The safety management requirements, in plain terms.
Each section answers one question a safety manager or accountable manager actually asks, then says where the answer lives in AviSMS.
General information as of September 2026, not legal advice. The consolidated regulations on EUR-Lex and EASA's Easy Access Rules are the texts that count; verify with your competent authority.
01
What does Regulation (EU) No 376/2014 require of an operator?
An organisation must run a system through which its staff report occurrences, must pass each mandatory occurrence to its competent authority within 72 hours of becoming aware of it in an ECCAIRS-compatible format, must analyse what it collects and act on it, and must protect the people who report.
- Article 4 sets mandatory reporting: the occurrence types are listed in Implementing Regulation (EU) 2015/1018, and the organisation reports them to the authority as soon as possible and within 72 hours of becoming aware of them.
- Article 5 sets voluntary reporting for everything else that a reporter considers a hazard.
- Article 7 requires reports to carry the data fields the authority needs, in a format compatible with ECCAIRS and the ADREP taxonomy, so they can be loaded into the European Central Repository.
- Article 13 requires the organisation to analyse each occurrence, decide the safety action, report the preliminary results and the action to the authority within 30 days, and the final results within three months.
- Article 16 protects the reporter: identity is recorded only where necessary, and no prejudice may follow a report except in cases of wilful misconduct or gross negligence. Each organisation adopts internal rules that implement Just Culture.
02
What does ORO.GEN.200 require an AOC holder's management system to contain?
Six things, each of which has to exist and be documented: clear lines of responsibility and accountability including the accountable manager's direct accountability for safety; a safety policy; hazard identification with evaluation and management of the associated risks, including verifying that mitigations work; personnel kept trained and competent; documentation of all key management-system processes; and a compliance monitoring function. The whole thing must be proportionate to the operator's size and the complexity of its activities.
| ORO.GEN.200(a) | Requirement | Module |
|---|---|---|
| (1) | Lines of responsibility and accountability; the accountable manager's direct accountability for safety | Settings: organisation profile, Accountable Manager history |
| (2) | A safety policy | Safety documentation: the signed policy statement |
| (3) | Hazard identification, risk evaluation and management, verification of mitigations | Risk register, occurrence reporting, dashboard SPIs |
| (4) | Personnel trained and competent for their tasks | Safety promotion: training records with expiry |
| (5) | Documentation of key management-system processes | Safety documentation: controlled documents with versions |
| (6) | A compliance monitoring function | Audits and findings: checklists, findings, deadlines |
03
Does an approved training organisation need a safety management system?
Yes. ORA.GEN.200 in Regulation (EU) No 1178/2011 requires an approved training organisation to run a management system with the same six components as an operator's under ORO.GEN.200, proportionate to its size and the complexity of its training. Declared training organisations under Part-DTO are a different regime and are not subject to ORA.GEN.200.
04
What does ICAO Annex 19 add to the EU rules?
The framework the EU rules are built on. Annex 19 defines a safety management system as four components with twelve elements: safety policy and objectives; safety risk management; safety assurance; and safety promotion. ICAO Doc 9859, the Safety Management Manual, supplies the working methods — including the likelihood-against-severity risk matrix that most operators use.
| Annex 19 component | Elements | Module |
|---|---|---|
| Safety policy and objectives | Management commitment; accountabilities; key safety personnel; emergency response planning; SMS documentation | Settings, safety documentation |
| Safety risk management | Hazard identification; safety risk assessment and mitigation | Occurrence reporting, risk register |
| Safety assurance | Safety performance monitoring and measurement; management of change; continuous improvement | Dashboard SPIs, trends, audits and findings |
| Safety promotion | Training and education; safety communication | Safety promotion |
05
What is ERCS, the European Risk Classification Scheme?
ERCS, established by Delegated Regulation (EU) 2020/2034 under Article 7 of Regulation (EU) No 376/2014, gives an occurrence a risk score from two judgements: the severity of the most probable accident it could have led to, graded A to E within a key risk area, and how much of the defence remained, assessed barrier by barrier. Competent authorities use it to classify every report they receive; an organisation that classifies its own occurrences the same way speaks the authority's language.
06
How does a 5×5 risk matrix work?
A hazard is scored on two five-point scales — likelihood, from extremely improbable to frequent, and severity, from negligible to catastrophic — and the two are multiplied. The score falls into one of three regions: acceptable, tolerable with mitigation, or intolerable. Doc 9859 gives the shape; the organisation sets the thresholds. AviSMS defaults to 8 and 15, so a score of 15 or more is intolerable and escalated to the Accountable Manager.
07
What are Level 1 and Level 2 findings?
The authority's classification, in ARO.GEN.350, for what it finds during oversight: a Level 1 finding is a significant non-compliance that lowers safety or seriously hazards flight safety and demands immediate action; a Level 2 finding is any other non-compliance, for which the authority sets a corrective-action period of up to three months. Internal compliance monitoring borrows the same language. AviSMS defaults to 30 days for Level 1, 90 for Level 2 and 180 for observations; each is configurable.
08
What are ECCAIRS 2 and E5X?
ECCAIRS 2 is the European reporting platform, operated by EASA, through which organisations and authorities file and exchange occurrence reports, and which feeds the European Central Repository. E5X is its exchange file format: a package that carries the occurrence in the ADREP taxonomy, so that a report produced in one system can be loaded into another without retyping.
09
What is the Accountable Manager responsible for?
Under ORO.GEN.210(a) the operator appoints an accountable manager with the corporate authority to ensure that all activities can be financed and carried out to the applicable requirements, and who is responsible for establishing and maintaining an effective management system. ORO.GEN.200(a)(1) adds direct accountability for safety. A change of accountable manager is a change to the certificate that the authority must be told about.
General information as of September 2026, not legal advice. The consolidated regulations on EUR-Lex and EASA's Easy Access Rules are the texts that count; verify with your competent authority.
Run it the way the regulation reads.
The defaults in AviSMS are the ones above. Change any of them in Settings when your authority or your manual says otherwise.