By Ferhan Bugay, Executive Director, Aero Support Group · 8 November 2026
From 26 November 2026, Annex 19, 3rd Edition (Amendment 2), applies to every operator of aeroplanes or helicopters authorised for international commercial air transport. For an airline SMS it means a written system description with interfaces, interface hazards in the hazard log, resources under the first component, a restructured safety performance section, and periodic SMS assessment by your authority.
Does it apply to your airline?
| Your operation | Annex 19 basis | What it means |
|---|---|---|
| International commercial air transport, aeroplanes or helicopters | 3.3.2.1 b); 4.2.2 | SMS acceptable to the State of the Operator |
| Maintenance done under the operator’s own system, not by an AMO | 3.3.2.1 b), Note | That maintenance is inside the operator’s SMS scope |
| International RPAS operations | 3.3.2.1 c); 4.2.3 | New in the 3rd Edition |
| International general aviation, large or turbojet aeroplanes | 3.3.2.2; 4.3 | The State of Registry sets SMS criteria |
| Domestic-only operations | National rules | Annex 19 covers international operations; check whether your State requires an SMS for domestic operations too |
What changes in an airline SMS
The table below takes the eight framework changes from the 3rd Edition and shows what each one usually means for an airline.
| Change and provision | What it means for an airline |
|---|---|
| Resources join the first component App. 2, 1; 1.5.1 a) |
The SMS manual names the safety team, the budget for safety data tools such as FDM and reporting software, and who approves them |
| System description, scope and interfaces 4.1.1 b)–c) |
A system description covering bases, fleets, outstations and contracted services, with an owner for each interface |
| Interface hazards App. 2, 2.1.1 |
The hazard log covers ground handlers, contracted MROs, fuel suppliers, airports, ATC, codeshare and wet-lease partners, and handovers between your own departments |
| Safety performance measurement restructured App. 2, 3.1 a)–c) |
SPIs such as unstable approaches, FDM events per 1,000 sectors and ground damage; progress shown against each safety objective; evidence that key risk controls work |
| Objectives consider State objectives App. 2, 1.1.3 |
Safety objectives cross-checked against your State’s SSP objectives |
| Human performance 4.1.3 |
Investigation, risk assessment and change templates prompt for fatigue, roster patterns, automation, workload and procedure design |
| Effects from other domains App. 2, 2.2, Notes 1–2 |
Commercial and security decisions, such as a new route, a schedule change or a security screening change, go through a safety risk assessment |
| Size and complexity in guidance 4.1.1, Note 1 |
The way the SMS is scaled to your fleet and network is written down and justified |
What your authority will check
Three State provisions change the conversation with your inspector.
Periodic SMS assessment (3.4.1.3). Your State must assess your SMS periodically and monitor your safety performance. An assessor will want to see that the SMS runs: hazard log entries from line operations, SPI trends with action taken, Safety Review Board minutes with decisions followed through, and investigations that changed something.
Internal resolution policy (3.4.1.4). Your State must publish a policy on which safety events you may resolve inside your SMS. Check your occurrence handling procedure against it, especially for events found through FDM and confidential reports.
State-level SPIs (3.4.2.2). Where your State publishes safety performance indicators, it should ask operators to consider them. Expect questions on how your SPIs relate to the national ones.
Evidence an assessor will ask for
| Area | Evidence |
|---|---|
| Resources | Organisation chart of the safety department, approved budget line, tool licences |
| System description | Current document with interfaces, owners and date of last review |
| Interface hazards | Hazard log entries for at least the main contracted services, with risk owners |
| Safety performance | Twelve months of SPI trends, objectives with progress, one or more validated risk controls |
| Management review | SRB minutes, action log with closure dates |
| Human performance | Investigation reports that examined fatigue, workload or procedure design |
| Change management | Risk assessments for recent route, fleet, schedule or contractor changes |
IOSA and EASA
IOSA ISM Edition 18 added maturity assessment criteria to many ORG provisions, including hazard identification (ORG 3.1) and the other risk management sections. The questions an IOSA auditor now asks about maturity are close to the ones a State assessor will ask under 3.4.1.3. If you prepare for one, use the same evidence for the other. For the next edition, see our guide to IOSA ISM Edition 19.
EU operators already work under ORO.GEN.200, which requires a management system with safety risk management. Third country operators under EASA TCO or UK CAA TCO are assessed against ICAO standards, so the 3rd Edition changes will appear in your next TCO review through your State of the Operator.
Where to start
- Write or update the system description and list every interface with an owner.
- Add interface hazards to the hazard log, starting with ground handling, contracted maintenance and fuel.
- Rewrite the resources section of the SMS manual.
- Review your SPIs and objectives and pick one risk control to validate this quarter.
- Prepare a one-page evidence pack for the State SMS assessment.
How ASG can help
ASG’s SMS specialists include active IATA IOSA auditors. We run Annex 19 gap assessments for airlines with an evidence check for each element, prepare operators for IOSA, and support SMS implementation through ASG RADAR. Write to info@aerosupport360.com.
Related: ICAO Annex 19 Amendment 2: the 11 changes · IOSA audit preparation · EASA TCO authorisation · SMS development consulting
References
- ICAO Annex 19, Safety Management, 3rd Edition, November 2025 (Amendment 2): 3.3.2, 3.4.1.3, 3.4.1.4, 3.4.2.2, Chapter 4 and Appendix 2
- ICAO Doc 9859, Safety Management Manual
- IATA IOSA Standards Manual (ISM), Edition 18, Revision 1, ORG Sections 2–4
- Regulation (EU) No 965/2012, Annex III (Part-ORO), ORO.GEN.200
Frequently asked questions
No. International commercial air transport operators were already covered. The 3rd Edition changes what the SMS must contain and how your State will assess it.
When maintenance is not done by an approved maintenance organisation but under the operator’s own system, it falls inside the operator’s SMS (3.3.2.1 b), Note). Contracted AMOs run their own SMS, and the interface with them belongs in your hazard log.
The 3rd Edition asks for measurement and monitoring of safety performance, progress towards each objective and validation of risk controls. Targets are used where appropriate and can be supported by qualitative means.
A document that defines the scope of your SMS and shows your organisation, operations, contracted services and the interfaces between them (4.1.1 b)–c)). Guidance is in Doc 9859.
IOSA standards follow IATA’s own revision cycle. Their SMS provisions draw on Annex 19, so check each new ISM edition.
Subscribe to Global Aviation Safety Radar
Weekly aviation safety and compliance intelligence covering ICAO, IATA, EASA, and UK CAA developments — translated into practical implications for airlines, MROs, airports, ground handlers, and aviation leaders.