]
(2) the Chicago Convention, its relevant annexes and documents, the applicable requirements of Regulation (EU) No 2018/1139, its delegated and implementing acts and related Acceptable Means of Compliance, Certification Specifications and Guidance Material, as well as an assessment methodology of the alternative means of compliance and the applicable national legislation;
[applicable from 4 August 2024 - ED Decision 2023/011/R]
(3) the applicable requirements and procedures; and
(4) areas of particular interest.
(b) The training programme and plan should be updated, as needed, to reflect, at least, changes in aviation legislation and industry. The training programme should also cover the specific needs of the personnel and the competent authority.
(c) The competent authority should ensure that its personnel, including its ATM/ANS inspectors, undergo recurrent training at regular intervals as defined by the competent authority or whenever deemed necessary, in order to be kept up to date.
[applicable until 3 August 2024 - ED Decision 2015/010/R]
(c) The competent authority should ensure that its personnel, including its ATM/ANS inspectors, receive recurrent training at regular intervals as defined by the competent authority or whenever deemed necessary, in order to be kept up to date.
[applicable from 4 August 2024 - ED Decision 2023/011/R]
GM1 ATCO.AR.B.001(c) Management system
ED Decision 2023/011/R
EXCHANGE OF ALL NECESSARY INFORMATION
‘All necessary information’ refers to information that relates to the oversight of persons and organisations concerned (exercising activities within the territory of the Member State, but overseen, certified or licensed by the competent authority of another Member State or the Agency), as agreed between these competent authorities.
[applicable from 4 August 2024 - ED Decision 2023/011/R]
AMC1 ATCO.AR.B.001(d) Management system
ED Decision 2015/010/R
PROCEDURES AVAILABLE TO THE AGENCY
(a) Copies of the procedures related to the competent authority’s management system and their amendments to be made available to the Agency for the purpose of standardisation should provide at least the following information:
(1) Regarding oversight functions undertaken by the competent authority, the competent authority’s organisational structure with description of the main processes. This information should demonstrate the allocation of responsibilities within the competent authority, and that the competent authority is capable of carrying out the full range of tasks regarding the size and complexity of the Member State’s aviation industry. It should also consider the overall proficiency and authorisation scope of the competent authority’s personnel.
(2) For personnel involved in oversight activities, the minimum professional qualification requirements as well as experience and procedures leading to appointment (e.g. assessment).
(3) How the following are carried out: assessing applications and evaluating compliance, issuing of certificates, performance of oversight, follow-up of findings, enforcement measures and resolution of safety concerns.
(4) Principles of managing exemptions and derogations.
(5) Systems used to disseminate applicable safety information for timely reaction to a safety problem.
(6) Criteria for planning oversight (oversight programme).
(7) Outline of the initial training of newly recruited oversight personnel (taking future activities into account), and the basic framework for continuation training of oversight personnel.
(b) As part of the continuous monitoring of a competent authority, the Agency may request details of the working methods used, in addition to the copy of the procedures of the competent authority’s management system (and amendments thereto). These additional details are the procedures and related guidance material describing working methods for competent authority personnel conducting oversight.
(c) Information related to the competent authority’s management system may be submitted in electronic format.
ATCO.AR.B.005 Allocation of tasks to qualified entities
Regulation (EU) 2023/893
[applicable until 21 February 2026 - Regulation (EU) 2023/893]
ATCO.AR.B.005 Allocation of tasks
[applicable from 22 February 2026 – Regulation (EU) 2023/203]
(a) If the competent authority allocates tasks related to the initial certification or continuous oversight of persons or organisations subject to Regulation (EC) No 216/2008 and its implementing rules, they shall only be allocated to qualified entities. When allocating tasks, the competent authority shall ensure that it has:
(1) a system in place to initially and continuously assess that the qualified entity complies with Annex V to Regulation (EC) No 216/2008.
This system and the results of the assessments shall be documented;
(2) established a documented agreement with a qualified entity, approved by both parties at the appropriate management level, which clearly defines:
(i) the tasks to be performed;
(ii) the declarations, reports and records to be provided;
(iii) the technical conditions to be met in performing such tasks;
(iv) the related liability coverage; and
(v) the protection given to information acquired in carrying out such tasks.
[applicable until 3 August 2024 - Regulation (EU) 2015/340]
(a) If the competent authority allocates tasks related to the initial certification or continuous oversight of persons or organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts, they shall only be allocated to qualified entities. When allocating tasks, the competent authority shall ensure that it has:
(1) a system in place to initially and continuously assess that the qualified entity complies with Annex VI to Regulation (EU) 2018/1139.
This system and the results of the assessments shall be documented;
(2) established a documented agreement with a qualified entity, approved by both parties at the appropriate management level, which clearly defines:
(i) the tasks to be performed;
(ii) the declarations, reports and records to be provided;
(iii) the technical conditions to be met in performing such tasks;
(iv) the related liability coverage; and
(v) the protection given to information acquired in carrying out such tasks.
[applicable from 4 August 2024 - Implementing Regulation (EU) 2023/893]
(b) The competent authority shall ensure that the internal audit process and a safety risk management process required by ATCO.AR.B.001(a)(4) cover all certification or oversight tasks performed on its behalf.
(c) With regard to the certification and oversight of the organisation’s compliance with point ATCO.OR.C.001A, the competent authority may allocate tasks to qualified entities in accordance with point (a), or to any relevant authority responsible for information security or cybersecurity within the Member State. When allocating tasks, the competent authority shall ensure that:
(1) all aspects related to aviation safety are coordinated and taken into account by the qualified entity or relevant authority;
(2) the results of the certification and oversight activities performed by the qualified entity or relevant authority are integrated in the overall certification and oversight files of the organisation;
(3) its own information security management system established in accordance with point ATCO.AR.B.001(e) covers all the certification and continuing oversight tasks performed on its behalf.
[applicable from 22 February 2026 – Regulation (EU) 2023/203]
GM1 ATCO.AR.B.005 Allocation of tasks to qualified entities
ED Decision 2023/011/R
[applicable until 21 February 2026 - ED Decision 2015/010/R]
GM1 ATCO.AR.B.005 Allocation of tasks
[applicable from 22 February 2026 – ED Decision 2023/011/R]
CERTIFICATION TASKS
The tasks that may be performed by a qualified entity on behalf of the competent authority include those related to the initial certification and oversight of training organisations as defined in this Regulation, excluding:
(a) the issue, suspension and revocation of licences, ratings and endorsements;
(b) the issue of temporary OJTI authorisations according to ATCO.C.025;
(c) the issue of temporary assessor authorisations according to ATCO.C.065;
(d) the issue, renewal, suspension, revocation and limitation of training organisation certificates.
[applicable until 3 August 2024 - ED Decision 2015/010/R]
GENERAL
The competent authority may decide to allocate to qualified entities certain or all its tasks that are assigned to such competent authority under this Regulation.
[applicable from 4 August 2024 - ED Decision 2023/011/R]
ATCO.AR.B.010 Changes to the management system
Regulation (EU) 2023/893
(a) The competent authority shall have a system in place to identify changes that affect its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EC) No 216/2008 and this Regulation. It shall enable it to take action, as appropriate, to ensure that the management system remains adequate and effective.
(b) The competent authority shall update its management system to reflect any change to Regulation (EC) No 216/2008 and this Regulation in a timely manner in order to ensure effective implementation.
(c) The competent authority shall notify the Agency of changes affecting its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EC) No 216/2008 and this Regulation.
[applicable until 3 August 2024 - Regulation (EU) 2015/340]
(a) The competent authority shall have a system in place to identify changes that affect its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts. It shall enable it to take action, as appropriate, to ensure that the management system remains adequate and effective.
(b) The competent authority shall update its management system to reflect any change to Regulation (EU) 2018/1139 and its delegated and implementing acts in a timely manner, so as to ensure effective implementation of its management system.
(c) The competent authority shall notify the Agency of changes affecting its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts.
[applicable from 4 August 2024 - Implementing Regulation (EU) 2023/893]
Regulation (EU) 2023/893
(a) Competent authorities shall maintain a list of all organisation certificates and personnel licences and certificates they issue.
(b) The competent authority shall establish a system of record keeping providing for adequate storage, accessibility and reliable traceability of:
(1) the management system's documented policies and procedures;
(2) training, qualification and authorisation of its personnel;
(3) the allocation of tasks, covering the elements required by ATCO.AR.B.005 as well as the details of tasks allocated;
(4) certification processes and continuing oversight of certified organisations;
(5) details of courses provided by training organisations;
(6) processes for the issue of licences, ratings, endorsements and certificates, and for the continuing oversight of the holders of those licences, ratings, endorsements and certificates;
(7) continuing oversight of persons and organisations exercising activities within the territory of the Member State, but certified by the competent authority of another Member State, as agreed between these authorities;
(8) findings, corrective actions and date of action closure;
(9) enforcement measures taken;
(10) safety information and follow-up measures;
(11) the use of flexibility provisions in accordance with Article 14 of Regulation (EC) No 216/2008; and
(12) the evaluation and notification to the Agency of alternative means of compliance proposed by organisations and the assessment of alternative means of compliance used by the competent authority itself.
(c) Records shall be kept for a minimum period of 5 years and with regard to personnel licences for a minimum period of 10 years after the expiry of the last endorsement on the licence, subject to applicable data protection law.
[applicable until 3 August 2024 - Regulation (EU) 2015/340]
(a) Competent authorities shall maintain a list of all organisation certificates and personnel licences and certificates they issue.
(b) The competent authority shall establish a system of record-keeping providing for adequate storage, accessibility and reliable traceability of:
(1) the management system’s documented policies and procedures;
(2) training, qualification and authorisation of its personnel;
(3) the allocation of tasks, covering the elements required by point ATCO.AR.B.005 as well as the details of tasks allocated;
(4) certification processes and continuing oversight of certified organisations;
(5) details of courses provided by training organisations;
(6) processes for the issue of licences, ratings, endorsements and certificates, and for the continuing oversight of the holders of those licences, ratings, endorsements and certificates;
(7) continuing oversight of persons and organisations exercising activities within the territory of the Member State, but certified by the competent authority of another Member State, as agreed between these authorities;
(8) findings, corrective actions and date of action closure;
(9) enforcement measures taken;
(10) safety information and follow-up measures;
(11) the use of flexibility provisions in accordance with Article 71 of Regulation (EU) 2018/1139; and
(12) the evaluation and notification to the Agency of alternative means of compliance proposed by organisations and the assessment of alternative means of compliance used by the competent authority itself.
(c) Records shall be kept for a minimum period of 5 years and with regard to personnel licences for a minimum period of 10 years after the expiry of the last endorsement on the licence, subject to applicable data protection law.
[applicable from 4 August 2024 - Implementing Regulation (EU) 2023/893]
GM1 ATCO.AR.B.015 Record keeping
ED Decision 2015/010/R
STORAGE
Records may be stored electronically.
GM1 ATCO.AR.B.015(b)(5) Record keeping
ED Decision 2015/010/R
DETAILS OF COURSES
Details of courses provided by training organisations may consist of subjects, subject objectives, topics and subtopics, where applicable.