AMC & GM to Part-ATM/ANS.OR

European Aviation Safety Agency

Acceptable Means of Compliance (AMC) and Guidance Material (GM) to Part-ATM/ANS.OR Common requirements for service providers

Initial Issue 8 March 2017

Annex III to ED Decision 2017/001/R

SUBPART A — GENERAL REQUIREMENTS (ATM/ANS.OR.A)

GM1 ATM/ANS.OR.A.001 Scope

DEFINITIONS AND SCOPE IN RELATION TO SERVICE PROVIDERS (a) To recognise which of the annexes applies to which service provider, it is necessary to understand how services are defined. These definitions have determined the structure and the content of Annexes III to XIII. (b) Article 3(q) of Regulation (EC) No 216/2008 defines ATM/ANS as ‘the air traffic management functions as defined in Article 2(10) of Regulation (EC) No 549/2004, air navigation services defined in Article 2(4) of that Regulation, and services consisting in the origination and processing of data and formatting and delivering data to general air traffic for the purpose of safety-critical air navigation’. (c) It should, therefore, be noted that ATM/ANS include more services than ‘Air Traffic Management’ and ‘Air Navigation Services’ together. (d) In this Regulation, ‘services’ means those specified in Annex Vb(2) to Regulation (EC) No 216/2008. This Annex includes an additional service (airspace design) that is neither directly included in the definition of ATM/ANS nor in the definition of ‘Air Traffic Management’ or ‘Air Navigation Service’. (e) As already defined, ‘ATM network functions’ refers to functions performed by the Network Manager in accordance with Regulation (EU) No 677/2011 . (f) Figure 1 below provides a pictorial representation of the services and how they interrelate through the various definitions. (g) Figure 1 indicates both a further breakdown of ATS into air traffic control services (ATC), alerting services, air traffic advisory services, and flight information services and groupings of: (1) air traffic management (ATM): comprising ATS, ASM, and ATFM; (2) air navigation services (ANS): comprising ATS, CNS, MET, and AIS; and (3) airspace design (ASD) and data provision (DAT) and ATM network functions. (h) It is important to note that ATS is included in ATM and ANS.

Annex III to ED Decision 2017/001/R

air navigation services

air traffic management air traffic services ASM DAT

Figure 1: The scope of the services as specified in Annex Vb to Regulation (EC) No 216/2008 and, additionally, the other ATM network functions.

SERVICES (a) Annex III (Part-ATM/ANS.OR) applies to the service providers, as relevant, and contains the common requirements for the service providers. This Annex is broken down into four subparts: (1) Subpart A — General requirements (ATM/ANS.OR.A); (2) Subpart B — Management (ATM/ANS.OR.B); (3) Subpart C — Specific organisational requirements for service providers other than ATS providers (ATM/ANS.OR.C); and (4) Subpart D — Specific organisational requirements for ANS and ATFM providers and the Network Manager (ATM/ANS.OR.D). (b) Subpart D applies only to ANS and ATFM providers and the Network Manager (and not to ASM and DAT providers). (c) Thereafter, each specific requirement for various service providers is allocated to an annex (Annexes IV to XII) which contains specific requirements for that service provider. Table 1 below indicates which annexes are applicable to each service provided. (d) Annex XIII contains requirements for service providers regarding personnel training and competence assessment.

Annex III to ED Decision 2017/001/R AIR TRAFFIC SERVICES FOR FLIGHT TEST (a) When the flight tests have one of the following characteristics: (1) frequent changes in levels and headings, depending on the tests which are carried out with certain unpredictability; (2) unless necessary for the purpose of the flight tests, navigation in general (route/destination, etc.) is not the primary objective of these flights; (3) specific aircraft configurations sometimes resulting in reduced ability to manoeuvre; (4) technical constraints, including airborne and ground testing facilities; (5) airborne equipment is not proven to be up to the required certification level; and (6) the planning for conducting flight tests can be of a very ad hoc nature giving little timing for carrying out strategy or pre-tactical air traffic flow management. (e.g. the need to test under specific weather conditions which would require flexibility for allocation of slots for these flight tests), then the air traffic services provider providing services to this type of flight testing may need a specific privilege within the certificate issued by the competent authority because of the specificities of the air traffic services to be provided to this type of operations and because of the need to ensure safe operations in the airspace in which flight tests are being conducted. (b) Given the characteristics in (a), flight tests can be made in cohabitation with other airspace users in controlled or non-controlled airspace, and sometimes in temporarily reserved areas when necessary.

Annex III to ED Decision 2017/001/R

Annex III Annex Annex Annex Annex Annex Annex Annex Annex Annex Annex IV V VI VII VIII IX X XI XII XIII (Part-ATM/ANS.OR) (Part- (Part- (Part- (Part- (Part- (Part- (Part- (Part- (Part- (Part- ATS) MET) AIS) DAT) CNS) ATFM) ASM) ASD) NM) PERS) Subpart Subpart Subpart Subpart A B C D Air traffic services X X X X (see Note 1) Meteorological services X X X X X Aeronautical information X X X X X services Data services X X X X Communication, X navigation and X X X X surveillance service Air traffic flow X X X X X management service Airspace management X X X X service Airspace design service X X X tbd* Network Manager X X X X X service providers X (see Note 2) Table 1: Applicability of annexes to service providers

Annex III to ED Decision 2017/001/R

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.A.005 Application for a service provider certificate

EXPOSITION — DAT PROVIDERS (a) The DAT provider should submit to the competent authority an exposition providing the following information: (1) a statement signed by the accountable manager confirming that the exposition and any associated manuals which define the organisation’s compliance with the requirements will be complied with at all times; (2) the duties and responsibilities of the manager(s) as required by ATM/ANS.OR.B.020 including matters on which they may deal directly with the competent authority on behalf of the organisation; (3) an organisational chart showing lines of responsibility and accountability throughout the DAT provider, including a direct accountability of the accountable manager as required by ATM/ANS.OR.B.005(a)(1); (4) a list of attesting staff as referred to in DAT.TR.100(b); (5) a general description of manpower resources; (6) a general description of the facilities of the DAT provider; (7) a general description of the activities for which the DAT provider’s certificate is requested; (8) the procedure for the notification of organisational changes to the competent authority; (9) the amendment procedure for the exposition; (10) a description of the management system and the procedures as required by DAT.OR.110; and (11) a list of those contracted organisations referred to in ATM/ANS.OR.B.015(b). (b) The exposition should be amended as necessary to remain an up-to-date description of the organisation, and copies of any amendments should be supplied to the competent authority.

GM1 to AMC1 ATM/ANS.OR.A.005 Application for a service provider certificate

EXPOSITION — DAT PROVIDERS The exposition should contain the following table of contents:

1. General Table of contents, document revision history, abbreviations, and terms.

2. Introduction Purpose, scope, standards declaration, and reference documents.

3. Company description and policy Description of the company, products and services, quality policy and objectives, customer requirements.

4. Terms of approval Scope of work, notification of changes to the terms of approval, control of documents and records.

Annex III to ED Decision 2017/001/R

5. Management/resources responsibilities Management team and personnel, organisation charts, duties and responsibilities of personnel. Management review, human resources, competence, awareness, and training.

6. Production processes Data production procedures, arrangements with suppliers, users/customers and other DAT providers, data receiving inspection and testing, data release, data distribution process, data products identification and quality checks, tailored data, data error reporting.

7. Management system Introduction, document control, quality assurance, internal system audits, standards compliance plan audits, methods of improvement, occurrence management and reporting, record-keeping.

8. Appendix 1 — List of relevant personnel

GM2 to AMC1 ATM/ANS.OR.A.005 Application for a service provider certificate

EXPOSITION — DAT PROVIDERS A means to develop the exposition may be by cross-referring to the procedures of the quality manual, which are needed to demonstrate compliance with these requirements.

GM1 ATM/ANS.OR.A.010 Application for a limited certificate

GENERAL The relationship between the type of service provision, criteria to be complied with and the applicable rules are indicated in Table 2 below.

Type of service Type of approval Criteria to be Applicable Rules complied with

Air traffic service Limited Certificate ATM/ANS.OR.A.010(a) ATM/ANS.OR.B.001 providers ATM/ANS.OR.B.005 ATM/ANS.OR.B.020 ATM/ANS.OR.A.075 Annex IV Air navigation service Limited Certificate ATM/ANS.OR.A.010(b)(1) ATM/ANS.OR.B.001 providers ATM/ANS.OR.B.005 (other than the air ATM/ANS.OR.B.020 traffic services providers) ATM/ANS.OR.A.075 (gross annual turnover Annexes V, VI and VIII of EUR 1 000 000 depending upon service or less) provision

Annex III to ED Decision 2017/001/R

Air navigation service Limited Certificate ATM/ANS.OR.C.010(b)(2) ATM/ANS.OR.B.001 providers ATM/ANS.OR.B.005 (aerodrome flight ATM/ANS.OR.B.020 information services providers operating ATM/ANS.OR.A.075 regularly not more than Annex IV one working position at any aerodrome)

Table 2: Type of service provision, criteria to be complied with, and the applicable rules

GM1 ATM/ANS.OR.A.015(b)(1) Declaration by flight information services providers

MODEL TEMPLATE OF DECLARATION OF COMPLIANCE

DECLARATION OF COMPLIANCE FOR THE PROVISION OF FLIGHT INFORMATION SERVICES

in accordance with Commission Implementing Regulation (EU) 2017/373

Provider of flight information service

Name: Principal place of operation and, if any, registered office: Name and contact details of the accountable manager:

Flight Information Service

Starting date of provision of flight information services/applicability date of the change: Scope of flight information services: ⎕ Aerodrome flight information services (AFIS) ⎕ En-route flight information services (En-route FIS) List of alternative means of compliance with references to the AMCs they replace (to be attached to the declaration)

Statements

⎕ The management system documentation, including the operations manual, complies with the applicable requirements set out in Part-ATM/ANS.OR and Part-ATS. ⎕ The provision of flight information services will be carried out in accordance with the requirements of Regulation (EC) No 216/2008 and its implementing rules, as well as Regulations (EC) Nos 549/2004, 550/2004, 551/2004, and 552/2004 and their implementing rules, and the procedures and instructions specified in the operations manual. ⎕ All personnel are qualified, competent and trained in accordance with the applicable requirements. ⎕ (If applicable) The provider of flight information services has implemented and demonstrated conformance

Annex III to ED Decision 2017/001/R to an officially recognised industry standard. Reference of the standard: Certification body: Date of the last conformance audit: ⎕ Any change in the provision of flight information services that affects the information disclosed in this declaration will be notified to the competent authority. ⎕ The provider of flight information service confirms that the information disclosed in this declaration is correct.

Date, name, and signature of the accountable manager

AMC1 ATM/ANS.OR.A.035 Demonstration of compliance

EVIDENCE — DAT PROVIDERS The exposition as referred to in AMC1 ATM/ANS.OR.A.005 ‘Application for service provider certificate’ EXPOSITION — DAT PROVIDERS should be considered as one of the means to demonstrate compliance with the applicable requirements.

GM1 ATM/ANS.OR.A.035 Demonstration of compliance

GENERAL — DAT PROVIDERS In order to demonstrate compliance with the applicable requirements, the DAT provider should produce a compliance matrix/checklist detailing how its data production processes relate to EUROCAE ED-76A/RTCA DO- 200B ‘Standards for Processing Aeronautical Data’, dated June 2015. EUROCAE ED-76/RTCA DO-200A may be also used for the demonstration of compliance.

AMC1 ATM/ANS.OR.A.040 Changes — general

CHANGE OF THE OWNERSHIP AND/OR THE LOCATION A change of the service provider’s ownership and/or the location of its facilities should comply with ATM/ANS.OR.A.040(a)(2) and should not be subject to the procedure identified in ATM/ANS.AR.C.025(c).

AMC1 ATM/ANS.OR.A.040(b) Changes — general

PROCEDURE FOR CHANGES REQUIRING PRIOR APPROVAL For changes requiring prior approval, a procedure should define how the service provider should notify the competent authority and obtain an approval issued by that authority: (a) Notifications should be submitted before any such change is made in order to enable the competent authority to determine continued compliance with Regulation (EC) No 216/2008 and its implementing rules and also to amend, if necessary, the certificate and the related conditions attached to it. (b) Changes should only be implemented upon receipt of approval by the competent authority in accordance with the procedure established by that authority.

Annex III to ED Decision 2017/001/R (c) The service provider should operate under the conditions prescribed by the competent authority during such changes, as applicable.

AMC2 ATM/ANS.OR.A.040(b) Changes — general

PROCEDURE FOR CHANGES NOT REQUIRING PRIOR APPROVAL (a) For changes not requiring prior approval, the procedure should define how the service provider should notify and manage the change. (b) The service provider should inform the competent authority of any changes to nominated persons specified in ATM/ANS.OR.B.020(b) and ATS.OR.200(1)(iii), as applicable.

GM1 ATM/ANS.OR.A.040(b) Changes — general

PROCEDURE FOR CHANGES NOT REQUIRING PRIOR APPROVAL The procedure agreed by the service provider and the competent authority may also include the process for the reaction by the service provider to an unplanned change that may arise with the need for urgent action that would normally require prior approval of the competent authority. This is the case in which the service provider responds immediately to a safety problem as required in ATM/ANS.OR.A.060 or when an emergency situation arises in which the service provider has to take immediate action to ensure the safety of the services.

AMC1 ATM/ANS.OR.A.045(a) Changes to a functional system

NOTIFICATION The notification of a change should not be considered complete until the following information is provided: (a) Name of the organisation notifying the change; (b) Unique identifier of change; (c) Version number of notification; (d) Title of the change; (e) Date of the submission of the original of this change notification; (f) Scheduled date of entry into service (even if only approximate); (g) Details of the change and its impact; (h) The list of the service providers and other aviation undertakings that are affected by the change as identified in ATM/ANS.OR.A.045(a)(3); (i) Entity in charge of the assurance case; and (j) Identity of a point of contact for communications with the competent authority.

GM1 ATM/ANS.OR.A.045(a) Changes to a functional system

NOTIFICATION (a) A change should be notified as soon as the data defined in AMC1 ATM/ANS.OR.A.045(a) is available. The decision to review a change by the competent authority will be based, in most circumstances, on the notification data. Exceptions to this are cases where the competent authority is not familiar with the type of change or the complexity of the change requires a more thorough consideration. (b) Early and accurate notification facilitates the interactions between the provider and the competent authority and, thus, maximises the likelihood of introducing a change into service in due time and

Annex III to ED Decision 2017/001/R according to the service provider’s initial schedule when the competent authority has decided to review an assurance case. Therefore, it is advisable that the change description identified in AMC1 ATM/ANS.OR.A.045(a) is completed as soon as possible and contains the following data: (1) Purpose of the change; (2) Reasons for the change; (3) Place of implementation; (4) New/modified functions/services brought about by the change; (5) High-level identification of the constituents of the functional system being changed, and what is modified in their functionality; (6) Consequence of the change, i.e. the harmful effects of the hazards associated with the change — see (f) below and also the definition of ‘risk’ in Annex I (80). (c) The information provided in (b) may expedite the decision whether to review or not the proposed change, because it will allow the competent authority to gain complete knowledge of the change and, consequently, reduces the need for additional information. However, lack of some of this data should not delay the service provider’s submission of the notification if to do so is likely to impede the introduction of the change. It should be noted that early interaction with its competent authority may help to complete the missing data. (d) The service provider should take into account that an early, clear and accurate change notification will assist the competent authority in making the decision to review or not the change and may prevent any inconvenience such as: (1) the competent authority having to ask for more information about the change in order to make its decision as required in ATM/ANS.OR.A.045(a)(2); (2) the competent authority deciding to review a change unnecessarily because the notification is not clear enough; or (3) the delay in the competent authority deciding whether to review a change, caused by the lack of information, having an impact on the proposed date of entry into service. (e) It is recognised that the understanding of the change will improve as the change process progresses and the interaction between the competent authority and the service provider strengthens. The service provider should notify the competent authority when the information provided in the previous notification is no longer valid or when the information previously missing becomes available. When additional information — other than the data specified in AMC1 ATM/ANS.OR.A.045(a) — is supplied at the competent authority’s request, then no update of the notification is required. (f) For air traffic services (ATS) providers, the consequences of the change specified in (b)(6), should be expressed in terms of the harmful effects of the change, i.e. the effects of the hazards associated with safety risks. These could be the result of a preliminary safety assessment, if available, or an early hazard analysis that concentrates on the service level effects. For service providers other than air traffic services providers, the consequences should be expressed in terms of what aspects of the performance of the service are impacted by the change. (g) The point of contact, as required in point (j) in AMC1 ATM/ANS.OR.A.045(a), provides a focal point for the competent authority to contact when seeking complementary information about the change when

Annex III to ED Decision 2017/001/R required. The aim is to improve communications between the provider and the competent authority about the change. (h) All notified changes should be unambiguously identified. The service provider and its competent authority should agree on a means of referencing so as to associate a unique identifier to a given notified change. (i) For routine changes, the notification to the competent authority may be done in a simpler manner, e.g. using forms less detailed than those specified in AMC1 ATM/ANS.OR.A.045(a) or notifying these changes collectively after being implemented at regular periods of times agreed between the provider and the competent authority. A service provider and its competent authority should coordinate so as to reach a common agreement on these types of changes that may not be reviewed by the competent authority. The list of such changes should be documented and formalised. The formalised agreement becomes part of the change management procedures identified in ATM/ANS.OR.B.010. Consequently, the list will be reviewed by the competent authority as part of the audits it performs that are described in ATM/ANS.AR.C.010(a). The relevant audit activity is detailed in AMC1 ATM/ANS.AR.C.010(a)(a)(2).

AMC1 ATM/ANS.OR.A.045(a)(3) Changes to a functional system

NOTIFICATION TO USERS OF THE SERVICE Having notified a change, the service provider should: (a) individually inform all known service providers potentially affected by the notified change; and (b) inform all aviation undertakings potentially affected by the change either individually or via a representative body of aviation undertakings or by publishing details of the planned change in a dedicated publication of the service provider or aeronautical information publications such as an aeronautical information circular (AIC).

GM1 ATM/ANS.OR.A.045(a)(3) Changes to a functional system

DEDICATED PUBLICATION FOR PROPOSED CHANGES The final users of services potentially affected by a change to a functional system may not be known by the service provider proposing the change. However, this should not prevent the service provider from using other means for notification than direct communication with the interested parties. In that case, the changes may be published in a dedicated website where the users of the service can periodically check for current proposed changes to the functional system that may affect them.

AMC1 ATM/ANS.OR.A.045(b) Changes to a functional system

MODIFICATION OF A NOTIFIED CHANGE (a) The service provider should inform the competent authority that was initially notified about any update in the notification data when the information provided in a previous notification about the same change is no longer valid or when information previously missing becomes available. The other service providers and aviation undertakings should also be informed, when they are affected by the new data. (b) The cancellation of a previously notified change should be considered as a modification of a notified change. Therefore, the service provider should inform about this update the competent authority, and inform other service providers and aviation undertakings that were initially informed about the change.

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.A.045(c); (d) Changes to a functional system

ENTRY INTO OPERATIONAL SERVICE OF A CHANGE SELECTED FOR REVIEW The service provider should not start the implementation of any part of the change that has the potential to affect the safety of the services currently being provided until a valid safety (support) assessment for that part of the change exists and, if the change is subject to competent authority review, it has been approved by the competent authority.

GM1 ATM/ANS.OR.A.045(c); (d) Changes to a functional system

TRANSITION INTO SERVICE (a) No matter whether the competent authority has decided to review the notified change or not, the service provider should not start the implementation of any part of the change that has the potential to affect the safety of any of the services it provides, e.g. the functions performed or the performance of the services, until it has produced a valid argument in accordance with ATS.OR.205(a)(2) or/and ATM/ANS.OR.C.005(a)(2), as appropriate. (b) Implementation of the change, which means the creation and installation of the items to be used in the changed operational system may or may not affect the performance of the current services offered by the service provider. For example, much of the implementation of equipment and procedures can be performed ‘off line’, i.e. in development facilities that do not interact with the operational services and installation may be started, provided the items are not connected to the operational system and their presence in the operational environment does not affect the current services. However, these items must not be introduced into the operational system, i.e. they must not affect the behaviour of any operational service, until a valid assurance case exists and, if the change is subject to competent authority review, before the competent authority has approved the change. (c) The installation of an artefact may have an impact on services other than the service being changed. This can happen where the installation involves disrupting these other services, e.g. aerodrome operations may be disrupted because runways or taxiways are being used by constructor’s vehicles or are being interfered with. In this case, the scope of the change includes these other services (please refer to ATM/ANS.OR.C.005(a)(1)(iii) & (iv) or ATS.OR.205(a)(1)(iii) & (iv), as appropriate) and the assessment of the change includes the effects installation may have on them, including where the installation does not go according to plan.

AMC1 ATM/ANS.OR.A.045(e) Changes to the functional system

CHANGES AFFECTING MULTIPLE SERVICE PROVIDERS — OVERARCHING SAFETY ARGUMENT A change as defined in ATM/ANS.OR.A.045(e) may involve more than one service provider changing their functional systems. In this case, the change will consist of a set of changes to different ATM/ANS functional systems or their context. However, no matter how many individual changes to service providers’ functional systems are part of the change, they should be coordinated. An overarching safety argument, coherent with the arguments of the individual changes, that claims the complete change is safe should be provided.

Annex III to ED Decision 2017/001/R

GM1 ATM/ANS.OR.A.045(e) Changes to the functional system

CHANGES AFFECTING MULTIPLE SERVICE PROVIDERS AND AVIATION UNDERTAKINGS — GENERAL (a) Any change proposed by a service provider as defined in ATM/ANS.OR.A.045(a) affects other service providers and/or aviation undertakings when: (1) the proposed change may alter the service delivered to other service providers and aviation undertakings as users of that service; or (2) the proposed change may alter the operational context in which the services of other service providers and aviation undertakings are delivered or in which the aviation undertakings are operating. (b) The changes referred to in ATM/ANS.OR.A.045(e) could be considered ‘multi-actor changes’ and are those changes that require coordination between the service provider(s) proposing the change and any service providers and aviation undertakings affected by the change(s) due to the presence of dependencies between the service providers that planned the change and other affected service providers and/or other aviation undertakings. This coordination is essential to ensure a correct safety (support) assessment when there are dependencies. (c) A single-actor change is one that is limited to those cases where a change to a service provider’s functional system alters neither the service nor the operational context of other service providers and aviation undertakings.

GM2 ATM/ANS.OR.A.045(e) Changes to the functional system

AFFECTED STAKEHOLDERS — SERVICE PROVIDERS AND AVIATION UNDERTAKINGS (a) ‘Other service providers’ mentioned in ATM/ANS.OR.A.045(e) refers to European service providers other than the service provider proposing the change, that are regulated in accordance with Regulation (EC) No 216/2008 and its implementing rules; (b) Aviation undertakings affected by the change included in ATM/ANS.OR.A.045(e) can be understood as the stakeholders and professional associations with dependencies with the changed service, and may include the following: (1) service providers that do not fall under the remit of Regulation (EC) No 216/2008 and its implementing rules, e.g. non-European service providers; (2) aerodrome operators; (3) aircraft operators; (4) airframe and equipment manufacturers; (5) maintenance organisations; (6) regulatory bodies, e.g. European Commission, EASA, national aviation authorities (NAAs); and (7) other bodies not regulated by Regulation (EC) No 216/2008 and its implementing rules, e.g. power suppliers or military authorities.

Annex III to ED Decision 2017/001/R

GM3 ATM/ANS.OR.A.045(e) Changes to the functional system

CHANGE AFFECTING MULTIPLE SERVICE PROVIDERS AND AVIATION UNDERTAKINGS — COORDINATION (a) ATM/ANS.OR.A.045(e) applies to all the affected service providers involved in the change, and, therefore, they should coordinate dependencies as well as shared assumptions and shared risk mitigations. They should only use the agreed and aligned assumptions and mitigations that are related to more than one service provider or aviation undertaking in their safety or safety support cases, as required by ATM/ANS.OR.A.045(f). (b) Assumptions and risk mitigations used during the assessment of the change that are not shared by the affected service providers, can be handled independently by each service provider, and do not need agreement. (c) This coordination means that the affected service providers: (1) have jointly identified the scope of their responsibilities with regard to the change, and in particular their safety responsibilities, e.g. what part of the change will be covered in whose safety (support) assessment case; (2) have jointly identified the dependencies; (3) have jointly identified the hazards associated with the change in the common context; (4) have mutually agreed on the assumptions for the change that jointly relate to them; and (5) have mutually agreed on the mitigations for risks that require joint implementation. (d) Service providers would need to achieve a common understanding about: (1) consequences in the shared operational context; and (2) chains of causes/consequences. (e) Service providers would jointly need to identify their dependencies to be able to assess the change to their functional systems. (f) Where necessary in relation to the dependences identified in accordance with GM1 ATM/ANS.OR.A.045(e)(1), the service providers may perform together: (1) identification of hazards/effects; (2) assessment of risks; (3) evaluation of risks; (4) planning and assessment of risk mitigations; and (5) verification. (g) The level of interaction and coordination between service providers and aviation undertakings will vary depending on the particular needs of the change at hand.

Annex III to ED Decision 2017/001/R

GM4 ATM/ANS.OR.A.045(e) Changes to a functional system

COORDINATION WITH AFFECTED AVIATION UNDERTAKINGS (a) The aviation undertakings are the entities, persons or organisations as defined in point 34 of Annex I to Regulation (EU) 2017/373 and thus, ATM/ANS.OR.A.045(e) does not apply to them. However, any service provider affected by a change should seek the participation of aviation undertakings when assumptions and risk mitigations used in the safety (support) assessment are shared with those aviation undertakings. (b) When the number of aviation undertakings affected by the change is large, the service providers may not need to involve every individual stakeholder. If a body can represent the views of a group of affected aviation undertakings, it may suffice to involve that representative body to obtain the supporting evidence to move forward with the assessment of the change.

GM1 ATM/ANS.OR.A.045(e)(2) Changes to a functional system

CHANGE AFFECTING MULTIPLE SERVICE PROVIDERS AND AVIATION UNDERTAKINGS — ASSUMPTIONS AND RISK MITIGATIONS In order to satisfy ATM/ANS.OR.A.045(e)(2), the affected service providers coordination will identify those assumptions and risk mitigations that relate to: (a) more than one service provider; (b) a service provider and one or more aviation undertakings; or (c) multiple service providers and aviation undertakings.

GM1 ATM/ANS.OR.A.045(f) Changes to a functional system

LACK OF COORDINATION (a) If an aviation undertaking decides not to cooperate, the service provider, who has identified dependencies with the aviation undertaking, in accordance with ATM/ANS.OR.A.045(e)(1), needs to consider the impact of having the assumptions and risk mitigations not agreed with that aviation undertaking. It should propose a way forward by doing one or more of the following: (1) making the assumptions themselves and providing evidence that supports them; (2) adding additional mitigating measures so that the change remains acceptably safe; (3) modifying the scope of the change, or even reconsidering and cancelling the change. (b) The service provider affected by a lack of cooperation with an aviation undertaking may wish to inform its competent authority about those aviation undertakings that are not participating and its form of nonparticipation, in order to seek the assistance of the competent authority in trying to persuade the aviation undertaking to participate.

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.A.055(b) Findings and corrective actions

GENERAL The corrective action plan defined by the service provider should address the effects of the non-conformity and its root cause.

AMC1 ATM/ANS.OR.A.055(c) Findings and corrective actions

CORRECTIVE ACTION IMPLEMENTATION PERIOD — DAT PROVIDERS In case of a Level 1 finding, the DAT provider should demonstrate corrective action to the satisfaction of the competent authority within a period of no more than 21 working days following receipt of written confirmation of the finding. At the end of this period and subject to the nature of the finding, the 21-workingday period may be extended and agreed by the competent authority when the safety issue is mitigated.

GM1 ATM/ANS.OR.A.055 Findings and corrective actions

GENERAL (a) Corrective action is the action taken to eliminate or mitigate the root cause(s) and prevent the recurrence of existing detected non-compliance or other undesirable condition or situation. (b) The proper determination of the root cause is crucial for defining effective corrective actions.

AMC1 ATM/ANS.OR.A.065 Occurrence reporting

REPORTING PROCEDURES The service provider should establish procedures to be used for reporting to the competent authority and any other organisation required which include: (a) description of the applicable requirements for reporting; (b) description of the reporting mechanism, including reporting forms, means and deadlines; (c) personnel responsible for reporting; and (d) description of mechanism and personnel responsibilities for identifying root causes, and the actions that may be needed to be taken to prevent similar occurrences in the future, as appropriate.

GM1 ATM/ANS.OR.A.065 Occurrence reporting

GENERAL The reporting to the organisations defined in the ATM/ANS.OR.A.065 does not affect the need to report to other organisations with which the service provider interfaces, and which might be involved in or be affected by the reported event (e.g. other service providers involved in an occurrence, aerodrome operators, etc.).

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.A.065(a) Occurrence reporting

GENERAL (a) The service provider should submit all reportable occurrences as defined in Regulation (EU) No 2015/1018 . (b) In addition to the reports required by (a), the service provider should report volcanic ash clouds, encountered by aircraft operators, for which it has become aware of.

GM1 ATM/ANS.OR.A.065(b) Occurrence reporting

SYSTEMS AND CONSTITUENTS (a) When determining which failures of systems and constituents are to be reported, a degree of practicality is required as it is not intended that every failure is reported. Only those that have or may have an impact on the safety of the provision of services are reported. (b) When nothing is defined in European Union or national legislation, the determination of the failures of systems and constituents that need to be reported is done by the service provider and needs to be approved by the competent authority. This determination can be done as a result of an assessment of the installations or changes to the systems and constituents. (c) The organisation responsible for the design of the systems and constituents may no longer exist or may no longer support the design. In this case, the service provider will have made arrangements to ensure that the safety of the systems and constituents can be assured by appropriate and practical means. In many cases, this means that the service provider has taken over the design responsibilities. (d) Within the application of Regulation (EC) No 552/2004, the organisation responsible for the design of the constituent will be the entity that signs the Declaration of Conformity or Suitability for use. For systems and constituents which existed before the applicability date of Regulation (EC) No 552/2004, the service provider should identify the responsible organisation, otherwise the service provider should make appropriate arrangements.

GM1 ATM/ANS.OR.A.070 Contingency plans

GENERAL The contingency plan may include the definition of the measures, the coordination with other actors (i.e. the State, the competent authorities, possibly the other service providers, the insurance companies, aerodrome operators, as applicable) and alternative services needed in case of degradation or interruption of the services, while the applicability of emergency response planning may be attributable to or affected by an aviation safety occurrence.

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.A.075(a) Open and transparent provision of services

GENERAL — PROVIDERS OF AIR NAVIGATION SERVICES AND AIR TRAFFIC FLOW MANAGEMENT Providers of air navigation services and air traffic flow management should consult with the users of their services at least once a year.

SUBPART B — MANAGEMENT (ATM/ANS.OR.B)

GM1 ATM/ANS.OR.B.001 Technical and operational competence and capability

TECHNICAL AND OPERATIONAL CAPACITY Technical and operational capacity should include a sufficient number of personnel to perform its tasks and discharge its responsibilities.

GM1 ATM/ANS.OR.B.005 Management system

DEFINITIONS AND CONCEPT OF MANAGEMENT SYSTEM (a) ISO 9000:2005 defines a management system as a 'set of interrelated or interacting elements to establish policy and objectives and to achieve those objectives'. (b) Another available definition of management system is the following: ‘The structure, processes and resources needed to establish an organisation's policy and objectives and to achieve those objectives.' (c) Traditionally, separate management systems were developed to address issues such as safety, quality, environment, health and safety, finance, human resources, information technology and data protection. However, it is foreseen that more and more the services providers will establish integrated management systems following the harmonised set of requirements in this Regulation. (d) The Regulation does not require that the different management systems are integrated but it facilitates their integration.

GM2 ATM/ANS.OR.B.005 Management system

RELATIONSHIP BETWEEN THE TYPE OF SERVICE AND SAFETY MANAGEMENT — QUALITY MANAGEMENT (a) All service providers are required to establish and maintain a management system. However, only an air traffic services provider can have managerial control over functions directly affecting the safety of the flight (e.g. the ATCO to separate aircraft from each other). Hence, the management system requirements in Annex III, which apply to all service providers, are more broadly associated with the quality of the service rather than the safety of the service. Annex IV (Part-ATS) has specific safety management requirements for the provision of air traffic services. Therefore, only the air traffic services provider (that providing air traffic control, alerting service, air traffic advisory service or flight information service) is required to have a safety management system and undertake safety assessment of changes to the functional system. (b) Service providers other than the air traffic services provider can still affect the safety of the flight through functions or services they provide, but this will always be influenced by the way in which the air traffic services provider or airspace user are using those functions or services. Therefore, service providers other than air traffic services providers have a management system which manages the performance of service (rather than the safe use of their services for flight navigation and the control which is beyond the managerial control of the service provider). This performance of the service refers

Annex III to ED Decision 2017/001/R to such properties of the service provided such as accuracy, reliability, integrity, availability, timeliness, etc. (c) It is quite likely that air traffic services providers have contractual arrangements in place with other service providers, whose services they use, specifying the required performance and requiring the service provider to inform, in a timely manner, the air traffic services provider of any impact on the performance of services supplied. (d) When the service provider other than an air traffic services provider provides services or functions directly to a flight (e.g. MET) without involving air traffic services, then the safe use of those services is the responsibility of the users of those services. (e) When the air traffic services provider also provides other services, it may choose to combine the necessary performance and safety management activities into an integrated management system covering all services.

AMC1 ATM/ANS.OR.B.005(a) Management system

GENERAL An ISO 9001 certificate, issued by an appropriately accredited organisation, addressing the quality management elements required in this Subpart should be considered a sufficient means of compliance for the service provider. In this case, the service provider should accept the disclosure of the documentation related to the certification to the competent authority upon the latter’s request.

AMC2 ATM/ANS.OR.B.005(a) Management system

GENERAL — TYPE 1 DAT PROVIDERS An ISO 9001 or EN 9100 certificate issued by an appropriately accredited organisation addressing the quality management elements required in the respective Subparts should be considered a sufficient means of compliance for the Type 1 DAT provider. In this case, the Type 1 DAT provider should accept the disclosure of the documentation related to the certification to the competent authority upon its request.

AMC3 ATM/ANS.OR.B.005(a) Management system

GENERAL — TYPE 2 DAT PROVIDERS An EN 9100 certificate issued by an appropriately accredited organisation addressing the quality management elements required in the respective Subparts should be considered as a sufficient means of compliance for the Type 2 DAT provider. In this case, the Type 2 DAT provider should accept the disclosure of the documentation related to the certification to the competent authority upon its request.

AMC4 ATM/ANS.OR.B.005(a) Management system

GENERAL — NON-COMPLEX SERVICE PROVIDERS (a) The policy should include a commitment to improve towards the highest standards, comply with all the applicable legal requirements, meet all the applicable standards, consider the best practices, and provide the appropriate resources. (b) The compliance monitoring task may be exercised by the accountable manager, provided that he or she has demonstrated having the related competence as defined in point (b)(4) of GM1 ATM/ANS.OR.B.005(c).

Annex III to ED Decision 2017/001/R (c) Risk management may be performed using hazard checklists or similar risk management tools or processes, which are integrated into the activities of the service provider. (d) A service provider should manage associated risks related to changes, as applicable. Management of changes should be a documented process to identify external and internal changes. (e) A service provider should identify persons who fulfil the role of managers and who are responsible with regard to safety, quality and security of its services, as applicable. These persons may be accountable managers or individuals with an operational role in the service provider.

GM1 to AMC1 ATM/ANS.OR.B.005(a) Management system

GENERAL ISO 9001 Certificate(s) covers (cover) the quality management elements of the management system. Other elements required by this Regulation in reference to the management system that are not covered by the ISO 9001 certificate issued by an appropriately accredited organisation should be subject to oversight by the competent authority.

GM2 to AMC1 ATM/ANS.OR.B.005(a) Management system

GENERAL — FOR ATS PROVIDERS An ISO 9001 certificate may not give the presumption of compliance with the provisions of ATS.OR.200 ‘Safety management system’.

GM1 to AMC2 ATM/ANS.OR.B.005(a) Management system

GENERAL — TYPE 1 DAT PROVIDERS ISO 9001/EN 9100 Certificate(s) covers (cover) the quality management elements of the management system. Other elements required by this Regulation in reference to the management system that are not covered by the ISO 9001/EN 9100 certificate issued by an appropriately accredited organisation should be subject to oversight by the competent authority.

GM1 to AMC3 ATM/ANS.OR.B.005(a) Management system

EN 9100 CERTIFICATE — TYPE 2 DAT PROVIDERS EN 9100 Certificate(s) covers (cover) the quality management elements of the management system. Other elements required by this Regulation in reference to the management system that are not covered by EN 9100 certificate issued by an appropriately accredited organisation should be subject to oversight by the competent authority.

GM1 ATM/ANS.OR.B.005(a)(1) Management system

RESPONSIBILITIES AND ACCOUNTABILITIES (a) Senior management should ensure that responsibilities and accountabilities are defined and communicated within the service provider and documented within the management system. In the context of this rule, ‘responsibilities’ refers to obligations that can be delegated and ‘accountabilities’ refers to obligations that cannot be delegated. (b) The appointment of an accountable manager who is given the required authorities and responsibilities, requires that the individual has the necessary attributes to fulfil the role. The accountable manager may have more than one function in the organisation. Nonetheless, the accountable manager’s role is to

Annex III to ED Decision 2017/001/R ensure that the management system is properly implemented and maintained through the allocation of resources and tasks.

AMC1 ATM/ANS.OR.B.005(a)(2) Management system

POLICY (a) The policy should: (1) be signed by the accountable manager; (2) reflect organisational commitments regarding performance of its services and safety, where applicable, and its proactive and systematic management; (3) include reporting principles; and (4) include a commitment to: (i) improve towards the highest performance standards so as to support the achievement of the highest level of safety; (ii) comply with all applicable legislation and requirements, meet all applicable standards and consider best practices; (iii) continually improve the effectiveness of the management system; (iv) provide appropriate resources; (v) enforce the performance of the service required to support the achievement of the highest level of safety in the airspace where the service is provided as one primary responsibility of all managers; and (vi) that the purpose of reporting is improvement and not to apportion blame to individuals. (b) Senior management should: (1) ensure that the policy: (i) is appropriate to the purpose of service providers; (ii) provides a framework for establishing and reviewing objectives in relation to the provision of the service; (iii) is communicated and understood within the service provider; and (iv) is reviewed for continuing suitability; (2) continually promote the policy to all personnel and demonstrate their commitment to it; (3) provide necessary and appropriate human and financial resources for its implementation; and (4) establish objectives in relation to the provision of the services and performance standards.

GM1 ATM/ANS.OR.B.005(a)(2) Management system

POLICY FOR AIR TRAFFIC SERVICES PROVIDERS VS POLICY FOR ALL OTHER SERVICE PROVIDERS If a service provider does not undertake the provision of air traffic services, then the policy will be recognisable more as a quality policy that is concerned with the performance of the service and conformance to the service provision requirements supporting the achievement of the highest level of safety in the airspace where the

Annex III to ED Decision 2017/001/R service is provided. Should the service provider undertake the provision of air traffic services, then ATS.OR.200 also applies and the policy will need to be expanded to include both the safety and the quality of the service.

GM2 ATM/ANS.OR.B.005 (a)(2) Management system

POLICY — NON-COMPLEX SERVICE PROVIDERS The policy is the means whereby the service provider states its intention to maintain and, where practicable, improve performance levels in all their activities and to minimise their contribution to the risk of an aircraft accident as far as is reasonably practicable.

GM3 ATM/ANS.OR.B.005(a)(2) Management system

SAFETY CULTURE The policy should actively encourage effective safety reporting and, by defining the line between acceptable performance (often unintended errors) and unacceptable performance (such as negligence, recklessness, violations or sabotage), provide fair protection to reporters. A safety or just culture may not, however, preclude the ‘criminalisation of error’, which is legally, ethically and morally within the sovereign rights of any Member State, provided that European Union law and established international agreements are observed. A judicial investigation, and consequences of some form, may be expected following an accident or serious incident especially if a system failure resulted in lives lost or property damaged, even if no negligence or ill intent existed. A potential issue could, therefore, exist if voluntary hazard reports, which relate to latent deficiencies of a system or its performance, are treated in the same way as those concerning accident and serious incident investigations. The intent of protecting hazard reports should not challenge the legitimacy of a judicial investigation or demand undue immunity.

AMC1 ATM/ANS.OR.B.005(a)(3) Management system

MANAGEMENT OF METEOROLOGICAL SERVICES PERFORMANCE (a) The management system of the meteorological service provider should provide users with assurance that the meteorological information supplied complies with the stated requirements in terms of geographical and spatial coverage, format and content, time and frequency of issuance and period of validity, as well as the accuracy of measurements, observations and forecasts. (b) When the management system indicates that the meteorological information to be supplied to users does not comply with the stated requirements, and automatic error correction procedures are not appropriate, such information should not be supplied to users unless it is validated with the originator. (c) In regard to the exchange of meteorological information for operational purposes, the management system should include verification and validation procedures and resources for monitoring adherence to the prescribed transmission schedules for individual messages and/or bulletins required to be exchanged as well as the times of their filing for transmission. The management system should be capable of detecting excessive transit times of messages and bulletins received.

AMC2 ATM/ANS.OR.B.005(a)(3) Management system

SAFETY PERFORMANCE MONITORING AND MEASUREMENT — ATS PROVIDER (a) Safety performance monitoring and measurement should be the process by which the safety performance of the air traffic services providers is verified in comparison to the safety policy and the safety objectives established by the air traffic services provider. (b) This process should include:

Annex III to ED Decision 2017/001/R (1) safety reporting; (2) safety studies encompassing broad safety concerns; (3) safety reviews including trends reviews, which would be conducted during introduction and deployment of new technologies, change or implementation of procedures, or in situations of structural change in operations; (4) safety audits focusing on the integrity of the air traffic services provider’s management system, and periodically assessing the status of safety risk controls; and (5) safety surveys, examining particular elements or procedures of a specific operation, such as problem areas or bottlenecks in daily operations, perceptions and opinions of operational personnel, and areas of dissent or confusion.

GM1 ATM/ANS.OR.B.005(a)(3) Management system

SAFETY PERFORMANCE MONITORING AND MEASUREMENT — ATS PROVIDER (a) The means to monitor performance is often through one or more leading or lagging indicators. (b) Indicators and performance measures provide feedback on what is happening so that the air traffic services provider can take appropriate actions to respond to changing circumstances. The indicators provide information on: (1) what is happening around the air traffic services provider; (2) how well the air traffic services provider is doing; (3) what has happened so far; and (4) warning of impending problems or dangers that the air traffic services provider may need to take action to avoid. (c) Although ‘lagging’ performance indicators that measure the final outcomes resulting from the air traffic services provider’s activities are often considered as the most interesting, lagging indicators themselves may not provide enough information to guide the air traffic services provider’s actions and ensure success. (d) By measuring the inputs to a process, leading performance indicators can complement the use of lagging indicators and compensate for some of their shortcomings. Leading indicators can be used to monitor the effectiveness of control systems and give advance warning of any developing weaknesses before problems occur. One purpose of leading performance indicators is, therefore, to show the condition of systems before accidents, incidents, harm, damage or failure occurs. In this way, they can help to control risks and prevent mishaps. (e) There is good evidence that when leading performance indicators are used correctly, they are effective in improving performance. However, there is also good evidence that they can be misused. (f) For leading performance indicators to play an effective role in the improvement process, there should be an association between the inputs that the leading performance indicators measure and the desired lagging outputs. There needs to be a reasonable belief that the actions taken to improve leading performance indicators will be followed by an improvement in the associated lagging output indicators. (g) The process for effective use of leading performance indicators can be summarised as: (1) Identify where there are potential weaknesses or opportunities for improvement;

Annex III to ED Decision 2017/001/R (2) Identify what can be done to counter weaknesses or deliver improvement; (3) Set performance standards for the actions identified; (4) Monitor performance against the standards; (5) Take corrective actions to improve performance; and (6) Repeat the process by using the following continuous improvement model:

(h) For any performance indicator to be effective, it is important that it is: (1) objective and easy to measure and collect; (2) relevant to the air traffic services provider whose performance is being measured; (3) capable of providing immediate and reliable indications of the level of performance; (4) cost-efficient in terms of the equipment, personnel and additional technology required to gather the information; (5) understood and owned by the air traffic services provider whose performance is being measured; (6) related to activities considered to be important for future performance; (7) amenable to intervention/influence by the air traffic services provider whose performance is being measured; (8) related to something where there is scope to improve; and (9) a clear indication of a means to improve performance.

GM2 ATM/ANS.OR.B.005(a)(3) Management system

PERFORMANCE MONITORING AND MEASUREMENT — SERVICE PROVIDER OTHER THAN AIR TRAFFIC SERVICES PROVIDER A performance indicator (PI) is a type of performance measurement. An organisation may use PIs to evaluate its success, or to evaluate the success of a particular activity in which it is engaged. Sometimes success is defined in terms of making progress towards strategic goals, but often success is simply the repeated, periodic achievement of some level of operational goal (e.g. zero defects). Accordingly, choosing the right PIs relies upon a good understanding of what is important to the organisation. Since there is a need to understand well what is important, various techniques to assess the present state of the business, and its key activities, are associated with the selection of PIs. These assessments often lead to the identification of potential Page 30 of 56

Annex III to ED Decision 2017/001/R improvements, so performance indicators are routinely associated with 'performance improvement' initiatives. When PIs have performance targets associated with them, they are known as key performance indicators (KPIs).

GM1 to AMC2 ATM/ANS.OR.B.005(a)(3) Management system

SAFETY SURVEYS — COMPLEX AIR TRAFFIC SERVICES PROVIDER (a) An air traffic services provider should: (1) initiate safety surveys and ensure that all safety-related activities within its scope are addressed periodically; (2) appoint an appropriate survey leader and survey team whose expertise is in accordance with the particular requirements of the intended survey, taking due account of the desirability of including staff from outside areas where relevant, and being mindful of the opportunity such an activity provides for staff development and engagement; (3) define an annual safety survey plan; (4) take immediate remedial action as soon as any safety-related shortcomings are identified; (5) ensure that the actions identified in the action plans are carried out within the specified timescales; and (6) ensure that examples of lesson learning and good practice arising from safety surveys are disseminated and acted upon. (b) The survey leader should: (1) carry out the survey; (2) record the results; (3) make recommendations; and (4) agree actions with the relevant operational management. (c) The survey team should assist the survey leader in fulfilling their responsibilities as determined by the survey leader. (d) Safety surveys may be initiated by a number of means such as occurrence reports, safety performance, suggestions from members of staff, etc. (e) Safety surveys may be documented in a safety survey report which should also contain the specific actions that will be taken to address the recommendations. The actions should specify those responsible for completion and the target dates. The actions should be tracked to closure through an action plan. This action plan may be implemented as part of an existing locally or centrally managed action tracker. (f) A typical safety survey report would require the following content: (1) Front sheet: (i) reference number; (ii) title; (iii) survey period; (iv) team members and team leader; and

Annex III to ED Decision 2017/001/R (v) survey initiator; (2) Survey description: (i) introduction; (ii) objective; (iii) scope; (iv) record of results; (v) conclusions; and (vi) recommendations and actions. (g) Survey leader The survey leader should be adequately trained and competent for the subject of the survey. Where this is not possible, at least one member of the survey team should be competent in the subject of the survey. (h) Survey team It is advantageous for the survey team to be multi-disciplined and, where possible, be drawn from differing parts of the air traffic services provider’s organisation.

GM1 ATM/ANS.OR.B.005(a)(4) Management system

IDENTIFICATION OF CHANGES TO FUNCTIONAL SYSTEMS This process is used by the service provider to correctly identify proposed changes. The changes dealt with in this GM are the proposed changes to the functional system. These can be triggered internally by changing circumstances that are related to the service provider of concern or externally by changing circumstances that are related to others or to the context in which the service operates, i.e. in situations where the service provider does not have managerial control over them. The triggers are called ‘change drivers’. (a) Identification of internal circumstances (1) The procedure to identify changes needs to be embedded in all parts of the organisation that can modify the functional system, i.e. the operational system used to support the services provided. Examples of proposed changes to the functional system as a response to changing circumstances under the control of the organisation, therefore, include: (i) changes to the way the components of the functional system are used; (ii) changes to equipment, either hardware or software; (iii) changes to roles and responsibilities of operational personnel; (iv) changes to operating procedures; (v) changes to system configuration, excluding changes during maintenance, repair and alternative operations that are already part of the accepted operational envelope; (vi) changes that are necessary as a result of changing circumstances to the operational context under the managerial control of the provider that can impact the service, e.g. provision of service under new conditions;

Annex III to ED Decision 2017/001/R (vii) changes that are necessary as a result of changing circumstances to the local physical (operational) environment of the functional system; and (viii) changes to the working hours and/or shift patterns of key personnel which could impact on the safe delivery of services. (2) These changes are often identified by the service provider using business processes, which will be used to identify changes planned for the medium and long term. Such processes can include: (i) annual business plans; (ii) strategic safety boards; (iii) equipment replacement projects; (iv) airspace reorganisation plans; (v) introduction of new operational concepts, e.g. Free Flight; (vi) accident and incident investigation reports; and (vii) safety monitoring and safety surveys. (b) Identification of external circumstances The service provider should have processes in place to react appropriately to notifications received from those service providers that supply services to them. In addition, changes to the context that can impact on the service provided and are not under the managerial control of the service provider should be identified and treated as potential triggers. Furthermore, the service provider should negotiate contracts with unregulated service providers in accordance with ATM/ANS.OR.B.015 ‘Contracted activities’ that place a responsibility on such organisations to inform them of planned changes to their services.

AMC1 ATM/ANS.OR.B.005(a)(5) Management system

ASSESSMENT OF THE MANAGEMENT SYSTEM (a) Senior management should assess the service provider’s management system, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness. (b) The review should include assessing opportunities for improvement and the need for changes to the management system, including the policy and objectives. (c) Records from management assessments should be maintained.

AMC1 ATM/ANS.OR.B.005(a)(6) Management system

TRAINING AND COMPETENCY A service provider should: (a) determine the necessary competence for personnel performing activities supporting services provision; (b) where applicable, provide training or take other actions to achieve the necessary competence; (c) evaluate the effectiveness of the actions taken; (d) ensure that personnel are aware of the relevance and importance of their activities and how they contribute to the achievement of the objectives; and (e) maintain appropriate records of education, training, skills and experience. Page 33 of 56

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.B.005(a)(7) Management system

COMMUNICATION RESPONSIBILITIES The senior management should ensure that appropriate communication processes are established within the service provider and that communication takes place regarding the effectiveness of the management system.

AMC1 ATM/ANS.OR.B.005(b) Management system

SERVICE PROVIDER’S MANAGEMENT SYSTEM DOCUMENTATION A service provider’s management system documentation should at least include the following information: (a) a statement signed by the accountable manager to confirm that the service provider will continuously work in accordance with the applicable requirements and the service provider’s documentation as required by this Part and other applicable Parts; (b) the service provider’s scope of activities; (c) the titles and names of nominated postholders referred to in ATM/ANS.OR.B.020(b); (d) the service provider’s chart showing the lines of responsibility between the persons referred to in ATM/ANS.OR.B.020(b); (e) a general description and location of the facilities referred to in ATM/ANS.OR.B.025; (f) procedures describing the function and specifying how the service provider monitors and ensures compliance with the applicable requirements referred to in ATM/ANS.OR.B.005(c); and (g) the amendment procedure for the service provider’s management system documentation.

GM1 ATM/ANS.OR.B.005(b) Management system

SERVICE PROVIDER’S MANAGEMENT SYSTEM DOCUMENTATION (a) It is not required to duplicate information in several manuals. The information may be contained in the service provider’s manuals (e.g. operations manual, training manual), which may also be combined. (b) A service provider may also choose to document some of the information required to be documented in separate documents (e.g. procedures). In this case, it should ensure that manuals contain adequate references to any document kept separately. Any such documents are then to be considered an integral part of the service provider’s management system documentation. (c) A service provider’s management system documentation may be included in a separate manual or in (one of) the manual(s) as required by the applicable subpart(s). A cross reference should be included.

AMC1 ATM/ANS.OR.B.005(c) Management system

COMPLIANCE MONITORING — GENERAL FOR COMPLEX SERVICE PROVIDERS (a) Compliance monitoring The implementation and use of a compliance monitoring function should enable the service provider to monitor compliance with the relevant requirements of this Part and other applicable Parts. (1) A service provider should specify the basic structure of the compliance monitoring function applicable to the activities conducted.

Annex III to ED Decision 2017/001/R (2) The compliance monitoring function should be structured according to the size of the service provider and the complexity of the activities to be monitored, including those which have been subcontracted. (b) A service provider should monitor compliance with the procedures they have designed to ensure that services are provided with the required safety levels and quality, as applicable. In doing so, they should as a minimum, and where appropriate, monitor: (1) manuals, logs, and records; (2) training standards; and (3) management system procedures. (c) Organisational set-up (1) A person should be responsible for compliance monitoring to ensure that the service provider continues to meet the requirements of this Part and other applicable Parts. The accountable manager should ensure that sufficient resources are allocated for compliance monitoring. (2) Personnel involved in the compliance monitoring should have access to all parts of service provider and, as necessary, any contracted organisation. (3) In the case the person responsible for compliance monitoring acts also as safety manager, the accountable manager, with regard to his or her direct accountability for safety, should ensure that sufficient resources are allocated to both functions, taking into account the size of the service provider and the nature and complexity of its activities. (4) The independence of the compliance monitoring function should be established by ensuring that audits and inspections are carried out by personnel not directly involved in the activity being audited. (d) Compliance monitoring documentation (1) Relevant documentation should include relevant part(s) of the service provider’s management system documentation. (2) In addition, relevant documentation should also include: (i) terminology; (ii) specified activity standards; (iii) a description of the service provider; (iv) allocation of duties and responsibilities; (v) procedures to ensure compliance; (vi) the compliance monitoring programme, reflecting: (A) the schedule of the monitoring programme; (B) audit procedures; (C) reporting procedures; (D) follow-up and corrective action procedures; and (E) the record-keeping system;

Annex III to ED Decision 2017/001/R (vii) the training syllabus referred to in (e)(2); and (viii) document control. (e) Training (1) Correct and thorough training is essential to optimise compliance in every service provider. In order to achieve significant outcomes of such training, the service provider should ensure that all personnel understand the objectives as laid down in the service provider’s management system documentation. (2) Those responsible for managing the compliance monitoring function should receive training on this task. Such training should cover the requirements of compliance monitoring, manuals and procedures related to the task, audit techniques, reporting and recording. (3) Time should be provided to train all personnel involved in compliance management and for briefing the remainder of the personnel. (4) The allocation of time and resources should be governed by the volume and complexity of the activities concerned.

GM1 ATM/ANS.OR.B.005(c) Management system

COMPLIANCE MONITORING ORGANISATIONAL SET-UP (a) The role of the compliance monitoring may be performed by a compliance monitoring manager to ensure that the activities of the service provider are monitored for compliance with the applicable regulatory requirements and any additional requirements established by the service provider, and that these activities are being carried out properly under the supervision of other relevant nominated postholders and line managers. (b) The compliance monitoring manager should: (1) be responsible for ensuring that the compliance monitoring programme is properly implemented, maintained, and continually reviewed and improved; (2) have direct access to the accountable manager; (3) not be one of the line managers; and (4) be able to demonstrate relevant knowledge, background and appropriate experience related to the activities of the service provider, including knowledge and experience in compliance monitoring. (c) The compliance monitoring manager may perform all audits and inspections himself/herself or appoint one or more auditors by choosing personnel having the related competence as defined in point (b)(iii), either from within or outside the service provider. (d) Regardless of the option chosen, it needs to be ensured that the independence of the audit function is not affected, in particular in cases where those performing the audit or inspection are also responsible for other activities within the service provider. (e) In case external personnel are used to perform compliance audits or inspections: (1) any such audits or inspections are performed under the responsibility of the compliance monitoring manager; and

Annex III to ED Decision 2017/001/R (2) the compliance monitoring manager remains responsible for ensuring that the external personnel has relevant knowledge, background and experience as appropriate to the activities being audited or inspected, including knowledge and experience in compliance monitoring. (f) A service provider retains the ultimate responsibility for the effectiveness of the compliance monitoring function, in particular for the effective implementation and follow-up of all corrective actions.

AMC1 ATM/ANS.OR.B.005(d) Management system

REACTION TO UNDERPERFORMANCE OF FUNCTIONAL SYSTEMS If the cause of the underperformance is found to be: (a) a flaw in the functional system, the service provider should initiate a change to the functional system either to remove the flaw or mitigate its effects; (b) a flawed argument associated with a change to that functional system, the service provider should either: (1) provide a valid argument; or (2) where the service provider considers it more feasible, initiate a change to the functional system.

AMC1 ATM/ANS.OR.B.005(e) Management system

SIZE, NATURE AND COMPLEXITY OF THE ACTIVITY (a) An air traffic services provider should be considered as complex unless it is eligible to apply for a limited certificate and fulfils the criteria set out in ATM/ANS.OR.A.010(a). (b) An air navigation services provider, other than an air traffic services provider, should be considered as complex unless it is eligible to apply for a limited certificate and fulfils the criteria set out in ATM/ANS.OR.A.010(b)(1). (c) An aerodrome flight information services provider should be considered as complex unless it is eligible to apply for a limited certificate and fulfils the criteria set out in ATM/ANS.OR.010(b)(2). (d) A service provider, other than an air navigation services provider, should be considered as complex when it has a workforce of more than 20 full-time equivalents (FTEs) involved in the activity subject to Regulation (EC) No 216/2008 and its implementing rules.

GM1 ATM/ANS.OR.B.005(e) Management system

SIZE, NATURE AND COMPLEXITY OF THE ACTIVITY (a) In consideration of the EUR 1 000 000 gross annual turnover referred to in ATM/ANS.OR.A.010(b)(1), this is assessed against the income the air navigation services provider generates in the provision of the services specified in Annex Vb to Regulation (EC) No 216/2008 and does not include any income generated by the air navigation services provider who undertakes other commercial activity that generates income. (b) In consideration of operating regularly not more than one working position at any aerodrome referred to in ATM/ANS.OR.A.010(b)(2), this means that for the majority (i.e. greater than 50 %) of time an aerodrome is operational, only one working position is used. (c) Table 3 below illustrates the circumstances under which the service provider could be considered as non-complex.

Annex III to ED Decision 2017/001/R

Type of service Criteria to be complied with

Air traffic services Eligible for limited certificate and meets criteria in ATM/ANS.OR.A.010(a)

CNS/MET/AIS Eligible for limited certificate and meets criteria in ATM/ANS.OR.A.010(b)(1)

AFIS Eligible for limited certificate and meets criteria in ATM/ANS.OR.A.010(b)(2)

ASM/ATFM/ DAT Workforce of 20 or less FTEs per service

Table 3: Non-complex service provider

GM1 ATM/ANS.OR.B.005(f) Management system

GENERAL Within the scope of this Regulation, only the air traffic services provider can identify hazards, assess the associated risks and mitigate or propose mitigating measures where necessary. This requirement implies that all service providers (air traffic services and non-air traffic services) establish formal interfaces (e.g. service level agreements, letters of understanding, memorandum of cooperation) between the relevant services providers themselves or between the service providers and other aviation undertakings (e.g. aerodrome operators) so as to ensure that hazards associated with the use of the services they provide are identified and the risks assessed and whenever needed mitigated. It does not imply that this has to be done by the service providers themselves (e.g. MET or AIS providers cannot do this by themselves) as only the air traffic services provider can, but they need to establish the interfaces with those service providers (ATS providers) or other aviation undertaking (e.g. aerodrome operators) who are able to do so. The formal interfaces could address the mitigation means put on the different providers (e.g. via requirements in a service level agreement).

GM2 ATM/ANS.OR.B.005(f) Management system

LOCAL RUNWAY SAFETY TEAM The service provider should participate in the local runway safety team (LRST) established by the aerodrome operator in accordance with AMC1 ADR.OR.D.027 and GM2 ADR.OR.D.027.

AMC1 ATM/ANS.OR.B.010(a) Change management procedures

GENERAL (a) The procedures, and the change of the procedures, used by a service provider to manage changes should cover the complete lifecycle of a change. (b) The service provider should show that the procedures address all the actions and all the evidence needed in order to comply with the requirements laid down in ATM/ANS.OR.A.045, ATS.OR.205, ATS.OR.210, and ATM/ANS.OR.C.005, as appropriate. For that purpose, the service provider should use a compliance matrix, which shows: (1) which part of a procedure addresses which part of the Regulation (i.e. the requirement of the implementing rule); and (2) the rationale explaining how the procedures demonstrate compliance with the Regulation.

Annex III to ED Decision 2017/001/R (c) The service provider should ensure that the roles and responsibilities for the change management processes are identified in the procedures. (d) Procedures should be submitted in a manner agreed between the service provider and the competent authority. Until an agreement is reached, the competent authority will prescribe the means of submission. (e) The procedure that defines the notification process for changes includes: (1) the point of contact in charge of the notification of changes, e.g. person, or part of the organisation and the role; (2) the means used for notification, e.g. fax, email, mail, use of database or others. (f) The management of change procedures should include a change identification procedure. This procedure, which is a precursor of the change notification process, should seek out potential changes, confirm that there is a real intent to implement them (propose the change) and, if so, initiate the notification process.

AMC2 ATM/ANS.OR.B.010(a) Change management procedures

GENERAL (a) As part of the change management procedures, the service provider should keep a register of the records of all notified changes. The register should include: (1) the status of the implementation of the change, i.e. planned, under review, under implementation, implemented, or cancelled; (2) the notification; (3) (a link to) the location of the actual record, including a reference to all information passed to the competent authority in accordance with ATM/ANS.OR.A.045(a)(2). (b) In addition, when the changes are selected for review, the register should also include: (1) the review decision from the competent authority; and (2) a link to records of the change approval by the competent authority.

GM1 ATM/ANS.OR.B.010(a) Change management procedures

GENERAL (a) The change management procedures for changes to functional systems should include: (1) the identification and notification of proposed changes; (2) the identification of the scope of the change, i.e. the identification of what parts of the functional system are to be changed or are affected by the change; (3) the assessment and assurance of the change; (4) the approval of the change; and (5) the establishment of the monitoring criteria to ensure that the change will remain acceptable as long as it is in operation (acceptably safe for air traffic service providers or acceptably trustworthy for other service providers). The monitoring of the changed system is part of the activities related

Annex III to ED Decision 2017/001/R to the management system of the service provider. It is not covered by the change management procedures themselves. (b) The procedures that manage changes to functional systems do not include the processes to identify the circumstances that will trigger the change. These should be part of the management system(s) as laid down in ATM/ANS.OR.B.005 and/or ATS.OR.200, as applicable. (c) The change management procedures should address the following: (1) procedural-oriented content, which details: (i) the roles and activities with regard to change management, safety assessment and safety support assessment; (ii) the identification of the parts of the functional system affected by the proposed change; (iii) the type of safety assessment or safety support assessment that has to be used for the identified type of changes; (iv) the competence of the persons performing change management, safety assessments and safety support assessments; (v) the identified triggers for performing a safety assessment and a safety support assessment; (vi) the means of change notification; ‘means’ includes the form of notification; (vii) the means of identifying any organisations or aviation undertakings using the service that are potentially affected by the change; and (viii) the means of informing those identified in (vii). (2) Method-oriented content, which details description of the safety assessments and safety support assessments methods and mitigation methods used by the service provider. (d) For each change management procedure or part of a change management procedure approved, the agreement on notification of any change over them should be documented and formalised. In any case, the service provider should keep records of these changes.

Annex III to ED Decision 2017/001/R

GM1 to AMC1 ATM/ANS.OR.B.010(a) Change management procedures

COMPLIANCE MATRIX The following example of a matrix could be used by the service provider to document the compliance status of its change management procedures. Service provider [Name of the provider]

ATS: C: N: S: MET: AIS: DAT: ASM: ATFCM: Provided services

Date MM/DD/YYYY Version of the form Vx.y Procedure ‘ XYZ ‘ — version ‘ a.b ‘ of MM/DD/YYYY

Submitted

Procedure ‘ JKL ‘ — version ‘ c.d ‘ of MM/DD/YYYY

procedure(s)

[…]

Annex III to ED Decision 2017/001/R

Requirement in the Competent authority AMC Procedure Rationale Status Regulation comment

Paragraph 4 states that the

transition into operation of any Procedure ‘ JKL ’ — functional change will occur ATM/ANS.OR.A.045(c) None version ‘ c.d ’ — Non-approved To be assessed following the completion of the Paragraph 4 activities required by the

procedures XYZ, MNO, and ABC

Paragraph 3 stresses that a

change subject to competent Procedure ‘ XYZ ’ — authority review should not be ATM/ANS.OR.A.045(d) AMC1 ATM/ANS.OR.A.045(d) version ‘ a.b ’ — Approved None allowed to be put into service Paragraph 3 before formal approval has

been granted.

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES (a) A contract should exist between the service provider and the contracted organisation clearly defining the contracted activities and the applicable requirements, including training and competences requirements for air traffic safety electronics personnel (ATSEP) employed by the contracted organisation, where applicable. (b) The contracted activities, performed by an organisation that is not itself certified in accordance with this Regulation to carry out such activity, should be included in the service provider’s oversight process. In this context, where the contracted activity requires the ATSEP employed by contracted organisation to undertake any aspect of this activity, the service provider should ensure that those ATSEP have received the applicable training and competences foreseen in Subpart A of Annex XIII. (c) A service provider should ensure that the contracted organisation has the necessary authorisation, declaration or approval when required, and commands the resources and competence to undertake the task.

AMC2 ATM/ANS.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES (a) When the contracted organisation is itself certified in accordance with this Regulation to carry out the contracted activities, the service providers’ compliance monitoring should at least check that the approval effectively covers the contracted activities and that it is still valid. (b) When the service provider is not certified itself to provide the service, it should only contract or purchase services from a certified organisation when so required by this Regulation.

AMC3 ATM/ANS.OR.B.015 Contracted activities

SAFETY — ATS PROVIDER An air traffic services provider should ensure adequate justification of the safety of the externally provided and supplied services, having regard to their safety significance within the provision of its services.

GM1 ATM/ANS.OR.B.015 Contracted activities

GENERAL (a) A service provider may contract certain activities to external organisations. ‘Contracted activities’ means those activities within the service provision conditions attached to the service provider’s certificate that are performed by other organisations either themselves certified to carry out such an activity or if not certified, working under the service provider’s oversight. The scope of the service provider's oversight covers the contracted activities performed by the external organisation that is not itself certified in accordance with this Regulation. (b) Activities contracted to external organisations for the provision of services may include areas such as: (1) aeronautical information services; (2) meteorological services, etc. (c) In the case of activities contracted, the service provider should define relevant management responsibilities within its own organisation.

Annex III to ED Decision 2017/001/R (d) The ultimate responsibility for the services provided by contracted organisations should always remain with the contracting service provider.

GM2 ATM/ANS.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES (a) A contract could take the form of a written agreement, letter of agreement, service letter agreement, memorandum of understanding, etc. as appropriate for the contracted activities. (b) A service provider’s assurance process could be included into the service provider’s management system and compliance monitoring programmes. (c) In order to ensure that the contracted organisation is able to perform the contracted activities, the service provider may conduct a prior audit of the contracted party.

GM3 ATM/ANS.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES (a) Regardless of the approval status of the contracted organisation, the service provider is responsible for ensuring that all contracted activities are subject to compliance monitoring as required by ATM/ANS.OR.B.005(c), and in the case of air traffic services provider, also to hazard identification and risk management as required by ATS.OR.200(2). (b) If a service provider requires a contracted organisation to conduct an activity which exceeds the privileges of the contracted organisation’s certificate, this will be considered as the contracted organisation working under the approval and oversight of the contracting service provider.

GM4 ATM/ANS.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES Table 4 below illustrates the responsibilities when contracting.

Table 4: Responsibility when contracting activities

Annex III to ED Decision 2017/001/R

GM1 to AMC1 ATM/ANS.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES The applicable requirements may include the necessary elements from the training and competence assessment of ATSEP laid down in Annex XIII to this Regulation in accordance with ATSEP.OR.105 in order to ensure equivalent level of safety and level playing field for the maintenance of systems and equipment regardless of whether such services are provided internally in the service provider or outsourced.

GM1 ATM/ANS.OR.B.020(a) Personnel requirements

ACCOUNTABLE MANAGER Depending on the size, structure and complexity of the organisation, the accountable manager may be: (a) the chief executive officer (CEO); (b) the chief operating officer (COO); (c) the chairperson of the board of directors; (d) a partner; or (e) the proprietor.

AMC1 ATM/ANS.OR.B.020(b) Personnel requirements

GENERAL Senior management should appoint a member of the service provider’s management who, irrespective of other responsibilities, should have responsibility and authority that includes: (a) ensuring that processes needed for the management system are established, implemented and maintained; (b) reporting to senior management on the performance of the management system and any need for improvement; and (c) ensuring the promotion of awareness of performance and service requirements throughout the service provider and of the impact it has on safety.

GM1 ATM/ANS.OR.B.020(b) Personnel requirements

COMBINATION OF NOMINATED POSTHOLDERS RESPONSIBILITIES (a) The acceptability of a single person holding more than one post, possibly in combination with being the accountable manager, should depend upon the service provider’s organisation and the complexity of its activities. The two main areas of concern should be competence and an individual’s capacity to meet his or her responsibilities. (b) As regards competence in different areas of responsibility, there should not be any difference from the requirements applicable to persons holding only one post.

The capacity of an individual to meet his or her responsibilities should primarily be dependent upon the complexity of the service provider’s organisation and its activities. However, the complexity of the service provider’s organisation or of its activities may prevent or limit the combination of posts.

Annex III to ED Decision 2017/001/R

AMC1 ATM/ANS.OR.B.030 Record-keeping

GENERAL (a) The record-keeping system should ensure that all the records required in ATM/ANS.OR.B.030(a) are accessible whenever needed. These records should be organised in a way that ensures traceability and retrieval throughout the retention period. (b) Records should be kept in paper form or in electronic format or a combination of both. Records stored on microfilm or optical disc format are also acceptable. The records should remain legible throughout the required retention period. The retention period starts when a record has been created or last amended. (c) Paper systems should use robust material which can withstand normal handling and filing. (d) Computer systems should have at least one backup system which should be updated within 24 hours of any new entry. Computer systems should include safeguards against the probability of unauthorised personnel altering the data. (e) All computer hardware used to ensure data backup should be stored in a different location from that containing the working data and in an environment that ensures they remain in good condition. When hardware or software changes take place, special care should be taken that all necessary data continues to be accessible at least through the full retention period.

GM1 ATM/ANS.OR.B.030 Record-keeping

GENERAL The record-keeping provision is intended to address the management system records rather than operational data which is covered by other record-keeping applicable requirements.

AMC1 ATM/ANS.OR.B.030(b) Record-keeping

RETENTION PERIOD The records should be kept for a minimum period of at least 5 years unless otherwise specified by the competent authority.

SUBPART C — SPECIFIC ORGANISATIONAL REQUIREMENTS FOR SERVICE PROVIDERS OTHER THAN AIR TRAFFIC SERVICES PROVIDERS

GM1 ATM/ANS.OR.C.005(a)(1) Safety support assessment and assurance of changes to the functional system

GENERAL (a) The safety support assessment should be conducted by the service provider itself. It may also be carried out by another organisation, on its behalf, provided that the responsibility for the safety support assessment remains with the service provider. (b) A safety support assessment needs to be performed when a change affects a part of the functional system managed by a service provider other than an air traffic services provider and it is being used in the provision of its services. The safety support assessment or the way it is conducted does not depend on whether the change is a result of a business decision or a decision to improve the service performance.

Annex III to ED Decision 2017/001/R

GM2 ATM/ANS.OR.C.005(a)(1) Safety support assessment and assurance of changes to the functional system

SAFETY SUPPORT ASSESSMENTS BY PROVIDERS THAT ARE ALSO ATS PROVIDERS (a) Only air traffic services providers can perform a safety assessment. Service providers other than air traffic services providers can only perform a safety support assessment to determine that the new or changed service behaves only as specified in a specified context. (b) A safety support assessment should be carried out for changes that cross the organisation’s boundary. (c) An air traffic services provider may choose not to perform a safety support assessment of changes to its functional system when the changes do not cross the organisation’s boundary. In this specific case, the safety assessment of changes to the functional system should be performed.

GM3 ATM/ANS.OR.C.005(a)(1) Safety support assessment and assurance of changes to the functional system

SAFETY SUPPORT ASSESSMENT (a) A safety support assessment is needed whenever the functional system of a service provider other than an air traffic services provider changes. This may be as a result of: (1) the provider proposing a change to: (i) its functional system; (ii) the services it provides; (iii) the context in which its functional system operates; or (iv) the context in which the service is provided; (2) the services used by the provider in the delivery of its services being planned to change; or/and (3) a change to the context in which the service provider’s functional system operates as a result of a proposed change by another service provider, another organisation regulated by Regulation (EC) No 216/2008 or an unregulated body. (b) The granularity of the safety support case report will depend on: (1) the scope of the change; (2) the nature and number of arguments; and (3) the necessary and sufficient evidence needed to provide appropriate confidence that the safety support assurance is valid (complete and correct).

GM4 ATM/ANS.OR.C.005(a)(1) Safety support assessment and assurance of changes to the functional system

SCOPE OF THE CHANGE (a) The description of the elements being changed includes the nature, functionality, location, performance, maintenance tasks, training and responsibilities of these elements, where applicable. The description of interfaces and interactions, between machines and between humans and machines, should include communication means, e.g. language, phraseology, protocol, format, order and timing and transmission means, where applicable. In addition, it includes the description of the context in which they operate.

Annex III to ED Decision 2017/001/R (b) There are two main aspects to consider in evaluating the scope of a change: (1) The interactions within the changed functional system. (2) The interactions within the changing functional system, i.e. those that occur during transitions from the current functional system to the changed system. During such transitions, components are replaced/installed in the functional system. These installation activities are interactions within the changing functional system and are to be included within the scope of the change. As each transition can be treated as a change to the functional system, the identification of both the above has a common approach described below. (c) The scope of the change is defined as the set of the changed components and affected components. In order to identify the impacted components and the changed components, it is necessary to: (1) know which components will be changed; (2) know which component’s (components’) behaviour might be affected by the changed components, although it is (they are) not changed itself (themselves); and (3) detect indirectly affected components by identifying: (i) new interactions introduced by the changed or directly affected components; (ii) interactions with changed or directly affected components via the context. Furthermore, directly and indirectly impacted components will be identified as a result of applying the above iteratively to any directly and indirectly impacted components that have been identified previously. The scope of the change is the set of changed, directly impacted and indirectly impacted components identified when the iteration identifies no new components. (d) The context in which the changed service is intended to be provided (see ATM/ANS.OR.C.005(a)(1)(iii)) includes the interface through which the service will be delivered to other service providers.

GM5 ATM/ANS.OR.C.005(a)(1) Safety support assessment and assurance of changes to the functional system

TRAINING If the change modifies the way people interact with the rest of the functional system, then they will require training before the change becomes operational. Care should be taken when training operational staff before the change is operational, as the training may change the behaviour of the operational staff when they interact with the existing functional system before any other part of the change is made, and so the training may have to be treated as a transitional stage of the change. For example, as a result of training, ATCOs may come to expect information or alerts to be presented differently. People may also need refreshment training periodically in order to ensure that their performance does not degrade over time. The training needed before operation forms part of the design of the change, while the refreshment training is part of the maintenance of the functional system after the change is in operation.

GM6 ATM/ANS.OR.C.005(a)(1) Safety support assessment and assurance of changes to the functional system

INTERACTIONS The identification of changed interactions is necessary in order to identify the scope of the change because any changed behaviour in the system comes about via a changed interaction. Changed interaction happens via an

Annex III to ED Decision 2017/001/R interaction at an interface of the functional system and the context in which it operates. Consequently, identification of both interfaces and interactions is needed to ensure that all interactions have identified interfaces and all interfaces have identified interactions. From this, all interactions and interfaces that will be changed can be identified.

AMC1 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

FORM OF ASSURANCE Service providers other than air traffic services providers should ensure that the assurance is documented in a safety support case.

AMC2 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

COMPLETENESS OF THE ARGUMENT The argument should be considered complete when it shows that: (a) the safety support assessment of ATM/ANS.OR.C.005(b) has produced a service specification and context specification where: (1) the service has been defined in terms of functionality, performance and the form of the interfaces; (2) the specification of context correctly and completely records the conditions under which the specification of the service is true; (3) the interaction of components, under failure conditions or failures in services delivered to the components, have been assessed for their impact on the service and, where necessary, degraded modes of service have been defined; and (4) the specification encompasses the interaction with the environment; (b) safety support requirements have been placed on the elements changed and on those elements affected by the change; (c) the behaviour necessitated by the safety support requirements is the complete behaviour expressed by the service specification; (d) all safety support requirements have been traced from the service specification to the level of the architecture at which they have been satisfied; (e) each component satisfies its safety support requirements; and (f) the evidence is derived from known versions of the components and the architecture and known sets of products, data and descriptions that have been used in the production or verification of those versions.

AMC3 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

DETERMINATION OF THE SPECIFICATION OF THE CHANGED SERVICE When determining the changes in the service specification that have resulted from the change to the functional system, service providers other than air traffic services providers should ensure that:

Annex III to ED Decision 2017/001/R (a) the properties specified for the service can be observed and measured either directly or indirectly with a degree of certainty commensurate with the level of confidence sought from assurance; and (b) the specification of the changed service must cover everything that has changed in the service provided when operated within the declared operational context.

AMC4 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

DETERMINATION OF THE OPERATIONAL CONTEXT FOR THE CHANGE (a) When determining the operational context for the change, service providers other than an air traffic services provider should ensure that: (1) the specification of the operational context can be shown to be true for all circumstances and environments in which the changed service is intended to operate; (2) the operational context is completely and coherently specified; and (3) the specification of the operational context is internally consistent. (b) The operational context must be specified so that its adherence to (a)(1) and (a)(2) is observable and measurable either directly or indirectly with a degree of certainty commensurate with the level of confidence sought from assurance.

GM1 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

SPECIFICATION ‘Continue to behave only as specified in the specified context’ means that assurance needs to be provided that the monitoring requirements are suitable for demonstrating that the service behaves only as specified in the specified context during operation.

GM2 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

ASSURANCE LEVELS The use of assurance level concepts, e.g. design assurance levels (DAL), software assurance levels (SWAL), hardware assurance levels (HWAL), can be helpful in generating an appropriate and sufficient body of evidence to help establish the required confidence in the argument.

GM3 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

SAFETY SUPPORT REQUIREMENTS The complete behaviour is limited to the scope of the change. Safety support requirements only apply to the parts of a system affected by the change. In other words, if parts of a system can be isolated from each other and only some parts are affected by the change, then these are the only parts that are of concern and so will have safety support requirements attached to them. The following list contains examples, not exhaustive, of safety support requirements that specify: (a) for equipment, the complete behaviour, in terms of functions, accuracy, timing, order, format, capacity, resource usage, robustness to abnormal conditions, overload tolerance, availability, reliability, confidence and integrity;

Annex III to ED Decision 2017/001/R (b) for people, their performance in terms of tasks (e.g. accuracy, response times, acceptable workload, resilience to distraction, self-awareness, ‘team-playerness’, adaptability, reliability, confidence, skills, and knowledge in relation to their tasks); (c) for procedures, the circumstances for their enactment, the resources needed to perform the procedure (i.e. people and equipment), the sequence of actions to be performed and the timing and accuracy of the actions; and (d) interactions between all parts of the system.

GM1 to AMC2 ATM/ANS.OR.C.005(a)(2) Safety support assessment and assurance of changes to the functional system

COMPLETENESS OF THE ARGUMENT (a) Sufficiency of specifications The way the service specification is arrived at is not of particular interest in a safety support case and so it is not dealt with here. A specification that is sufficient implies that the service meets the provider’s intent, i.e. it is valid. Two necessary conditions for a sufficient specification are provided here: (1) Assessment of failure conditions (i) Failures or failure conditions are malfunctions of behaviour. This means either the loss or corruption of some intended behaviour, e.g. behaviour that is considered to be: (A) more than (quantity, information); (B) less than (quantity, information); (C) additional to; (D) faster than; (E) slower than; (F) part of; (G) reverse of; (H) other than; (I) not; (J) earlier than; (K) later than; (L) before; or (M) after that which was intended. If the behaviour of the service is altered in any way during malfunctions, the altered behaviour needs to be included in the specification. Further details could be found GM1 ATM/ANS.OR.C.005(b)(1) and GM1 ATM/ANS.OR.C.005(b)(2). (ii) Some failures may not result in a degraded service. (iii) Some failures may not be relevant in the context of use.

Annex III to ED Decision 2017/001/R (iv) Strictly speaking, the failure and failure conditions described here are malfunctions of the services delivered by a component and may be caused by failures of components, errors in design, failures of services used by the component, or failures of the activities associated with installing the component, i.e. failure to install the component in the intended manner. (v) When a redundancy within a component is no longer available, the behaviour of the component is considered to have changed, e.g. the reliability of the component will have changed and an indication of the loss of redundancy will have been provided. (2) Evaluation of the behaviour It is necessary to argue that the behaviour of the implementation, i.e. the system as built, matches the specification and there is no additional (unspecified) behaviour. This implies verification of service behaviour, which is required by ATM/ANS.OR.C.005(b)(2) and stated here in a more specific way. It is also necessary to argue that the behaviour of the change during transition into service matches the specification and there is no additional (unspecified) behaviour. If transition into service causes disruption to the service being changed or other services provided by the service provider, then it may be necessary to include, within the specification, a specification of the intended installation activities. This implies an assessment of failure conditions associated with the installation activities and the specification of any necessary mitigations, should the failures materialise and the installation not be performed as intended. (b) Safety support requirements (1) The safety support requirements are characteristics/items of the functional system to ensure that the system operates as specified. Based on the verification/demonstration of these characteristics/items, it could be concluded that the specifications are met. (2) The highest-layer of safety support requirements represents the desired behaviour of the change at its interface with the operational context. These, ultimately become the specification, once the implementation is verified. (3) In almost all cases, verification that a system behaves as specified cannot be accomplished to an acceptable level of confidence at the level of its interface with its operational environment. To this end, the system verification should be decomposed into verifiable parts, taking into account the following principles: (i) Verification relies on requirements placed on these parts via a hierarchical decomposition of the top-level requirements, in accordance with the constraints imposed by the chosen architecture. (ii) At the lowest level, this decomposition places requirements on elements, where verification that the implementation satisfies its requirements can be achieved by testing. (iii) At higher levels in the architecture, during integration, verified elements of different types are combined into subsystems/components, in order to verify more complete parts of the system. (iv) While they cannot be fully tested, other verification techniques may be used to provide sufficient levels of confidence that these subsystems/components do what they are supposed to do.

Annex III to ED Decision 2017/001/R (v) Consequently, since decomposing the system into verifiable parts relies on establishing requirements for those parts, then safety support requirements are necessary. (4) The way safety support requirements are achieved, is not of particular interest in a safety assessment, because a safety support argument demonstrates the trustworthiness of the specification. (5) The architecture may not have requirements. During development, the need to argue satisfaction of system level requirements, which cannot be performed at the system level for any practical system, drives the architecture because verifiability depends on the decomposition of the system into verifiable parts. (6) Demonstration that safety support requirements at system level are met allows them to be transformed into the safety support specification. (c) Satisfaction of safety support requirements (1) The concept laid down in AMC2 ATM/ANS.OR.C.005(a)(2) is that, provided the system and each subsystem/component/element meet its requirements, the system will behave as specified. This will be true provided (2), (3) and (4) below are met. (2) The activity needed to meet objective (c) of AMC2 ATM/ANS.OR.C.005(a)(2) consists of obtaining sufficient confidence that the set of requirements is complete and correct, i.e. that: (i) the architectural decomposition leads to a complete and correct set of requirements being allocated to each subsystem/component/element; (ii) each requirement is a correct, complete and unambiguous statement of the desired behaviour, and does not contradict another requirement or any other subset of requirements; and (iii) the requirements allocated to a subsystem/component/element necessitate the complete required behaviour of the subsystem/component/element in the target environment. (3) This should take into account specific aspects such as: (i) the possible presence of functions within the subsystem/component/element that produce unnecessary behaviour. For instance, in the case where a previously developed part is used, activities should be undertaken to identify all the possible behaviours of the part. If any of these behaviours is not needed for the foreseen use, then additional requirements may be needed to make sure that these functions are not solicited or inadvertently activated in operation or that the effects of any resulting behaviour are mitigated; (ii) subsystem/component/element requirements that are not directly related to the desired behaviour of the functional system. This kind of requirement can, for instance, ask that the subsystem/component/element be developed in a given syntax or be designed in a certain way. These requirements often relate to technical aspects of the subsystem/component/element. Activities should be undertaken to ensure that each of these requirements is a correct, complete and unambiguous statement of the desired effect, and does not contradict another requirement or any other subset of requirements. (4) The system behaviour should be considered complete in the sense that the specification is only true for the defined context. This restriction to the context of the use of the service makes safety support assessment and assurance of changes to the functional system a practical proposition.

Annex III to ED Decision 2017/001/R (d) Traceability of requirements The traceability requirement can be met by tracing to the highest-level element in the architectural hierarchy that has been shown to satisfy its requirements, by verifying it in isolation. It is likely and completely acceptable that this point will be reached at a different architectural level for each element. (e) Satisfaction of safety support requirements (1) The component view taken must be able to support verification, i.e. the component must be verifiable — see guidance in (b). (2) Care should be taken in selecting subsystems that are to be treated as components for verification to ensure that they are small and simple enough to be verifiable. (3) The context argument needs to demonstrate that the context in which a component is verified does not compromise the claim that the specification is true over a specified context, i.e. the component verification context is correctly related to the context claimed for the operation of the functional system. (f) Configuration identification (1) This is only about configuration of the evidence and should not be interpreted as configuration management of the functional system. However, since the safety support assessment is based on a set of elements and the way they are interlinked, the safety support assessment should only be valid if the configuration remains as described in the safety support argument. (2) Evidence for the use of a component should rely on testing activities considering the actual usage of domains and contexts. When the same component is used in different parts of the system or in different systems, it may not be possible to rely on testing in a single context since it is unlikely that the contexts for each use will be the same or can be covered by a single set of test conditions. This applies equally to the reuse of evidence gathered from testing subsystems.

AMC1 ATM/ANS.OR.C.005(b)(1) Safety support assessment and assurance of changes to the functional system

VERIFICATION The service provider other than the air traffic services provider should ensure that verification activities of the safety support assessment process include verification: (a) that the full scope of the change is addressed throughout the whole assessment process, i.e. all the elements of the functional system or environment of operation that are changed or affected by the change and those unchanged elements that depend upon them and on which they depend are identified; (b) that the way the service behaves complies with and does not contradict any requirements placed on the changed service by another part of the regulations or conditions attached to the providers’ certificate; (c) that the specification of the way the service behaves and the safety support requirements are complete and correct; (d) that the specification of the operational context is complete and correct; (e) that the specification was analysed in the context in which it is intended to operate; (f) of the completeness of the argument as per AMC2 ATM/ANS.OR.C.005(a)(2);

Annex III to ED Decision 2017/001/R (g) that the safety support requirements are correct and complete by reference to the specification; and (h) to the intended degree of confidence, that the implementation satisfies the safety support requirements and behaves only as specified in the given operational context.

GM1 ATM/ANS.OR.C.005(b)(1) Safety support assessment and assurance of changes to the functional system

DESCRIPTION OF THE SCOPE — ‘MULTI-ACTOR CHANGE’ In the case where the change is a ‘multi-actor change’ in reference to ATM/ANS.OR.A.045(e), the interfaces and interactions include the interfaces with the other service providers and/or aviation undertakings that are also affected by the change. Information related to cooperatively identifying the scope of ‘multi-actor changes’ may be found in EUROCAE ED-78A.

GM2 ATM/ANS.OR.C.005(b)(1) Safety support assessment and assurance of changes to the functional system

VERIFICATION This requirement is seeking verification because it is a simple cross-check of available material, i.e. that the specification reflects the requirements of other parts of this Regulation. (a) Behaviour ATM/ANS.OR.C.005(b)(1)(ii) requires that the service meets its specification. Consequently, the specification must be complete and valid, i.e. it includes the behaviour addressed in ATM/ANS.OR.C.005(b)(1)(iii) and any additional behaviour in the specified context. (b) Compliance with other requirements (1) ATM/ANS.OR.C.005(b)(1)(iii) requires the service providers to identify all parts of this Regulation that impose behaviour on the changed service and also includes any conditions attached to the certificate. They have to identify only those parts of this Regulation that describe required behaviour relevant to the changed service. The identified behaviour shall be included in the specification of the changed service. Note that the Regulation or conditions attached to the certificate may render compliance with technical standards and ICAO SARPs mandatory. (2) Compliance with other non-mandatory standards may also be a necessary condition for other reasons. (3) ATM/ANS.OR.C.005(b)(1)(iii) does not state that the service only meets the requirements of the other parts of this Regulation. It may do other things as well, as described in (5) below. (4) In ATM/ANS.OR.C.005(b)(1)(iii), ‘does not contradict’ is used to express the concern that behaviour beyond that required by a standard might cause the behaviour required by the standard to be undermined. (5) The behaviour of a service is likely to include behaviour unspecified in standards; such behaviour may come from: (i) the behaviour of degraded modes of operation; (ii) additional behaviour not required by the standard, but put there for commercial purposes, e.g. competitive edge; or

Annex III to ED Decision 2017/001/R (iii) other behaviour identified by the customer, e.g. an air traffic services provider. (6) Consequently, the total behaviour should be specified.

AMC1 ATM/ANS.OR.C.005(b)(2) Safety support assessment and assurance of changes to the functional system

MONITORING Service providers other than an air traffic services provider should ensure that within the safety support assessment process for a change, the monitoring criteria that are to be used to demonstrate that the safety support case remains valid during the operation of the changed functional system, i.e. that the changed service continues to meet its specification, are identified and documented. These criteria should be such that: (a) they indicate that the assumptions made in the safety support case remain valid; and (b) if the properties being monitored remain within the bounds set by these criteria, the service will be behaving as specified.

GM1 ATM/ANS.OR.C.005(b)(2) Safety support assessment and assurance of changes to the functional system

MONITORING OF INTRODUCED CHANGES (a) Monitoring is intended to maintain confidence in the safety support argument during operation of the changed functional system. Monitoring is, therefore, only applicable following the entry into service of the change. (b) Monitoring is likely to be of internal parameters of the functional system that provide a good indication of the performance of the service. These parameters may not be directly observable at the service level, i.e. at the interface of the service with the operational environment. For example, where a function is provided by multiple redundant resources, the availability of the function will be so high that monitoring it may not be useful. However, monitoring the availability of individual resources, which fail much more often, may be a useful indicator of the performance of the overall function.

SUBPART D — SPECIFIC ORGANISATIONAL REQUIREMENTS FOR ANS AND ATFM PROVIDERS AND THE NETWORK MANAGER (ATM/ANS.OR.D)

GM1 ATM/ANS.OR.D.010(d) Security management

INFORMATION SECURITY THREAT Information security threat may be any circumstance or event with the potential to adversely impact the operation, systems and/or constituents due to human action (accidental, casual or purposeful, intentional or unintentional, mistaken) resulting from unauthorised access, use, disclosure, denial, disruption, modification, or destruction of information and/or information system interfaces. This should include malware and the effects of external systems on dependent systems, but does not include physical threats.