AMC & GM to Part-DPO.OR — Issue 1

Acceptable Means of Compliance and Guidance Material for the technical requirements and administrative procedures for the organisations involved in the design or production of air traffic management/air navigation services systems and air traffic management/air navigation services constituents AMC & GM to Annex II (Part-DPO.OR) to Commission Implementing Regulation (EU) 2023/1769

Issue 1 22 March 2024

AMC1 DPO.OR.A.010(a) Application for a design or production organisation approval and demonstration of capability

FORM

The dedicated EASA application form (FO.AOA.00085) should be obtained from the EASA website and completed and signed by the accountable manager of the design or production organisation (DPO). The completed form should be submitted to EASA, accompanied by a copy of the organisation exposition and the company’s registration, in accordance with the instructions included in the form.

AMC1 DPO.OR.A.045(a)(1) Failures, malfunctions, and defects

COLLECTION, INVESTIGATION AND ANALYSIS OF OCCURRENCES

The ‘collection’, ‘investigation’ and ‘analysis’ functions of the DPO’s reporting system should include means to: — analyse occurrences, and related available information; — identify adverse trends; — investigate associated root cause(s); and — establish any necessary corrective action(s).

GM1 DPO.OR.A.045(a)(1) Failures, malfunctions, and defects

COLLECTION FUNCTION

The word ‘collection’ refers to the setting up of procedures which will enable relevant failures, malfunctions and defects or other occurrences to be properly collected when they occur. As the collection system needs to accept reports that originate outside the organisation (from ATM/ANS providers, suppliers, etc.), it is necessary to inform possible reporters of the existence of the DPO’s reporting system and the appropriate means to submit reports into it. This does not presume that direct access to the system is to be granted if other mechanisms are more appropriate.

GM1 DPO.OR.A.045(c) Failures, malfunctions, and defects

REPORTING TO EASA

The reporting process could include: — a description of the applicable requirements for the reporting; — a description of the reporting mechanism, including forms, means and deadlines; — the personnel responsible for reporting.

GM1 DPO.OR.A.045(c);(d) Failures, malfunctions and defects

REPORTING TO EASA — ‘AWARE’

The reference to being ‘aware’ of an occurrence implies that the organisation identifies the event as one that falls into the category of occurrences to be reported. The 72-hour period starts when the possible unsafe condition is identified by the DPO.

AMC1 DPO.OR.A.045(e) Failures, malfunctions and defects

FOLLOW-UP AND CLOSURE OF REPORTED OCCURRENCES

(a) The organisation should transmit the following information to EASA within 30 days from the date of notification of the occurrence to EASA: (1) the latest position of the organisation responsible for design as to whether an unsafe, insecure or under-performing condition is confirmed; (2) the results of the occurrence analysis and of the first investigation — including the cause(s) of the occurrence and missing information, if known; and (3) the measures it has taken, intends to take or proposes to take, including an assessment evaluating whether the product can be operated safely until the corrective action is defined and implemented, or that immediate mitigation measures need to be implemented until a more refined assessment can be provided. (b) The final (close-out) report, as soon as available and, in principle, no later than 3 months after the occurrence notification, should include: — the final position of the organisation involved in the design as to whether an unsafe, insecure or under-performing condition exists; — the results of the occurrence analysis and of the final investigation — including the cause(s) of the occurrence and missing information; — any corrective and preventive measures taken by the reporting organisation; and — an assessment evaluating whether these corrective and preventive measures allow the product to be operated as intended. (c) Notwithstanding point (a), when the organisation identifies that no unsafe, insecure or underperforming condition exists as a result of their analysis of a voluntarily reported occurrence, it can delay further communication to EASA up to the issuance of the final report and report the occurrence as closed upon issue (data exchange). In such cases, no follow-up report should be submitted. The final report to EASA should include confirmation and justification that no unsafe, insecure or under-performing condition exists. The organisation is requested to provide information on the cause(s) of the occurrence and on the corrective or preventive measures that were taken by the organisation. This way of reporting should not be understood as an accepted deviation from the applicable requirements. If, at any stage during the investigation, the organisation identifies that a possible

unsafe, insecure or under-performing condition exists, it should be communicated to EASA via a mandatory report within 72 hours.

GM1 DPO.OR.B.001 Management system

QUALITY MANAGEMENT ELEMENTS OF THE MANAGEMENT SYSTEM — ISO 9001 CERTIFICATE

An ISO 9001 certificate, relevant to the scope of the approval being requested, issued by an appropriately accredited organisation, covers some quality management elements of the management system, but it does not address other system engineering and safety processes required by this Regulation. EASA may accept ISO 9001 certificates as evidence during compliance investigations for those elements covered. Other elements required by this Regulation in reference to the management system that are not covered by the ISO 9001 certificate issued by an appropriately accredited organisation will be subject to oversight by EASA.

GM1 DPO.OR.B.001(a) Management system

The management system should include: (a) an organisational structure to: (1) control the design, including demonstration of compliance with the applicable detailed specifications; (2) independently check demonstrations of compliance; (3) liaise with EASA; (4) continuously evaluate the organisation; (5) manage contracted activities; (b) procedures and responsibilities associated with the functions listed above, taking due account of the requirements applicable to design and approval of changes to ATM/ANS equipment design.

AMC1 DPO.OR.B.001(c) Management system

COMPLIANCE MONITORING

(a) The monitoring of compliance of the management system with the applicable requirements and the adequacy of the established procedures should be performed by systematic means. These systematic means of compliance monitoring may include structured experience exchanges, regular design meetings, brainstorming or lessons-learned sessions, project reviews at appropriate phases of the development, or other similar means.

(b) Audits should be one element of compliance monitoring. When implemented, audits should be conducted as combined process/product (project) audits that focus on the implemented key processes or methods practised. In addition, audits should also allow the design or production organisation to find ways to become more efficient by continuous improvement.

AMC1 DPO.OR.B.005(b) Change management

PROCEDURE TO MANAGE CHANGES TO ATM/ANS EQUIPMENT

(a) A procedure should be established for the classification and approval of design changes to the ATM/ANS equipment. The procedure should define criteria for classifying a change as minor or major, taking into account points ATM/ANS.EQMT.CERT.020 and ATM/ANS.EQMT.DEC.020 of Delegated Regulation (EU) 2023/1768, and the following key aspects: (b) The change is classified as major when: (1) the change includes one of the following evolutions: (i) new concept of operation of the equipment; (ii) new technologies or techniques used in the ATM/ANS equipment development (e.g. used in design or verification); (iii) changes to the ATM/ANS equipment that could significantly impact its functions and its reverification; (iv) changes to the software that significantly impact a software function and induce subsequent reverification and reinvestigation; (v) changes to the hardware that significantly impact a hardware function and induce subsequent reverification and reinvestigation; or (vi) modified ATM/ANS equipment architecture (2) the change introduces the need to add requirements to or remove requirements from: (i) the previously approved certification basis (for ATM/ANS equipment subject to certification); or (ii) the detailed specifications referred to in the declaration (for ATM/ANS equipment subject to declaration of design compliance); for instance, addition or removal of a function addressed in the detailed specifications; (3) the change introduces a new limitation to or a new deviation from: (i) the previously approved certification basis (for ATM/ANS equipment subject to certification); or (ii) the detailed specifications referred to in the declaration (for ATM/ANS equipment subject to declaration of design compliance); and (4) the change introduces a new or modified means of compliance used by the DPO, not previously investigated by EASA, to demonstrate compliance with the certification basis

(for ATM/ANS equipment subject to certification) or with detailed specifications referred to in the declaration (for ATM/ANS equipment subject to declaration of design compliance). (c) The procedure for change management should be defined in coordination with the procedure for configuration of the ATM/ANS equipment, i.e. the part numbering system of DPO equipment should incorporate how minor changes will be reflected in the configuration of the equipment, and more particularly in the part number structure. In the case of a major change, a new model designation / part number may need to be defined. (d) Minor changes should be processed in accordance with the privileges of the approved DPO. For minor changes, the approved DPO should: (1) record the change description and the justification for the change classification; (2) update all related technical documents including the user manual; (3) record continuous compliance with the ATM/ANS equipment certificate or ATM/ANS equipment declaration of design compliance; (4) notify EASA of the minor changes. When the change is managed in accordance with the change management procedure approved by EASA, the notification can be sent after the change is introduced. (e) Major changes should be notified to EASA prior to their introduction by submission of one of the following: (1) an application for the issue of a new certificate, in accordance with point ATM/ANS.EQMT.CERT.020 of Implementing Regulation (EU) 2023/1768, for ATM/ANS equipment subject to Article 4 of that Regulation; or (2) a new declaration of design compliance, in accordance with point ATM/ANS.EQMT.DEC.020(b) of Implementing Regulation (EU) 2023/1768, for ATM/ANS equipment subject to Article 5 of that Regulation.

GM1 DPO.OR.B.005(b) Change management

GENERAL

When performing changes to ATM/ANS equipment, a change impact analysis is performed to assess and document the impact of the change on the requirements, design, verification and its associated life cycle data, used for demonstration of compliance. The communication regarding major changes to ATM/ANS equipment will indicate: (a) the description of the change; (b) the impact on the equipment and its associated life cycle data for demonstration of compliance; (c) the impact on the demonstration of compliance with the EASA applicable detailed specifications and certification basis, identifying in particular: (1) the compliance demonstration with any new detailed specifications, not subject to the initial certificate or declaration;

(2) any new limitations; (3) any new deviations; (4) changes in the means of compliance with the applicable detailed specifications; and (d) the proposed EASA level of involvement, in the case of ATM/ANS equipment subject to certification.

GM2 DPO.OR.B.005(b) Change management

REACTION BY THE DPO TO AN UNPLANNED (MAJOR) CHANGE

The procedure may also include the process for the reaction by the DPO to an unplanned (major) change that may arise with the need for urgent action that would normally require prior approval by the Agency.

GM3 DPO.OR.B.005(b) Change Management

CASES IN WHICH THE DPO REACTS TO AN UNPLANNED (MAJOR) CHANGE

The cases in which the DPO reacts to an unplanned (major) change usually are when the DPO responds immediately to a safety, security or interoperability problem or when an emergency situation arises in which the DPO has to take immediate action (e.g. security patches) to ensure the safety, security or interoperability of its equipment in operation.

AMC1 DPO.OR.B.015 Contracted activities

DPO RESPONSIBILITY WHEN CONTRACTING ACTIVITIES

(a) A DPO, responsible for ensuring that the design of the ATM/ANS equipment complies with the applicable certification basis requirements or detailed specifications used for the declaration of design compliance, as applicable, should ensure that components designed, or tasks performed, by external parties are acceptable. To discharge this responsibility, the DPO should implement documented methods that ensure the compliance of the finished (ready to be delivered) ATM/ANS equipment, and that make use of these components or task results, prior to issuing the final EASA release form. (b) As the responsibility for verification of compliance remains with the DPO, no specific qualification measures are required other than to pragmatically verify the capabilities of the external party, and to ensure that the required level of detail is met to enable the task results to be adequately verified. (c) If a DPO subcontracts the compliance monitoring function to an external party that conducts the task, but does not hold its own DPO approval, then the same requirements for the qualification, nomination and documentation apply to the person who is nominated and indicated in the DPO handbook of the contracting DPO.

(d) Alternatively, if an organisation with a DPO approval obtains design substantiation data from a subcontractor that also holds a DPO approval, and the work that is conducted is within the approved scope of this subcontractor DPO, the subcontractor’s design data becomes acceptable when the contracting DPO has verified that the results adequately meet the needs of the ATM/ANS equipment under development. Additional formal compliance verification by the contracting DPO is not required if the person responsible for compliance verification of the contracted DPO signs and approves the document under its DPO approval.

AMC2 DPO.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES

(a) A contract should exist between the DPO and the contracted organisation clearly defining the contracted activities and the applicable requirements. (b) The contracted activities, performed by an organisation that is not itself approved in accordance with this Regulation to carry out such activity, should be included in the DPO’s oversight process. (c) A DPO should ensure that the contracted organisation has the necessary authorisation, declaration or approval when required, and commands the resources and competence to undertake the task.

GM1 DPO.OR.B.015 Contracted activities

RESPONSIBILITY WHEN CONTRACTING ACTIVITIES

Regardless of the approval status of the contracted organisation, the DPO is responsible for ensuring that all contracted activities are subject to compliance monitoring.

AMC1 DPO.OR.C.001(b) Organisations involved in the design or production of ATM/ANS equipment

DESIGN ACTIVITIES

(a) Specifying, developing, and testing the ATM/ANS equipment before production should be considered design activities. (b) When components designed by contracted organisations are integrated into the ATM/ANS equipment, design activities by the DPO should also include the requirements specification (functional, performance, interfaces, adaptation) of these components at the level of their integration and corresponding verifications to ensure the overall compliance.

AMC1 DPO.OR.C.001(c) Organisations involved in the design or production of ATM/ANS equipment

PRODUCTION ACTIVITIES

The following should be considered production activities: (a) manufacturing/acquisition; (b) conformance to design data; (c) release process; and (d) delivery to customers.

GM1 DPO.OR.C.001(c) Organisations involved in the design or production of ATM/ANS equipment

PRODUCTION ACTIVITIES

Figure 1 — Production activities

AMC1 DPO.OR.C.001(d) Organisations involved in the design or production of ATM/ANS equipment

EASA RELEASE FORM

(a) An EASA release form should be issued for ATM/ANS equipment produced by the DPO as per the organisation’s scope of work relevant to the terms of approval. (b) Each organisation involved in the production of ATM/ANS equipment subject to conformity assessment under this Regulation should issue a statement of conformity regarding its production, using an EASA release form (see AMC1 DPO.OR.C.001(e)). This statement should be signed by an authorised person involved in the production of the ATM/ANS equipment. (c) An EASA release form should contain a statement that: (1) the finished (ready to be delivered) ATM/ANS equipment conforms to the approved design data of the ATM/ANS equipment subject to certification or declaration in accordance with Article 4 or Article 5 of Delegated Regulation (EU) 2023/1768 respectively; (2) the ATM/ANS equipment has been manufactured in compliance with Implementing Regulation (EU) 2023/1769.

GM1 DPO.OR.C.001(d) Organisations involved in the design or production of ATM/ANS equipment

EASA RELEASE FORM

The term ‘produced’ should be considered as ‘released’ for ATM/ANS equipment that has a software component.

AMC1 DPO.OR.C.001(e) Organisations involved in the design or production of ATM/ANS equipment

EASA RELEASE FORM | STANDARD FORM

ATM/ANS EQUIPMENT RELEASE FORM

1. DPO reference 2. Statement ref No: 3. ATM/ANS equipment serial number 4. ATM/ANS equipment model name 5. Part number 6. Certificate ref No: / Declaration ref No: 7. Description of the ATM/ANS equipment 8. Concessions 9. Exemptions, waivers or derogations 10. Remarks 11. Statement of Conformity

It is hereby certified that this ATM/ANS equipment conforms fully to the certificated design/the declaration of design compliance and to the items above in boxes 7, 8, 9 and 10. The ATM/ANS equipment is manufactured in compliance with Implementing Regulation (EU) 2023/1769. 12. Signed 13. Name 14. Date (d/m/y) 15. DPO Approval Reference Block 1: The full name and the address of the location of the DPO that issues the statement. This block may be preprinted. Logos, etc. are permitted if the logo, etc. can be contained within the block. Block 2: A unique form tracking number established by the numbering system/procedure of the DPO must be indicated. Block 3: The serial number identification linked to a specific item assigned by the organisation involved in the production for control and traceability and product support purposes. Block 4: The ATM/ANS equipment model name in full as specified in the certificate or declaration of design compliance. Block 5: The part number identification of the ATM/ANS equipment, as it appears on the equipment marking, and on the certificate/declaration of design compliance. Block 6: Reference to the certificate or declaration of design compliance reference numbers for the subject ATM/ANS equipment. Block 7: Brief description of the ATM/ANS equipment, including its main functionalities. Block 8: Unintentional differences from the approved design, referred to as ‘concessions’. Block 9: Only agreed exemptions, waivers or derogations may be included here. Block 10: Any statement, information, particular data or limitation which may affect the compliance of the ATM/ANS equipment. If there is no such information or data, state ‘NONE’. List the design changes to the ATM/ANS equipment, under approved design data, and reference all the applicable ATM/ANS equipment directives (or equivalent) that have been applied on the equipment. Block 11: The validity of the EASA release form is subject to the full completion of all the blocks on the form. Block 12: The EASA release form is signed by an authorised person. Block 13: The name of the person that signs the statement. Block 14: The date on which the EASA release form is signed should be given. Block 15: The EASA DPO approval reference should be quoted.