Abstract. The airworthiness of a modern aircraft can no longer be described solely in terms of structures, propulsion and certified documentation; it is equally a property of interconnected data networks, communication links and software-intensive systems, each of which constitutes a potential attack surface. On 7–8 October 2026 the European Union Aviation Safety Agency (EASA) convened its Part-IS Implementation Workshop to examine how information security requirements are being translated into routine organisational practice. This article summarises the regulatory framework, the phased applicability of the rule, recent adjustments to its oversight regime, and the implementation difficulties most frequently reported by practitioners.

1. Introduction

Civil aviation has historically managed risk through physical barriers, redundancy and procedural control. The progressive digitalisation of aircraft systems, maintenance records, flight operations and air traffic services has introduced a further class of hazard: information security events whose consequences may propagate into flight safety. Part-IS is the European regulatory response to this shift. Rather than prescribing specific technical countermeasures, it establishes an obligation to identify, assess and manage information security risks with a potential safety impact.

2. Regulatory Framework

Part-IS is not a hardware or equipment standard; it is a management-system requirement. It is established by two legal instruments: Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203. Organisations within scope are required to:

  • identify information security risks that could affect aviation safety;
  • assess and treat those risks within a documented information security management system (ISMS);
  • demonstrate, on an ongoing basis, that the system is functioning effectively in day-to-day operations.

The emphasis on demonstrable effectiveness distinguishes Part-IS from a purely documentary compliance exercise: the existence of procedures is necessary but not sufficient.

3. Phased Applicability

The rule entered into application in two stages:

Date of applicationOrganisations in scope
16 October 2025Design and production organisations; aerodrome operators; apron management service providers
22 February 2026Maintenance and continuing airworthiness organisations; air operators; training organisations; air navigation service providers; competent authorities

As of the October 2026 workshop, both cohorts are therefore subject to the requirements, with the second cohort approximately eight months into application.

4. Recent Developments in Oversight

4.1 Integration into routine oversight

Compliance is expected to be assessed through existing oversight channels rather than through a separate audit regime: during scheduled audits, in the context of changes to an approval, or following an occurrence.

4.2 An 18-month maturity ramp

Organisations were expected to have an ISMS that is present and suitable at the date of application, and to progress towards full effectiveness over an 18-month period. This graduated model acknowledges that effectiveness can only be evidenced through operational data accumulated over time.

4.3 Reduced administrative burden for declared organisations

An amendment adopted in November 2025 reportedly removes the requirement for prior approval of the ISMS for organisations operating under a declaration, and simplifies the notification of changes. The substantive requirements remain unchanged; the adjustment concerns procedure, not the level of protection.

4.4 Contractual propagation

The practical reach of Part-IS extends beyond its legal scope. Connectivity providers and other partners may pass equivalent security requirements on through contractual clauses, so organisations formally outside the rule may nonetheless be expected to meet comparable standards.

5. Implementation Challenges

Practitioner accounts converge on a consistent set of difficulties:

  1. Accountability — assigning clear ownership of information security risk within existing safety and compliance structures.
  2. Asset inventory — defining the boundaries of the inventory and the level of granularity required.
  3. Risk analysis — completing a defensible assessment; this is consistently reported as the most time-consuming step, particularly for multi-site organisations.
  4. Competence and training — building awareness and specialised competence across operational staff.
  5. Supplier management — extending assurance to third parties whose systems interface with the organisation’s own.

The prominence of risk analysis is unsurprising: it is the stage at which abstract regulatory language must be mapped onto the specific architecture, interfaces and operational context of each organisation.

6. Discussion and Conclusion

Part-IS formalises a principle that the aviation safety community has long applied to physical hazards: risks must be identified systematically, managed proportionately and shown to be under control. Its distinctive feature is the explicit recognition that information security is now a constituent of flight safety rather than an adjacent IT concern. The implementation experience discussed at the EASA workshop suggests that the principal challenges are organisational rather than technical — accountability, scoping and the disciplined execution of risk analysis. Organisations that treat Part-IS as an extension of their existing safety management culture, rather than as a stand-alone compliance project, are likely to be best positioned as the 18-month maturity period draws to a close.

Sources

  • EASA — Part-IS Implementation Workshop, event page
  • EU Agenda — event listing
  • Jones Day — regulatory commentary
  • Wavestone — implementation analysis
  • OPS Group — industry briefing
  • SAS Sofia — regulatory update

Interested in Aviation Safety?

Get expert consulting on aviation safety management, compliance, and risk assessment for your organization.

Get in Touch