CAO.B.010 Scope

Regulation (EU) 2019/1383

This Section establishes the administrative requirements to be met by the competent authorities in connection to the requirements for organisations set out in Section A.

CAO.B.017 Means of compliance

Regulation (EU) 2019/1383

(a) The Agency shall develop Acceptable Means of Compliance (‘AMC’) that may be used to demonstrate compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts.

(b) Alternative means of compliance may be used to demonstrate compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts

(c) The competent authority shall establish a system to consistently evaluate that all alternative means of compliance used by organisations under its oversight allow for the establishment of compliance with Regulation (EU) No 2018/1139 and its delegated and implementing acts.

(d) The competent authority shall evaluate all alternative means of compliance proposed by an organisation in accordance with point CAO.A.017 by analysing the documentation provided and, if considered necessary, conducting an inspection of the organisation.

When the competent authority finds that the alternative means of compliance are in accordance with Regulation (EU) 2018/1139 and its delegated and implementing acts, it shall without undue delay:

(1) notify the applicant that the alternative means of compliance may be used and, if applicable, amend the approval or certificate of the applicant accordingly;

(2) notify the Agency of their content, including copies of all relevant documentation.

GM1 CAO.B.017  Means of compliance

ED Decision 2020/002/R

ALTERNATIVE MEANS OF COMPLIANCE

Alternative means of compliance that are used by a CAO, may be used by another CAO only if they are processed again in accordance with point CAO.B.017(d).

CAO.B.020 Record-keeping

Regulation (EU) 2019/1383

(a) The competent authority shall establish a system of record-keeping that allows adequate traceability of the process to keep the records for issuing, continuing, changing, suspending or revoking each issued certificate.

(b) The records of the competent authority for the oversight of organisations approved in accordance with this Annex shall include, as a minimum:

(1) the application for an organisation approval;

(2) the organisation approval certificate, including any changes thereto;

(3) a copy of the audit programme of the organisation, listing the dates at which audits were carried out and when they are due;

(4) the continuing-oversight records, including all audit records, as provide for in point CAO.B.055;

(5) all findings, actions required to close the findings and recommendations;

(6) copies of all relevant correspondence with the organisation;

(7) details of any exemption in accordance with point CAO.B.035 and enforcement actions;

(8) any report from other competent authorities relating to the oversight of the organisation;

(9) CAE and its amendments;

(10) copies of any other document approved by the competent authority.

(c) The retention period for the records listed under point (b) shall be at least 5 years.

(d) All records shall be made available to the competent authority of another Member State or the Agency, upon request.

CAO.B.025 Mutual exchange of information

Regulation (EU) 2019/1383

(a) Where necessary for the performance of their tasks under this Regulation, the competent authorities shall exchange information.

(b) In the case of a potential safety threat involving several Member States, the competent authorities concerned shall assist each other in carrying out the necessary oversight action.

CAO.B.030 Responsibilities

Regulation (EU) 2019/1383

The competent authority shall conduct the necessary inspections and investigations in order to verify and ensure that the organisations for which it is responsible in accordance with point CAO.1 meets the requirements of Section A of this Annex.

CAO.B.035 Exemptions

Regulation (EU) 2019/1383

Where a Member State grants an exemption from the requirements of this Annex in accordance with paragraph 2 of Article 71 of Regulation (EU) 2018/1139, the competent authority shall record the exemption. It shall retain those records as provided for in point (b)(6) of point CAO.B.020.

CAO.B.040 Application

Regulation (EU) 2019/1383

Where facilities of the CAO are located in more than one Member State, the initial certification procedure and continued oversight of the approval shall be carried out in cooperation with the competent authorities designated by the Member States in whose territory the other facilities are located.

CAO.B.045 Initial certification procedure

Regulation (EU) 2020/270

(a) Where it has been established that the organisation meets the requirements laid down in points (a) and (b) of CAO.A.035, the competent authority shall formally notify the applicant about the acceptance of the personnel.

(b) The competent authority shall ensure that the procedures specified in the CAE comply with Section A, and that the accountable manager has signed the commitment statement referred to in point (a)(1) of CAO.A.025.

(c) The competent authority shall verify that the organisation complies with Section A.

(d) The competent authority shall convene a meeting with the accountable manager at least once during the investigation for approval to ensure that he or she fully understand the significance of the approval and the statement referred to in point (a)(1) of CAO.A.025

(e) All findings in accordance with point CAO.B.060 shall be confirmed in writing to the applicant organisation.

(g) Before issuing the approval the competent authority shall close all be findings after the organisation has corrected them.

FORMAL ACCEPTANCE OF MANAGEMENT STAFF

The approval by the competent authority of the CAE, containing in accordance with CAO.A.025(a)(3) the nominative list of CAO.A.035(a) and (b) persons, constitutes the formal notification of acceptance by the competent authority of this personnel.

VERIFICATION OF COMPLIANCE

(a) In order to verify the organisation’s compliance with the applicable requirements, the competent authority should conduct an audit of the organisation, including interviews of the personnel, and inspections carried out at the organisation’s facilities.

(b) The competent authority should only conduct such an audit if it is satisfied that the application and the supporting documentation are in compliance with the applicable requirements.

(c) The audit should focus on the following areas:

(1) the management structure, including the names and qualifications of personnel required by points CAO.A.035(b), and the adequacy of the organisation and its management structure;

(2) the personnel:

(i) the adequacy of the number of staff, and their qualifications and experience with regard to the intended terms of approval and the associated privileges;

(ii) the validity of licences and/or authorisations, as applicable;

(3) the quality system (or organisational review);

(4) the facilities and their adequacy regarding the organisation’s scope of work;

(5) the documentation required by Part-CAO, including:

(i) the verification that the procedures specified in the CAE comply with the applicable requirements; and

(ii) the verification that the accountable manager has signed the exposition statement.

(d) If an application for an organisation certificate is refused, the applicant should be informed of the right of appeal that exists under national law.

MAINTENANCE DATA

The organisation is not required to continuously hold all the maintenance data. It is acceptable to have a procedure to ensure that the specific maintenance data required for a particular maintenance activity will be available before that maintenance takes place.

However, the organisation should be able to demonstrate its maintenance capability and find means to comply with CAO.A.050(a) when it does not hold all current applicable maintenance data before the approval.

AMC1 CAO.B.045(c)  Initial certification procedure

ED Decision 2020/002/R

An EASA Form 613 should be used for this activity (see Appendix I to AMC1 CAO.B.045(c) and AMC1 CAO.B.055(b)).

CAO.B.050 Issuance of the initial certificate

Regulation (EU) 2020/270

(a) Where the competent authority has established that the applicant complies with point CAO.B.045, it shall issue the certificate, using the EASA Form 3-CAO template laid down in Appendix I and specifying the terms of approval.

(b) The competent authority shall include the reference number of the CAO as specified in the EASA Form 3-CAO template laid down in Appendix I.

CAO.B.055 Continuing oversight

Regulation (EU) 2019/1383

(a) The competent authority shall establish and keep up-to-date, an oversight programme, specifying all CAOs to which it has issued a certificate and the dates at which it has audited and is scheduled to audit those CAOs.

(b) The competent authority shall audit at periods not exceeding 24 months each CAO to which it has issued an approval. Those audits shall concentrate, in particular, on the changes to the organisation notified to it in accordance with the procedure specified in point (b) of point CAO.A.105.

(c) A relevant sample of the aircraft managed by the CAO, if the organisation is approved to do so, shall be surveyed at every 24-month period. The size of the sample shall be decided by the competent authority based on the result of prior audits and earlier product surveys.

(d) The competent authority shall confirm in writing any finding during those audits to the CAO.

(e) The competent authority shall record any findings during those audits, any actions required to close the findings and any recommendations issued.

(f) The competent authority shall convey a meeting with the accountable manager of the CAO at least once every 24 months.

AMC1 CAO.B.055  Continuing oversight

ED Decision 2020/002/R

At the successful conclusion of the audit(s), including verification of the CAE, an audit report form should be completed by the auditing surveyor including all recorded findings, closure actions and the recommendation. An EASA Form 613 should be used for this activity (see Appendix I to AMC CAO.B.045(c) and CAO.B.055(b)).

A review of EASA Form 613 audit report form should be carried out by a competent independent person nominated by the competent authority. Satisfactory review of the audit form should be indicated by a signature on the audit form.

SUBCONTRACTED ACTIVITIES

(a) If a CAO subcontracts continuing airworthiness management tasks, all subcontracted organisations should also be audited by the competent authority at periods not exceeding 24 months to ensure that the subcontracted continuing airworthiness management tasks are carried out in compliance with Part-CAO, Part-M and Part-ML, as applicable.

(b) If a CAO subcontracts specialised maintenance tasks, the competent authority should determine whether the subcontracted organisation needs to be audited and included in the oversight programme, taking into account the specific nature and complexity of the subcontracted activities and the results of previous oversight activities of the CAO. Consideration may also be given to subcontracted organisation holding an organisation approval or a certification to an industry standard.

(c) For these audits, the competent authority inspector should ensure that he or she is accompanied throughout the audit by a senior technical member of the CAO.

NOTE: When a CAO subcontracts tasks, the competent authority should also ensure that the CAO has sufficient control over the subcontracted organisation.

CAO.B.060 Findings

Regulation (EU) 2019/1383

(a) When during audits or by any other means, evidence is found showing non-compliance to the Part-CAO requirements, the competent authority shall take the following actions:

(1) for Level 1 findings, immediate action shall be taken by the competent authority to revoke, limit or suspend in whole or in part, depending upon the extent of the Level 1 finding, the CAO approval, until successful corrective action has been taken by the organisation; and

(2) for Level 2 findings, the competent authority shall grant a corrective action period of no more than 3 months, appropriate to the nature of the finding — in certain circumstances, at the end of this first period and subject to the nature of the finding, the competent authority can extend this 3-month period subject to a satisfactory corrective action plan.

(b) Action shall be taken by the competent authority to suspend in whole or in part the approval in case of failure to comply within the timescale set out by the competent authority.

AMC1 CAO.B.060(a)(1) Findings

ED Decision 2020/002/R

LEVEL 1 FINDINGS

Where a level 1 finding directly relates to an aircraft, the competent authority should inform the State in which the aircraft is registered.

For a level 1 finding related to maintenance, it may be necessary for the competent authority to ensure that further maintenance and re-certification of all affected products is accomplished, dependent upon the nature of the finding.

CAO.B.065 Changes

Regulation (EU) 2019/1383

(a) Upon receiving an application for a change in accordance with point (a) of point CAO.A.105, the competent authority shall verify the organisation’s compliance with the applicable requirements before issuing the approval of the change.

(b) The competent authority may indicate the conditions under which the CAO shall operate during the change unless the competent authority determines that the organisation’s certificate shall be suspended because of the nature or extent of the changes.

(c) For changes not requiring prior approval, the competent authority shall assess during the oversight activities that the CAO complies with the approved control procedure provided for in point (b) of point CAO.A.105 and complies with the applicable requirements.

CAO.B.070 Suspension, limitation and revocation

Regulation (EU) 2019/1383

The competent authority shall:

(a) suspend an approval on reasonable grounds in the case of a potential safety threat; or

(b) suspend, revoke or limit an approval pursuant to point CAO.B.060.