30 March 2026 · By Ferhan Bugay, Executive Director – Aero Support Group
Key Regulatory Update — November 2026 Deadline
With the applicability date of ICAO Annex 19, 3rd Edition set for 26 November 2026, aviation organisations have less than eight months to close the gap between current practice and the new international safety management standard. Adopted by the ICAO Council on 23 June 2025, this edition is the most substantive update to the global Safety Management System (SMS) framework in years — extending obligations to new categories of organisation, strengthening State Safety Programme provisions, and introducing formal safety intelligence requirements for the first time.
Understanding the Scope of ICAO Annex 19, 3rd Edition
Annex 19 — Safety Management has been the cornerstone of ICAO’s aviation safety governance architecture since it brought safety management provisions from multiple Annexes together into a single, cohesive framework. The 2nd Edition deepened the integration between State Safety Programmes and operator-level SMS. The 3rd Edition goes further, addressing three distinct domains that together shift the global safety management framework towards a more proactive, data-driven, and operationally inclusive architecture.
Enhanced requirements on how States design, resource, and demonstrate SSP effectiveness — moving beyond documentation to operational functionality and evidence-based oversight.
Formal SMS obligations extended to RPAS operators conducting international operations, their approved maintenance organisations, and certified heliports.
First formal ICAO SARPs provisions for structured safety intelligence development — supported by the new ICAO Safety Intelligence Manual (Doc 10159).
The first domain — enhanced SSP provisions — requires States to demonstrate that their national safety oversight frameworks are operationally functional, not simply documented in policy. Hazard identification, safety risk management, and safety performance monitoring must be embedded into the oversight lifecycle and actively influencing regulatory decision-making. For operators working across multiple jurisdictions, this shift has direct operational consequences: as States align their SSPs with the 3rd Edition standard, audit methodologies, safety data-sharing expectations, and the criteria for demonstrating SMS effectiveness will evolve accordingly.
The extension of SMS obligations to RPAS operators and certified heliports reflects ICAO’s intent to apply consistent safety governance principles across the full operational spectrum as the industry evolves. Approved maintenance organisations providing services to internationally operating RPAS operators come within formal SMS scope for the first time under this edition.
The third domain — safety intelligence — is the most structurally ambitious. For the first time, Annex 19 introduces formal provisions requiring the development of safety intelligence to support aviation decision-making. This moves the framework beyond reactive reporting towards structured analysis of safety data, identification of emerging risks, and the generation of actionable insight at both the organisational and State level.
Why Safety Intelligence Marks a Genuine Shift in Regulatory Expectations
The first edition of Doc 10159 provides structured guidance on the collection, processing, analysis, and application of safety data and safety information. It directly supports the safety intelligence provisions introduced in Chapter 5 of Annex 19, 3rd Edition, and is available through the ICAO eLibrary.
Safety intelligence is a concept that many mature aviation organisations have embraced informally for years — tracking trends, cross-referencing occurrence data, and using safety performance indicators (SPIs) to anticipate risk rather than simply react to events. What the 3rd Edition does is formalise this expectation within the ICAO SARPs framework, which means it will progressively influence how States assess SMS effectiveness and how oversight methodologies evolve across the industry.
ICAO Doc 10159 outlines a structured process: data collection from multiple sources (occurrence reports, safety audits, operational monitoring, predictive indicators), followed by processing and analysis to identify patterns and system-level risk factors, culminating in intelligence products that inform management decisions at the appropriate organisational level. The distinction between information and intelligence is the core of this shift — interpreted, contextualised insight that links safety data directly to operational and regulatory decisions.
For organisations already operating mature Safety Management Systems — with functioning hazard logs, Safety Review Boards, and robust SPI monitoring — this is an evolution rather than a revolution. For organisations whose SMS is primarily documentation-focused, however, where safety meetings are periodic rather than decision-driving and where SPIs exist on paper without meaningfully influencing management behaviour, the 3rd Edition represents a genuine compliance gap requiring structural intervention, not cosmetic document updates.
Implications for Aviation Organisations: What Must Change
The practical implications of the 3rd Edition vary by organisation type, but several common threads run across all affected entities.
Airlines must review their SMS frameworks against the enhanced SSP expectations of their flag States and of every State where they operate. Airlines preparing for or maintaining IOSA registration should factor 3rd Edition alignment into their current compliance programmes, as IATA’s ISARPs are expected to reflect the updated standard in coming cycles. As host States align their oversight systems, the regulatory interface — audit methodologies, evidence expectations, SMS effectiveness criteria — will shift. Cross-border operators need to track these changes across multiple competent authority environments.
MROs already subject to SMS obligations must assess whether their frameworks meet the strengthened expectations of the 3rd Edition — particularly around safety intelligence and proactive risk identification. Those providing services to internationally operating RPAS operators will, for the first time, come within formal SMS scope under the Annex 19 framework. Organisations operating under EASA TCO arrangements or Part-145 approvals should not wait for national transposition before beginning gap analysis.
Ground handling organisations with ISAGO registration or safety management obligations under contract with airlines will need to review whether their safety management frameworks reflect the enhanced standards expected by airlines now aligning with the 3rd Edition. As ISAGO standards evolve, proactive SMS maturity assessment is essential for continued audit readiness.
The formal inclusion of certified heliports within the SMS scope is a direct new obligation under the 3rd Edition. For airports already maintaining SMS frameworks, this is an opportunity to review whether safety intelligence capabilities are genuinely embedded in operational decision-making or remain largely administrative.
CAAs face the most complex challenge: simultaneously updating their own SSPs and oversight tools to reflect 3rd Edition provisions while guiding and auditing the industry through the transition. The degree to which States actively use operator safety data to inform national risk profiles and oversight priorities will come under increasing scrutiny in ICAO USOAP assessments.
What Aviation Organisations Should Do Now — A Structured Action Plan
With November 2026 as the applicability deadline, the required actions are structured and time-bound. A credible preparation programme must go beyond policy review and demonstrate operational readiness.
Go beyond checklist comparison. Assess whether the SMS framework is operationally effective, not just documented. Focus on safety intelligence capabilities: is there a defined process for converting safety data into actionable intelligence? Are SPIs genuinely driving management decisions? Is the link between hazard identification, risk assessment, and corrective action operationally traceable and auditable?
Safety Management Manuals, safety policies, SPI frameworks, and Safety Review Board terms of reference must be reviewed and revised against the new provisions. Revisions need to be traceable to both the ICAO standard and any national regulatory transposition documents issued by the competent authority.
For many organisations, this is the most significant structural gap. Building a genuine safety intelligence function — as outlined in ICAO Doc 10159 — requires defined data aggregation processes, trained analytical personnel, governance structures connecting intelligence output to management decisions, and documented evidence that intelligence products influence risk controls and safety priorities.
National aviation authorities are at different stages of transposing the 3rd Edition into domestic frameworks. Proactive engagement — understanding how the regulator interprets the new provisions, what evidence will be expected during safety oversight activities, and what transitional arrangements apply — is strategically important, particularly for operators with multiple authority relationships including EASA TCO authorisation or UK CAA TCO approval.
The 3rd Edition reinforces the expectation that safety management is a governance responsibility at senior leadership level — not a technical function managed in isolation. The Accountable Manager’s role, Safety Review Board composition and cadence, and the escalation pathway from safety data to executive decision must all reflect the enhanced standard. Evidence of leadership engagement will be expected during regulatory oversight activities.
IOSA, ISAGO, EASA, and UK CAA: How the 3rd Edition Connects to Other Frameworks
ICAO Annex 19, 3rd Edition does not exist in isolation — it sits at the centre of a web of interconnected audit, certification, and regulatory frameworks that aviation organisations must manage simultaneously.
IATA’s IOSA programme and ISAGO programme draw directly on ICAO safety management standards. Future editions of IOSA Standards and Recommended Practices (ISARPs) and ISAGO Standards (IGSARPs) are expected to reflect 3rd Edition provisions — particularly the safety intelligence and proactive risk identification requirements. Organisations preparing for IOSA or ISAGO audits in 2026 and 2027 should factor 3rd Edition alignment into their readiness programmes now, not after the next audit cycle opens.
EASA’s regulatory framework, while operating within its own legal architecture, is closely informed by ICAO standards. The EASA European Plan for Aviation Safety (EPAS) 2026 confirms ongoing alignment with ICAO global safety priorities. Organisations operating under EASA Part-145 or Part-CAMO approvals should expect SMS effectiveness expectations at the EU level to continue converging with the enhanced ICAO framework over time.
Third country operators holding EASA TCO authorisation or UK CAA TCO approval operate under bilateral safety oversight frameworks that reference ICAO standards as the baseline. As EASA and the UK CAA progressively embed the expectations of the 3rd Edition into their assessment criteria, the quality and maturity of an operator’s SMS — including its safety intelligence capabilities — will become an increasingly visible part of the oversight picture.
For civil aviation authorities, the pressure is equally direct. ICAO USOAP assessments measure States against the SARPs framework, including Annex 19. As the 3rd Edition becomes applicable, USOAP protocol questions and Corrective Action Plans will increasingly reflect the enhanced SSP and safety intelligence provisions. States that have not yet initiated their 3rd Edition alignment programmes face compounding risk both in their USOAP scores and in the confidence their national industry has in regulatory leadership.
Support Your ICAO Annex 19, 3rd Edition Preparation with Aero Support Group
Aero Support Group (ASG) provides specialist aviation consulting support across the full spectrum of safety management and regulatory compliance — from gap analysis and SMS development to audit preparation, corrective action planning, and regulatory implementation. Our team supports airlines, maintenance organisations, ground handlers, airports, and civil aviation authorities in aligning with ICAO, IATA, and EASA expectations.
As ICAO Annex 19, 3rd Edition approaches its November 2026 applicability date, ASG is working with aviation organisations globally to conduct structured gap analyses, develop safety intelligence frameworks, revise SMS documentation, and prepare evidence-based compliance programmes that meet both the letter and the intent of the updated standard.
Frequently Asked Questions
Aviation safety and regulatory compliance consultant with extensive international experience supporting airlines, MROs, ground handlers, and civil aviation authorities across ICAO, IATA, EASA, and national regulatory frameworks. Specialist in SMS, IOSA, ISAGO, EASA TCO, UK CAA TCO, and Part-145 consulting.
- › ICAO Safety Management — icao.int/safety-management — Annex 19, 3rd Edition (Adopted 23 Jun 2025; Applicable 26 Nov 2026)
- › ICAO Doc 10159 — Safety Intelligence Manual, 1st Edition
- › ICAO Safety Management SARPs
- › EASA European Plan for Aviation Safety (EPAS) 2026, 15th Edition
- › FAA — ICAO Annex 19 International Safety Management
- › SKYbrary — ICAO Annex 19, Safety Management