ICAO ANNEX 19 SMS COMPLIANCE · Aero Support Group FZCO · Updated 22 October 2026
What is ICAO Annex 19?
ICAO Annex 19 (Safety Management) is the ICAO Annex that sets the safety management Standards and Recommended Practices for States and service providers. Guidance on implementing it is in ICAO Doc 9859, the Safety Management Manual.
Annex 19 applies to the service providers that States must require to implement an SMS, including air operators, approved maintenance organisations, organisations responsible for type design or manufacture, approved training organisations, air traffic services providers and certified aerodrome operators. Appendix 2 sets the SMS framework of four components and twelve elements:
- Safety policy and objectives: management commitment, safety accountability and responsibilities, appointment of key safety personnel, coordination of emergency response planning and SMS documentation.
- Safety risk management: hazard identification, and safety risk assessment and mitigation.
- Safety assurance: safety performance monitoring and measurement, management of change, and continuous improvement of the SMS.
- Safety promotion: training and education, and safety communication.
ICAO Doc 9859, the Safety Management Manual (fourth edition), provides the guidance, and ICAO Doc 10159, the Safety Intelligence Manual, supports the use of safety data and analysis.
How Annex 19 reaches your organisation
Annex 19 is addressed to States. It reaches organisations through national regulations and through audit programmes:
- EASA implements the SMS requirements in the management system rules of each organisation type, such as ORO.GEN.200 for air operators, 145.A.200 for maintenance organisations and CAMO.A.200 for CAMOs.
- The UK CAA, the FAA and other authorities implement them in their own rules, for example 14 CFR Part 5 for US air carriers.
- IOSA and ISAGO assess the SMS in the ORG and ORM sections of their standards manuals.
- EASA and UK TCO assessments check third country operators against the applicable ICAO standards, including safety management.
When a new edition of Annex 19 becomes applicable, organisations should expect their authorities and audit programmes to update their requirements in turn.
Where SMS implementations fall short
- The SMS manual describes processes copied from guidance material that the organisation does not use.
- The hazard log is a list compiled once for an audit and not updated from reports, investigations and changes.
- Risk assessments end with a rating and no mitigation, owner or review date.
- Safety performance indicators count events but have no targets, alert levels or trend analysis.
- The safety review board meets without recording decisions, and actions are not followed up.
- Management of change covers major projects only and misses everyday operational changes.
- Investigations stop at human error and do not identify organisational causes.
How ASG supports Annex 19 compliance
SMS development. For organisations building or rebuilding an SMS, ASG designs the system around the Appendix 2 framework and the applicable national rules: safety policy, accountabilities, hazard identification and risk management processes, the SPI framework, safety review board terms of reference, investigation procedures and training. We set up the working tools and run the first cycle with the organisation.
SMS assessment. For organisations with an SMS in place, ASG assesses whether it is present, suitable, operating and effective, using evidence from the hazard log, risk register, SPIs, safety review board minutes and investigations. The result is a gap report with systemic causes and a corrective action plan.
States and authorities. For civil aviation authorities, ASG supports State Safety Programme implementation and USOAP preparation; see our USOAP and CAA development page.
Continuous support. SMS RADAR provides periodic review of SPIs, risk register currency and safety review board follow-up between audits.
Conclusion
Annex 19 asks for a safety management system that works, and auditors look for the evidence: a hazard log in use, risk assessments that lead to action, SPIs with trends and a safety review board that follows up. ASG builds and assesses SMSs to that standard, against the edition and national rules that apply to each organisation.
Frequently asked questions
The Safety Management Manual (SMM) is ICAO Doc 9859, currently in its fourth edition. It gives guidance on implementing the SMS and State Safety Programme provisions of Annex 19.
The service providers that States must require to implement an SMS, including air operators, approved maintenance organisations, design and production organisations, approved training organisations, air traffic services providers and certified aerodrome operators. National rules may extend this to other organisations.
Annex 19 Appendix 2 sets four components: safety policy and objectives, safety risk management, safety assurance and safety promotion, divided into twelve elements.
On 26 November 2026. National regulations and audit standards are then updated to reflect it.
The State Safety Programme is the State’s system for managing safety, including regulation, oversight and safety data. The SMS is the service provider’s system for managing the safety risks of its own operations.
By looking at evidence of use: hazards identified from reports and changes, risk assessments with mitigations and owners, SPIs with targets and trends, safety review board decisions and follow-up, and investigations that identify organisational causes.
Key takeaways
- Annex 19 Appendix 2 sets four SMS components and twelve elements
- It reaches organisations through national rules and IOSA, ISAGO and TCO assessments
- The third edition applies from 26 November 2026
- Auditors look for a working hazard log, risk register, SPIs and safety review board
- Investigations should reach organisational causes
Is your SMS ready for the next audit?
Tell us your organisation type and upcoming audits. ASG will assess your SMS against Annex 19 and the rules that apply to you.