(a)

Without prejudice to Regulation (EU) No 376/2014 of the European Parliament and of the Council (1), and the delegated and implementing acts adopted on the basis thereof, the Agency shall implement a system to appropriately collect, analyse, and disseminate safety, security and interoperability information.

(b)

Upon receiving the information referred to in point (a), the Agency shall take appropriate measures to address any identified safety, security, or interoperability problem, including the issuing of ATM/ANS equipment directives in accordance with point ATM/ANS.EQMT.AR.A.030 of Annex I to Delegated Regulation (EU) 2023/1768.

(c)

The measures taken under point (b) shall immediately be notified to the organisation concerned, who is obliged to comply with them, in accordance with point DPO.OR.A.035. The competent authorities of the ATM/ANS providers concerned shall also be notified.

(a)

The Agency shall implement a system to appropriately collect, analyse, and disseminate information related to information security incidents and vulnerabilities with a potential impact on aviation safety that are reported by organisations. This shall be done in coordination with any other relevant authorities responsible for information security or cybersecurity within the Member State to increase the coordination and compatibility of reporting schemes.

(b)

Upon receiving the information referred to in point (a), the Agency shall take adequate measures to address the potential impact on aviation safety of the information security incident or vulnerability.

(c)

Measures taken in accordance with point (b) shall immediately be notified to all persons or organisations that shall comply with them under Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on its basis. The Agency shall also notify those measures to the competent authorities of the Member States concerned.

(a)

The Agency shall establish and maintain a management system, including, as a minimum, the following elements:

(b)

The Agency shall, for each field of activity included in the management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s).

(c)

The Agency shall establish procedures for its participation in a mutual exchange of all the necessary information with any other competent authority(ies) referred to in Article 4 of Commission Implementing Regulation (EU) 2017/373 (2) and provide them with assistance or request assistance from them, including any information that stems from mandatory and voluntary occurrence reporting as required by point DPO.OR.A.045.

(d)

The management system established and maintained by the Agency shall comply with Annex I (Part-IS.AR) of Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

(a)

The Agency shall have a system in place to identify those changes that affect its capability to perform its tasks and discharge its responsibilities as set out in Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on the basis thereof. That system shall enable the Agency to take action, as appropriate, to ensure that the management system remains adequate and effective.

(b)

The Agency shall update its management system to reflect any changes to Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on the basis thereof, in a timely manner, so as to ensure the effective implementation of its management system.

(a)

The Agency shall establish and maintain a record-keeping system that provides for adequate storage, accessibility, and reliable traceability of:

(b)

The Agency shall maintain a list of all the certificates it has issued and of any declarations it has registered.

(c)

All the records referred to in points (a) and (b) shall be stored in a manner that ensures protection against damage, alteration and theft and kept for a minimum period of five years after the approvals and certificates cease to be valid or the declarations are withdrawn, subject to the applicable data protection law.

(a)

Upon receiving an application for the issue of an approval to an organisation involved in the design or production of ATM/ANS equipment, the Agency shall verify the organisation’s compliance with the requirements laid down in Annexes II and III of Delegated Regulation (EU) 2023/1768 and in Annex II to this Regulation.

(b)

The Agency may request any audits, inspections or assessments it finds necessary before issuing the approval with all the relevant information set out in Appendix 1 to this Annex.

(c)

The approval shall be issued for an unlimited duration. The privileges as regards the activities the organisation is approved to conduct shall be specified in the conditions attached to the approval.

(d)

The approval shall not be issued where a level 1 finding referred to in DPO.AR.C.015 remains open. In exceptional circumstances, finding(s) other than level 1 shall be assessed and mitigated as necessary by the organisation and a corrective action plan for closing the finding(s) shall be approved by the Agency prior to the issue of the approval.

(e)

Each change to the approval and to its conditions shall be approved by the Agency.

(a)

The Agency shall establish and update annually an oversight programme taking into account the specific nature of the organisations it oversees, the complexity of their activities, and the results of past certification or oversight activities, and shall base it on the assessment of the associated risks. The oversight programme shall include audits, which shall:

(b)

The Agency may decide to modify the objectives and the scope of the preplanned audits, including documentary reviews and additional audits, wherever that need arises.

(c)

The Agency shall decide which arrangements, elements, physical locations, and activities are to be audited within a specified time frame.

(d)

Audit observations and findings issued in accordance with point DPO.AR.C.015 shall be documented.

(e)

The findings shall be supported by evidence and identified in terms of applicable requirements and their implementation arrangements against which the audit has been conducted.

(f)

An audit report, including the details of findings and observations, shall be prepared and communicated to the organisation concerned.

(a)

For changes managed and notified to the Agency in accordance with the procedure set out in point IS.I.OR.255(a) of Annex II (Part-IS.I.OR) to Implementing Regulation (EU) 2023/203, the Agency shall include the review of such changes in its continuing oversight programme in accordance with the principles laid down in point DPO.AR.C.005 of this Annex. If any non-compliance is found, the Agency shall notify the organisation thereof, request further changes and act in accordance with point DPO.AR.C.015 of this Annex.

(b)

With regard to other changes requiring an application for approval in accordance with point IS.I.OR.255(b) of Annex II (Part-IS.I.OR) to Implementing Regulation (EU) 2023/203:

(a)

When the Agency, during investigation, oversight or by any other means, identifies any non-compliance with the applicable requirements of this Regulation of a procedure or manual required by this Regulation, or of a certificate or declaration issued in accordance with this Regulation, it shall, without prejudice to any additional action required by Regulation (EU) 2018/1139, raise a finding.

(b)

The Agency shall have a system in place to:

(c)

A level 1 finding shall be raised by the Agency when it identifies any significant non-compliance with the ATM/ANS certification basis as per point ATM/ANS.EQMT.AR.B.001 of Annex I to Delegated Regulation (EU) 2023/1768 that may lead to uncontrolled non-compliance and to a potential unwanted condition.

Level 1 findings shall include but are not limited to:

(d)

A level 2 finding shall be raised by the Agency where non-compliance with any of the following is identified:

which is not classified as a level 1 finding.

(e)

Where a finding is raised, the Agency shall, without prejudice to any additional action required by Regulation (EU) 2018/1139 and the delegated and implementing acts adopted on its basis, communicate the finding in writing to the organisation concerned and require it to take corrective action to address the non-compliance(s) identified.

(f)

For those cases where level 1 and level 2 findings are not required, the Agency may issue observations.

(g)

The Agency shall:

(h)

Upon taking enforcement measures in accordance with point (g), the Agency shall notify them to the addressee, state the reasons for them, and inform the addressee of its right to appeal.

(a)

the Agency as the competent authority that issues the approval;

(b)

the applicant’s name and postal address;

(c)

the applicant’s scope of work;

(d)

the location where the activities are to be performed;

(e)

the associated privileges for which the applicant has been approved;

(f)

a statement of the applicant’s conformity and compliance with the applicable requirements;

(g)

the date of issue and the validity of the approval;

(h)

the additional conditions or limitations attached to it.

(a)

An application for a design or production organisation approval shall be made in a form and manner established by the Agency.

(b)

In order to obtain an approval, an organisation involved in the design or production of ATM/ANS equipment shall comply with the requirements set out in this Regulation where those requirements are applicable to the design or production of ATM/ANS systems and ATM/ANS constituents that the organisation performs or intends to perform.

(a)

An organisation involved in the design or production of ATM/ANS equipment shall establish and maintain an organisation exposition, which provides the following information:

(b)

The organisation exposition shall be amended as necessary to remain an up-to-date description of the organisation, and a copy of it, including its amendments, shall be supplied to the Agency.

(c)

An application for a change approval referred to in point DPO.OR.B.005 of this Annex shall be based on the submission of the proposed changes to the organisation exposition.

(a)

An organisation’s approval shall remain valid for an unlimited period of time provided that:

(b)

Upon revocation or surrender of the approval, if issued in a paper format, it shall be returned to the Agency without delay.

(c)

The holder of an organisation approval shall be entitled, within the scope of its terms of approval and under the relevant procedures of the design management system:

(a)

An organisation involved in the design or production of ATM/ANS equipment shall facilitate the inspections and audits performed by the Agency or by a qualified entity that acts on its behalf, and it shall cooperate as necessary for the efficient and effective exercise of the powers of the Agency.

(b)

An organisation involved in the design or production of ATM/ANS equipment shall cooperate with and support the ATM/ANS providers using its ATM/ANS equipment in their compliance demonstration process to the competent authorities concerned.

(a)

identify the root cause of the non-compliance;

(b)

define a corrective action plan;

(c)

demonstrate the implementation of the corrective action to the satisfaction of the Agency within the time period proposed and approved by the Agency, as defined in point (e)(2) of point DPO.AR.C.015.

(a)

The holder of an approval issued in accordance with this Regulation shall:

(b)

For organisations that have their principal place of business in a Member State, the system established in accordance with point (a)(1) shall include provisions for occurrence reporting and follow-up that meet the requirements of Regulations (EU) No 376/2014 and (EU) No 2018/1139 and the delegated and implementing acts adopted on their basis.

(c)

The approval holder shall report to the Agency any failure, malfunction, defect or other occurrence of which it is aware, and which has resulted or may result in an unsafe, insecure, or under-performing condition.

(d)

For approval holders that do not have their principal place of business in a Member State, reports shall be made in a form and manner established by the Agency, as soon as practicable and in any case submitted not later than 72 hours after the person or organisation has become aware of the particular occurrence, unless exceptional circumstances prevent this.

(e)

The approval holder shall investigate an occurrence that has been reported under point (c), including the deficiencies that have led to that occurrence, and report to the Agency the results of its investigation and any action it intends to take or proposes to take to correct these deficiencies.

(a)

An organisation involved in the design or production of ATM/ANS equipment shall implement and maintain a management system that includes the following:

(b)

An organisation involved in the design or production of ATM/ANS equipment shall document all key management system processes, including a process for making personnel aware of their responsibilities, and the procedure for amending those processes.

(c)

An organisation involved in the design or production of ATM/ANS equipment shall establish a function within its management system to monitor its compliance with the applicable requirements and the adequacy of the established procedures. Compliance monitoring shall include a feedback system of findings to the accountable manager to ensure the effective implementation of corrective actions, as necessary.

(d)

The management system shall be proportionate to the size of the organisation involved in the design or production of ATM/ANS equipment and the complexity of its activities, taking into account the hazards and associated risks inherent in those activities.

(e)

In addition to the management system referred to in point (a), the organisation involved in the design or production of ATM/ANS equipment shall establish, implement and maintain an information security management system in accordance with Implementing Regulation (EU) 2023/203 in order to ensure the proper management of information security risks which may have an impact on aviation safety.

(a)

Following the issue of an organisation’s approval, any change to the management system that is significant shall be approved by the Agency before being implemented unless such a change is notified and managed in accordance with a procedure approved by the Agency. The organisation shall submit to the Agency an application for approval demonstrating continuous compliance with the applicable requirements.

(b)

Each change to ATM/ANS equipment shall be notified to and approved by the Agency before being implemented unless such a change is managed in accordance with a change management procedure approved by the Agency. This change management procedure shall define the classification of the changes to the ATM/ANS equipment and describe how such changes will be notified and managed.

(a)

Contracted activities include all those activities that are within the scope of the organisation’s activities, in accordance with the terms of the certificate, which are performed by other organisations either themselves certified to carry out such activities or, if not certified, working under such an organisation’s supervision. An organisation involved in the design or production of ATM/ANS equipment shall ensure that when it contracts any part of its activities to, or when it purchases any part of its activities from, external organisations, the contracted or purchased activity, as applicable, conforms with the applicable requirements.

(b)

When an organisation involved in the design or production of ATM/ANS equipment contracts any part of its activities to an organisation that is not itself certified in accordance with this Regulation to carry out such activities, it shall ensure that the contracted organisation works under its supervision. An organisation involved in the design or production of ATM/ANS equipment shall ensure that the Agency is given access to the contracted organisation to determine its continued compliance with the applicable requirements of this Regulation.

(a)

An organisation involved in the design or production of ATM/ANS equipment shall appoint an accountable manager who has the authority to ensure that all activities may be financed and carried out in accordance with the applicable requirements of this Regulation. The accountable manager shall be responsible for establishing and maintaining an effective management system.

(b)

The authority, duties, and responsibilities of the nominated post-holders, in particular management personnel in charge of safety, quality, security, finance and human-resources, shall also be defined.

(a)

An organisation involved in the design or production of ATM/ANS equipment shall establish a record-keeping system that allows for the adequate storage of records and the reliable traceability of all its activities, covering in particular all the elements indicated in point DPO.OR.B.001.

(b)

The format and the retention period of the records referred to in point (a) shall be specified in the organisation’s management system procedures.

(c)

Records shall be stored in a manner that ensures their protection against damage, alteration, and theft.

(d)

An organisation involved in the design or production of ATM/ANS equipment shall maintain a register of the ATM/ANS equipment deployed.

(a)

An applicant for, and a holder of, a design or production organisation approval for ATM/ANS equipment shall be entitled, as applicable, to any of the following:

(b)

As regards design activities, an organisation involved in the design or production of ATM/ANS equipment shall:

(c)

As regards production activities, an organisation involved in the design or production of ATM/ANS equipment shall:

(d)

In addition to point (c), an organisation involved in the production of ATM/ANS equipment shall be entitled, within the scope of its terms of approval, to determine that each completed ATM/ANS equipment conforms with the applicable design data and is in a condition for safe operation before issuing an EASA release form stating that the ATM/ANS equipment has been produced in accordance with the applicable requirements of this Regulation and with the applicable design data.

(e)

The EASA release form referred to in point (d) for each ATM/ANS equipment manufactured shall contain at least the following information:

(a)

the satisfactory coordination, with the appropriate arrangements, between design and production activities, as appropriate;

(b)

the satisfactory coordination with and proper support to the relevant ATM/ANS providers and aviation undertaking(s) as regards the continued suitability of the ATM/ANS equipment, as applicable.

(a)

propose an appropriate corrective action and submit it together with details to the Agency for approval;

(b)

following the approval by the Agency of the proposal referred to in point (a), make available to all known users or owners of ATM/ANS equipment appropriate descriptive data and accomplishment instructions and, on request, to any person required to comply with the ATM/ANS equipment directive.