Module 10.8–10.10 — Oversight principles, requirements beyond EU rules, and cybersecurity (Part-IS)

Scope and levels

These three sub-modules were added by Regulation (EU) 2023/989:

Sub-module	Level A	Level B1/B2/B2L/B3
10.8 Oversight principles in continuing airworthiness	1	1
10.9 Maintenance and certification beyond current EU regulations	not required	1
10.10 Cybersecurity in aviation maintenance	1	1

All are level 1 — know the principles and terms. They are not in the UK CAA retained syllabus.

10.8 Oversight principles in continuing airworthiness

Who oversees whom

• Competent authorities (national aviation authorities) oversee the organisations and persons they certify: Part-145, Part-CAMO, Part-CAO, Part-147 organisations, Part-66 licence holders, and aircraft on their register.
• EASA oversees organisations located outside the EU (third-country Part-145 etc.) and conducts standardisation inspections of national authorities to ensure the rules are applied uniformly.
• Authority requirements are in Section B of each Part (e.g. 145.B, M.B, 66.B). Authorities must themselves have a management system, qualified inspectors and documented procedures.

Oversight principles (e.g. 145.B.300)

The authority verifies:

1. compliance before issuing a certificate;
2. continued compliance of certified organisations;
3. implementation of safety measures it has mandated.

Verification is based on assessments, audits and inspections — including unannounced inspections — documented, with results given to the organisation, and scoped by past results and safety priorities (risk-based oversight). Meetings between the accountable manager and the authority keep both informed.

Oversight planning cycle (145.B.305; similar for CAMO and CAO)

Condition	Maximum cycle
Standard	24 months
Organisation effectively manages safety risks, controls changes, no level 1 findings, corrective actions on time during the previous 24 months	Up to 36 months
Plus an approved continuous system for reporting its safety performance and compliance to the authority	Up to 48 months
Evidence of decreasing safety performance	Cycle may be shortened

Findings and observations (145.B.350)

Type	Definition	Authority action
Level 1 finding	Significant non-compliance that lowers safety or seriously endangers flight safety; also: refusing access after two written requests, obtaining/maintaining a certificate by falsification, malpractice or fraudulent use of the certificate, lack of an accountable manager	Immediate action to prohibit or limit activities; revoke, limit or suspend the certificate in whole or part until corrected
Level 2 finding	Any other non-compliance	Corrective action period appropriate to the finding, initially not more than 3 months; may be extended if an agreed corrective action plan exists
Observation	Not a non-compliance, but an item that could become one / could be improved	Organisation should consider it

If the organisation fails to submit an acceptable corrective action plan or to complete it on time, a level 2 finding is raised to level 1. The organisation's side (145.A.95): find the root cause, define a corrective action plan, and demonstrate implementation to the authority's satisfaction.

Key fact: Standard oversight cycle = 24 months (extendable to 36 or 48). Level 2 findings: corrective action period initially up to 3 months.

Aircraft and persons

• ACAM (Aircraft Continuing Airworthiness Monitoring, M.B.303): the authority surveys a sample of aircraft on its register — in-depth surveys and ramp surveys — to check airworthiness and the effectiveness of the system.
• The licensing authority may suspend, limit or revoke Part-66 licences (66.B.500) and investigates evidence of non-compliance.
• Findings involving an aircraft are communicated to the State of registry.

10.9 Maintenance and certification beyond current EU regulations

Annex I aircraft

The Basic Regulation does not apply to aircraft listed in its Annex I, which remain under national rules of each Member State (national certificates, permits, national licences/approvals). Examples:

• historic aircraft (initial design before 1 January 1955 and production stopped before 1 January 1975, or clear historical relevance);
• research/experimental aircraft built in very limited numbers;
• amateur-built aircraft (at least 51 % built by amateurs, non-commercial);
• ex-military aircraft (unless EASA has adopted a design standard for the type);
• very light aeroplanes, helicopters, powered parachutes and sailplanes with no more than two seats within set mass limits (e.g. 300 kg single-seat / 450 kg two-seat aeroplane or helicopter);
• single and two-seat gyroplanes up to 600 kg MTOM;
• replicas of historic or ex-military aircraft;
• small balloons and airships; any manned aircraft with an empty mass (including fuel) up to 70 kg.

Also outside EU civil rules: State aircraft (military, customs, police, search and rescue, fire-fighting, coastguard, border control). Member States may "opt in" certain Annex I categories (except some) to EU rules.

EMAR 66 — the military equivalent

• EMAR = European Military Airworthiness Requirements, developed by the Military Airworthiness Authorities (MAWA) Forum under the European Defence Agency (EDA).
• EMAR 66 defines a military aircraft maintenance licence modelled on Part-66 (categories and modules), alongside EMAR 145, EMAR 147, EMAR M and EMAR 21. Adopted voluntarily by national military authorities, it eases recognition of experience between military and civil sectors.

National and international requirements for specialised work

Where EU rules do not specify the standard, national or recognised industry standards apply, for example:

Activity	Typical standard / requirement
NDT	Personnel qualified to a European or equivalent standard recognised by EASA (145.A.30(f)) — in practice EN 4179 (NAS 410 equivalent), levels 1–3; colour-contrast dye penetrant may be done by B1/B3/L staff
Welding	Welder qualification to recognised standards (e.g. EN ISO 9606 / EN 4632 series for aerospace) or national schemes
Painting / surface treatment	Manufacturer process specifications, environmental and health legislation (e.g. REACH restrictions on chromates)
Component maintenance	Component maintenance manuals; national requirements where the component is outside EU scope
Other specialised services	Composite repair, plating, heat treatment — process qualification per approved data

Other States' requirements matter when maintaining aircraft registered elsewhere (e.g. FAA requirements for N-registered aircraft under the EU–US agreement) or when working under national legislation (e.g. the UK Air Navigation Order).