21.A.1 Scope

Regulation (EU) 2022/201

This Subpart establishes the general rights and obligations of the applicant for, and holder of, any certificate that has been issued or is to be issued in accordance with this Annex.

21.A.2 Undertaking by another person than the applicant for, or holder of, a certificate

Regulation (EU) No 748/2012

The actions and obligations required to be undertaken by the holder of, or applicant for, a certificate for a product, part or appliance under this Section may be undertaken on its behalf by any other natural or legal person, provided the holder of, or applicant for, that certificate can show that it has made an agreement with the other person such as to ensure that the holder's obligations are and will be properly discharged.

21.A.3A Reporting system

Regulation (EU) 2022/201

(a) Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council⁹.Regulation (EU) No 376/2014 of the European Parliament and of the Council of 3 April 2014 on the reporting, analysis and follow-up of occurrences in civil aviation, amending Regulation (EU) No 996/2010 of the European Parliament and of the Council and repealing Directive 2003/42/EC of the European Parliament and of the Council and Commission Regulations (EC) No 1321/2007 and (EC) No 1330/2007 (OJ L 122, 24.4.2014, p. 18). and its delegated and implementing acts, all natural or legal persons that have applied for or hold a type-certificate, restricted type-certificate, supplemental type-certificate, European Technical Standard Order (ETSO) authorisation, major repair design approval or any other relevant approval deemed to have been issued under this Regulation shall:

1. establish and maintain a system for collecting, investigating and analysing occurrence reports in order to identify adverse trends or to address deficiencies and to extract occurrences whose reporting is mandatory in accordance with point 3 and those which are reported voluntarily. When the principal place of business is located in a Member State, a single system may be established to meet the requirements of Regulation (EU) No 376/2014 of the European Parliament and of the Council and its implementing acts and of Regulation (EU) 2018/1139 and its delegated and implementing acts. The reporting system shall include:

(i) reports of and information related to failures, malfunctions, defects or other occurrences which cause or might cause adverse effects on the continuing airworthiness of the product, part or appliance covered by the type-certificate, restricted type-certificate, supplemental type-certificate, ETSO authorisation, major repair design approval or by any other relevant approval deemed to have been issued under this Regulation;

(ii) errors, near misses and hazards that do not fall under point (i);

2. make available to known operators of the product, part or appliance and, on request, to any person authorised under other implementing or delegated acts the information about the system established in accordance with point 1, and on how to provide reports of and information related to failures, malfunctions, defects or other occurrences referred to in point 1(i);

3. report to the Agency any failure, malfunction, defect or other occurrence of which it is aware and is related to a product, part or appliance covered by the type-certificate, restricted type-certificate, supplemental type-certificate, ETSO authorisation, major repair design approval or by any other relevant approval deemed to have been issued under this Regulation, and which has resulted or may result in an unsafe condition.

(b) Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council and its delegated and implementing acts, any natural or legal person that holds or has applied for a production organisation approval certificate under Subpart G of this Section, or that produces a product, part or appliance under Subpart F of this Section, shall:

1. establish and maintain a system for collecting and assessing occurrence reports, including reports on errors, near misses and hazards, in order to identify adverse trends or to address deficiencies and extract occurrences whose reporting is mandatory in accordance with points 2 and 3 and those which are reported voluntarily. For organisations that have their principal place of business in a Member State, a single system may be established to meet the requirements of Regulation (EU) No 376/2014 of the European Parliament and of the Council and its implementing acts and of Regulation (EU) 2018/1139 and its delegated and implementing acts;

2. report to the responsible design approval holder all the cases where products, parts or appliances have been released by the production organisation and possible deviations from the applicable design data have been subsequently identified, and investigate with the design approval holder to identify those deviations which could lead to an unsafe condition;

3. report to the competent authority of the Member State responsible in accordance with point 21.1 and the Agency the deviations that have been identified in accordance with point 21.A.3A(b)2 and which could lead to an unsafe condition;

4. if the production organisation acts as a supplier to another production organisation, also report to that other organisation all the cases where it has released products, parts or appliances to that organisation and possible deviations from the applicable design data have been subsequently identified.

(c) Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council and its delegated and implementing acts, any natural or legal person, when reporting in accordance with points (a)(3), (b)(2), (b)(3) and (b)(4), shall appropriately protect the confidentiality of the person who reports and of the person(s) mentioned in the report.

(d) Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council and its delegated and implementing acts, any natural or legal person shall make the reports referred to in points (a)(3) and (b)(3) in a form and manner established by the Agency or the competent authority, respectively, and dispatch them as soon as practicable and in any case not later than 72 hours after the natural or legal person has identified that the occurrence may lead to a possible unsafe condition, unless exceptional circumstances prevent this.

(e) Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council and its delegated and implementing acts, if an occurrence reported under point (a)(3) or under point (b)(3) results from a deficiency in the design or a production deficiency, the holder of the type-certificate, restricted type-certificate, supplemental type-certificate, major repair design approval, ETSO authorisation or any other relevant approval deemed to have been issued under this Regulation, or the production organisation as appropriate, shall investigate the reason for the deficiency and report to the competent authority of the Member State responsible in accordance with point 21.1 and to the Agency the results of its investigation and any action it intends to take or proposes to be taken to correct that deficiency.

(f) If the competent authority finds that action is required to correct the deficiency, the holder of the type-certificate, restricted type-certificate, supplemental type-certificate, major repair design approval, ETSO authorisation or any other relevant approval deemed to have been issued under this Regulation, or the production organisation as appropriate, shall submit the relevant data to the competent authority upon its request.

GM1 21.A.3A Reporting system

ED Decision 2022/021/R

LINK BETWEEN POINT 21.A.3A AND REGULATION (EU) No 376/2014

Regulation (EU) No 376/2014 of the European Parliament and of the Council lays down requirements on the reporting, analysis and follow-up of occurrences in civil aviation. Compliance with point 21.A.3A of Part 21 does not exempt organisations from compliance with Regulation (EU) No 376/2014. For each category of reporter, Regulation (EU) 2015/1018¹⁰ defines the nature of items to be mandatorily reported. Regulation EU) No 376/2014 also considers voluntary reporting of other items that are perceived by the reporter as a threat to aviation safety.

Point 21.A.3A lays down requirements for the mandatory reporting of events to the competent authority, in view of performing the necessary activities linked to the continued airworthiness of aircraft, parts, and appliances.

For Part 21 design organisations (DOs) and production organisations (POs), the reportability criteria (i.e. a potential unsafe condition) are the same as the ones laid down by Regulation (EU) No 376/2014.

Furthermore, compliance with Regulation (EU) No 376/2014 does not exempt organisations from compliance with point 21.A.3A. However, this should not give rise to two parallel reporting systems, and point 21.A.3A and Regulation (EU) No 376/2014 should be seen as complementary in that respect.

In practice, this means that reporting obligations under point 21.A.3A on one hand and reporting obligations under Regulation (EU) No 376/2014 on the other hand are compatible. These reporting obligations may be discharged using one reporting channel.

In addition, any natural or legal person that has more than one role subject to the obligation to report may discharge all those obligations through a single report. Organisations are encouraged to properly describe this in their organisation manual, to address cases in which the responsibilities are discharged on behalf of the organisation.

AMC1 21.A.3A(a) Reporting system

ED Decision 2022/021/R

COLLECTION, INVESTIGATION, AND ANALYSIS OF EVENTS

In the context of the following AMC and GM to point 21.A.3A, the term ‘event’ refers to any failure, malfunction, defect, error, near miss, hazard identification, incident, accident, or other occurrence that is subject to a reporting system.

The ‘collection’, ‘investigation’, and ‘analysis’ functions of the system should include means:

—      to analyse events and related available information;

—      to identify adverse trends;

—      to investigate the associated root cause(s); and

—      to determine any necessary corrective action.

It should also allow the determination of reportable occurrences as required by point 21.A.3A(a)(3) or 21.A.3A(b)(3), as applicable.

In addition, for parts whose failure could lead to an unsafe condition, the ‘analysis’ function of the system should ensure that reports and information sent, or available, to the design approval holder (DAH) are fully investigated so that the exact nature of any event and its effect on continuing airworthiness is understood. This may then result in changes to the design and/or to the instructions for continued airworthiness (ICA), and/or in establishing a mitigation plan to prevent or minimise the possibility of such occurrences in the future, as necessary. The ‘analysis’ is not limited to those occurrences that require the involvement of EASA under point 21.A.3A(e).

AMC2 21.A.3A(a) Reporting system

ED Decision 2022/021/R

COLLECTION, INVESTIGATION, AND ANALYSIS OF DATA RELATED TO FLAMMABILITY REDUCTION MEANS (FRM) RELIABILITY

Holders of a TC, an RTC, an STC, or any other relevant approval that is deemed to have been issued under Part 21, which have included an FRM in their design, should continuously assess the effects of aeroplane component failures on FRM reliability. This should be part of the system for the collection, investigation, and analysis of data, which is required by point 21.A.3A(a). The applicant/holder should therefore:

(a) demonstrate effective means to collect FRM reliability data; those means should provide data that affect FRM reliability, such as component failures;

(b) unless alternative reporting procedures are approved by EASA, submit a report to EASA every 6 months for the first 5 years after service introduction; after that period, continued reporting every 6 months may be:

—      replaced with other FRM reliability tracking methods that are deemed acceptable by EASA; or

—      eliminated if it is established that the FRM reliability meets, and will continue to meet, the exposure specifications in paragraph M25.1 of Appendix M to the Certification Specifications for Large Aeroplanes (CS-25); and

(c) develop service instructions or revise the applicable aeroplane manual, according to a schedule that is approved by EASA, to correct any failures of the FRM that occur in service, which could increase any fuel tank’s fleet average flammability exposure to more than what is specified in paragraph M25.1 of Appendix M to CS-25.

AMC3 21.A.3A(a) Reporting system

ED Decision 2022/021/R

COLLECTION, INVESTIGATION, AND ANALYSIS OF DATA RELATED TO EDTO-SIGNIFICANT OCCURRENCES

(a) Holders of a TC, an RTC, an STC, or any other relevant approval that is deemed to have been issued under Part 21 and includes extended diversion time operation (EDTO) capability should implement a specific tracking, reporting, and resolution system for EDTO-significant occurrences. That system should be suitable to ensure the initial and continued fleet compliance with the applicable EDTO reliability objectives, and be part of the system for the collection, investigation, and analysis of data, which is required by point 21.A.3A(a).

Appropriate coordination should exist between the engine TC holder, the propeller TC holder, the auxiliary power unit (APU) ETSO authorisation holder, and the aircraft TC holder, to ensure compliance with the EDTO reliability objectives.

(b) For the tracking, reporting, and resolution of EDTO-significant occurrences, refer to the latest edition of AMC 20-6 of the ‘General Acceptable Means of Compliance for Airworthiness of Products, Parts and Appliances’ (AMC-20).

GM1 21.A.3A(a) and 21.A.3A(b) Reporting system

ED Decision 2022/021/R

GENERAL — COLLECTING SYSTEM

The term ‘collection’ means the setting up of systems and procedures that will enable relevant failures, malfunctions, and defects, or other occurrences, to be properly collected when they occur.

As the collection system needs to accept reports that originate outside the organisation (from operators, maintenance organisations, suppliers, etc.), it is necessary to inform possible reporters of the existence of the system and of the appropriate means to introduce reports into it. This does not presume that direct access to the system is to be granted if other mechanisms are more appropriate.

The collection system should also ensure the collection, through an internal reporting scheme, of internal errors, near misses, and hazards that are perceived by the reporter as an actual or potential aviation safety risk.

Considerations for the collection of information related to events should include the following:

—      the analysis of failure rates;

—      the early rejection of parts from service; and

—      comparison with the certification assumptions.

GM1 21.A.3A(a), 21.A.3A(e), and 21.A.3A(f) Reporting system

ED Decision 2022/021/R

GENERAL

In the context of points 21.A.3A(a), 21.A.3A(e), and 21.A.3A(f), the phrase ‘[…] or any other relevant approval deemed […]’ refers to ‘grandfathered’ design approvals under Part 21, as defined in Article 3 of Regulation (EU) No 748/2012.

Design approval holders (DAHs) of minor changes and minor repairs do not have to comply with the requirements in point 21.A.3A(a), as according to the classification criteria for design changes and repairs (see points 21.A.91 and 21.A.435), minor changes and minor repairs have no appreciable effect on the characteristics that affect the airworthiness of the product. However, it should be noted that the obligations under Regulation (EU) No 376/2014 and its implementing acts still apply.

GM1 21.A.3A(a)(1) and (b)(1) Reporting system

ED Decision 2022/021/R

EVENTS REPORTED VOLUNTARILY TO THE ORGANISATION

A natural or a legal person (including organisations that are not approved by a Member State) may voluntarily report to an organisation any event that is perceived by that person as posing an actual or potential hazard to aviation safety.

Voluntary reports may be originated by:

(a) persons that are not listed in Article 4(6) of Regulation (EU) No 376/2014; or

(b) persons that are listed in Article 4(6) of Regulation (EU) No 376/2014, even though such events are not included in Regulation (EU) 2015/1018; or

(c) an organisation, if such organisation cannot determine whether the event should be mandatorily reported.

Example

A maintenance staff member in a maintenance organisation is reporting to their maintenance organisation a perceived design issue that is not covered by Regulation (EU) 2015/1018. The maintenance organisation should make a final assessment of the voluntary report and if it assesses that the reported event ‘may involve an actual or potential aviation safety risk’, then it should mandatorily report it to the TC holder, the competent authority, etc., as per point 145.A.60 ‘Occurrence reporting’ of Annex II (Part‑145) to Regulation (EU) No 1321/2014¹¹. If the maintenance organisation cannot determine whether a safety risk exists (due to lack of competence, lack of data, etc.), it could voluntarily report the event to the TC holder for further assessment.

GM2 21.A.3A(a)(1) and (b)(1) Reporting system

ED Decision 2022/021/R

INTERNAL SAFETY REPORTING SCHEME

The internal safety reporting scheme is part of the overall collection system. The objective of this GM is to provide specific guidance on the internal safety reporting scheme only.

(a) The overall objectives of the internal safety reporting scheme are:

—       to collect information that is reported by the organisation staff; and

—       to use that reported information to improve the safety of operations,

in conjunction with the safety management elements that are defined in points 21.A.139 and 21.A.239. Each internal safety reporting scheme should include provisions for confidentiality and enable and encourage free and frank reporting of events, as those listed in points 21.A.3A(a)(1)(i) and (ii). This is facilitated by establishing a ‘just culture’.

(b) The specific objectives of the scheme are to:

(1) enable an assessment of the safety implications of each relevant event that is reported, including previous similar events, so that any necessary action can be initiated; and

(2) ensure that lessons from relevant events are shared so that other persons and parts of the organisation may learn from them.

(c) The scheme is an essential part of the overall management system and should be complementary to routine procedures and ‘control’ systems; it is not intended to duplicate or supersede any of them. The scheme is a tool to identify those instances in which routine procedures have failed or may fail.

(d) All safety-related reports should be retained as the significance of such reports may only become obvious later.

(e) The collection and analysis of timely, appropriate, and accurate data will allow the organisation to react to the information that it receives and to take necessary action.

AMC1 21.A.3A(a)(3), 21.A.3A(b)(3), 21.A.3A(d) Reporting system

ED Decision 2022/021/R

REPORTING TO THE COMPETENT AUTHORITY

Within the overall limit of 72 hours, the degree of urgency for submitting a report should be determined by the level of risk that is judged to have resulted from the occurrence.

If an occurrence is judged by the organisation that identified the possible unsafe condition to have resulted in an immediate and particularly significant hazard, EASA (or the competent authority of the Member State, as required) should be advised immediately and by the fastest possible means (telephone, fax, email, telex, etc.) of whatever details are available at that time. This initial report must be followed up with a full written report within 72 hours. An example would be an uncontained engine failure that results in damage to the aircraft primary structure.

In all other cases, the submission of the report may be delayed up to a maximum of 72 hours after determining the possible unsafe condition, in order to provide more details.

GM1 21.A.3A(a)(3), 21.A.3A(b)(3) and 21.A.3A(d) Reporting system

ED Decision 2022/021/R

REPORTING TO THE COMPETENT AUTHORITY — GENERAL

(a) The reference to ‘is aware of an occurrence’ implies that the organisation identifies the event as one that falls into the category of occurrences to be reported — usually when the organisation determines that the event is reportable. The 72-hour period starts when the possible unsafe condition is identified.

(b) For organisations that have their principal place of business in a Member State, Regulation (EU) 2015/1018 lays down a generic ‘list classifying occurrence in civil aviation to be mandatorily reported’. This list should not be understood as being an exhaustive collection of all the issues that may pose a significant risk to aviation safety and, therefore, reporting should not be limited to the items that are listed in that Regulation.

(c) AMC-20 provides further details on occurrence reporting (AMC 20-8) and also applies to organisations that are approved under Part 21 and do not have their principal place of business in a Member State.

(d) Point 21.A.3A(a)(3) requires the reporting of occurrences that may result in an unsafe condition. GM1 21.A.3B(b) ‘Failures, malfunctions and defects — Determination of an unsafe condition’ could be used to assist in that determination.

AMC1 21.A.3A(e) Reporting system

ED Decision 2022/021/R

FOLLOW-UP TO, AND CLOSURE OF, REPORTED OCCURRENCES

(a) The organisation should transmit the following information to the competent authority within 30 days from the date of notification of the occurrence to the competent authority:

(1) the latest position of the design organisation (DO) as to whether an unsafe condition is confirmed;

(2) the results of the analysis and of the first investigation — including the cause(s) of the occurrence, if known; and

(3) the measures it has taken, intends to take, or proposes to be taken, including:

(i) containment measures that have already been defined by the reporting organisation and put in place (if any) ; and

(ii) in the case of reports made by the DO, for unsafe conditions, a risk assessment supporting that the product can be operated safely (see GM 21.A.3B(d)(4)) until the corrective action is defined and implemented, or that immediate mitigation measures need to be implemented until a more refined risk assessment can be provided.

Organisations are encouraged to provide a complete analysis and follow-up as soon as available and, in principle, no later than 3 months after the occurrence notification. It is recognised that analysing an occurrence may take longer than 3 months, especially if the investigation is complex or where the services of a special investigator are required.

The requirements for follow-up are not intended to jeopardise the quality and thoroughness of an occurrence analysis. It may be detrimental to safety if the analysis is completed in a rush within the encouraged 3-month period without properly establishing the root cause(s), making a risk assessment, and determining whether remedial action is required.

The design approval holder (DAH) and the production approval holder (PAH) should cooperate, as necessary, to ensure that any corrective action can be implemented. In addition, affected organisations are expected to cooperate under their respective regulatory framework from the reporting of an occurrence until its closure, to ensure complete results.

The final (close-out) report should include:

—       the final DAH position as to whether an unsafe condition exists;

—       the results of the occurrence analysis and of the final investigation, including the cause(s) of the occurrence;

—       any corrective and preventive action by the reporting organisation; and

—       in the case of reports made by the DO, a risk assessment supporting that those corrective and preventive measures allow the product to be operated safely (see GM 21.A.3B(d)(4)).

(b) Notwithstanding point (a), when the organisation identifies that no unsafe condition exists as a result of its analysis of a voluntarily reported occurrence, it can delay further communication to the competent authority up to the issuance of the final report and report the occurrence as closed upon issue (data exchange). In such cases, no follow-up report should be submitted. The final report to EASA should include confirmation and justification that no unsafe condition exists. The organisation is requested to provide information on the cause(s) of the occurrence and on any corrective or preventive action that was taken by the organisation.

This way of reporting should not be understood as an accepted deviation from the requirements of Part 21. If at any stage during the investigation, the organisation identifies that a possible unsafe condition exists, this should be communicated to EASA via a mandatory report within 72 hours.

21.A.3B Airworthiness directives

Regulation (EU) No 748/2012

(a) An airworthiness directive means a document issued or adopted by the Agency which mandates actions to be performed on an aircraft to restore an acceptable level of safety, when evidence shows that the safety level of this aircraft may otherwise be compromised.

(b) The Agency shall issue an airworthiness directive when:

1. an unsafe condition has been determined by the Agency to exist in an aircraft, as a result of a deficiency in the aircraft, or an engine, propeller, part or appliance installed on this aircraft; and

2. that condition is likely to exist or develop in other aircraft.

(c) When an airworthiness directive has to be issued by the agency to correct the unsafe condition referred to in point (b), or to require the performance of an inspection, the holder of the type-certificate, restricted type-certificate, supplemental type-certificate, major repair design approval, ETSO authorisation or any other relevant approval deemed to have been issued under this Regulation, shall:

1. propose the appropriate corrective action or required inspections, or both, and submit details of these proposals to the Agency for approval;

2. following the approval by the Agency of the proposals referred to under point (1), make available to all known operators or owners of the product, part or appliance and, on request, to any person required to comply with the airworthiness directive, appropriate descriptive data and accomplishment instructions.

(d) An airworthiness directive shall contain at least the following information:

1. an identification of the unsafe condition;

2. an identification of the affected aircraft;

3. the action(s) required;

4. the compliance time for the required action(s);

5. the date of entry into force.

AMC1 21.A.3B(b) Failures, malfunctions and defects

ED Decision 2021/001/R

UNSAFE CONDITION

An unsafe condition exists if there is factual evidence (from service experience, analysis or tests) that:

(a) An event may occur that would result in fatalities, usually with the loss of the aircraft, or reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:

(i) A large reduction in safety margins or functional capabilities, or

(ii) Physical distress or excessive workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely, or

(iii) Serious or fatal injury to one or more occupants

unless it is shown that the probability of such an event is within the limit defined by the applicable certification specifications, or

(b) There is an unacceptable risk of serious or fatal injury to persons other than occupants, or

(c) Design features intended to minimise the effects of survivable accidents are not performing their intended function.

Note 1: Non-compliance with applicable certification specifications is generally considered as an unsafe condition, unless it is shown that possible events resulting from this non-compliance do not constitute an unsafe condition as defined under paragraphs (a), (b) and (c).

Note 2: An unsafe condition may exist even though applicable airworthiness requirements are complied with.

Note 3: The above definition covers the majority of cases where the Agency considers there is an unsafe condition. There may be other cases where overriding safety considerations may lead the Agency to issue an airworthiness directive.

Note 4: There may be cases where events can be considered as an unsafe condition if they occur too frequently (significantly beyond the applicable safety objectives) and could eventually lead to consequences listed in paragraph (a) in specific operating environments. Although having less severe immediate consequences than those listed in paragraph (a), the referenced events may reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload, or in conditions impairing crew efficiency, or discomfort to occupants, possibly including injuries.

GM1 21.A.3B(b) Failures, malfunctions and defects

ED Decision 2021/001/R

DETERMINATION OF AN UNSAFE CONDITION

It is important to note that these guidelines are not exhaustive. However, this material is intended to provide guidelines and examples that will cover most cases, taking into account the applicable certification requirements.

1. INTRODUCTION

Certification or approval of a product, part or appliance is a demonstration of compliance with requirements which are intended to ensure an acceptable level of safety. This demonstration, however, includes certain accepted assumptions and predicted behaviours, such as:

—       fatigue behaviour is based on analysis supported by test,

—      modelling techniques are used for Aircraft Flight Manual performances calculations,

—       the systems safety analyses give predictions of what the systems failure modes, effects and probabilities may be,

—       the system components’ reliability figures are predicted values derived from general experience, tests or analysis,

—       the crew is expected to have the skills to apply the procedures correctly, and

—       the aircraft is assumed to be maintained in accordance with the prescribed instructions for continued airworthiness (ICAs) (or maintenance programme).

In service experience, additional testing, further analysis, etc., may show that certain initially accepted assumptions are not correct. Thus, certain conditions initially demonstrated as safe, are revealed by experience as unsafe.  In this case, it is necessary to mandate corrective actions in order to restore a level of safety consistent with the applicable certification requirements.

To support the determination of an unsafe condition, the investigation may need to include   examinations of worn, damaged and time-expired parts / analysis / certification demonstration / tests / statistical analysis, and comparison with the certification assumptions.

See AMC1 21.A.3B(b) for the definition of ‘unsafe condition’ used in 21.A.3A(b).

2. GUIDELINES FOR ESTABLISHING IF A CONDITION IS UNSAFE

The following paragraphs give general guidelines for analysing the reported events and determining if an unsafe condition exists, and are provided for each type of product, part or appliance subject to a specific airworthiness approval: type-certificates (TC) or supplemental type-certificates (STC) for aircraft, engines or propellers, or European Technical Standard Orders (ETSO).

This analysis may be qualitative or quantitative, i.e. formal and quantitative safety analyses may not be available for older or small aircraft. In such cases, the level of analysis should be consistent with that required by the certification specifications and may be based on engineering judgement supported by service experience data.

2.1 Analysis method for aircraft

2.1.1 Accidents or incidents without any aircraft, engines, system, propeller or part or appliance malfunction or failure

When an accident/incident does not involve any component malfunction or failure but when a crew human factor has been a contributing factor, this should be assessed from a man-machine interface standpoint to determine whether the design is adequate or not. Paragraph 2.5 gives further details on this aspect.

2.1.2 Events involving an aircraft, engines, system, propeller or part or appliance failure, malfunction or defect

The general approach for analysis of in-service events caused by malfunctions, failures or defects will be to analyse the actual failure effects, taking into account previously unforeseen failure modes or improper or unforeseen operating conditions revealed by service experience.

These events may have occurred in service, or have been identified during maintenance, or been identified as a result of subsequent tests, analyses, or quality control.

These may result from a design deficiency or a production deficiency (non-conformity with the type design), or from improper maintenance. In this case, it should be determined if improper maintenance is limited to one aircraft, in which case an airworthiness directive may not be issued, or if it is likely to be a general problem due to improper design and/or maintenance procedures, as detailed in paragraph 2.5.

2.1.2.1 Flight

An unsafe condition exists if:

—      There is a significant shortfall of the actual performance compared to the approved performance (taking into account the accuracy of the performance calculation method), or

—      The handling qualities, although having been found to comply with the applicable certification specifications at the time of initial approval, are subsequently shown by service experience not to comply.

2.1.2.2 Structural or mechanical systems

An unsafe condition exists if the deficiency may lead to a structural or mechanical failure which:

—      Could exist in a Principal Structural Element that has not been qualified as damage tolerant.  Principal Structural Elements are those which contribute significantly to carrying flight, ground, and pressurisation loads, and whose failure could result in a catastrophic failure of the aircraft.

Typical examples of such elements are listed for large aeroplanes in AMC 25.571(a) ‘Damage tolerance and fatigue evaluation of structure’, and in the equivalent material for rotorcraft.

—      Could exist in a Principal Structural Element that has been qualified as damage tolerant, but for which the established inspections, or other procedures, have been shown to be, or may be, inadequate to prevent catastrophic failure.

—      Could reduce the structural stiffness to such an extent that the required flutter, divergence or control reversal margins are no longer achieved.

—      Could result in the loss of a structural piece that could damage vital parts of the aircraft, cause serious or fatal injuries to persons other than occupants.

—      Could, under ultimate load conditions, result in the liberation of items of mass that may injure occupants of the aircraft.

—      Could jeopardise proper operation of systems and may lead to hazardous or catastrophic consequences, if this effect has not been taken adequately into account in the initial certification safety assessment.

2.1.2.3 Systems

The consequences of reported systems components malfunctions, failures or defects should be analysed.

For this analysis, the certification data may be used as supporting material, in particular systems safety analyses.

The general approach for analysis of in-service events caused by systems malfunctions, failures or defects will be to analyse the actual failure effects.

As a result of this analysis, an unsafe condition will be assumed if it cannot be shown that the safety objectives for hazardous and catastrophic failure conditions are still achieved, taking into account the actual failure modes and rates of the components affected by the reported deficiency.

 The failure probability of a system component may be affected by:

—      A design deficiency (the design does not meet the specified reliability or performance).

—      A production deficiency (non-conformity with the certified type design) that affects either all components, or a certain batch of components.

—      Improper installation (for instance, insufficient clearance of pipes to surrounding structure).

—      Susceptibility to adverse environment (corrosion, moisture, temperature, vibrations etc.).

—      Ageing effects (failure rate increase when the component ages).

—      Improper maintenance.

When the failure of a component is not immediately detectable (hidden or latent failures), it is often difficult to have a reasonably accurate estimation of the component failure rate since the only data available are usually results of maintenance or flight crew checks.  This failure probability should therefore be conservatively assessed.

As it is difficult to justify that safety objectives for the following systems are still met, a deficiency affecting these types of systems may often lead to a mandatory corrective action:

—      back up emergency systems, or

—      fire detection and protection systems (including shut off means).

Deficiencies affecting systems used during an emergency evacuation (emergency exits, evacuation assist means, emergency lighting system ...) and to locate the site of a crash (Emergency Locator Transmitter) will also often lead to mandatory corrective action.

2.1.2.4 Others

In addition to the above, the following conditions are considered unsafe:

—      There is a deficiency in certain components which are involved in fire protection or which are intended to minimise/retard the effects of fire/smoke in a survivable crash, preventing them to perform their intended function (for instance, deficiency in cargo liners or cabin material leading to non-compliance with the applicable flammability requirements).

—      There is a deficiency in the lightning or High Intensity Radiated Fields protection of a system which may lead to hazardous or catastrophic failure conditions.

—      There is a deficiency which could lead to a total loss of power or thrust due to common mode failure.

If there is a deficiency in systems used to assist in the enquiry following an accident or serious incident (e.g., Cockpit Voice Recorder, Flight Data Recorder), preventing them to perform their intended function, the Agency may take mandatory action.

2.2 Engines

The consequences and probabilities of engine failures have to be assessed at the aircraft level in accordance with paragraph 2.1, and also at the engine level for those failures considered as Hazardous in CS E-510.

The latter will be assumed to constitute unsafe conditions, unless it can be shown that the consequences at the aircraft level do not constitute an unsafe condition for a particular aircraft installation.

2.3 Propellers

The consequences and probabilities of propeller failures have to be assessed at the aircraft level in accordance with paragraph 2.1, and also at the propeller level for those failures considered as hazardous in CS P-70.

The latter will be assumed to constitute unsafe conditions, unless it can be shown that the consequences at the aircraft level do not constitute an unsafe condition for a particular aircraft installation.

2.4 Parts and appliances

The consequences and probabilities of equipment failures have to be assessed at the aircraft level in accordance with paragraph 2.1.

2.5 Human factors aspects in establishing and correcting unsafe conditions

This paragraph provides guidance on the way to treat an unsafe condition resulting from a maintenance or crew error observed in service.

It is recognised that human factors techniques are under development. However, the following is a preliminary guidance on the subject.

Systematic review should be used to assess whether the crew or maintenance error raises issues that require regulatory action (whether in design or other areas), or should be noted as an isolated event without intervention. This may need the establishment of a multidisciplinary team (designers, crews, human factors experts, maintenance experts, operators etc.)

The assessment should include at least the following:

—      Characteristics of the design intended to prevent or discourage incorrect assembly or operation;

—      Characteristics of the design that allow or facilitate incorrect operation,

—      Unique characteristics of a design feature differing from established design practices;

—      The presence of indications or feedback that alerts the operator to an erroneous condition;

—      The existence of similar previous events, and whether or not they resulted (on those occasions) in unsafe conditions;

—      Complexity of the system, associated procedures and training (has the crew a good understanding of the system and its logic after a standard crew qualification programme?);

—      Clarity/accuracy/availability/currency and practical applicability of manuals and procedures;

—      Any issues arising from interactions between personnel, such as shift changeover, dual inspections, team operations, supervision (or lack of it), or fatigue.

Apart from a design change, the corrective actions, if found necessary, may consist of modifications of the manuals, inspections, training programmes, and/or information to the operators about particular design features. The Agency may decide to make mandatory such corrective action if necessary.

GM 21.A.3B(d)(4) Defect correction – Sufficiency of proposed corrective action

ED Decision 2012/020/R

This GM provides guidelines to assist in establishing rectification campaigns to remedy discovered defects.

1. STATUS

This document contains GM of a general nature for use in conjunction with engineering judgement, to aid airworthiness engineers in reaching decisions in the state of technology at the material time.

While the main principles of this GM could be applied to small private aeroplanes, helicopters, etc. the numerical values chosen for illustration are appropriate to large aeroplanes for public transport.

2. INTRODUCTION

2.1 Over the years, target airworthiness risk levels underlying airworthiness requirements have developed on the basis of traditional qualitative airworthiness approaches; they have been given more precision in recent years by being compared with achieved airworthiness levels (judged from accident statistics) and by the general deliberations and discussions which accompanied the in­troduction of rational performance requirements, and more recently, the Safety Assessment approach in requirements. Although the target airworthiness risk level tends to be discussed as a single figure (a fatal accident rate for airworthiness reasons of not more than 1 in 10 000 000 flights/flying hours for large aeroplanes) it has to be recognised that the requirements when applied to particular aircraft types will result in achieved airworthiness levels at certification lying within a band around the target level and that thereafter, for particular aircraft types and for particular aircraft, the achieved level will vary within that band from time to time.

2.2 The achieved airworthiness risk levels can vary so as to be below the target levels, because it is difficult if not impossible to design to the minimum requirements without being in excess of requirements in many areas; also because aircraft are not always operated at the critical conditions (e.g., aircraft weight, CG position and operational speeds; environmental conditions - temperature, humidity, degree of turbulence). The achieved level may vary so as to be above the target level because of undetected variations in material standards or build standards, because of design deficiencies, because of encountering unforeseen combinations of failures and/or combinations of events, and because of unanticipated operating conditions or environmental conditions.

2.3 There is now a recognition of the need to attempt to monitor the conditions which tend to increase the level and to take appropriate corrective action when the monitoring indicates the need to do so in order to prevent the level rising above a predetermined ‘ceiling’.

2.4 The Agency also has a duty in terms of providing the public with aviation services and therefore should consider the penalties associated with curtailment or even removal (by ‘grounding’) of aviation services when establishing the acceptability of any potential variation in airworthiness level.

2.5 Thus, the purpose of this GM is:

(a) To postulate basic principles which should be used to guide the course of actions to be followed so as to maintain an adequate level of airworthiness risk after a defect has occurred which, if uncorrected, would involve a potential significant increase of the level of risk for an aircraft type.

(b) For those cases where it is not possible fully and immediately to restore an adequate level of airworthiness risk by any possible alleviating action such as an inspection or limitation, to state the criteria which should be used in order to assess the residual increase in risk and to limit it to an appropriate small fraction of the mean airworthiness through life risk.

3. DISCUSSION

3.1 Several parameters are involved in decisions on safety matters.  In the past the cost of proposed action has often been compared with the notional 'risk cost', i.e. the cost of a catastrophe multiplied by its probability of occurrence.

3.2 This can be a useful exercise, but it should be held within the constraint of acceptable airworthiness risk levels, i.e., within airworthiness risk targets which represent the maximum levels of risk with which an aircraft design must comply, i.e., in the upper part of the 'band'.  Currently for large aeroplanes the mean airworthiness risk level is set at a catastrophe rate for airworthiness reasons of not more than one in every ten- million flights/flying hours. The constraint is overriding in that any option, which could be permitted on risk cost considerations, or other grounds, is unacceptable if it leads to significant long-term violation of this safety requirement.

3.3 While it should clearly be the objective of all to react to and eliminate emergency situations, i.e., those involving a potentially significant increase of airworthiness risk levels, without unreasonable delay, the Agency should be able finally to rule on what is a minimum acceptable campaign programme. It has therefore seemed desirable to devise guidelines to be used in judging whether a proposed campaign of corrective actions is sufficient in airworthiness terms, and clearly this ought to be based on determining the summation of the achieved airworthiness risk levels for the aircraft and passengers during any periods of corrective action and comparing them with some agreed target.

3.4 As the period of corrective action will not be instantaneous (unless by grounding), there is potentially an increase in the achieved airworthiness risk level possibly to and, without controls, even above the higher part of the 'band', and the amount by which the level is above the mean target figure, and the period for which it should be allowed to continue, has been a matter of some arbitrary judgement.

3.5 It would appear desirable to try to rationalise this judgement. For example, if an aircraft were to spend 10 % of its life at a level such that the risk of catastrophe was increased by an order of magnitude, the average rate over its whole life would be doubled which may not be in the public interest. A more suitable criterion is perhaps one which would allow an average increase in risk of, say one third on top of the basic design risk when spread over the whole life of the aircraft an amount which would probably be acceptable within the concept (See Figure 1). It would then be possible to regard the 'through life' risk to an aircraft - e.g., a mean airworthiness target of not more than one airworthiness catastrophe per 10 million (107) hours, as made up of two parts, the first being 3/4 of the total and catering for the basic design risk and the other being 1/4 of the total, forming an allowance to be used during the individual aircraft's whole life for unforeseen campaign situations such as described above.

3.6 Investigation has shown that a total of ten such occasions might arise during the life of an individual aircraft.

3.7 Using these criteria, there could then be during each of these emergency periods (assumed to be ten in number) a risk allowance contributed by the campaign alone of:

1 x 10^-7 for 2.5% of the aircraft's life; or

5 x 10^-7 for 0.5% of the aircraft's life; or

1 x 10^-6 for 0.25% of the aircraft's life; or

1 x 10^-5 for 0.025% of the aircraft's life, etc.

without exceeding the agreed 'allowance' set aside for this purpose.

3.8 Thus a 'reaction table' can be created as indicated in Table 1 (the last two columns assuming a typical aircraft design life of 60,000 hours and an annual utilisation of 3 000 hours per annum) showing the flying or calendar time within which a defect should be corrected if the suggested targets are to be met.

Table 1

3.9 These principles may be applied to a single aircraft or a number of aircraft of a fleet but in calculating risk, all the risk should be attributed to those aircraft which may carry it, and should not be diluted by including other aircraft in the fleet which are known to be free of risk. (It is permissible to spread the risk over the whole fleet when a source is known to exist without knowing where). Where a fleet of aircraft is involved Column 2 may be interpreted as the mean time to rectification and not the time to the last one.

3.10 There is one further constraint. However little effect a situation may have on the 'whole life' risk of an aircraft, the risk should not be allowed to reach too high a level for any given flight. Thus while a very high risk could be tolerated for a very short period without unacceptable degradation of the overall airworthiness target, the few flights involved would be exposed to a quite unacceptable level of risk. It is therefore proposed that the Table 1 should have a cut-off at the 2 x 10^-6 level so that no flight carries a risk greater than 20 times the target. At this level the defect is beginning to contribute to a greater likelihood of catastrophe than that from all other causes, including non-airworthiness causes, put together. If the situation is worse than this, grounding appears to be the only alternative with possibly specially authorised high-risk ferry flights to allow the aircraft to return to base empty. Figures 2 and 3 show a visualisation chart equivalent to Table 1, giving average rectification time (either in flight hours or months) based on probability of defect that must be corrected.

3.11 It will be seen that the above suggestions imply a probability of catastrophe from the campaign alone of 1.5/10 000 per aircraft during each separate campaign period (i.e., p = 0.015 per 100 aircraft fleet).

3.12 In addition, in order to take into account large fleet size effect, the expected probability of the catastrophic event during the rectification period on the affected fleet shall not exceed 0.1. See Figure 4.

3.13 It should also be noted that in assessing campaign risks against 'design risk', an element of conservatism is introduced, since the passenger knows only 'total risk' (i.e. airworthiness plus operations risks) and the fatal accident rate for all reasons is an order of magnitude greater than that for airworthiness reasons only (i.e., 10^-6 as against 10^-7). The summated campaign risk allowance proposed by this GM is therefore quite a small proportion of the total risk to which a passenger is subject. When operating for short periods at the limit of risk proposed (2 x 10^-6 per hour) the defect is however contributing 100 % more risk than all other causes added together.

3.14 A similar approach is proposed to cover the case of defects associated to hazardous failure conditions for which the safety objectives defined by the applicable certification specifications are not met. According to CS 25.1309, the allowable probability for each hazardous failure condition is set at 10^-7 per flight hour compared to 10^-9 per flight hour for a catastrophic failure condition. Figure 5 is showing a visualisation chart giving average rectification time based on probability of defect that should be corrected. This is similar to Figure 2 but with lower and upper boundaries adapted to cover the case of hazardous failure conditions (probabilities of 10^-7 and 2x10^-4 respectively).

3.15 In addition, in order to take into account large fleet size effect, the expected probability of the hazardous event during the rectification period on the affected fleet shall not exceed 0.5. See Figure 6.

4. GUIDELINES

4.1 The above would lead to the following guidelines for a rectification campaign to remedy a discovered defect associated to a catastrophic failure condition without grounding the aircraft:

(i) Establish all possible alleviating action such as inspections, crew drills, route restrictions, and other limitations.

(ii) Identify that part of the fleet, which is exposed to the residual risk, after compliance has been established with paragraph (i).

(iii) Using reasonably cautious assumptions, calculate the likely catastrophic rate for each aircraft carrying the risk in the affected fleet.

(iv) Compare the speed with which any suggested campaign will correct the deficiency with the time suggested in Figure 2.  The figure should not be used beyond the 2x10^-6 level, except for specially authorised flights.

(v) Also ensure that the expected probability of the catastrophic event during the rectification period on the affected fleet is in accordance with Figure 4.

4.2 Similarly, the following guidelines would be applicable for a rectification campaign to remedy a discovered defect associated to a hazardous failure condition without grounding the aircraft:

(i) Establish all possible alleviating action such as inspections, crew drills, route restrictions, and other limitations.

(ii) Identify that part of the fleet, which is exposed to the residual risk, after compliance has been established with paragraph (i).

(iii) Using reasonably cautious assumptions, calculate the likely hazardous rate for each aircraft carrying the risk in the affected fleet.

(iv) Compare the speed with which any suggested campaign will correct the deficiency with the time suggested in Figure 5.

(v) Also ensure that the expected probability of the hazardous event during the rectification period on the affected fleet is in accordance with Figure 6.

4.3 It must be stressed that the benefit of these guidelines will be to form a datum for what is considered to be the theoretically maximum reaction time. A considerable amount of judgement will still be necessary in establishing many of the input factors and the final decision may still need to be tempered by non-numerical considerations, but the method proposed will at least provide a rational 'departure point' for any exercise of such judgement.

4.4 It is not intended that the method should be used to avoid quicker reaction times where these can be accommodated without high expense or disruption of services.

Figure 1 - Visualisation Chart for CS-25

Figure 2 - Visualisation Chart for CS-25 (Flight hours)

Figure 3 - Visualisation Chart for CS-25 (Calendar basis)

Figure 4 - Visualisation Chart for CS-25 (Flight Hours)

Figure 5 - Visualisation Chart for CS-25 (Flight hours)

Figure 6 - Visualisation Chart for CS-25 (Flight hours)

21.A.4 Coordination between design and production

Regulation (EU) No 69/2014

Each holder of a type-certificate, restricted type-certificate, supplemental type-certificate, ETSO authorisation, approval of a change to type-certificate or approval of a repair design, shall collaborate with the production organisation as necessary to ensure:

(a) the satisfactory coordination of design and production required by 21.A.122, 21.A.130(b)(3) and (4),  21.A.133 and 21.A.165(c)(2) and (3) as appropriate; and

(b) the proper support of the continued airworthiness of the product, part or appliance.

AMC 21.A.4 Transferring of information on eligibility and approval status from the design holder to production organisations

ED Decision 2014/007/R

Where there is a need to provide (normally outside the design organisation) a visible statement of approved design data or airworthiness, operational suitability or environmental protection data associated with the approved design data, the following minimum information must be provided. The need for a visible statement may be in relation to Company holding a production organisation approval (POA) in relation to 21.A.163(c).

The procedures related to the use of forms or other electronic means to provide this information must be agreed with the Agency.

Information to be provided:

Company Name: the name of the responsible design organisation (TC, STC, approval of repair or minor change design, ETSO authorisation holder) issuing the information.

Date: the date at which the information is released.

Eligibility: indicate the specific products or articles, in case of ETSO authorisation, for which data have been approved.

Identification: the part number of the part or appliance. Preference should be given to the use of the Illustrated Parts Catalogue (IPC) designation. Alternatively the reference to the instruction for continued airworthiness (e.g., SB, AMM, etc.) could be stated. Marking requirements of Part 21 Section A Subpart Q should be taken into account.

Description: the name or description of the part or document should be given. In the case of a part or appliance preference should be given to use of IPC designation. The description is to include reference to any applicable ETSO authorisation or EPA marking, or previous national approvals still valid.

Purpose of data: the reason for the provision of the information should be stated by the design approval holder.

Examples:

a) Provision of approved design data to a production organisation to permit manufacture (AMC No 1 to 21.A.133(b) and (c))

b) Information regarding eligibility for installation (replacement parts, repair, modification, etc.)

c) Direct Delivery Authorisation (AMC No 1 to 21.A.133(b) and (c))

If the data is in support of a change or repair, then reference to the aircraft level approval should be given (make reference to the approved STC, change or repair).

Limitations/Remarks: state any information, either directly or by reference to supporting documentation that identifies any particular data or limitations (including specific importing requirements) needed by a production organisation to complete Block 12 of the EASA Form 1.

Approval: provide reference information related to the approval of the data (Agency document or DOA privilege).

Authorised signature: name and hand-written normal or electronic signature of a person who has written authority from the design organisation, as indicated in the procedures agreed with the Agency.

21.A.5 Record-keeping

Regulation (EU) 2022/201

All natural or legal persons that hold or have applied for a type-certificate, restricted type-certificate, supplemental type-certificate, ETSO authorisation, design or repair approval, permit to fly, production organisation approval certificate or letter of agreement under this Regulation shall:

(a) when they design a product, part or appliance or changes or repairs thereto, establish a record-keeping system and maintain the relevant design information/data; that information/data shall be made available to the Agency in order to provide the information/data that is necessary to ensure the continued airworthiness of the product, part or appliance, the continued validity of the operational suitability data, and compliance with the applicable environmental protection requirements;

(b) when they produce a product, part or appliance, record the details of the production process relevant to the conformity of the product, part or appliances with the applicable design data, and the requirements imposed on their partners and suppliers, and make that data available to their competent authority in order to provide the information that is necessary to ensure the continuing airworthiness of the product, part or appliance;

(c) with regard to permits to fly:

1. maintain the documents that are produced to establish and justify the flight conditions, and make them available to the Agency and to their competent authority of the Member State in order to provide the information that is necessary to ensure the continued airworthiness of the aircraft;

2. when they issue a permit to fly under the privilege of approved organisations, maintain the documents associated with it, including inspection records and documents that support the approval of the flight conditions and the issuance of the permit to fly itself, and make them available to the Agency and to their competent authority of the Member State responsible for the oversight of the organisation in order to provide the information that is necessary to ensure the continued airworthiness of the aircraft;

(d) retain records of the competence and qualifications, referred to in points 21.A.139(c), 21.A.145(b), 21.A.145(c), 21.A.239(c), 21.A.245(a) or 21.A.245(e)(1), of the personnel that are involved in the following functions:

1. design or production;

2. independent monitoring of the compliance of the organisation with the relevant requirements;

3. safety management;

(e) retain records of the authorisation of personnel, when they employ personnel that:

1. exercise the privileges of the approved organisation pursuant to points 21.A.163 and/or 21.A.263, as appropriate;

2. carry out the independent function to monitor the compliance of the organisation with the relevant requirements pursuant to points 21.A.139(e) and/or 21.A.239(e), as appropriate;

3. carry out the independent verification function of the demonstration of compliance pursuant to point 21. A.239(d)(2).

AMC1 21.A.5 Record-keeping

ED Decision 2022/021/R

(a) The record-keeping system should ensure that all the records that are required by point 21.A.5 are accessible within a reasonable time. Those records should be organised in a manner that ensures their traceability and retrievability throughout the required retention period.

(b) The records should remain legible throughout the required retention period and be protected against damage, alteration, and tampering.

(c) The format of the records should be specified in the organisation’s procedures.

(d) The organisation should ensure that copies of all the documents and supporting information that are developed:

(1) under the privileges that are defined under points 21.A.163 and 21.A.263; or

(2) for type certificates (TCs), restricted type certificates (RTCs), supplemental type certificates (STCs), major changes, and major repairs that are not issued under the privileges that are defined under point 21.A.263,

are retained throughout the operational life of the product or part.

(e) The retention period starts when the record is created or when it is last amended.

If the organisation transfers a certificate or a letter of agreement to another natural or legal person, the records related to the certificate or to the letter of agreement should be transferred to the new holder.

GM1 21.A.5 Record-keeping

ED Decision 2022/021/R

For organisations that hold or have applied for a type certificate (TC), restricted type certificate (RTC), supplemental type certificate (STC), a European technical standard order (ETSO) authorisation, a change to the TC approval, a repair design approval, a permit to fly, a production organisation approval (POA), or a letter of agreement under Part 21, the relevant design information/data includes at least the following, as applicable:

— design data such as type design data, as defined in point 21.A.31, and changes to that data, ETSO design data, and repair design data;

— drawings and test reports, including inspection records for the product tested;

— the certification programme, including related certification basis data (certification review items (CRIs), special conditions (SCs), equivalent safety findings (ESFs)); and

— compliance demonstration data.

For production organisations (POs), the relevant records include at least:

— conformity justification data; and

— conformity attestation data (e.g. EASA Form 1 or EASA Form 52).

GM1 21.A.5 Repair designs and record keeping

ED Decision 2021/007/R

For repair designs, the record-keeping requirement of point 21.A.5 applies to the data described in AMC 21.A.433(a).

AMC1 21.A.5(a) and 21.A.433(b) Repair design and record-keeping

ED Decision 2022/021/R

(a) The relevant substantiation data related to a new major repair design and record‑keeping should include:

(1) identification of the damage and of the source of the report;

(2) the major repair design approval sheet that identifies the applicable specifications and the references of the justifications;

(3) the repair drawing and/or instructions, and the scheme identifier;

(4) any correspondence with the holder of the type certificate (TC), supplemental type certificate (STC), or auxilliary power unit (APU) European technical standard order (ETSO) authorisation, if their advice on the design was sought;

(5) the structural justification (static strength, fatigue, damage tolerance, flutter, etc.) or references to that data;

(6) the effect on the aircraft, engines and/or systems (performance, flight handling, etc., as appropriate);

(7) the effect on the maintenance programme;

(8) the effect on the airworthiness limitations, the flight manual, and the operating manual;

(9) any change in the weight and moment; and

(10) any special test requirements.

(b) The relevant minor repair documentation includes points (a)(1) and (a)(3). Other elements of point (a) may be included, where necessary. If the repair is outside the approved data, a justification for the classification is required.

(c) Special consideration should be given to repairs that impose subsequent limitations on the part, product or appliance (e.g. engine turbine segments that may only be repaired a finite number of times, the number of repaired turbine blades per set, the oversizing of fastener holes, etc.).

(d) Special consideration should also be given to life-limited parts and critical parts, notably with the involvement of the TC or STC holder, when deemed necessary under point 21.A.433(a)(4).

(e) Repairs to engines or to APU-critical parts would normally be accepted only with the involvement of the TC holder.

GM1 21.A.5(a) and (b) Record-keeping

ED Decision 2022/021/R

RECORDING AND ARCHIVING SYSTEM

The main objective of record-keeping in design organisations (DOs) and production organisations (POs) is to ensure the retrievability of data that is required for the continued airworthiness of in-service products.

In addition, records within the design environment are essential to ensure proper control of the configuration of the type design and of its compliance with the certification basis.

In the production environment, records are also required, to ensure that products or parts are in conformity with the applicable data throughout the manufacturing cycle. In addition, certain records of milestones are needed, to subsequently provide objective evidence that all the prescribed stages of the production process have been satisfactorily completed.

Therefore, the approved DO or PO (or a natural or legal person that is demonstrating their design capability through an agreement on alternative procedures or through the acceptance of the organisation’s certification programme, or a natural or legal person that produces products and parts under Part 21, Subpart F) are required to implement a system for the compilation and retention of records during all stages of design or production, which covers short-term and long‑term records as appropriate to the nature of the product and its processes.

The management of such information is subject to the appropriately documented procedures in the management system that is required by points 21.A.139 and 21.A.239 or to the manual/procedures that are required by points 21.A.14(b), 21.A.125A(b), or 21.A.602B(b)(2), as appropriate. This also applies in case of demonstrating the design capability through the acceptance of the certification programme under point 21.A.14(c).

All forms of recording media are acceptable (paper, film, magnetic, etc.), including the use of electronic records*, provided that they can meet the required duration for archiving under the given conditions and that the continued readability of the records is ensured.

The related procedures are required to:

—      identify the records to be kept;

—      describe the organisation of, and responsibility for, the archiving system (its location, compilation, format) and the conditions for access to the information (e.g. by product, subject, etc.);

—      control access to the data and provide effective protection from deterioration or accidental damage, alteration, and tamperering;

—      ensure the continued readability of the records;

—      demonstrate to the competent authority the proper functioning of the record system; and

—      define an archiving period for each type of data as follows:

—      production data that supports the conformity of a product, part, or appliance is kept for not less than 3 years from the issue date of the related statement of conformity or authorised release certificate; and

—      design data, including data that supports the compliance of a product, part, or appliance with the certification basis (see GM1 21.A.5), as well as data that is considered essential for continuing airworthiness, is kept throughout the operational life of the product, part, or appliance; such continued airworthiness data may include, but are not limited to, in‑service occurrence reports and mandatory continuing-airworthiness information;

—      for organisations that are approved according to Part 21, Subparts G and J and organisations that demonstrate their design capability through an agreement on alternative procedures or acceptance of their certification programme by EASA, ensure that the recording and record‑keeping systems that are used by the partners, suppliers, and subcontractors meet the record-keeping objectives with the same level of confidence as they do for their own system;. in each case, it should be defined who should retain the data record (organisation, partner, supplier, or subcontractor), as well as the method of surveillance of the recording/record‑keeping system of the partners, suppliers, or subcontractors; and

—      for natural or legal persons that produce items under Part 21, Section A, Subpart F, the data on supplied parts may be retained by the supplier if the supplier has a system that is agreed by the competent authority under Part 21, Section A, Subpart F; in each case, the PO is required to define the archiving period and satisfy itself and the competent authority that the recording media are acceptable.

*Related to electronic records, the following definitions apply:

— electronic record: electronic or digital data that is created, generated, sent, communicated, received, or stored by electronic means;

— electronic data: it is typically in the form of documentation that is statically stored in a computer file that is not modifiable (e.g. pdf of a scanned document with wet ink signatures); and

— digital data: it is typically in the form of computer-generated bytes of information that is stored in a computer workable file (e.g. MS Word file, MS Excel file, 3D CAD file).

AMC1 21.A.5 (d) & (e) Record-keeping

ED Decision 2022/021/R

RECORD OF STAFF INVOLVED IN DESIGN OR PRODUCTION

(a) The following should be the minimum information to be recorded for each person that exercises the privileges of an organisation that is approved according to Part 21, Subparts G and J, or according to points 21.A.163 or 21.A.263, or that carries out the independent monitoring of compliance and adequacy according to points 21.A.139(e) and 21.A.239(e), or that carries out the independent verification function of demonstration of compliance pursuant to point 21.A.239(d)(2):

(a) name;

(b) date of birth;

(c) basic training received and standard attained;

(d) specific training received and standard attained;

(e) continuation training received (if appropriate);

(f) experience gained;

(g) scope of the authorisation;

(h) date of first issue of the authorisation;

(i) expiry date of the authorisation (if appropriate;

(j) identification number of the authorisation (or equivalent means to identify the link between the authorisation and the staff member that holds the authorisation); and

(k) changes to the data.

(b) The record may be kept in any format and should be controlled through an internal procedure of the organisation. That procedure is part of the management system.

(c) The staff member should be given reasonable access, on request, to their own records as per Regulation (EU) 2016/679.

(d) A design organisation (DO) or production organisation (PO) should keep the record for at least 3 years after the staff member is no longer employed by the organisation or has changed their position in the organisation, or after the withdrawal of the authorisation, whichever occurs sooner.

(e) Records of authorisation of the production staff are to be archived for at least 3 years after the staff member is no longer employed by the organisation or as soon as the authorisation is withdrawn. This staff member is any person that has an activity that is essential for ensuring:

—       the conformity to applicable design data, or

—       a condition for the safe operation of a product, part, or appliance.

21.A.6 Manuals

Regulation (EU) 2021/699

The holder of a type-certificate, restricted type-certificate, or supplemental type-certificate shall produce, maintain and update master copies of all manuals or variations in the manuals required by the applicable type-certification basis, the applicable operational suitability data certification basis and the environmental protection requirements for the product or article, and provide copies, on request, to the Agency.

21.A.7 Instructions for continued airworthiness

Regulation (EU) 2021/699

(a) The holder of a type-certificate, restricted type-certificate, supplemental type-certificate, design change or repair design approval shall develop or reference the instructions which are necessary for ensuring that the airworthiness standard related to the aircraft type and any associated part is maintained throughout the operational life of the aircraft, when demonstrating compliance with the applicable type-certification basis established and notified by the Agency in accordance with point 21.B.80.

(b) At least one set of complete instructions for continued airworthiness shall be provided by the holder of:

1. a type-certificate or restricted type-certificate to each known owner of one or more products upon its delivery or upon the issuance of the first certificate of airworthiness or restricted certificate of airworthiness for the affected aircraft, whichever occurs later,

2. a supplemental type-certificate or design change approval to all known operators of the product affected by the change upon the release to service of the modified product,

3. a repair design approval to all known operators of the product affected by the repair upon the release to service of the product in which the repair design is embodied. The repaired product, part or appliance may be released into service before the related instructions for continued airworthiness have been completed, but this shall be for a limited service period, and in agreement with the Agency.

Thereafter, those design approval holders shall make those instructions available on request to any other person required to comply with those instructions.

(c) By way of derogation from point (b), the type-certificate holder or restricted type-certificate holder may delay the availability of a part of the instructions for continued airworthiness, dealing with long lead accomplishment instructions of a scheduled nature, until after the product or modified product has entered into service, but shall make those instructions available before the use of this data is required for the product or modified product.

(d) The design approval holder, who is required to provide instructions for continued airworthiness in accordance with point (b), shall also make available changes to those instructions to all known operators of the product affected by the change and, on request, to any other person required to comply with those changes. That design approval holder shall demonstrate to the Agency, on request, the adequacy of the process of making changes to the instructions for continued airworthiness available in accordance with this point.

AMC1 21.A.7(a) ICA contents

ED Decision 2021/007/R

(a) The instructions for continued airworthiness (ICA) should identify the following, in accordance with the applicable certification specifications:

(1) any limitations that are necessary for the continued airworthiness of the product or article;

(2) the means to determine when the product or article has deteriorated to the extent that it is no longer airworthy;

(3) the minimum actions required to restore the airworthiness of the product or article before the limitations (as per point (1)) have been exceeded or before their deterioration (as per point (2)), as an alternative to the withdrawal of the product or article from service.

(b) The ICA should, therefore, include, in accordance with the applicable certification specifications:

(1) any limitations determined through the certification of the product or article, and instructions on how to determine that the limitations have been exceeded;

(2) any inspection, servicing or maintenance actions determined to be necessary by the certification process;

(3) any inspection or troubleshooting actions determined to be necessary to establish the nature of faults and the necessary remedial actions;

(4) sufficient general information on the operation of the product or article to enable the understanding of the instructions in (a)(1) to (a)(3) above.

AMC2 21.A.7(a) Identification of ICA

ED Decision 2021/007/R

The instructions for continued airworthiness (ICA) may be provided together with other, additional or optional, maintenance information, as described in point 21.A.6, or in another acceptable format as per GM1 21.A.7(a), with the following conditions:

(a) The information that is necessary for the continued airworthiness is clearly identified (refer to AMC1 21.A.7(b)).

(b) The ICA may reference additional instructions for continued airworthiness in separate publications, where necessary (for example, those produced by suppliers).

If the product ICA reference the use of supplier’s data (e.g. component maintenance manual (CMM) or section of it) as the appropriate location for the ICA, those applicable instructions are incorporated by reference and become part of the complete set of the ICA for the product.

(c) Additional or optional maintenance information not considered as ICA but referenced by the design approval holder (DAH) together with the ICA should be evaluated appropriately by the DAH in order to ensure that its use will not compromise the continued airworthiness of the product or article.

(d) If the maintenance data made available by a DAH includes data from an operator (i.e. in order to customise the data for the operator, and created under the authority of the operator), the operator’s data should be identified as such, and the DAH is not required to additionally evaluate it.

AMC3 21.A.7(a) DAH responsibility to check the supplier data which is part of the ICA or referenced with the ICA

ED Decision 2021/007/R

The DAH may carry out a complete check of the supplier data, or may choose to rely, in whole or in part, on the supplier’s process. In the latter case, the DAH will propose a means to validate the supplier’s process. Supplier data may also be issued by the supplier to the DAH under a contract or an arrangement, addressing the following:

(a) the accuracy and the adequacy of the technical documentation, which should be checked through a verification processes (e.g. component workshop verification);

(b) evidence showing that workshop verification was performed should be kept by the supplier and a clear statement should be given in the introduction to the supplier data as a confirmation that component verification is complete;

(c) evidence that the supplier has taken into account all justified feedback and changes to data requested by any person required to use the ICA; typical examples would be the correction of reported errors, or mistakes.

In addition, some validation activities may be decided by the DAH, depending on the articles and the capability level of the supplier.

For articles subject to an ETSO authorisation, the validation of the supplier’s process is not needed. This is also valid for other national TSO authorisations (e.g. FAA TSOs) accepted by EASA as stipulated in related bilateral agreements.

GM1 21.A.7(a) Scope of ICA, their publication format and typical ICA data

ED Decision 2021/007/R

(a) ICA can be published in documents or in a manner other than the traditional understanding of a document — for example, as a series of web pages, or Information Technology (IT) tools, or in a publishing format linked to tasks or data modules rather than pages.

(b) The design approval holder (DAH) can decide — within the framework provided by point 21.A.7 and its acceptable means of compliance and guidance material — to publish the ICA in the most suitable location as part of all the information published to support the airworthiness of an aircraft. Publications typically produced by DAHs (e.g. for the demonstration of compliance with a certification basis established on the basis of CS-25), and which may therefore include ICA, consist of:

—      aircraft maintenance manuals (AMMs);

—      scheduled maintenance requirements (e.g. MRBRs);

—      off-wing component maintenance or overhaul manuals;

—      parts catalogues;

—      tooling manuals;

—      wiring diagram manuals;

—      weight and balance manuals;

—      electrical loads analyses;

—      extended range operations (ETOPS) configuration maintenance programs/plans;

—      supplemental structural inspection documentation;

—      certification maintenance requirements;

—      Airworthiness Limitations items;

—      ageing aircraft maintenance requirements;

—      fuel tank safety related limitations (e.g. critical design configuration control limitation (CDCCL));

—      electrical wiring interconnection system instructions;

—      corrosion prevention and control programmes;

—      troubleshooting manuals.

Note: The above is only an example of the publications that may contain ICA according to CS‑25; the list is not exhaustive, nor does it represent a minimum list of ICA.

(c) The requirement for ICA is not intended to ensure that all products or articles may be restored to an airworthy condition. A certain level of deterioration may require a product or an article to be permanently withdrawn from service, and restoration may not be reasonably achievable. Notwithstanding the above, the existence of an MRBR task other than ‘Discard (DS or DIS)’ should be a clear indication of the necessity/obligation to produce a corresponding ICA.

Certain deteriorations or levels of deterioration may require specific instructions (e.g. inspection or restoration) that will only be developed and provided on a case-by-case basis, as needed, for a given product or article, and as such, will not be included in the ICA.

In some exceptional cases, product ICA may ultimately instruct the user to contact the DAH in order to define the specific instructions on a case-by-case basis. This typically happens when the definition of generic instructions covering all possible cases is not possible. For example, following an aircraft hard landing, a detailed analysis may have to be carried out by the DAH to determine the specific instructions to be followed, which depends on the touchdown loads, recalculated postflight, based on recorded flight data.

GM2 21.A.7(a) Determination of which supplier data is part of the ICA

ED Decision 2021/007/R

Note 1: For the purpose of this GM, the term ‘supplier data’ also applies to similar types of data when issued directly by the DAH (e.g. component maintenance manuals issued by the DAH).

Note 2: For the purpose of this GM, the term ‘supplier data’ has to be understood as data coming from the supplier and related to either a full CMM or to part of a CMM.

Note 3: The link between the aircraft ICA and the engine/propeller CMM, as detailed below, is similar to the link between engine/propeller ICA and the CMM of equipment fitted to the engine/propeller.

Note 4: If the supplier is also the DAH (for instance, an engine or propeller manufacturer), then the ICA for these items will be made available by virtue of the DAH obligations as type-certificate holder (TCH) and need not be included in the aircraft ICA.

(a) When determining whether a supplier data is part of the ICA, the following should be considered:

(1) Supplier data related to the Airworthiness Limitations Section (ALS) of the ICA is part of the ICA. A typical CS-25 example is critical design configuration control limitation (CDCCL) items that are included in CMMs.

(2) Supplier data related to instructions on how to accomplish the scheduled maintenance part of the aircraft ICA (such as MRBR) are part of the aircraft ICA. A typical case is the periodical removal of a component to perform a workshop task.

Example: Escape slide removal for restoration in accordance with the supplier data instructions.

(3) Supplier data related to scheduled maintenance on the component should be endorsed by the DAH before becoming part of the aircraft ICA, to define and confirm that the supplier data is applicable and effective.

(4) If the ICA are defined at aircraft level, the following principles apply to the other supplier data that is not related to the ALS nor to scheduled maintenance:

(i) If the supplier data includes a maintenance instruction for an action identified in the aircraft-level ICA, including an engine or propeller, this supplier data should be referenced in the aircraft-level ICA and should be made available like any other ICA.

As an alternative to linking such supplier data to the aircraft-level ICA (e.g. with cross references), it is possible to include the relevant data directly into the aircraft ICA. In such a case, the supplier data is not part of the aircraft ICA since the aircraft ICA already contain all the required information.

(ii) If an aircraft ICA task only requires a replacement task for an engine, propeller, part or appliance (i.e. ‘remove and replace’ or ‘discard’) and does not refer to the supplier data for further maintenance of the removed engine, propeller, part or appliance, this means that the aircraft airworthiness may only be maintained by replacement action, and that the supplier data is not part of the ICA for the aircraft. In such cases, the supplier data does not need to be referenced in the aircraft ICA.

Example: If supplier data provides off-aircraft maintenance instructions for an engine, propeller, or other article (i.e. workshop maintenance), then this data may not be considered as part of the complete set of ICA for the aircraft, but may be considered as part of the complete set of ICA for the engine or propeller. However, the procedure for removal from / installation on the aircraft is necessarily part of the aircraft ICA.

(b) However, for the above cases, aircraft-level ICA can provide, as additional or optional maintenance information, the references to the supplier data even if it is not considered part of the ICA. In such cases, it should be made clear that the supplier data references are provided as additional or optional maintenance information and is not part of the product ICA. Besides, it should be ensured that the use of additional or optional maintenance information not considered as ICA but referenced together with the ICA will not compromise the continued airworthiness of the product or article.

(b) For the supplier data identified as part of the ICA, the DAH should:

(1) identify the supplier data that is part of the ICA; this can be achieved either by creating a listing or by any other acceptable means that allow to identify which data is part of the ICA and which data is not part of the ICA (refer to AMC1 21.A.7(b));

(2) just as for any other ICA, ensure the publication of the supplier data;

(3) ensure the accuracy and the adequacy of the technical content of the supplier data (refer to GM No. 1 to 21.A.239(a), point 3.1.5)

GM3 21.A.7(a) Non-ICA supplier data (e.g. component maintenance manuals (CMMs))

ED Decision 2021/007/R

(a) Non-ICA supplier data referenced together with the ICA

Supplier data, or parts of the supplier data, which is not considered to be part of the ICA but is additional or optional maintenance information referenced together with the product-level ICA, may be issued by the supplier to the DAH under a contract or an arrangement, using the methodology proposed in AMC3 21.A.7(a).

(b) Other non-ICA supplier data

Non-ICA supplier data, which is not referenced together with the ICA, but which can be used for the maintenance of components approved for installation by the DAH, should be acceptable to the DAH. This non-ICA supplier data may be documented in a list.

AMC1 21.A.7(b) Identification of a complete set of instructions for continued airworthiness (ICA)

ED Decision 2021/007/R

The design approval holder (DAH) should identify the complete set of ICA according to point 21.A.7(b) in such a way that the complete set can be:

(a) directly listed in the product TCDS; or

(b) indirectly referenced in the TCDS through other means, which allow the complete list of the ICA to be obtained (e.g. a complete listing of ICA contained in a ‘principal manual’ or a reference to a DAH’s website); or

(c) directly listed in the product STC; or

(d) indirectly referenced in the STC through other means, which allow the obtainment of the complete list of the ICA; or

(e) if direct reference is made to the ICA in the TCDS or the STC, no reference to the revision level of the ICA should be made; in this case, the revision level should be available elsewhere (e.g. on the DAH’s website).

For changes to type certificates and repairs, the identification of ‘a complete set of the changes to the instructions for continued airworthiness’ should be performed by the DAH by a statement to provide this information, or by confirmation that there are no changes to the ICA. This statement can also be made in the accomplishment document (e.g. embodiment instructions).

For products and articles for which the DAH holds a design organisation approval (DOA), the ICA are considered to be issued under the authority of the DOA and, therefore, the approval of the ICA should be made explicit to the reader in accordance with point 21.A.265(h), unless otherwise agreed with EASA.

GM1 21.A.7(b) Other persons required to comply

ED Decision 2021/007/R

For the purpose of this GM, ‘any other person required to comply’ means:

—      any independent certifying staff who performs maintenance on a product or article, in accordance with Regulation (EU) No 1321/2014, in the framework of a contract (or work order) with the person or organisation responsible for the aircraft continuing airworthiness;

—      any maintenance organisation approved to maintain a product or article, in accordance with Regulation (EU) No 1321/2014, in the framework of a contract (or work order) with the owner of the engine or article, or the person or organisation responsible for the aircraft continuing airworthiness;

—      any organisation approved to manage the aircraft continuing airworthiness in accordance with Regulation (EU) No 1321/2014, in the framework of a contract with the aircraft owner or aircraft operator.

GM2 21.A.7(b) ICA — format

ED Decision 2021/007/R

ICA can be furnished or made available by various means (including paper copies, electronic documents, or web-based access). Regardless of the format, the design approval holder (DAH) is expected to furnish or make ICA available in a means that is readily accessible for and useable by the owner and any person required to comply with the ICA. Service documents, such as service information letters, may be used for transmitting ICA information and updates.

(a) Formatting standards

Applicants may use the latest ATA, AECMA/ASD or GAMA formatting standards such as:

(1) AeroSpace and Defence Industries Association of Europe (ASD), ASD-S1000D, International Specification for Technical Publications Utilizing a Common Source Data Base, version 4 or higher;

(2) the Air Transport Association’s (ATA) iSpec 2200, Information Standards for Aviation Maintenance, latest edition (ATA is now known as Airlines for America (A4A) but the standard is still listed as ATA); or

(3) General Aviation Manufacturers Association (GAMA) Specification No. 2, Specification for Manufacturers Maintenance Data, latest edition.

In regard to scheduled maintenance, applicants may also refer to the glossary of the ATA MSG‑3 standard, latest revision, for standardised task definitions and designations.

(b) General considerations

ICA should be easy to read and to follow. All ICA should include a means to identify their applicability (model, type, etc.), and the associated revision status. Refer to sample formats in the Air Transport Association’s iSpec 2200, Information Standards for Aviation Maintenance, latest edition, or AECMA/ASD standards. There is no requirement for any specific format or arrangement of the ICA in document or documents. However, the specific format selected by the applicant should be used and applied in a uniform manner. Empty pages in a document should contain a statement like ‘Intentionally left blank’ or similar.

At the beginning of each procedure, the ICA should contain cautions and warnings regarding possible mistakes that can be made when following the instructions.

Abbreviations, acronyms and symbolisation should be either avoided or explained as part of the ICA documentation.

ICA contain units of measurement. Measurements could be, for instance, instrument readings, temperatures, pressures, torque values with tolerances, limits, and ranges when applicable. If the ICA contain units of measurement of a system other than the metric, the ICA should include a conversion to the metric system for each measurement, tolerance, or torque value. A general conversion table alone should not be provided, as it may introduce an additional source of error.

The DAH should use a means to indicate changes to the ICA directly in relation to each item of the information/data of the ICA, e.g. using a vertical change bar in the margin next to the line.

(c) Publication of ICA in multiple documents

DAHs may prepare ICA as a document, or several documents, depending on how much data is necessary to provide a complete set of ICA.

If there are multiple documents, there should be a principal document that describes the general scope of all other documents, in order to provide an overview of the multiple document structure.

According to different standards, the Airworthiness Limitations Section (ALS) needs to be included in the principal document as a dedicated section. However, EASA may also accept a separate Airworthiness Limitations document, when it is at least referenced as such in the principal document.

DAHs who decide to segregate information dedicated to a specific subject from a principal document into a separate document, e.g. ‘Fuel Pipe Repair Manual’, ‘Cable Fabrication Manual’, ‘Duct Repair Manual’ or ‘Instrument Display Manual’, should declare these documents to be ICA.

DAHs may decide to integrate certain information in a principal document (as, for example, troubleshooting information as part of the aircraft maintenance manual (AMM) instead of a separate troubleshooting manual (TSM)).

(d) Language

ICA should be provided in any of the official language(s) of the European Union which is (are) acceptable to the competent authority.

Note: In certain countries, such as the USA, English is required for ICA. EASA, therefore, recommends that DAHs include a version of the ICA in simplified technical English (e.g. in accordance with ASD Specification STE100).

(e) Electronic media

ICA may be provided in an electronic format (e.g. CDs, via the internet, etc.) instead of paper copies or microfilms (refer to AMC1 21.A.7(b)).

When an electronic format is used, the DAH should consider aspects such as the traceability of updates, keeping previous versions (record keeping), data security and the obligations of the person(s) or organisation(s) responsible for the aircraft continuing airworthiness, considering that the ICA form the basis of the data used for continuing airworthiness activities.

GM3 21.A.7(b) Approval status of the manual for a component or article

ED Decision 2021/007/R

When the ICA refer to a document for a specific component or article, it is possible that this document is used for products from more than one DAH. In such cases, instead of placing approval statements from each DAH in the same manual, it may be more practical to identify the approved status of the relevant document through its inclusion in lists managed by the DAH in accordance with the AMC1 21.A.7(b).

GM4 21.A.7(b) Integration of ICA between products (aircraft, engines, propellers)

ED Decision 2021/007/R

The aircraft/engine/propeller type-certificate holder (TCH) should ensure the availability of ICA to allow maintenance of the aircraft, including engines/propellers when installed on the aircraft.

When referring to engine/propeller ICA directly in the aircraft ICA, the aircraft TCH should not perform additional verification and validation. However, the integration and interface aspects between the aircraft and the engine/propeller are still under the responsibility of the aircraft TCH.

If the ICA published by the aircraft TCH include some engine/propeller ICA developed by the engine/propeller TCH, the engine/propeller TCH should make an arrangement with the aircraft TCH setting out engine/propeller TCH and aircraft TCH shared responsibilities with respect to the ICA under point 21.A.7.

This arrangement should:

—      define the part of the engine/propeller ICA which is published in the aircraft ICA; and

—      address the development, publication and update processes of these ICA, including completeness and timely availability aspects.

The incorporated engine/propeller data content remains under the responsibility of the engine/propeller TCH, and the publication is under the responsibility of the aircraft TCH. Therefore, the aircraft TCH must coordinate with the engine/propeller TCH regarding any modification or alteration of the incorporated data.

AMC1 21.A.7(c) Completeness and timely availability of the ICA

ED Decision 2021/007/R

COMPLETENESS AND TIMELY AVAILABILITY OF THE ICA FOR TYPE-CERTIFICATE (TC) AND RESTRICTED TYPE‑CERTIFICATE (RTC) APPLICANTS

(a) An applicant may wish to choose among the three options described below. Once the certification programme starts, it may be necessary to modify the initially selected option to accommodate programme changes. All such changes should be coordinated with EASA.

(1) Option 1: Complete ICA are available at the time of the design approval (TC/RTC)

(i) The ICA will be made available at the time of the design approval. This option minimises the risk of incomplete ICA, especially for changes.

(ii) With all ICA available at the time of the design approval, they should also be furnished / made available to the aircraft operator / aircraft owner and made available to any other person required to comply with any of those instructions in accordance with points 21.A.21(c)(4), 21.A.44 and 21.A.7, without using the provision to delay certain parts of the ICA after the entry into service.

(iii) Frequently, there is only a short period of time between the design approval and the entry into service. Nevertheless, applicants/holders may still wish to apply Option 2 or 3 for a part of their ICA as stated below.

(2) Option 2: Complete ICA are available at entry into service (TC/RTC)

If an applicant plans to make part of the ICA available to EASA at entry into service, the following approach is acceptable:

(i) For the ALS, as part of the type design, notwithstanding the selection of Option 2: the applicant submits the ALS for approval prior to the design approval. Any ALS content that is incomplete, not yet demonstrated for compliance, or delayed beyond the design approval, requires to be compensated through an interim limitation to establish compliance within this limitation. The interim limitation is notified to the aircraft operator(s) concerned as a temporary operational limitation in a manner agreed with EASA.

In this context, ALS content is understood as the task method (e.g. a detailed inspection), including its reference, title and applicability, and the associated threshold / interval / life-limit. The accomplishment procedure itself, i.e. how to carry out the task, is usually described in other parts of the ICA (e.g. in the AMM or NDT manual). However, the feasibility study of the accomplishment procedure is required for compliance with specific requirements (e.g. CS 25.611).

(A) This may typically apply when the aircraft structural full-scale fatigue testing required for compliance with the fatigue- and damage-tolerance requirements, considering the expected operational life, will not be completed prior to the type certificate being issued. In this case, a temporary operational limitation is assigned and stated in the ALS, dependent on the aircraft full-scale fatigue testing progress. The ALS is effectively incomplete beyond this temporary operational limitation, as the required justification and the resulting ICA are not yet available to support the safe operation of the aircraft beyond this limitation.

(B) A TCDS notation is not necessary, since the product is provided with complete ALS content up to the established temporary operational limitation.

(ii) A compliance plan identifying those parts of the ICA that are only to be made available at entry into service is produced, submitted to EASA and agreed between the applicant and EASA prior to the design approval (refer also to (iv) for ICA considered to be necessary at the time of the design approval.

(iii) A commitment is provided to produce, verify and submit (when requested) to EASA the relevant ICA prior to entry into service. This commitment should be provided in a certification document (e.g. the compliance plan) and should also be addressed in a more general manner in a DOA procedure for EU holders/applicants in accordance with points 21.A.239 and 21.A.263. If the respective DOA holder has not previously exercised the practice of delaying the ICA beyond the design approval in order for the DOA to demonstrate this capability in its design assurance system (DAS), the required procedural changes need to be addressed via a significant change to the DAS in accordance with point 21.A.247.

(iv) ICA considered to be necessary at the time of design approval are provided or made available in a format that adequately defines the data. Furthermore, the way the data is presented at the time of the design approval offers the same understanding of the data as in the final published format.

The applicant should agree with the Agency, in a compliance plan, on all ICA necessary at the time of design approval. The Agency investigation may vary from no involvement or evaluating a limited sample of the ICA to performing a thorough review of specific parts of the ICA.

(v) In cases where the AgencyEASA has doubts as to whether the applicant/holder can fulfil the applicable requirements of point 21.A.44 to control and support delaying the ICA beyond the design approval, or TC/RTC, and until entry into service, EASA can decide to assign a condition for entry into service for non-ALS ICA.

As a condition for the entry into service, a note should be included in the type certificate data sheet (TCDS) as a result of these pending issues under the ICA paragraph as follows:

‘Note: The ICA are not complete. As per point 21.A.7 of Commission Regulation (EU) No 748/2012, they must be completed before the entry into service of the aircraft. Contact EASA for information on the status.’

The decision to assign a condition may be based on the applicant’s performance, e.g. if the applicant has already demonstrated in previous projects that it provided the complete set of ICA before the entry into service, if the applicant has already experienced difficulties in providing the ICA considered necessary at the time of the design approval, or has previously failed on a different project to meet its commitment to complete the ICA prior to entry into service, or if the applicant/holder has no previous experience with the practice of delaying the ICA beyond the design approval.

(vi) Post-TC action is established together with EASA (if EASA requests such a review) to review the ICA status at entry into service.

(vii) If all ICA are made available to EASA at the time of entry into service, they should also be furnished at this time to the aircraft operator / aircraft owner and made available to any other person(s) required to comply with any of those instructions in accordance with points 21.A.21(c)(4), 21.A.44 and 21.A.7, without using the provision to delay certain parts of the ICA beyond the entry into service. For an EU holder/applicant, this should be supported as part of the DOA/ADOA procedure.

Flow chart A — ‘Completeness of ICA’, Option 1 and 2

(3) Option 3: Complete ICA are available after the entry into service (TC/RTC)

As per point 21.A.7(c), certain ICA dealing with the ‘overhaul or other forms of heavy maintenance’ may be delayed until after the aircraft entry into service. Although there is no definition of what is meant by ‘overhaul or other forms of heavy maintenance’, the intention of the rule is to provide flexibility to applicants/holders for long-lead ICA of a scheduled nature.

If an applicant plans to make part of the ICA available only after the entry into service, the following is acceptable for the complete set of ICA:

(i) for the ALS, as it cannot be delayed until after the entry into service, point (i) of Option 2 applies;

(ii) for ICA considered to be necessary at the time of the design approval, point (iv) of Option 2 applies.

(iii) a detailed compliance plan identifying those parts of the ICA that are to be provided prior to and after the entry into service. For ICA made available after the entry into service, the plan should account for when the ICA are needed so that they can be complied with. This approach may only be used for scheduled maintenance accomplishment procedures, where threshold / interval / life-limit requirements of the related scheduled tasks are established. In that respect, the following aspects should be considered:

(A) The majority of the ICA are of an unscheduled nature; therefore, these items should be available at entry into service at the latest.

(B) Consideration should be given to the fact that a number of tasks are used for both scheduled and unscheduled maintenance (e.g. an operational check of a system is planned as a scheduled task at a certain point in time, but is also required as part of the installation procedure to determine the operational status of the system).

(C) For ICA to be made available after entry into service, the detailed plan should contain threshold(s) controlled by the applicant/holder, stating the maximum value in flight hours (FH) / flight cycles (FC) or calendar time (CT), or a combination of them as applicable, by which point in time the delayed ICA should be made available.

(D) This detailed plan should be available prior to the time of the design approval and should be either directly integrated or cross-referenced in a compliance plan.

(E) Information on the format in which the ICA delayed until after entry into service will be made available in time (e.g. regular revisions or temporary revisions (TRs) or service information (SBs, SIL, etc.).

(iv) A procedure/programme that ensures a detailed plan is produced and implemented in the applicant’s organisation in order to ensure the timely availability (to the aircraft operator / aircraft owner and to any other person required to comply with any of those instructions and to the Agency, if involved and when requested). For an EU holder/applicant, this should be part of the design organisation approval (DOA) procedure in accordance with points 21.A.239 and 21.A.263.

(v) A commitment is made to produce, verify and provide the relevant ICA in accordance with the detailed plan. This commitment should be provided in a certification document (e.g. a compliance plan) and should also be addressed in a more general manner in a DOA procedure for EU holders/applicants in accordance with points 21.A.239 and 21.A.263. If the respective DOA holder has not previously exercised the practice of delaying the ICA beyond the design approval in order for the DOA to demonstrate this capability in its design assurance system (DAS), the required procedural changes need to be addressed via a significant change to the DAS in accordance with point 21.A.247.

(vi) In order to ensure that the applicant/holder can meet their obligations as set out in point 21.A.44 to control and support delaying the ICA, EASA may decide:

(A) for ICA delayed until entry into service, to assign a condition/notation for the entry into service to be included in the TCDS as a result of these pending issues under the ICA paragraph, as per point (v) of Option 2;

(B) for ICA delayed until after entry into service, to assign an interim limitation to be published and included in the ALS as a temporary operational limitation, also for non-ALS ICA, to compensate for the delayed ICA; this approach may only be used for scheduled maintenance accomplishment procedures, where task and interval requirements are available.

The decision to assign a condition/limitation may be based on the applicant’s performance, e.g. if the applicant has already demonstrated in previous projects that it provided the complete set of ICA before the entry into service, if the applicant had already difficulties in providing the ICA considered necessary at the time of the design approval, or has failed before in a different project to control and support delaying the ICA, or if the applicant/holder has not previously exercised the practice of delaying the ICA beyond the design approval.

(vii) Post-TC action should be established with EASA to regularly review the ICA status, if EASA requests such a review, taking into account the DOA oversight activities.

(viii) An applicant/holder should provide visibility, regarding the ICA that are delayed beyond entry into service, to the aircraft operator / aircraft owner and to any other person(s) required to comply with any of those instructions. This can be achieved by providing this information, for example, on a website or in a document, such as an MPD or AMM, preferably in the principal ICA manual. This visibility information is then itself considered to be ICA information.

(ix) It is assumed that for those ICA that are made available to EASA at the time of entry into service, they are also at the same time furnished to the aircraft operator / aircraft owner and made available to any other person(s) required to comply with any of those instructions in accordance with points 21.A.21(c)(4), 21.A.44 and 21.A.7.

This is to satisfy EASA that such a delayed publication will not have an adverse effect on the continuing airworthiness of any individual aircraft.

To allow the timely review and incorporation of a delayed part of the ICA into continuing airworthiness activities and processes (e.g. amendment of the aircraft Maintenance Programme) by the person or organisation responsible for the aircraft continuing airworthiness or for performing maintenance, the Agency considers that the delayed ICA should typically be made available two years before the actual ICA has to be used, when using normal revisions as a format. However, shorter time margins may be acceptable, provided that the format used ensures the prompt notification of the availability of the delayed ICA or the ICA itself, but they should not be less than 1 year before the ICA has to be used.

Flow chart B — ‘Completeness of ICA’, Option 3

(b) Completeness and timely availability of changes to the ICA (TC/RTC)

Point 21.A.7(d) regulates the distribution of changes to the ICA required from the TC/RTC holder. Those changes to the ICA could result from the design change process (minor and major changes), in-service experience, corrections, and others.

For an EU TC/RTC holder/applicant, a programme showing how changes to the ICA are distributed is part of the respective procedures (e.g. design organisation procedures, or alternative procedures used to demonstrate capabilities). For changes to the ICA triggered by design changes, typically these procedures follow the same principles as those available for TC/RTC, Options 1 to 3, while taking into account the relevant privileges, e.g. that a DOA may approve minor changes in accordance with point 21.A.263(c)(2).

21.A.9 Access and investigation

Regulation (EU) 2022/201

Any natural or legal person that holds or has applied for a type-certificate, restricted type-certificate, supplemental type-certificate, ETSO authorisation, design change or repair approval, certificate of airworthiness, noise certificate, permit to fly, design organisation approval, production organisation approval certificate or letter of agreement under this Regulation, shall:

(a) grant the competent authority access to any facility, product, part and appliance, document, record, data, process, procedure or to any other material in order to review any report, make any inspection, or perform or witness any flight and ground test, as necessary, in order to verify the initial and continued compliance of the organisation with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts;

(b) make arrangements to ensure the competent authority has access, as provided for in point (a), also in respect of the natural or legal person’s partners, suppliers and subcontractors.

GM1 21.A.9 Access and investigations

ED Decision 2022/021/R

ARRANGEMENTS

The arrangements made by the applicant for, or holder of, a type certificate (TC), restricted type certificate (RTC), supplemental type certificate (STC), a European technical standard order (ETSO) authorisation, a major repair design approval, a permit to fly, a design organisation approval (DOA), a production organisation approval (POA), or a letter of agreement under Part 21 are required to allow the competent authority to make investigations that include the complete organisation, including its partners, subcontractors, and suppliers, whether they are in the State of the applicant or not.

The investigations may include audits, enquiries, questions, discussions, and explanations, monitoring, witnessing, inspections, checks, as well as flight and ground tests and inspections of completed products, parts, or appliances that are either designed or produced.

In order to maintain its confidence in the standards that are achieved by the organisation, the competent authority may make an investigation into a sample product, part, or appliance and of its associated records, reports, and certifications.

The arrangements are required to enable the organisation to assist the competent authority and cooperate with it in conducting the investigation during the initial assessment and the subsequent surveillance.

‘Cooperation in conducting the investigation’ means that the competent authority has been granted full and free access to the facilities and to any information relevant to demonstrating compliance with the Part 21 requirements, and has been provided assistance, as necessary.

‘Assistance to the competent authority’ includes all the appropriate means regarding the facilities of the organisation, to allow the competent authority to conduct the investigation, such as meeting rooms, offices, personnel support, records, documentation, computer data, and communication facilities, all properly and promptly made available, as necessary.

The competent authority seeks to have an open relationship with the organisation, and suitable liaison staff are required to be nominated to facilitate this, including one or more suitable representatives to accompany competent authority staff during visits, not only at the organisation’s own facilities, but also at subcontractors, partners, or suppliers.