EASA Part-IS Compliance: The February 2026 Deadline Has Passed — What Aviation Organisations Must Do Now

A Line in the Sand for Aviation Cybersecurity

On 22 February 2026, the applicability date under Commission Implementing Regulation (EU) 2023/203 took effect. For the vast majority of EASA-regulated organisations — air operators, Part-145 maintenance organisations, Continuing Airworthiness Management Organisations (CAMOs), Approved Training Organisations (ATOs), aeromedical centres, and Flight Simulation Training Device (FSTD) operators — this date marked a legal obligation, not a recommended practice. EASA Part-IS compliance is now mandatory.

This is not a gradual transition. The regulatory framework under Part-IS — composed of Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203 — represents a structural shift in how the European Union treats cybersecurity in aviation. Information security risks that could impact aviation safety are now formally subject to the same management rigour as operational safety risks. They must be identified, assessed, mitigated, monitored, and reported — through a documented system that regulators can inspect and audit.

This aligns with the core principle underpinning our work at Aero Support Group’s Safety Management System consulting: cybersecurity is not an IT department problem. It is a safety governance issue that sits squarely within the remit of Accountable Managers, Safety Managers, and Quality Assurance teams. And now, it is a regulatory compliance issue with audit consequences.

The Regulatory Framework: What EASA Part-IS Actually Requires

EASA Part-IS is built on two regulatory pillars. Delegated Regulation (EU) 2022/1645 established the overarching framework for managing information security risks with potential safety impact. Implementing Regulation (EU) 2023/203 translates this into detailed, operational requirements applicable to the wider aviation population.

At its core, Part-IS requires organisations to establish, implement, and maintain an Information Security Management System (ISMS) that is proportionate to their size, complexity, and risk profile. While the standard is broadly aligned with ISO/IEC 27001, EASA has introduced aviation-specific provisions that go beyond conventional IT security frameworks — particularly around the interface between information security and flight safety.

Core ISMS Requirements Under Part-IS

• A formally documented Information Security Management Manual (ISMM)
• An initial risk assessment covering all critical information assets, systems, and interfaces
• Defined governance structure including roles, responsibilities, and accountability at senior management level
• A security policy aligned with safety management objectives
• Processes for detecting, escalating, and reporting information security events
• Change management procedures addressing security impacts
• Personnel training and security awareness programmes
• Evidence of ISMM submission to the Competent Authority

Who Must Comply: The Two-Phase Applicability Timeline

EASA structured Part-IS implementation in two waves. The first applicability date of 16 October 2025 targeted design and production organisations (Part-21 DOA/POA), aerodrome operators, and apron management service providers. The second — and most widely impactful — wave took effect on 22 February 2026.

The following organisations became subject to Part-IS on 22 February 2026:

• Commercial and non-commercial air operators (AOC holders)
• EASA Part-145 approved maintenance organisations (MROs)
• Continuing Airworthiness Management Organisations (Part-CAMO)
• Approved Training Organisations (ATO) and FSTD operators
• Aeromedical centres for flight crew and air traffic controllers
• Air Navigation Service Providers (ANSPs)
• Air Traffic Controller training organisations
• Relevant competent authorities, including EASA itself

The PSOE Model: Where Should Your Organisation Stand Today?

EASA recognises that full ISMS maturity is a progressive journey. To manage this, the regulator introduced the PSOE model — a four-stage maturity framework:

By 22 February 2026, organisations were required to achieve at least the Present and Suitable levels. An additional 18-month transition period — running through approximately August 2027 — provides time to achieve Operational and Effective maturity. However, this is not a licence for inaction: National Aviation Authorities are already initiating their first cyber-audit cycles.

NAA Cyber-Audits: What Regulators Will Be Looking For

The post-deadline period is not a quiet one. National Aviation Authorities across Europe are now incorporating information security assessments into their standard oversight programmes. For Part-145 organisations and CAMOs in particular, the next scheduled surveillance audit may include specific cyber-resilience checks. Auditors will typically seek evidence in the following areas:

• The ISMM — its existence, scope, and approval/submission status
• A documented asset inventory covering critical information systems (maintenance tracking software such as AMOS, Envision, and TRAX; electronic logbooks; EFBs; aircraft health monitoring systems)
• Records of initial and ongoing risk assessments
• Evidence of security incident detection and reporting processes
• Training records demonstrating security awareness across operational staff
• Change management logs showing security impact assessment for system upgrades
• Board-level accountability — a designated Information Security accountable manager

One of the most common gaps we anticipate in the coming audit cycle is the failure to integrate the ISMS with existing SMS and QMS structures. Part-IS explicitly envisions that information security management should be embedded within — not parallel to — the organisation’s existing Safety Management System and Quality Management System. Running three separate silos is not just operationally inefficient; it is a compliance gap.

Organisation-Specific Implications

Connection to IOSA, ISAGO, ICAO Annex 19, and UK CAA

Part-IS does not exist in a regulatory vacuum. Organisations holding or pursuing IATA Operational Safety Audit (IOSA) registration will note that the IOSA Standards Manual increasingly incorporates information security considerations within its safety management chapter. A robust ISMS contributes directly to IOSA compliance maturity, and an IOSA-registered airline that cannot demonstrate Part-IS compliance faces an inconsistency that auditors will note.

ICAO Annex 19, 3rd Edition — the international standard for Safety Management Systems — now explicitly acknowledges information security as a component of the broader safety risk environment. Organisations building or enhancing their SMS under Annex 19 should ensure that their hazard identification and risk assessment processes extend to information security threats and vulnerabilities. This is a key area of focus within the ICAO USOAP framework, where State-level SMS effectiveness increasingly encompasses cybersecurity governance.

For Third Country Operators seeking or holding EASA TCO authorisation, Part-IS compliance adds a new dimension to the compliance matrix. While TCO authorisation is primarily assessed against safety oversight standards, the increasing integration of Part-IS into EASA’s oversight framework means that TCO holders and their national oversight authorities will face growing scrutiny of cybersecurity governance.

UK-based operators and approved organisations should note that the UK CAA has published its own regulatory framework aligned with the principles of EU Part-IS. UK organisations are not exempt from equivalent information security obligations and should verify their current compliance position with their National Aviation Authority. For ground handling providers, ISAGO-registered organisations should also review how Part-IS principles intersect with their ground operations safety and quality management frameworks.

What Aviation Organisations Should Do Now: 8 Action Steps

Conclusion: From Compliance Obligation to Operational Capability

EASA Part-IS is not a temporary regulatory exercise. It is a permanent expansion of the aviation safety framework — one that reflects the operational reality that the safety of modern aviation is increasingly dependent on the integrity, availability, and confidentiality of information systems.

The February 2026 deadline has passed. The question is no longer “Do we need to comply?” It is “How well can we demonstrate our compliance when the auditor arrives?” Organisations that treat Part-IS as a documentation exercise will fail that test. Organisations that embed information security governance into their operational safety culture will not only pass — they will be better positioned to manage the cyber risks that increasingly threaten aviation integrity.

At Aero Support Group, we work with airlines, MROs, CAMOs, and training organisations to build compliance systems that are operational, auditable, and sustainable. Part-IS compliance is not a standalone project — it is part of a broader safety and quality governance architecture that we help organisations design, implement, and defend.

Frequently Asked Questions