[Federal Register Volume 88, Number 7 (Wednesday, January 11, 2023)]
[Proposed Rules]
[Pages 1932-1972]
[FR Doc No: 2022-28583]

Vol. 88

Wednesday,

No. 7

January 11, 2023

Part VI

Department of Transportation

-----------------------------------------------------------------------

Federal Aviation Administration

14 CFR Parts 5, 21, 91, et al.

-----------------------------------------------------------------------

Safety Management Systems; Proposed Rule

Federal Register / Vol. 88 , No. 7 / Wednesday, January 11, 2023 /
Proposed Rules

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Parts 5, 21, 91, 119, 121, and 135

[Docket No.: FAA-2021-0419; Notice No. 23-05]
RIN 2120-AL60

Safety Management Systems

AGENCY: Federal Aviation Administration (FAA), Department of
Transportation (DOT).

ACTION: Notice of proposed rulemaking (NPRM).

-----------------------------------------------------------------------

SUMMARY: The FAA proposes to update and expand the requirements for
safety management systems (SMS) and require certain certificate holders
and commercial air tour operators to develop and implement an SMS. This
proposed rule would extend the requirement for an SMS to all
certificate holders operating under the rules for commuter and on-
demand operations, commercial air tour operators, production
certificate (PC) holders that are holders or licensees of a type
certificate (TC) for the same product, and holders of a TC who license
out that TC for production. The FAA also proposes this rule in part to
address a Congressional mandate as well as recommendations from the
National Transportation Safety Board (NTSB) and two Aviation Rulemaking
Committees (ARCs). Additionally, the proposed rule would more closely
align the United States with Annex 19 to the Convention on
International Civil Aviation. This proposed rule is intended to improve
aviation safety by requiring organizations to implement a proactive
approach to managing safety.

DATES: Send comments on or before March 13, 2023.

ADDRESSES: Send comments identified by docket number FAA-2021-0419
using any of the following methods:
     Federal eRulemaking Portal: Go to www.regulations.gov and
follow the online instructions for sending your comments
electronically.
     Mail: Send comments to Docket Operations, M-30; U.S.
Department of Transportation (DOT), 1200 New Jersey Avenue SE, Room
W12-140, West Building Ground Floor, Washington, DC 20590-0001.
     Hand Delivery or Courier: Take comments to Docket
Operations in Room W12-140 of the West Building Ground Floor at 1200
New Jersey Avenue SE, Washington, DC, between 9 a.m. and 5 p.m., Monday
through Friday, except Federal holidays.
     Fax: Fax comments to Docket Operations at<PHONE_NUMBER>.
    Privacy: In accordance with 5 U.S.C. 553(c), DOT solicits comments
from the public to better inform its rulemaking process. DOT posts
these comments, without edit, including any personal information the
commenter provides, to www.regulations.gov, as described in the system
of records notice (DOT/ALL-14 FDMS), which can be reviewed at
www.dot.gov/privacy.
    Docket: Background documents or comments received may be read at
www.regulations.gov at any time. Follow the online instructions for
accessing the docket or go to the Docket Operations in Room W12-140 of
the West Building Ground Floor at 1200 New Jersey Avenue SE,
Washington, DC, between 9 a.m. and 5 p.m., Monday through Friday,
except Federal holidays.

FOR FURTHER INFORMATION CONTACT: For technical questions concerning
this action, contact Scott Van Buren, Office of Accident Investigation
and Prevention, AVP-4, Federal Aviation Administration, 800
Independence Avenue SW, Room 300 East, Washington, DC 20591, telephone
(202) 494-8417; mail [email protected].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Executive Summary
    A. Purpose of This NPRM
    B. Summary of the Proposed Rule
    C. Summary of Costs and Benefits
II. Authority for This Rulemaking
III. Purpose of This Rulemaking
IV. Background
    A. SMS Aviation Rulemaking Committees
    B. National Transportation Safety Board Recommendations
    C. Safety Management System Rulemaking Efforts
    D. Aircraft Certification, Safety, and Accountability Act
    E. International Movement Toward SMS
V. Discussion of the Proposal
    A. Applicability
    B. General Requirements and Definitions
    C. Components of Safety Management Systems
    D. Implementation of SMS
    E. Proposed Changes to Sections 119.8, 91.147, 21.135, and
21.147
    F. Scalability
    G. Examples of Real World Scenarios
    H. Data Reporting and Protection
VI. Guidance Material
    A. Guidance for Aviation Service Providers
    B. Guidance for Design and Production Approval Holders
VII. Regulatory Notices and Analyses
    A. Regulatory Impact Analysis
    B. Regulatory Flexibility Act
    C. International Trade Impact Assessment
    D. Unfunded Mandates Assessment
    E. Paperwork Reduction Act
    F. International Compatibility
    G. Environmental Analysis
    H. Regulations Affecting Intrastate Aviation in Alaska
VIII. Executive Order Determinations
    A. Executive Order 13132, Federalism
    B. Executive Order 13211, Regulations That Significantly Affect
Energy Supply, Distribution, or Use
    C. Executive Order 13609, International Cooperation
IX. Additional Information
    A. Comments Invited
    B. Confidential Business Information
    C. Request for Comments
    D. Availability of Rulemaking Documents

List of Abbreviations and Acronyms Frequently Used in This Document

AC--Advisory Circular
ACSAA--Aircraft Certification and Accountability Act
ANPRM--Advance Notice of Proposed Rulemaking
ARC--Aviation Rulemaking Committee
CBI--Confidential Business Information
CFR--Code of Federal Regulations
EASA--European Union Aviation Safety Agency
FAA--Federal Aviation Administration
FOIA--Freedom of Information Act
ICAO--International Civil Aviation Organization
IRFA--Initial Regulatory Flexibility Analysis
LOA--Letter of Authorization
NAICS--North American Industry Classification System
NPRM--Notice of Proposed Rulemaking
NTSB--National Transportation Safety Board
OMB--Office of Management and Budget
PC--Production Certificate
RFA--Regulatory Flexibility Act
RIA--Regulatory Impact Analysis
SBA--Small Business Administration
SMS--Safety Management System
TC--Type Certificate
U.S.C.--United States Code

I. Executive Summary

A. Purpose of This NPRM

    A safety management system (SMS) provides an organization-wide
approach to identifying safety hazards, assessing, and managing safety
risk, and assuring the effectiveness of safety risk controls. An SMS
provides a set of decision-making processes and procedures that can
improve safety by assisting an organization in planning, organizing,
directing, and controlling its aviation-related business activities.
Currently, the SMS requirements of part 5 of Title 14 of the Code of
Federal Regulations (CFR) apply only to air carriers certificated under
part 119 and conducting operations in accordance with part 121 (part
121 operators). In this Notice of Proposed Rulemaking (NPRM), the
Federal Aviation Administration (FAA) proposes to expand the
applicability of the SMS requirements to include additional entities in
an effort to enhance safety, respond to a Congressional mandate,

and more closely align the FAA's SMS requirements with International
Civil Aviation Organization (ICAO) Annex 19.
    Historically, the approach to aviation safety was based on the
reactive analysis of past accidents and the introduction of corrective
actions to prevent the recurrence of those events. An SMS, however,
helps organizations to proactively identify potential hazards in the
operating environment, analyze the risks of those hazards, and mitigate
those risks to prevent an accident or incident. In 2015, the FAA
promulgated 14 CFR part 5, which required part 121 operators to develop
and implement SMS and set out the basic requirements for those systems.
The FAA believes that the next step in improving aviation safety is to
extend SMS requirements to additional organizations that play a
critical role in the design, manufacturing, and operation of aircraft
(i.e., part 119 certificate holders operating under part 135, Letter of
Authorization (LOA) holders operating commercial air tours under Sec.
91.147, and certain certificate holders under part 21). These
organizations are in the best position to prevent future incidents and
accidents because they are closest to the hazards, and they know the
most about their operations and products. An SMS provides a structured,
repeatable, systematic approach to proactively identify hazards and
manage safety risk. With implementation of an SMS, these organizations
would be better able to develop and implement mitigations that are
appropriate to their environment and operational structure. The FAA
believes the implementation of SMS can be used to avoid or mitigate
future accidents. Representative examples of accidents that the FAA
believes could be avoided can be found in sections V.G. and VII.A of
this proposal. This proposal is based on the recommendations of two
previous Aviation Rulemaking Committees (ARCs),\1\ the National
Transportation Safety Board (NTSB),\2\ and the Joint Authorities
Technical Review of the Boeing 737 MAX Flight Control System.\3\
---------------------------------------------------------------------------

    \1\ The SMS ARCs are discussed in Section IV.A.
    \2\ NTSB recommendations are discussed in Section IV.B.
    \3\ Joint Authorities Technical Review (JATR), Boeing 737 MAX
Flight Control System: Observations, Findings, and Recommendations,
Washington, October 11, 2019.
---------------------------------------------------------------------------

    Further, the Aircraft Certification Safety and Accountability Act
(Pub. L. 116-260, 134 Stat. 2309, hereafter referred to as ACSAA),
enacted on December 27, 2020, mandated the application of SMS
regulatory requirements to holders of both a Type Certificate (TC) and
a Production Certificate (PC) issued under part 21.\4\ ACSAA further
mandated that the FAA include certain requirements in its implementing
regulations. The FAA proposes amendments to part 5 in accordance with
this legislation.
---------------------------------------------------------------------------

    \4\ Section 102(a)(1) of ACSAA.
---------------------------------------------------------------------------

    Lastly, requiring SMS for certain commercial operators, and design
and manufacturers would more closely align the FAA's SMS requirements
with ICAO Annex 19; therefore, this proposed rule would increase U.S.
alignment with other civil aviation authorities that are also
implementing SMS requirements in accordance with ICAO Standards and
Recommended Practices.\5\
---------------------------------------------------------------------------

    \5\ Several major civil aviation authorities have established or
are in the process of establishing SMS requirements for air
operators, air traffic management, airports, and maintenance
organizations, including the European Union Aviation Safety Agency
(EASA), Brazil, Canada, Japan, New Zealand, and Australia. Fewer
countries have design and manufacturing organizations and,
therefore, they have not established SMS requirements for those
entities. However, New Zealand, Japan, and EASA have established SMS
requirements for design and manufacturing organizations.
---------------------------------------------------------------------------

B. Summary of the Proposed Rule

    An SMS requires four essential components--safety policy, safety
risk management, safety assurance, and safety promotion. Additionally,
an SMS requires that an organization document the system itself and
maintain any records produced under that system. In this NPRM, the FAA
proposes to expand the applicability of the SMS requirements to include
additional entities, add new requirements to part 5, and amend existing
regulations in parts 5, 21, 91, and 119. Several of these proposed
amendments respond to the statutory mandate in ACSAA.
    Specifically, the FAA proposes to expand the applicability of part
5 beyond part 121 operators to include part 135 operators, Sec.  91.147
air tour operators, and certain certificate holders under part 21.
These entities would receive the greatest safety benefits of an SMS as
they are best situated to prevent future incidents and aviation
accidents.
    In response to the statutory requirements in ACSAA, the FAA
proposes to add a requirement for each SMS to include a code of ethics
that applies to all employees and clarifies that safety is the highest
priority. Consistent with ACSAA, the FAA also proposes to revise the
existing requirement for a confidential employee reporting system by
adding a provision to ensure that employees can report without concern
of reprisal.
    Additionally, the FAA proposes several amendments to part 5 that
are intended to increase the effectiveness of SMS, including several
new requirements. The FAA proposes to require organizations to develop
a system description, which is a summary of aviation-related processes
and activities and a description of interfacing persons that contribute
to the safety of the organization's aviation-related products and
services. The FAA proposes to add information that must be considered
during the system analysis, which is conducted when a person applies
safety risk management. Specifically, the FAA proposes to require
persons to consider the interfaces of the system in conducting the
system analysis. The FAA also proposes to require persons who identify
hazards to notify interfacing persons who are best able to address or
mitigate the hazard. To account for these new requirements, the FAA
proposes conforming amendments to the SMS documentation and
recordkeeping requirements to ensure organizations document the system
description and retain all communications concerning the notification
of hazards to interfacing persons. Furthermore, the FAA proposes
several amendments to part 5, including a revision to the definition of
``hazard'' to ensure it encompasses aviation incidents as well as
accidents, the relocation of the definitions to the beginning of the
subpart to facilitate readability of part 5, and the removal of all
references to the term ``certificate holder'' to conform to the new
applicability proposed by the rule. The FAA also proposes amendments to
certain regulations in parts 21, 91, and 119 to conform with, and
enable the implementation of, the proposed requirements in part 5.
    The following table summarizes the proposed provisions and provides
the proposed section(s) of the Federal Aviation Regulations that
contains the provisions.
    Table 1 provides a summary of the major provisions of this proposed
rule.

                                      Table 1--Summary of Major Provisions
----------------------------------------------------------------------------------------------------------------
                                               Proposed 14 CFR Sec.
                Provision                            affected                 Summary of proposed provision
----------------------------------------------------------------------------------------------------------------
Applicability of part 5..................  5.1, 21.55, 21.135, 21.147,  Expand the applicability of part 5
                                            91.147, and 119.8.           (currently limited to part 121
                                                                         operators) to make SMS requirements
                                                                         applicable to part 135 operators, Sec.
                                                                          91.147 air tour operators, and certain
                                                                         holders of a TC \6\ and PC issued under
                                                                         part 21 for the same product.\7\
Definition of ``Hazard''.................  5.3 \8\....................  Revise the definition of ``hazard'' to
                                                                         also mean conditions or objects with
                                                                         the potential to cause or contribute to
                                                                         an incident.
General Requirements.....................  5.5(b).....................  Add a new requirement to develop and
                                                                         maintain a system description that
                                                                         includes information about the aviation
                                                                         products or services provided by the
                                                                         person and a description of the
                                                                         interfacing persons that contribute to
                                                                         the safety of the person's products or
                                                                         services.
Part 121 operators.......................  5.7(a).....................  Require part 121 operators to revise
                                                                         their current SMS in accordance with
                                                                         the new requirements of part 5 and to
                                                                         submit revisions no later than 12
                                                                         months after effective date of final
                                                                         rule.
Applicants seeking to operate under part   5.7(b).....................  Require applicants seeking to operate
 121.                                                                    under part 121 to develop and implement
                                                                         an SMS in accordance with part 5 and to
                                                                         submit a statement of compliance as
                                                                         part of the certification process.
Part 135 operators and Sec.   91.147 air   5.9(a).....................  Require part 135 operators and Sec.
 tour operators.                                                         91.147 air tour operators to develop
                                                                         and implement an SMS in accordance with
                                                                         part 5 and to submit a statement of
                                                                         compliance no later than 24 months
                                                                         after the effective date of final rule.
Applicants seeking to operate under part   5.9(b).....................  Require applicants seeking to operate
 135 or Sec.   91.147.                                                   under part 135 or Sec.   91.147 to
                                                                         develop and implement an SMS in
                                                                         accordance with part 5 and to submit a
                                                                         statement of compliance as part of the
                                                                         certification or LOA process.
Holders of PC and TC for the same product  5.11.......................  Require any person that holds a PC and
                                                                         TC \9\ issued under part 21 for the
                                                                         same product to develop an SMS in
                                                                         accordance with part 5; to submit an
                                                                         implementation plan for FAA approval no
                                                                         later than December 27, 2024; and to
                                                                         implement the SMS no later than
                                                                         December 27, 2025.
TC holders applying for a PC for same      5.13.......................  Require TC holders \10\ who apply for a
 product.                                                                PC for the same product to develop an
                                                                         SMS in accordance with part 5, to
                                                                         submit an implementation plan for FAA
                                                                         approval during the certification
                                                                         process, and to implement the SMS no
                                                                         later than one year after obtaining FAA
                                                                         approval.
TC holders who have a licensing agreement  5.15(b)....................  Require TC holders, who have a licensing
 to allow other persons to obtain a PC.                                  agreement to allow other persons to
                                                                         obtain a PC, to develop an SMS in
                                                                         accordance with part 5; to submit an
                                                                         implementation plan for FAA approval no
                                                                         later than December 27, 2024; and to
                                                                         implement the SMS no later than
                                                                         December 27, 2025.
TC holders who enter into a licensing      5.15(c)....................  Require TC holders, who enter into a
 agreement to allow other persons to                                     licensing agreement to allow other
 obtain a PC.                                                            persons to obtain a PC, to develop an
                                                                         SMS in accordance with part 5, to
                                                                         submit an implementation plan for FAA
                                                                         approval when providing written
                                                                         licensing agreements to the FAA, and to
                                                                         implement the SMS no later than one
                                                                         year after obtaining FAA approval.
Implementation plans.....................  5.17.......................  Require implementation plans filed under
                                                                         Sec.  Sec.   5.11, 5.13, and 5.15 to
                                                                         include a description of how the person
                                                                         intends to comply with part 5, and for
                                                                         the person to make available, upon
                                                                         request, all necessary information and
                                                                         data that demonstrates that the SMS has
                                                                         been or will be implemented in
                                                                         accordance with the implementation
                                                                         plan.
Safety policy............................  5.21(a)(7).................  Add a new requirement for the safety
                                                                         policy to include a code of ethics that
                                                                         is applicable to all employees,
                                                                         including management personnel and
                                                                         officers, which clarifies that safety
                                                                         is the organization's highest priority.
System analysis and hazard identification  5.53(b)(5).................  Add a new requirement for the person
                                                                         conducting the system analysis to
                                                                         consider the interfaces of the system.
Safety performance monitoring and          5.71(a)(7).................  Revise the requirement for a
 measurement.                                                            confidential employee reporting system
                                                                         by adding a provision to ensure that
                                                                         employees can report without concern of
                                                                         reprisal.
                                           5.71(c)....................  Add a new requirement for holders of
                                                                         both a TC and PC for the same product
                                                                         to submit a summary of the confidential
                                                                         employee reports to the FAA every 6
                                                                         months.
Notification of hazards to interfacing     5.94.......................  Add a new section to: (1) require the
 persons.                                                                person who identifies a hazard to
                                                                         notify the interfacing person who, to
                                                                         the best of their knowledge, could
                                                                         address the hazard or mitigate the
                                                                         risk; and (2) require procedures for
                                                                         reporting and receiving hazard
                                                                         information with interfacing persons.
SMS documentation........................  5.95(c)....................  Add a new requirement for SMS
                                                                         documentation to include the system
                                                                         description.
SMS records..............................  5.97(d)....................  Add a new requirement for persons to
                                                                         retain records of all communications
                                                                         provided under new Sec.   5.94 for a
                                                                         minimum of 24 consecutive calendar
                                                                         months.
----------------------------------------------------------------------------------------------------------------

C. Summary of Costs and Benefits
---------------------------------------------------------------------------

    \6\ As discussed in Section V.A.3 of the preamble, the FAA
considers a licensee of a TC to be equivalent to a holder of a TC.
For purposes of this table, each reference to ``TC holder'' or
``holder of a TC'' is intended to encompass ``licensee of a TC.''
Thus, part 5 would also apply to a person who holds a PC and is a
licensee of a TC for the same product.
    \7\ Part 5 would also apply to applicants seeking to operate
under part 135 or Sec.  91.147, and to an applicant for a PC who is
the holder or licensee of a TC for the same product.
    \8\ The definitions and general requirements currently exist in
Sec. Sec.  5.5 and 5.3, respectively. The FAA proposes to relocate
the definitions to Sec.  5.3 and the general requirements to Sec.
5.5.
    \9\ See footnote 7.
    \10\ See footnote 7.
---------------------------------------------------------------------------

    The FAA estimated quantified annualized costs of $51.3 million
using a 7 percent discount rate over a 5-year period of analysis. The
costs represent resources to develop and implement an SMS. Mitigation
costs to reduce or eliminate any hazards identified by an SMS, which
are yet to be identified and thus unknown, are not quantified in the
analysis. The FAA evaluated benefits qualitatively. The benefits are
the value that would result from avoided fatalities, injuries, aircraft
damage, and investigation costs. Please see Section VII. for more
information.

II. Authority for This Rulemaking

    The FAA's authority to issue rules on aviation safety is found in
Title 49 of the United States Code (U.S.C.). Subtitle I, Section 106
describes the authority of the FAA Administrator. Subtitle VII,
Aviation Programs, describes in more detail the scope of the Agency's
authority.
    In 2010, Congress mandated that the FAA conduct rulemaking to
require part 121 operators to implement an SMS in the Airline Safety
and Federal Aviation Administration Extension Act of 2010 (Pub. L. 111-
216, 124 Stat. 2366).\11\
---------------------------------------------------------------------------

    \11\ See Sec. 215(a).
---------------------------------------------------------------------------

    Subsequently, Congress enacted section 102(a)(1) of the Aircraft
Certification, Safety, and Accountability Act (Pub. L. 116-260; 134
Stat. 2309, hereafter referred to as ACSAA), on December 27, 2020.
Section 102, titled ``Safety Management Systems,'' requires the FAA to
initiate a rulemaking to require manufacturers that hold both a TC and
a PC issued pursuant to 49 U.S.C. 44704 have an SMS consistent with
Standards and Recommended Practices established by ICAO and contained
in Annex 19 to the

Convention on International Civil Aviation (61 Stat. 1180), for such
systems. Section 102 of ACSAA requires the implementing regulations to
include a confidential employee reporting system through which
employees can report hazards, issues, concerns, occurrences, and
incidents, without concern for reprisal for reporting, and a code of
ethics. This rulemaking proposes regulations in accordance with those
requirements.
    Additionally, given this clear Congressional support for SMS as a
safety concept, the FAA is proposing to use its discretion under the
following authorities to proactively extend SMS requirements to part
119 certificate holders authorized to operate under part 135 and LOA
holders operating under Sec.  91.147.
    This rulemaking is promulgated under the authority described in 49
U.S.C. 106(f), which establishes the authority of the Administrator to
promulgate regulations and rules. This rulemaking is also promulgated
under 49 U.S.C. 44701(a)(5) (``The Administrator of the Federal
Aviation Administration shall promote safe flight of civil aircraft in
air commerce by prescribing regulations and minimum standards for other
practices, methods, and procedure the Administrator finds necessary for
safety in air commerce and national security''); 44701(a)(2)(A) (``The
Administrator of the Federal Aviation Administration shall promote safe
flight of civil aircraft in air commerce by prescribing regulations and
minimum standards in the interest of safety for inspecting, servicing,
and overhauling aircraft, aircraft engines, propellers, and
appliances''); 44702(a) (``The Administrator of the Federal Aviation
Administration may issue airman certificates, design organization
certificates, type certificates, production certificates, airworthiness
certificates, air carrier operating certificates, airport operating
certificates, air agency certificates, and air navigation facility
certificates''); and 44704(a)(1) (``The Administrator of the Federal
Aviation Administration shall issue a type certificate for an aircraft,
aircraft engine, or propeller, or for an appliance specified under
paragraph (2)(A) of this subsection when the Administrator finds that
the aircraft, aircraft engine, propeller, or appliance is properly
designed and manufactured, performs properly, and meets the regulations
and minimum standards''). Additionally, this rulemaking is consistent
with the requirements of 49 U.S.C. 44701(d)(1)(A) (``When prescribing a
regulation or standard under [49 U.S.C. chapter 447], the Administrator
shall consider the duty of an air carrier to provide service with the
highest possible degree of safety in the public interest.'').
    Finally, 49 U.S.C. 44701(c) directs the Administrator to ``carry
out this chapter in a way that best tends to reduce or eliminate the
possibility or recurrence of accidents in air transportation.'' This
rulemaking is intended to require certain entities that are regulated
under the foregoing statutory authorities to develop and maintain an
SMS to improve the safety of their operations. The development and
implementation of SMS may enhance safety in air transportation and
design and manufacturing so that persons can proactively identify and
mitigate safety hazards, thereby reducing the possibility or recurrence
of accidents in air transportation consistent with the mandate in Sec.
44701(c). For these reasons, the proposed regulations are within the
scope of the FAA's authority and are consistent with Congress's mandate
that the FAA exercise its authority to proactively--not just
reactively--promote safe flight of civil aircraft and to reduce or
eliminate hazards that could result in accidents in air transportation.

III. Purpose of This Rulemaking

    An SMS is a formal, top-down, organization-wide approach to
managing safety risk and ensuring the effectiveness of safety risk
controls. It includes systematic procedures, practices, and policies
for the management of safety risk. An SMS is a management system
integrated into an organization's operations that enforces the concept
that safety should be managed with as much emphasis, commitment, and
focus as any other critical area of an organization.
    The purpose of an SMS is to reduce incidents, accidents, and
fatalities by aiding organizations in identifying hazards and
mitigating those hazards before they lead to an incident or accident.
Anecdotal evidence from SMS voluntary program participants indicates
that SMS improves the safety of organizations.\12\ Although the authors
of a 2012 study by the Australian Transport Safety Board acknowledged
the prevalence of earlier studies that were inconclusive, they
ultimately concluded that ``recent studies have demonstrated that well-
implemented SMS, especially those where the organisation invests effort
into the SMS, are associated with enhanced safety performance.'' \13\
Research by Tinsley, Dillon, and Madsen \14\ suggests that the
attention an SMS would bring to seemingly smaller events, or near
accidents, could prevent catastrophes. Tinsley, Dillon, and Madsen
studied near accidents in dozens of companies across industries and in
laboratory simulations. They determined that multiple near accidents
preceded and foreshadowed every disaster and business crisis they
studied, and that most near accidents were ignored. The authors found
that identifying near accidents and correcting root causes are good
investments for an organization. Similarly, in examining large U.S.
commercial airlines that operated from 1990 to 2007, Madsen, Dillon,
and Tinsley \15\ found that for airlines to continue to improve safety
they must attend to the yet undiscovered or unrecognized risks in the
system without waiting for an accident to bring attention to them.
Additionally, the FAA contends that expanding the implementation of SMS
in the aviation industry would increase overall safety for each entity
using an SMS, as well as requiring communication across the aviation
industry with respect to identified hazards.
---------------------------------------------------------------------------

    \12\ As described in the Regulatory Impact Analysis for the
rule, for example, one participant noted that the compressed
executive awareness time of new safety related issues resulted in
formal management actions occurring in less than 90 days for low-
risk issues and within hours for high-risk issues. Another
participant noted that they have a seen a substantial drop in the
major risk categories that they track.
    \13\ Thomas, Dr. Matthew J.W.; A Systematic Review of the
Effectiveness of Safety Management Systems, Australian Transport
Safety Bureau, 2012, p. 27. https://www.atsb.gov.au/sites/default/files/media/4053559/xr2011002_final.pdf.
    \14\ Tinsley, Catherine H. et al., How to Avoid Catastrophe.
Harvard Business Review, Brighton, 2011. https://hbr.org/2011/04/how-to-avoid-catastrophe.
    \15\ Madsen, Peter et al., Airline Safety Improvement Through
Experience with Near-Misses: A Cautionary Tale. Risk Analysis, May
2016, Vol. 36, No. 5.
---------------------------------------------------------------------------

    The FAA previously forecasted a reduction in fatalities as a result
of implementing SMS for part 121 certificate holders.\16\ The FAA still
expects an overall reduction in fatalities, however quantifying the
effects of part 5 requirements on part 121 certificate holders cannot
be done at this time due to inadequate data. The data available for
2020 and 2021 is both significantly reduced and atypical due to the
COVID-19 pandemic.
---------------------------------------------------------------------------

    \16\ See Section V (Regulatory Notices and Analysis) starting on
page 1318 of 14 CFR part 5 final rule published January 8, 2015, 80
FR 1308.
---------------------------------------------------------------------------

    Over the last few decades, accidents involving commercial aviation
operators

have decreased.\17\ Despite an overall reduction in accidents, the FAA
has determined that many of the accidents involving part 135 and Sec.
91.147 operators could have been effectively mitigated by the presence
of an SMS. These accidents highlight the systemic improvement
opportunities to safety as described in the Regulatory Impact Analysis
(RIA) for this rulemaking. According to NTSB data, from 2015 to 2019,
there were 215 accidents involving part 135 operators, with a total of
121 fatalities,\18\ as well as 33 accidents involving air tour
operators operating under Sec.  91.147, with a total of 16
fatalities.\19\ The FAA identified 35 of these accidents involving part
135 operators and four accidents involving Sec.  91.147 operators which
involved fatalities and serious injuries that could have been mitigated
had those operators implemented an SMS. Additional accidents not
involving fatalities or serious injuries may also have been avoided.
The FAA also identified several accidents across parts 91, 121, and 135
involving design and production issues that resulted in fatalities and
serious injuries that could have been mitigated or prevented if the
design and manufacturing organizations involved had implemented an
SMS.\20\ A full listing of each accident used to inform the analysis of
this rulemaking (including a brief description of the accident, a
quantified estimate of the probability of mitigation through the
adoption of SMS, and a rationale for estimated probability) is included
in Appendix A to the RIA.
---------------------------------------------------------------------------

    \17\ U.S. Air Carrier Safety Data, https://www.bts.gov/content/us-air-carrier-safety-data. Accessed March 22, 2022.
    \18\ National Transportation Safety Board. U.S. Civil Aviation
Accident Rates. 2022. Available at: https://www.ntsb.gov/safety/Pages/research.aspx.
    \19\ Data file of sightseeing accidents provided by the NTSB
April 2020.
    \20\ These accidents include those identified by NTSB accident
numbers: DCA19MA086, ERA18LA199, DCA18MA142, ERA18FA120, DCA17FA021,
WPR16FA153, DCA16FA199, ERA16FA185, WPR16FA055, DCA16FA013,
CEN15MA290, ERA15FA254, and DCA15FA073.
---------------------------------------------------------------------------

    Given the rapid development, growth, and increasing complexities of
the airspace, the FAA believes that SMS requirements should extend to
parties that play a critical role in the design, manufacturing, and
operation of aircraft. ACSAA requires the FAA to include holders of
both a TC and a PC among those organizations that should be required to
implement an SMS. Applying SMS to commuter and on-demand air carriers,
air tours, and the manufacturers responsible for design and production
of products would continue to reduce incidents, accidents, and
fatalities and improve safety in aviation by requiring these
organizations to proactively identify hazards, assess risk of those
hazards, and develop and implement mitigations, as necessary. The FAA
anticipates that this systemic safety effort will have a measurable
effect on the reduction in fatalities as described in the RIA for this
rulemaking. ICAO, other civil aviation authorities, industry advisory
groups, and the NTSB all agree that the use of an SMS improves safety.
An SMS has been implemented by each part 121 operator, and many other
organizations have implemented an SMS following the FAA's SMS Voluntary
Program. The FAA has also implemented SMS within many of its own
organizations. The FAA's own experience has shown that organizations
that have an SMS may:
     Increase safety of products or services by identifying and
addressing problems before they occur.
     Improve data-informed decision making to prioritize
resource allocation.
     Enhance communication regarding safety by using common,
consistent terminology within the organization and throughout the
industry.
     Strengthen the organization's safety culture.
    Further, expansion of the SMS requirements would increase U.S.
alignment with other civil aviation authorities that are also
implementing SMS requirements in accordance with ICAO Standards and
Recommended Practices. With an SMS, a U.S. company would have an
improved ability to operate internationally due to better alignment
with ICAO standards and recommended practices. Furthermore, a U.S.
company without an SMS could even be barred from doing business in a
country where the civil aviation authority requires them to have an
SMS.
    To date, SMS requirements have mainly focused on internal
identification and mitigation of risk within an organization. However,
the FAA is proposing to augment these requirements to encourage a more
collaborative approach in which persons required to have an SMS share
hazard information with each other and work together to identify and
address hazards and safety issues. To enable this more collaborative
approach, this proposal includes requirements to share hazard
information with other organizations, which are intended to ensure that
relevant information is shared with the person in the best position to
address the hazard. The expanded applicability and hazard information
sharing among interfacing organizations would enable a network of
organizations working collaboratively to manage risk, thereby enhancing
the safety benefits of SMS by assuring that hazards are communicated
and mitigated effectively.

IV. Background

A. SMS Aviation Rulemaking Committees

    The FAA chartered two ARCs composed of industry stakeholders to
provide advice on implementing SMS in aviation regulations, including
parts 21, 91, 121, 125, 135, 141, 142, and 145. The industry
stakeholders on these ARCs included individual companies and
associations representing operators, design and manufacturing
organizations, repair stations, and training organizations. These ARCs
expressed industry support for SMS and recommended that the FAA publish
rules requiring use of SMS.
1. SMS ARC (2009)
    On February 12, 2009, the FAA chartered the SMS ARC with membership
from across the aviation industry to evaluate the public comments
submitted in response to an Advance Notice of Proposed Rulemaking
(ANPRM) on potential rulemaking requiring certain part 21, 119, 121,
125, 135, 141, 142, and 145 certificate holders to develop an SMS \21\
and provide its recommendations regarding further action the agency
should consider in developing and implementing SMS requirements.\22\
---------------------------------------------------------------------------

    \21\ 74 FR 36414, July 23, 2009.
    \22\ Safety Management System (SMS) Aviation Rulemaking
Committee; Order 1110.152, Washington, DC. Available at: https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/SMSARC-2122009.pdf (as of March 15, 2022).
---------------------------------------------------------------------------

    In its report, the ARC recommended the FAA issue regulations on SMS
and that those regulations apply to certificate holders under 14 CFR
parts 21, 119, 121, 125, 135, 141, 142, and 145, as well as operators
under 14 CFR part 91 subpart K. This broad applicability would more
closely align with ICAO Standards and Recommended Practices. The ARC,
however, recommended phased promulgation of SMS regulations and that
the FAA prioritize new SMS regulations based on the potential safety
benefit, as well as industry experience and regulatory oversight
readiness. The FAA addressed these recommendations by first focusing on
part 121 by promulgating 14 CFR part 5 on January 8, 2015 and proposing
a rule to require airports certificated under part 139 to implement an
SMS. Although the SMS requirements in part 5 currently apply only to
part 121 operators, the FAA

explained in that rulemaking that part 5 was designed for broader
application and the FAA intended for the SMS requirements to apply to
other FAA-regulated entities in the future.\23\ The rulemakings
implementing SMS for part 121 operators and airports certificated under
part 139 are addressed in more detail in Section IV.C. of this NPRM
preamble.
---------------------------------------------------------------------------

    \23\ NPRM, ``Safety Management Systems for Part 121 Certificate
Holders,'' 75 FR 68224, 68232 (November 5, 2010).
---------------------------------------------------------------------------

    When considering this proposed rule, the FAA explored applying part
5 SMS requirements to additional certificate holders and operators
consistent with the ARC recommendations, as well as any certificate
holders and operators required by ICAO Standards and Recommended
Practices in ICAO Annex 19 (i.e., parts 21, 135, 141, 142, 145, and
some operators under part 91). However, in this proposed rule the FAA
is choosing to address the most impactful parts to which ICAO Annex 19
is applicable (part 135 [operators], part 21 [design and
manufacturing], and Sec.  91.147 [air tours]).
    The ARC also recommended that the FAA provide additional
protections for SMS safety information and proprietary data. As
discussed in more detail in Section V.H., the FAA has addressed data
protection in this proposal.
    The ARC recommended alignment with the SMS framework developed by
ICAO in Annex 19, which would facilitate SMS requirement compatibility
with States actively engaged in developing and adopting their own SMS
requirements. The FAA designed part 5 consistent with this
recommendation.
    The ARC recommended that the FAA recognize existing systems and
processes. For instance, some operators have systems for internal
auditing, employee reporting, and revising manuals, which could be
leveraged in the development of their SMS. The FAA is incorporating
this recommendation in this proposed rule by encouraging certificate
holders and LOA holders to leverage their existing systems and
processes to meet the requirements. In addition, the FAA is proposing
guidance material that describes how existing systems and processes may
align with SMS requirements.
    Further, the ARC expressed concern regarding the potential impact
of SMS requirements on small businesses. The FAA addressed this
concern. Just as existing part 5 requirements are performance-based and
scalable, each revision proposed in this NPRM is also intended to be
scalable. Scalability is discussed further in Section V.F. of this NPRM
preamble. In addition, the proposed guidance accompanying this NPRM
should assist certificate holders in appropriately scaling the
implementation of SMS to fit their operations. The guidance material is
discussed further in Section VI. of this preamble.
2. Part 21 SMS ARC (2012)
    The Part 21 SMS ARC, established on October 5, 2012,\24\ evaluated
improvements to the effectiveness and efficiency of existing
``certification procedures for products and parts,'' and the benefits
of incorporating SMS in the design and manufacturing environment. The
FAA received the ARC's final report in October 2014.\25\
---------------------------------------------------------------------------

    \24\ 14 CFR 21/Safety Management Systems Aviation Rulemaking
Committee Charter. Available at: https://www.faa.gov/regulations_policies/rulemaking/committees/documents/media/Part21ARC-10052012.pdf (visited March 15, 2022).
    \25\ Part 21/Safety Management Systems (SMS) Aviation Rulemaking
Committee to the Federal Aviation Administration: Recommendations on
Certification Procedures for Products and Parts. October 5, 2014.
---------------------------------------------------------------------------

    The ARC recommended establishing regulatory requirements for
implementing SMS for design and production approval organizations that
would be consistent with the part 5 requirements.\26\ The ARC
recommended that SMS requirements apply to organizations that design or
manufacture products (under a TC or a PC) and to those that design or
manufacture articles (under a technical standard order authorization or
parts manufacturer approval), or that make changes to products (under a
supplemental type certificate) that could directly prevent continued
safe flight and landing if they fail.\27\
---------------------------------------------------------------------------

    \26\ At the time the ARC submitted its final report in 2014, the
FAA had not finalized the proposed part 5 requirements. Part 5
became effective March 9, 2015.
    \27\ Part 21/Safety Management Systems (SMS) Aviation Rulemaking
Committee to the Federal Aviation Administration: Recommendations on
Certification Procedures for Products and Parts, page 31. October 5,
2014.
---------------------------------------------------------------------------

    The FAA analyzed the ARC's recommendation and developed an
alternative (see Alternative 1 in Section VII.A.5.) to the current
proposal that may have met the intent of the ARC's recommendation by
extending SMS requirements beyond holders of both a TC and a PC for the
same product. This alternative would require SMS for design and
production approval holders who design or produce products typically
used for compensation or hire with some exceptions (described in
Alternative 1 in Section VII.A.5.). As part of this alternative, the
FAA considered permitting design and production approval holders to
apply to be excluded from part 5 requirements if the failure of the
article or product alteration would have little or no impact on the
continued safe flight and landing of the aircraft. After analyzing the
costs and benefits, the FAA determined that there were costs to
including these design and production approval holders, but was unable
to estimate the magnitude of benefits. The analysis of this alternative
is provided in Section VII.A.5. As a result, the FAA is not proposing
to adopt the full scope of the ARC's recommendation in this NPRM at
this time.

B. National Transportation Safety Board Recommendations

    The NTSB first recommended in 1997 that transportation
organizations implement an SMS, and early recommendations were aimed at
improving safety in the maritime industry. Since then, a number of NTSB
investigations related to various modes of transportation, including
aviation, have cited organizational factors contributing to accidents
and have recommended SMS as a way to prevent future accidents and
improve safety. The NTSB issued 18 recommendations regarding SMS for
aviation organizations over a 15-year period, spanning 2007 through
2021.\28\ These recommendations covered commercial operations under 14
CFR parts 121 and 135, revenue passenger carrying business operations
under part 91, and certificate holders under part 21. Eight of the 18
NTSB recommendations were issued to the FAA.\29\
---------------------------------------------------------------------------

    \28\ NTSB Safety recommendations: A-07-010 (2007), A-09-016
(2009), A-09-089 (2009), A-09-098 (2009), A-09-106 (2009), A-12-062
(2012), A-12-063 (2012), A-14-105 (2014), A-14-106 (2014), A-16-036
(2016), A-19-028 (2020), A-19-036 (2019), A-19-038 (2019), A-20-025
(2020), A-21-007 (2021), A-21-013 (2021), A-21-014 (2021), and A-21-
048 (2021).
    \29\ NTSB Safety recommendations: A-07-010 (2007), A-09-089
(2009), A-09-016 (2009), A-16-036 (2016), A-19-028 (2020), A-21-013
(2021), A-21-014 (2021), and A-21-048 (2021).
---------------------------------------------------------------------------

    The NTSB regularly publishes a Most Wanted List, which ``highlights
transportation safety improvements needed now to prevent accidents,
reduce injuries, and save lives.'' \30\ The NTSB 2021-2022 Most Wanted
List recommended that the FAA, ``Require and Verify the Effectiveness
of Safety Management Systems in all Revenue

Passenger-Carrying Aviation Operations.'' \31\
---------------------------------------------------------------------------

    \30\ 2021-2022 NTSB Most Wanted List of Transportation Safety
Improvements, www.ntsb.gov/mwl.
    \31\ 2021-2022, NTSB Most Wanted List of Transportation Safety
Improvements, Require and Verify the Effectiveness of Safety
Management Systems in all Revenue Passenger-Carrying Aviation
Operations, https://www.ntsb.gov/Advocacy/mwl/Pages/mwl-21-22/mwl-as-01.aspx.
---------------------------------------------------------------------------

C. Safety Management System Rulemaking Efforts

1. Safety Management Systems for Domestic, Flag, and Supplemental
Operations
    On July 23, 2009, the FAA published an ANPRM to solicit public
comments on whether certain 14 CFR part 21, 119, 121, 125, 135, 141,
142, and 145 certificate holders, product manufacturers, applicants,
and employers (product/service providers) should be required to develop
an SMS.\32\ Subsequently, on August 1, 2010, Congress enacted the
Airline Safety and Federal Aviation Administration Extension Act of
2010 (Pub. L. 111-216, 124 Stat. 2366), which directed the FAA to
conduct rulemaking to ``require all part 121 air carriers to implement
a safety management system.'' \33\ To meet the rulemaking deadlines
mandated by the Act, the FAA decided not to immediately address SMS for
other product/service providers.\34\ The FAA limited the SMS rulemaking
project to part 121 air carriers, issuing an NPRM on November 5, 2010,
\35\ and subsequently withdrawing the ANPRM.\36\
---------------------------------------------------------------------------

    \32\ ANPRM, ``Safety Management Systems,'' 74 FR 36414. July 23,
2009.
    \33\ See Sec. 215(a).
    \34\ See ``Safety Management System; Withdrawal,'' 76 FR 14592.
March 17, 2011.
    \35\ 75 FR 68224.
    \36\ See id.
---------------------------------------------------------------------------

    On January 8, 2015, the FAA published the Safety Management Systems
for Domestic, Flag, and Supplemental Operations Certificate Holders
final rule (SMS for part 121 final rule) requiring operators authorized
to conduct operations under part 121 to develop and implement an SMS to
improve the safety of their aviation related activities.\37\ The final
rule added part 5 to Title 14 of the CFR, creating the SMS requirements
for part 121 certificate holders, modeled on the ICAO SMS framework in
ICAO Annex 19 and consistent with the 2009 ARC recommendations. The
requirements in part 5 were meant to be applicable to organizations of
various sizes and complexities, as well as adaptable to fit the
different types of organizations in the air transportation system and
operations within an individual company. The final rule also modified
14 CFR part 119 to specify applicability and implementation of the new
SMS framework in part 5 for part 119 certificate holders authorized to
conduct operations under part 121. Part 121 operators met the
requirement to have an SMS acceptable to the FAA by 2018. The FAA has
seen continuous improvement in 121 operators' use of SMS to manage the
safety of their operations and, therefore, is proposing to expand part
5 applicability with this rulemaking.
---------------------------------------------------------------------------

    \37\ 80 FR 1308. The FAA published technical amendments on
January 13, 2015 (80 FR 1584) and May 25, 2017 (82 FR 24009) to
correct a date and a reference in the rule, respectively.
---------------------------------------------------------------------------

2. Safety Management Systems for Part 139 Airports
    On July 14, 2016, the FAA published the ``Safety Management System
for Certificated Airports'' supplemental notice of proposed rulemaking
[(81 FR 45872)] (Airports SMS SNPRM). The Airports SMS SNPRM proposed
to require airports that meet certain criteria to develop and implement
an SMS in the airport's movement and non-movement areas. The FAA is
working to finalize that rule.

D. Aircraft Certification, Safety, and Accountability Act

    The Lion Air and Ethiopian Airlines accidents involving the Boeing
737 MAX resulted in several investigations, not only of the accidents,
but also of the FAA's oversight and certification processes. One such
investigation, convened by the FAA in April of 2019, was the Boeing 737
MAX Flight Control System Joint Authorities Technical Review. The Joint
Authorities Technical Review included representatives from the National
Aeronautics and Space Administration, the FAA, and several foreign
civil aviation authorities. One of the Joint Authorities Technical
Review recommendations was that the FAA encourage applicants to have a
system safety function, such as a safety management system, that is
independent from their design organization.\38\
---------------------------------------------------------------------------

    \38\ Joint Authorities Technical Review (JATR), Boeing 737 MAX
Flight Control System: Observations, Findings, and Recommendations.
October 11, 2019.
---------------------------------------------------------------------------

    Subsequently, on December 27, 2020, Congress enacted ACSAA, which
set forth a variety of reforms intended to address certain safety
standards relating to the aircraft certification process. Section 102
of ACSAA requires that the FAA promulgate rules to require holders of
both a TC and a PC issued under 14 CFR part 21 to implement an SMS.
ACSAA also establishes a timeline for those certificate holders to
adopt an SMS (i.e., no later than four years after the date of
enactment, December 27, 2024), and it establishes certain requirements
for the rulemaking, including a confidential employee reporting system
through which employees can report hazards, issues, concerns,
occurrences, and incidents without concern for reprisal for reporting,
and a code of ethics.

E. International Movement Toward SMS

    ICAO Annex 19, Safety Management, establishes a framework for
member States to develop and implement SMS requirements within their
State's rules. Several member States, including the U.S., started
developing and implementing SMS requirements within their countries
after Annex 19 First Edition was published in July 2013 and became
applicable in November 2013.\39\ Annex 19 currently requires States to
establish requirements for SMS for international commercial air
transportation, design and manufacturing, maintenance, air traffic
services, training organizations, and certified aerodromes, as well as
SMS criteria for international general aviation operators of large or
turbojet airplanes.
---------------------------------------------------------------------------

    \39\ The Second Edition of Annex 19 was published in July 2016
and became applicable in November 2019.
---------------------------------------------------------------------------

    Member States continue to make progress in developing,
implementing, and maintaining requirements for SMS that are aligned
with ICAO's SMS standards and recommended practices, including
certificating authorities in Canada, Brazil, the United Kingdom, Japan,
Australia, and Europe (European Union Aviation Safety Agency (EASA)).
In the EASA regulatory framework, SMS is mandatory for certificated
operators of airplanes and helicopters authorized to conduct commercial
air transportation. Additionally, as a result of recent EASA rulemaking
efforts, SMS will also be applicable for continuing airworthiness of an
aircraft and its components. The EASA also adopted a rule for design
and production organizations (part 21), which will become applicable on
March 7, 2023.\40\
---------------------------------------------------------------------------

    \40\ European Union Aviation Safety Agency Commission
Implementing Regulation (EU) 2022/203 of 14 February 2022.
---------------------------------------------------------------------------

    FAA also notes that other civil aviation authorities and interested
parties are initiating evaluations to determine the effects of SMS post
implementation. Two evaluations of note are discussed as follows.
    In 2019 Transport Canada Civil Aviation published an evaluation of
the impact of SMS on aviation safety 10 years after it was mandated for
airline operators, private operators, approved

maintenance organizations that service airline operator aircraft, air
navigation services, and aerodromes/airports/heliports.\41\ The
evaluation findings were based on multiple lines of evidence, including
a survey of nearly 1800 aviation industry stakeholders (operators,
approved maintenance organizations, aerodromes), case studies involving
eight enterprises and interviews. The evaluation found that many
organizations have implemented policies and practices associated with
an effective SMS, specifically, non-punitive reporting, executive
commitment and hazard identification and mitigation. The evaluation
found notable buy-in to SMS among those surveyed. Although accident
trends declined over the 10-year evaluation period it was also noted
that a lack of objective data limited ability to show safety
improvement directly attributable to SMS because of the difficulty in
separating other effects that may also benefit safety.
---------------------------------------------------------------------------

    \41\ Evaluation of Safety Management Systems in Civil Aviation--
Transport Canada, July 2019. Available at: https://tc.canada.ca/sites/default/files/2021-02/evaluation-safety-management-systems-civil-aviation.pdf.
---------------------------------------------------------------------------

    A Griffith University (Queensland Australia) doctoral thesis paper
evaluated the impact of SMSs on safety performance for commercial
aviation operations using two case studies.\42\ Legislation in
Australia for the implementation of an SMS for regular public transport
Air Operator Certificate holders was mandated by the Civil Aviation
Safety Authority in 2009 with phased implementation to be complete by
2011.
---------------------------------------------------------------------------

    \42\ The Impact of Safety Management Systems on Safety
Performance: Commercial Aviation Operations--Griffith University
thesis paper. April 2015. Available at: https://research-repository.griffith.edu.au/handle/10072/367145.
---------------------------------------------------------------------------

    The first case study examined SMSs in the international general
aviation and charter operation sector while the second case study
reviewed SMSs in the Australian airline sector. In the first case
study, researchers conducted an analysis of de-identified Flight Safety
Foundation general aviation and charter sector audit findings. A total
of 7,625 audit findings were reviewed from 2011-2014 from a population
of 117 operators. The determination of safety performance was not
possible for this sample population using a conventional accident rate
metric due to the lack of availability of flight departure data.
However, the study concluded that safety performance had improved since
SMS implementation, showing a uniform decrease in the number of
negative audit findings. Although the study did not control for the
number and thoroughness of audits performed during the years under
study, the study did present qualitative findings by year and
discipline, independent of the number of audits conducted. The study
further concluded that a decrease in findings for the last two years of
the study were likely due to the improvements brought about by growing
and maturing safety management systems.\43\
---------------------------------------------------------------------------

    \43\ Yeun, Richard Chee Kin, The Impact of Safety Management
Systems on Safety Performance: Commercial Aviation Operations, Ph.D.
Thesis (Queensland Australia: Griffith University, 2015), See table
6.5, pp 122-123. https://hdl.handle.net/10072/367145.
---------------------------------------------------------------------------

    In the second case study, researchers conducted a review of airline
SMSs in Australia by comparison of Civil Aviation Safety Authority
safety audit indicators for the sampled population before and after the
implementation of SMS. The study concluded that the empirical evidence
indicates that SMSs improve the safety performance of commercial
aviation operations. The study also showed that SMS safety assurance
plays the most critical role in an effective SMS; its associated
subcomponents of continuous improvement, safety performance monitoring
and measurement, and management of change have the highest net
influence of all the SMS components. FAA notes that the Griffith
University study conclusions and multiple correlation analyses are
based on a short timeframe (three years of fully implemented SMS) and
study of longer timeframes involving more mature SMSs is desirable.

V. Discussion of the Proposal

    The FAA proposes changes to part 5 to further the safety of flights
for compensation or hire and passenger carrying operations. To that
end, the FAA considers that overall aerospace system safety would be
increased by requiring entities beyond part 121 operators to implement
SMS, including other operators that fly for compensation or hire and
the designers and manufacturers of products used in the system. The FAA
envisions these safety management systems to be scalable to the size
and complexity of the organization, and to not be unduly burdensome. By
requiring entities that span the disparate sectors of aviation from
manufacturing and design to operations to implement an SMS, the FAA
seeks to create a network of organizations that speak the same language
of safety management and can better communicate with one another and
share information about any hazards they identify during the course of
their business. Although some part 121 operators may communicate with
one another voluntarily at this time, the FAA considers that there
would be greater safety benefit if all aviation organizations, from the
manufacturer to the operator, were to communicate hazard information to
one another. The FAA considers that the benefits of safety management
systems are derived from each of the components of an SMS and that the
proposed changes to part 5 would assist in maximizing the potential of
an SMS to increase safety across the aerospace system.

A. Applicability

    Part 5 currently applies only to persons authorized to conduct
operations under part 121. The FAA proposes to amend Sec.  5.1 and
expand the applicability of part 5 to: (1) any person authorized or
applying to conduct operations under part 135 or Sec.  91.147; (2) any
person that holds or applies for a PC issued under part 21 for a
product for which they are the TC holder or licensee; and (3) TC
holders who license the TC for production.
    Although the FAA recognizes the value of the variety of voluntary
safety programs, their optional nature and lack of comprehensive
application of all elements of part 5 may not yield as much safety
benefit as a mandatory SMS that complies with all proposed requirements
of part 5. Therefore, to ensure that the minimum standard is met, the
FAA is proposing to broaden the application of part 5 SMS requirements.
1. Part 135 Operators
    As described in Section III, the FAA identified a number of
accidents involving part 135 operators which resulted in fatalities and
serious injuries that could have been mitigated through SMS. These
accidents involved both passenger-carrying and cargo-only operations.
Each of these accidents stemmed from different circumstances; however,
the accidents analyzed were a representative cross section of the
overall circumstances that were present in the balance of total part
135 accidents that occurred. Therefore, the FAA considers that an SMS
would have been effective in similar accidents among those not
analyzed.
    The FAA proposes to require all part 119 certificate holders
authorized to operate under part 135 and applicants for those
certificates to develop and implement an SMS that meets the part 5
requirements. This aligns the proposed part 5 applicability with ICAO
Annex 19 and with other civil aviation

authorities that generally do not differentiate between size and
complexity of air carriers. SMS is necessary for safety of air
transportation generally because anyone who engages in air
transportation must understand the hazards associated with their
operation, effectively assess the risks, and understand how to mitigate
those risks. The identification of hazards through SMS may include
analyzing the potential risk associated with crewmember fatigue when
compounded by variations in individual 135 operations, such as
scheduling variances, frequency of operations, distance, and number of
pilots.\44\
---------------------------------------------------------------------------

    \44\ See report from the Part 135 Pilot and Duty Rules Aviation
Rulemaking Committee dated July 2, 2021, a copy of which has been
placed in the docket for this rule.
---------------------------------------------------------------------------

    The FAA considered excluding part 135 operators who use only one
pilot-in-command in their operations from the SMS requirements.
Approximately 31 percent (594) of the part 135 operators use one pilot-
in-command. These operators have between 1 and 7 aircraft. Similar to
most part 135 operators, these operators might also meet the size
standard for small businesses (see Section VII.B for details). However,
as all part 135 operators conduct air transportation of passengers and
cargo, the FAA determined such exclusion would not be in the interest
of safety as evidenced by the part 135 accidents discussed in Section
III that could have been mitigated through an SMS (including those
involving only one pilot-in-command).
    As a fundamental matter, the flying public expects safe carriage
from operators offering flight services for hire. Irrespective of
whether an operator employs one pilot or a thousand, that company has
the same responsibility to conduct safe operations. Part 135 operators
employing just a single pilot are not immune to accident or serious
injury; the FAA's review of NTSB reports from 2015 to 2020 showed that
part 135 operators employing just a single pilot were involved in five
accidents involving a fatality or serious injury. This record
demonstrates that very small and single pilot part 135 operators
continue to face insufficiently addressed safety hazards that cause the
loss of life. More importantly, the FAA concluded that these operators
could have used basic components of SMS, such as establishing safety
policies, performing safety risk management to assess risk and develop
controls, and using safety assurance to verify risk control
effectiveness to address hazards that contributed to these accidents.
These SMS elements, which require the operator to proactively monitor
its practices, procedures, and how it makes decisions, are especially
important for small organizations Small organizations by definition
have fewer people and, as a result, have fewer opportunities for checks
and balances on decisions that can affect safety. SMS addresses this by
requiring small operators to create a structure for proactively
monitoring their decision-making processes and addressing deficiencies.
Very small operators may implement SMS requirements differently than
larger operators. For example, with respect to Sec.  5.93, small
operators will have fewer employees to communicate with than large
operators where personnel may have a more narrow set of
responsibilities and less awareness of all operations. At one end of
the spectrum, a one-person operator would have a system for documenting
their own hazard information, actions, mitigations, safety performance,
etc. for future reference. At the other end of the spectrum, a large
organization would have a system capable of documenting and sharing
information with larger groups of people. In particular, certain
aspects of SMS such as developing more routine expectations for
monitoring and responding to hazards may be particularly beneficial for
smaller operators. The FAA requests comment regarding how SMS might
present unique opportunities or challenges for smaller organizations.
    The five accidents involving single-pilot part 135 operators
between 2015 and 2020 resulted in 5 fatalities and 4 serious
injuries.\45\ Appendix A of the RIA describes how SMS could help avoid
similar accidents in the future. The following discussion describes
three of those accidents and identifies how having an SMS could have
addressed the hazards contributing to the accidents. In each of these
cases, if the operator had invested in an appropriately scaled SMS
program on the front end, it could have avoided property damage,
injury, and loss of life on the back end.
---------------------------------------------------------------------------

    \45\ NTSB accident numbers: CEN18FA215, ANC18LA046, ANC16FA017,
ANC17TA015, and CEN17FA100.
---------------------------------------------------------------------------

    According to the NTSB, the probable cause of accident CEN18FA215
was the pilot's decision to fly over the river at a low altitude and
his failure to maintain clearance with wires during low-level flight.
The FAA examined the effect SMS would be expected to have on this
accident and determined that SMS would have enabled the operator to
identify hazards along waterways. As a result of conducting safety risk
management (Sec. Sec.  5.51-5.55) the organization would develop a
safety risk control that would help prevent the accident from
occurring. Specifically, the risk control might have established a
minimum altitude above known or presumed obstructions (Sec.  5.55(c)).
The operator might have also established a policy or control that
whenever the pilot is operating around wires, the pilot would mark the
location of the wires on a map. This risk control would have helped to
mitigate the risk of the pilot inadvertently flying into the wires
because these additional controls would help to ensure the pilot's
situational awareness regarding the location of the wires in relation
to the aircraft. In this case, the pilot would monitor the safety
performance (Sec.  5.71), by validating the location of the wires on
the map and updating the information as appropriate. This is one way
that the operator could verify that risk controls were appropriately
applied and effective. In a small organization the operator could
communicate (Sec.  5.93) the control to others in the organization
face-to-face, via email, or other methods that the company regularly
uses to communicate with its employees.
    The probable cause of accident ANC18LA046 was the pilot's selection
of an unsuitable takeoff area with unfavorable wind conditions, which
resulted in the airplane's inability to maintain a climb. The FAA
determined that the effect SMS would have had on this accident was
similar to that of accident CEN18FA215. In this case, had the operator
conducted safety risk management (Sec. Sec.  5.51-5.55), it would
likely have developed risk controls to ensure safer operations (Sec.
5.55(c)). For example, the operator could establish tools for a go/no-
go decision customized for its operations. This could include special
procedures specific to the environment or operations. Another risk
control might be establishing procedures to ensure that the equipment
is appropriate for the environment. Both of these controls would be
documented using standard information tools already in use within the
company. Conducting safety risk management could have included
identifying and evaluating company approved unimproved landing areas to
include ingress/egress routes and minimum acceptable weather
performance limits could mitigate these hazards. In this case, safety
performance monitoring (Sec.  5.71) might include periodic review of
operations in non-standard environments to ensure that the controls
provide the intended effect.

Similar to the previous example, the operator could communicate (Sec.
5.93) the control to others in the organization face-to-face, via
email, or other methods that the company regularly uses to communicate
with its employees.
    The probable cause of accident ANC16FA017 was the pilot's
inadvertent turn toward terrain that was higher-than-expected while
trying to avoid poor visibility conditions and his subsequent attempt
to clear terrain, which reduced the airspeed and led to the exceedance
of the airplane's critical angle of attack and an aerodynamic stall and
spin was the probable cause of accident. The FAA determined that SMS
would have had an effect on this accident. In this case, with an SMS,
the operator would have conducted safety risk management (Sec. Sec.
5.51-5.55), and it would likely have identified hazards with low
visibility hazards and mountainous terrain. The operator might develop
safety risk controls regarding route suitability (Sec.  5.55(c)). These
risk controls could include setting higher alternative weather minimums
and selection of alternative routes that are consistent with the
aircraft's performance, along with training to support these risk
controls. The operator would also monitor its safety performance (Sec.
5.71), by validating that the higher alternative weather minimums and
alternative routes are appropriate mitigations. Similar to other
examples, the operator could communicate (Sec.  5.93) the control to
others in the organization face-to-face, via email, or other methods
that the company regularly uses to communicate with its employees.
    In addition to addressing risk in this segment of the part 135
population, the FAA considers that a part 119 certificate holder
authorized to operate under part 135 with only one pilot-in-command
receives the same privileges and authorization as any other size or
complexity part 119 certificate holder authorized to operate under part
135, and should therefore be subject to the same requirements with
regard to SMS. The FAA recognizes that the implementation of part 5
requirements, applicable to all part 135 operators, must remain
scalable to the size and complexity of the organization. (For more
information regarding scalability, please refer to Section V.F.).
    Some part 119 certificate holders may be authorized to operate
under both parts 121 and 135. The proposal would extend the SMS
requirements to operations conducted by those combination certificate
holders authorized to operate under both parts 121 and 135. Certificate
holders that already have an SMS in place for only their part 121
operations would have to implement SMS for their part 135 operation.
2. Section 91.147 Letter of Authorization Holders
    The FAA is proposing to extend the SMS requirements to all holders
and applicants of LOAs issued under Sec.  91.147 to enhance the safety
of commercial air tour operations. Most operations for compensation or
hire are conducted pursuant to a part 119 certification, however,
nonstop commercial air tours operated under a Sec.  91.147 LOA conduct
operations for compensation or hire without a part 119 certificate.
Because air tours operated under Sec.  91.147 carry passengers for
compensation or hire, the FAA is proposing to apply part 5 to these
operations.
    The FAA considered excluding some smaller Sec.  91.147 LOA holders
from this proposal (those conducting fewer than 100 flights per year).
The FAA does not collect data on number of flights conducted under
Sec.  91.147 LOAs; however, approximately 54 percent (373) have only
one aircraft registration. These LOA holders might also meet the size
standard for small businesses, but the FAA does not have data to make
this determination either (see Section VII.B for details). Consistent
with the approach proposed for part 135 operators who use only one
pilot-in-command in their operations, the FAA believes such an
exception would not meet the safety objective.
    FAA review of NTSB accident reports from 2015 to 2020 identified
one accident involving a fatality or serious injury in the segment of
Sec.  91.147 LOA holders conducting fewer than 100 flights per year. As
discussed in Section V.A.1, small operators bear the same
responsibility for safety as large operators.
    The Sec.  91.147 LOA holder accident resulted in 5 fatalities
involving an operator conducting air tours.\46\
---------------------------------------------------------------------------

    \46\ NTSB accident number: ERA18MA099.
---------------------------------------------------------------------------

    The NTSB indicated that the probable cause of this accident was the
operator's use of a passenger harness/tether system, which caught on
and activated the floor-mounted engine fuel shutoff lever. As a result,
the aircraft lost engine power in-flight and ditched into the East
River. In addition, the operator allowed outside influence on company
decisions. Moreover, they failed to address foreseeable safety risks
associated with the harness/tether device.
    If the operator had an SMS in place the company would have
conducted safety risk management prior to installing the harness/tether
device. While conducting safety risk management, the hazard of the
harness/tether device potentially shutting off the fuel lever would
have been identified under Sec.  5.53(a) and analyzed under Sec.
5.55(a). Based on that analysis, the company would assess the safety
risk (Sec.  5.55(b)) and implement appropriate safety risk controls
(Sec.  5.55(c)). After developing safety risk controls, the
organization would communicate them to the appropriate flight crews and
maintenance personnel (Sec.  5.93) face-to-face, via email, or other
methods that the company regularly uses to communicate with its
employees.
    In addition, all Sec.  91.147 LOA holders are authorized to provide
the same service, regardless of their size. Improving aviation safety
for all passenger-carrying operations conducted for compensation or
hire would require all Sec.  91.147 LOA holders to meet part 5
requirements for SMS, so long as the implementation of those
requirements remains scalable to the size and complexity of the
organization. (For more information regarding scalability, please refer
to Section V.F.). As the requirements are scalable, so too will be
compliance costs.\47\ And, as evidenced by the accident discussed,
there are safety benefits to be achieved from implementation of SMS
even among these smaller operators.
---------------------------------------------------------------------------

    \47\ For example, in Section VII.B, Regulatory Flexibility Act,
the FAA finds that the annual costs as a percentage of receipts for
smaller operators with 1 to 9 aircraft is about 0.1% to 0.4%
compared to those with a larger number of aircraft between 100 to
500 is about 0.2% to 0.3%.
---------------------------------------------------------------------------

    The FAA is aware that there are Sec.  91.147 LOA holders with low
flight volume, as well as 135 operators who use only one pilot-in-
command in their operations.\48\ The FAA seeks supporting information
and data regarding whether this applicability should be limited to a
certain subset of Sec.  91.147 LOA holders and part 135 operators, and
if so, how?
---------------------------------------------------------------------------

    \48\ There are some Sec.  91.147 LOA holders that conduct
infrequent air tours even though that is not their primary business
(e.g., flight schools, aerial applicators, or electronic news
gathering, etc.).
---------------------------------------------------------------------------

3. Part 21 Certificate Holders
    The FAA is proposing to require holders of both a TC and a PC
issued for the same product under part 21 to develop and implement an
SMS that complies with the part 5 requirements. Section 102(a)(1) of
ACSAA requires the FAA to initiate a rulemaking proceeding to require
that, ``manufacturers that hold both a type certificate and a
production certificate issued pursuant to section

44704 of title 49, United States Code, where the United States is the
State of Design and State of Manufacture, have in place an SMS that is
consistent with the standards and recommended practices established by
ICAO.'' As discussed in Section IV.E., Annex 19 requires ICAO member
States to mandate SMS for the management of safety risk in design and
production of aviation products. To meet the statutory requirement and
align U.S. aviation design and manufacturing organizations with safety
management practices followed by other international organizations
complying with Annex 19, the FAA proposes to require holders of both a
TC and a PC issued for the same product under part 21 to develop and
implement an SMS that complies with the part 5 requirements.
    Additionally, the FAA proposes to apply part 5 to: (1) persons who
hold or are licensees of a TC and are seeking a PC for that same
product, and (2) persons who hold a PC for a product for which the
person is a licensee of the TC. This approach ensures that there are no
gaps in SMS applicability for part 21 certificate holders because TC
licensees have the same privileges as TC holders under Sec.  21.45 and
the same reporting requirements as TC holders under Sec.  21.3 for
failures, malfunctions, and defects. Therefore, in the context of an
SMS, the FAA considers a licensee of a TC to be equivalent to a holder
of a TC and should be required to comply with the requirements of this
proposed rule.
    Through ACSAA, Congress intended for SMS requirements to apply to
entities that design and manufacture products. The FAA further
recognizes that critical decisions are made during design and
development that impact the safety of aviation products. Consequently,
companies that design a product and allow other companies to produce
that product should be held to the same regulatory requirements as a
person holding both the TC and a PC for the same product. Upon
evaluating section 102(a)(1) of ACSAA, the FAA determined that the
implementing regulations combined with the regulatory framework of part
21 could enable certain persons to avoid the proposed requirements by
licensing their TC to another person to obtain a PC.\49\ To address
this gap, the FAA proposes to apply part 5 to TC holders who license
their TC to other persons in accordance with Sec. Sec.  21.47 and
21.55.
---------------------------------------------------------------------------

    \49\ Under Sec. Sec.  21.47(a) and 21.55, a person who holds a
TC for a product may enter into a written licensing agreement to
allow another person to use that TC to obtain a PC. As a result, the
person obtaining the PC would be allowed to use the TC holder's
design approval to manufacture the product. Therefore, some business
relationships result in one person holding the TC and a different
person holding the PC for the same product.
---------------------------------------------------------------------------

    The FAA notes that there may be persons who manufacture products
under a TC in accordance with part 21 Subpart F. Section 21.123(g)
requires these persons to obtain a PC within 6 months after the date of
issuance of the TC. Therefore, these persons would be required to
comply with the proposed rule because they have applied for a PC.
    The FAA also notes that there may be persons who hold a PC for a
supplemental type certificate. A supplemental type certificate is a
design approval for a modification to a product. A person who holds a
PC for a supplemental type certificate may produce articles used to
modify the product but cannot produce a complete product. Under the
proposed rule, part 5 would not apply to either a supplemental type
certificate holder or a PC holder for a supplemental type certificate
because these design and production approvals are for modifications to
a product and not for complete products. Similarly, there are persons
who may hold a TC and a PC that is designated for the production of
parts or articles only. The proposed rule would not apply because the
PC is only for the production of a part or an article and not for the
same product.
    The FAA considered applying part 5 to certain persons holding other
design and production approvals such as technical standard order
authorizations, parts manufacturer approvals, and supplemental type
certificates, an approach that would be consistent with the Part 21 SMS
ARC recommendation. Although there may be safety benefits to applying
SMS to this larger population, the FAA could not substantiate these
benefits. The FAA invites comments as to whether part 5 should apply to
all holders of TCs, PCs, supplemental type certificates, technical
standard order authorizations, or parts manufacturer approvals. The FAA
requests that comments specify whether any exceptions should be made in
the event that the FAA extends part 5 to these design and production
approval holders and what those exceptions should entail. The FAA
further requests information and data related to the safety benefits or
impact of applying part 5 to additional design and production approval
holders beyond the applicability in this proposed rule.

B. General Requirements and Definitions

1. Definitions
    The FAA is proposing to move the definitions in part 5 from current
Sec.  5.5 to proposed Sec.  5.3 and to amend the definitions of
``hazard'' and ``safety policy.'' Currently, the definition of
``hazard'' in part 5 is ``a condition that could foreseeably cause or
contribute to an aircraft accident as defined in 49 CFR 830.2.'' In
Annex 19, ICAO defines ``hazard'' as ``a condition or an object with
the potential to cause or contribute to an aircraft incident or
accident.'' \50\ The FAA is proposing to amend the definition of the
term ``hazard'' to ``a condition or an object with the potential to
cause or contribute to an incident or aircraft accident, as defined in
49 CFR 830.2,'' to further align with the internationally-recognized
definition published by ICAO. Although the FAA previously did not
include incidents in the definition of hazard,\51\ the FAA now
considers that the definition of hazard should include anything that
affects or could affect the safety of aviation operations, not just
those conditions or objects that could result in serious injury, death,
or substantial damage. This is because many of the same circumstances
that result in an incident could just as easily result in an accident.
As discussed in Section III, Tinsley, Dillon, Madsen studied near
accidents in dozens of companies across industries and in laboratory
simulations. They determined that multiple near accidents preceded and
foreshadowed every disaster and business crisis they studied, and that
most near accidents were ignored. The authors found that ``surfacing
near misses and correcting root causes is one [of] the soundest
investments that organizations can make.'' \52\ Therefore, the FAA is
proposing to add to the definition of hazard, the term ``incident'' as
defined in 49 CFR 830.2. The FAA believes that this proposed change
would improve both international alignment and the identification of
hazards. 49 CFR 830.2 defines ``incident'' as an occurrence other than
an accident, associated with the operation of an aircraft, which
affects or could affect the safety of operations. The FAA does not
define a

threshold or de minimis standard for what could affect aviation safety.
The FAA believes that organizations are in the best position to
determine what occurrences would have the ability to impact the safety
of their products or services, and as a part of developing their SMS
they may define thresholds for what might entail a reportable incident
that could affect aviation safety.\53\ They are also in the best
position to determine the processes and tools they can use to
communicate this information to their employees. Because safety risk
management and safety assurance are ongoing and iterative processes,
the organization will continually improve its ability to identify,
communicate, and mitigate hazards, preventing them from resulting in
incidents or accidents.
---------------------------------------------------------------------------

    \50\ International Civil Aviation Organization, Annex 19 to the
Convention on International Civil Aviation, Safety Management,
Second Edition, pp. 1-2. July 2016.
    \51\ 80 FR 1308.
    \52\ Tinsley, Catherine H., Robin L. Dillon, and Peter M.
Madsen. How to Avoid Catastrophe. Harvard Business Review. https://hbr.org/2011/04/how-to-avoid-catastrophe. 2011.
    \53\ For additional discussion on hazard information sharing,
please see section V.C.4.b. (Safety Promotion (Subpart E), Proposed
amendments to subpart E).
---------------------------------------------------------------------------

    In addition, the FAA proposes two other modifications to the
definition of ``hazard'' to more closely align with the ICAO
definition: (1) while objects are a subset of the term ``condition,''
the FAA is proposing to add the term ``object,'' and (2) the FAA is
proposing to change ``foreseeably'' to ``the potential to.'' These
changes would align the definition more closely with the ICAO
definition of ``hazard''.
    In addition, the FAA proposes to amend the definition of safety
policy to change ``certificate holder'' to ``person.'' This proposed
change would make the definition consistent with the revised
applicability proposed by this rule, which includes persons who are not
certificate holders (e.g., LOA holders).
2. Requirement To Develop and Implement SMS
    As discussed previously, the FAA is proposing to move the General
Requirements for SMS currently contained in Sec.  5.3 to proposed Sec.
5.5. For clarity, the FAA would reorganize proposed Sec.  5.5 into
three subparagraphs: (1) general requirements for the components of an
SMS, (2) a new proposed requirement for a system description, and (3)
the requirement to maintain an SMS in accordance with part 5.
Additionally, the FAA is proposing to remove certain provisions from
current Sec.  5.3 as unnecessary.
    The FAA proposes to add a requirement for all persons subject to
part 5 to develop a system description. A system description is a
summary of aviation-related processes and activities and a description
of interfacing persons that contribute to the safety of the aviation-
related products and services provided. The FAA considers that
organizations that receive the aviation-related products and services
could contribute to the safety of those products and services and
would, therefore, be identified among the interfacing persons.
    A system description is important because organizations are often
made up of a complex network of interactions involving different
internal departments that also interface with external organizations
that contribute to the safe operation of the organization. For an
organization to have an effective SMS, it must fully understand its
aviation-related business operations and activities that impact the
management of aviation safety. Without that understanding, the SMS is
unlikely to be clearly defined, adequately applied, or effectively
executed. The use of an organization system description would also
enable the organization to have a clear picture of its many
interactions.
    Although the focus of this regulation is on aviation, some
organizations might also extend their SMS to their non-aviation related
activities, such as security and occupational safety and health issues.
If an organization elects to do so, the FAA would only conduct
oversight of the SMS related to its aviation functions. The FAA is
proposing to limit the application of SMS only to the aviation-related
activities conducted by the organization under 14 CFR.
    The FAA also proposes to add a provision in Sec.  5.5(c) to make
clear that the SMS requirements in part 5 are continuing requirements.
For example, the requirements of part 5 do not cease to apply the
moment a person develops and implements an SMS. Rather, a person must
also maintain SMS in accordance with part 5. The new provision in
proposed Sec.  5.5(c) is not intended to impose a new requirement on
the regulated community; it is intended only to clarify the existing
requirements.
    Furthermore, to remove unnecessary rule text, the FAA proposes to
remove the provisions that are currently contained in Sec.  5.3(b) and
(c). Section 5.3(b), which requires the SMS to be maintained in
accordance with the recordkeeping requirements of Subpart F of part 5,
is unnecessary because the recordkeeping requirements of Subpart F
apply irrespective of this provision. Additionally, Sec.  5.3(c), which
requires compliance with the relevant regulatory requirements of 14
CFR, is unnecessary because persons must comply with applicable
regulatory requirements in 14 CFR irrespective of whether the FAA
expressly requires compliance in Sec.  5.3(c).
    The FAA also proposes to remove two requirements from current Sec.
5.3(a). First, the FAA proposes to remove the requirement for the SMS
to be submitted to the Administrator for acceptance. The proposal to
expand the applicability of part 5 has resulted in the FAA proposing
new regulations to address the additional entities that would be
covered by part 5, namely Sec. Sec.  5.7, 5.9, 5.11, 5.13, and 5.15.
These proposed regulations would set forth the requirements for each
regulated entity, including which documents the entity must submit to
the Administrator for acceptance or approval. Second, the FAA proposes
to remove the requirement for an SMS to be appropriate to the size,
scope, and complexity of the organization's operation. The FAA has
determined that this provision is unnecessary because the FAA's SMS
requirements are performance-based and scalable. As such, persons that
are required to develop an SMS under part 5 may scale their SMS to the
size and complexity of their organizations. The FAA does not need to
expressly require scalability in the regulations when the performance-
based requirements are designed for that purpose.

C. Components of Safety Management Systems

    An SMS is composed of four major components: (1) safety policy, (2)
safety risk management, (3) safety assurance, and (4) safety promotion.
Additionally, an SMS requires documentation and recordkeeping.
Currently, part 5 contains a subpart for each major component and a
subpart for documentation and recordkeeping. The proposed rule would
retain these subparts but includes proposed amendments to each one.
1. Safety Policy (Subpart B)
    Safety policy is the foundation for an SMS and must be documented
and communicated throughout the organization. All organizations must
define policies, processes, procedures, and organizational structures
to accomplish their safety objectives and goals. A documented safety
policy ensures that all employees of the organization are aware of
management's commitment to achieving the organization's safety
objectives and are aware of their own role in meeting the safety
objectives.

a. Summary of Current Requirements in Subpart B
    Subpart B of part 5 sets forth the requirements for the
organization's safety policy. The safety policy component of SMS
includes safety policy documentation, identification accountability and
authority in regard to safety, designation and responsibilities of
safety management personnel, and emergency response planning. Section
5.21 currently requires a documented safety policy that: (1)
establishes the organization's safety objectives, (2) includes a
commitment to fulfill those safety objectives, (3) contains a statement
concerning the necessary resources for implementation of the SMS, (4)
contains a safety reporting policy, (5) defines unacceptable behavior
and conditions for disciplinary action, and (6) establishes an
emergency response plan for transitioning from normal to emergency
operations.
b. Proposed Amendments to Subpart B
    The FAA is proposing to add a requirement to Sec.  5.21(a) that
would require the safety policy to include a code of ethics that
applies to all employees, including management personnel and officers.
The code of ethics would clarify that safety is the organization's
highest priority. This proposed requirement responds to section 102(f)
of ACSAA, which mandates that ``the regulations issued under subsection
(a) shall require a safety management system to include establishment
of a code of ethics applicable to all appropriate employees of a
certificate holder, including officers (as determined by the FAA),
which confirms that safety is the organization's highest priority.''
The FAA agrees that a code of ethics is beneficial to overall safety;
therefore, this proposal would fulfill that legislative mandate and
extend the requirement to all persons required to have an SMS.
    The FAA acknowledges that section 102(f) of ACSAA only requires the
FAA to apply the code of ethics requirement to certain part 21
certificate holders. However, to the greatest extent possible, the FAA
seeks consistency in the SMS requirements. Furthermore, the FAA
believes having a code of ethics, applicable to all employees of the
organization, would influence the safety culture of the organization.
If employees see their management engaged with safety as the highest
priority, then that same safety attitude would likely prevail
throughout the entire organization. Therefore, all persons required to
have an SMS would benefit from having a code of ethics that confirms
that safety is the organization's highest priority. For that reason,
the FAA is proposing to apply this requirement to all persons who would
be required to have a part 5-compliant SMS.
    Additionally, the FAA proposes minor amendments to subpart B
(Sec. Sec.  5.21 through 5.27) to reflect the new applicability
requirements of the proposed rule. Currently, these regulations use the
term ``certificate holder'' because part 5 applies to part 119
certificate holders authorized to conduct operations under part 121.
The FAA proposes to remove all references to ``certificate holder.''
Instead, the proposed rule refers to ``person'' to reflect the new
applicability set forth in proposed Sec.  5.1. Additionally, the FAA
proposes to amend the current requirements of Sec.  5.25 that refer
only to ``certificate(s)'' by adding a reference to ``Letter(s) of
Authorization.'' This would ensure that the requirements of Sec.  5.25
pertaining to the accountable executive apply to Sec.  91.147 LOA
holders.
2. Safety Risk Management (Subpart C)
    Another core component of an SMS is safety risk management. A
comprehensive SMS using safety risk management includes identifying
hazards, assessing risk, and developing risk controls to reduce or
eliminate risk associated with those hazards. Safety risk management
allows an organization to focus on the areas of greatest risk from a
safety perspective, taking into account system complexity and scope of
the operations, and allows the organization to implement appropriate
risk controls.
    Organizations must apply safety risk management when implementing
new or revising existing systems, developing operational procedures,
and to address hazards or ineffective controls identified through
safety assurance processes. For example, an organization would initiate
safety risk management after learning that certain de-icing operations
are not effective and use safety risk management to analyze the de-
icing operations.\54\ Safety risk management includes the following:
(1) system analysis, (2) identifying hazards associated with the
system, (3) analyzing the risk associated with the hazards, (4)
assessing risk associated with the hazards to determine acceptable
safety risk, and (5) controlling the risk of identified hazards when
necessary.
---------------------------------------------------------------------------

    \54\ There are existing regulations that prohibit a takeoff when
frost, ice, or snow (contamination) is adhering to the wings,
control surfaces, rotors or propellers of an aircraft and some
operations require a de-icing program [Sec. Sec.  91.527, 121.629,
and 135.227]. However, this example describes how operators can use
SMS to focus on certain de-icing operations that may not be
performing adequately and use a structured process to correct
performance deficiencies or identify design changes (additional
controls) using the SRM process. Current regulations prohibit
takeoff when certain conditions are met, but there are no
requirements for the company to look more broadly at the system and
determine if or when there is a systemic issue with de-icing.
---------------------------------------------------------------------------

    The system analysis serves as the initial source for hazard
identification when new systems are designed, when systems are revised,
and when new operational procedures are developed. The system analysis
also serves as a basis for describing and organizing information for
risk analysis when potential hazards or ineffective risk controls are
discovered in the safety assurance process. The system analysis
processes ensure that information regarding the function and purpose of
the system; the system's operating environment; outline of the system's
processes and procedures; and the personnel, equipment, and facilities
that the system requires for operation are analyzed so that hazards may
be appropriately identified.
    Next, an organization must use established processes to identify
hazards within the context of the system analysis. Any hazards that are
identified must be analyzed to the extent necessary to determine
possible outcomes associated with each hazard.
    The organization must then analyze the outcomes to determine the
severity and likelihood (i.e., risk) associated with the outcomes.\55\
Subsequently, the organization must assess the safety risk, which
requires the certificate holder to determine whether the safety risk is
acceptable or mitigation is required.
---------------------------------------------------------------------------

    \55\ As discussed in examples later in the preamble, this
analysis may be either qualitative or quantitative depending on the
size of the organization, the nature of the safety issue being
addressed, and availability of relevant data, among other factors.
SRM, as with all components of the SMS, should be scaled to fit the
organization. Since each safety issue is unique and each SMS is
developed to fit the organization, the FAA cannot make general
estimates or judgments regarding the amount of time or documentation
an organization would need for any given identified hazard.
Consistent with the intent to scale this rule to the organization
and the issue, the FAA would look to the organization to make that
determination on a case-by-case basis.
---------------------------------------------------------------------------

    Finally, the organization would develop and implement risk controls
where necessary. Risk controls may mitigate the outcomes by reducing
the likelihood or severity of the outcome or eliminating hazards by
design. After these controls are developed, but before being
implemented, the organization must assess whether the controls are
likely to be effective and would not introduce any new hazards. When
the

risk controls are assessed and determined to be acceptable, the
organization would implement them. Those controls would then be
continuously monitored under the processes developed under subpart D,
Safety Assurance, to ensure they are effective.
a. Summary of Current Requirements in Subpart C
    Subpart C of part 5 currently contains the safety risk management
requirements for an SMS. Section 5.51 establishes when a certificate
holder would need to apply safety risk management processes and
procedures to systems to identify the hazards and assess the risk
associated with the systems. Once a certificate holder determines that
the processes of safety risk management have been triggered under Sec.
5.51, it must conduct a system analysis, as required by Sec.  5.53.
Section 5.53 provides information that must be considered when
conducting a system analysis and identifying hazards. Currently, when
conducting a system analysis, the following must be considered: (1)
function and purpose of the system, (2) the system's operating
environment, (3) an outline of the system's processes and procedures,
and (4) the personnel, equipment, and facilities necessary for
operation of the system. Section 5.55 establishes the requirements for
safety risk assessment and controls.
b. Proposed Amendments to Subpart C
    The FAA is proposing several changes to subpart C. First, as in the
other subparts, the FAA is proposing to amend Sec.  5.51 and Sec.  5.55
by removing the term ``certificate holder'' to reflect the broadened
applicability of the proposed rule. Instead, these sections will refer
to ``any person required to have an SMS under this subpart.''
    Additionally, the FAA is proposing to add a new requirement, Sec.
5.53(b)(5), which would add the interfaces of the system to the list of
items that must be considered when conducting a system analysis in
accordance with Sec.  5.53. Interfaces are a point where two or more
operations, systems, subjects, or organizations connect and interact.
Interfaces can be internal (e.g., between functional groups in an
organization, between hardware/software components of the system being
analyzed, or between processes in the system being analyzed), or they
can be external (e.g., between organizations, between the system being
analyzed and other systems, or between a human using the system and the
system itself). The FAA is proposing to include the interfaces of the
system in the list of considerations required when performing the
system analysis in Sec.  5.53 because hazards can exist with
interfacing organizations, processes, or systems in the way the two
interfacing parts interact with each other. Understanding the
interfaces while conducting a system analysis is important because the
system analysis serves as the basis for identifying and analyzing
hazards and their associated risk. This addition would further improve
the ability of part 121 operators to analyze risk. As the aviation
system becomes more complex, dynamic, and integrated, understanding
these interfaces can assist in the identification of related hazards
and improve safety overall. An SMS that looks both inward and outward
is more effective at identifying hazards, a core function of any
operational SMS. The FAA emphasizes that under this proposed
requirement interfaces would be considered only to the extent that they
affect aviation safety. For example, the interface between a part 21
aircraft manufacturer's engineering and payroll departments would not
be considered when conducting a systems analysis under Sec.  5.53
because this interface would not impact the aviation safety of the
aircraft design. Additionally, the use of fall-arrestors in operator
maintenance facilities to protect individuals working on aircraft would
not be considered when conducting a system analysis in Sec.  5.53
either because the interface is an occupational safety and health
concern and does not directly affect the quality of work performed on
the aircraft.
3. Safety Assurance (Subpart D)
    Safety assurance verifies that the risk controls put into place
under safety risk management continue to be effective in managing risk
and that the organization's safety performance is meeting or exceeding
its safety objectives. Safety assurance has three elements: (1) safety
performance monitoring and measurement; (2) safety performance
assessment; and (3) continuous improvement.
    Safety performance monitoring and measurement requires the
development and maintenance of processes and systems that monitor
operational processes and collect data on the performance of the
organization. Within an organization, there are processes to collect
data, such as those to meet regulatory requirements or voluntary
reporting programs. In addition, there are external data sources, such
as FAA systems or information from other organizations. Safety
assurance processes must also include investigations of accidents and
incidents. Employee reporting systems provide another source of
information regarding the performance of the organization.
    The safety performance assessment is used to assess the
organization's performance against its safety objectives. The safety
performance assessment includes verifying the organization's compliance
with established safety risk controls. In addition, the safety
performance assessment identifies changes in operational environments,
potential new hazards, and ineffective controls. If the assessment
reveals new hazards or ineffective controls, the organization must
initiate safety risk management processes. The accountable executive
designated in accordance with Sec.  5.25 must review information from
the safety performance assessment on a regular basis.
    Finally, safety assurance requires continuous improvement. The
analysis and assessment functions of safety assurance are essential in
alerting the organization to significant changes in the operating
environment, possibly indicating a need for system change to maintain
effective risk controls. As a result, an organization with an SMS must
take steps to correct any safety performance deficiencies identified in
the assessments.
a. Summary of Current Requirements in Subpart D
    Safety assurance requirements for an SMS are established in subpart
D of part 5. Section 5.71 covers safety performance monitoring and
measurement, Sec.  5.73 covers safety performance assessment, and Sec.
5.75 covers requirements for continuous improvement. Pursuant to Sec.
5.71(a), a person must develop and maintain processes and systems to
acquire data with respect to its operations, products, and services to
monitor the safety performance of the organization. Section 5.71(a)
prescribes specific data that must be monitored, audited, evaluated,
and investigated. Among these requirements, Sec.  5.71(a)(7) requires
the processes and systems to include a confidential employee reporting
system in which employees can report hazards, issues, occurrences, and
incidents, as well as a means to propose solutions and safety
improvements. Once an organization with an SMS collects data through
its safety monitoring and measurement processes, it must use the
processes developed under Sec.  5.71(b) to analyze the data.
    Specifically, Sec.  5.73 requires the organization to conduct
assessments of its safety performance against its safety

objectives contained in its safety policy, which include reviews by the
accountable executive to: (1) ensure compliance with safety risk
controls, (2) evaluate the performance of the SMS, (3) evaluate the
effectiveness of safety risk controls, (4) identify changes in the
environment that may introduce new hazards, and (5) identify new
hazards. This analysis is used to transform raw data into usable
information that can support informed decision-making related to
safety.
    Finally, Sec.  5.75 requires the organization to establish and
implement processes to correct any safety performance deficiencies that
are identified in the safety performance assessment, which ensures
continuous improvement of the organization's safety performance.
b. Proposed Amendments to Subpart D
    The FAA is proposing to remove the word ``operations'' from Sec.
5.71(a) to clarify the requirement and avoid confusion with the term
``operator.'' In addition, the FAA is proposing to amend Sec. Sec.
5.71-5.75 by replacing ``certificate holder'' with ``person'' or ``a
person required to have an SMS under this subpart'' to reflect the
proposed broadened applicability of the rule.
    The FAA is also proposing to add the text, ``without concern of
reprisal for reporting'' to the confidential employee reporting system
requirement in current Sec.  5.71(a)(7) to meet section 102(e) of ACSAA
which mandates that the proposed regulation:
    [R]equire a safety management system to include a confidential
employee reporting system through which employees can report hazards,
issues, concerns, occurrences, and incidents. A reporting system under
this subsection shall include provisions for reporting, without concern
for reprisal for reporting, of such items by employees in a manner
consistent with confidential employee reporting systems administered by
the Administrator.
    Further, section 102 mandates that regulations required by the
statute shall also require holders of both a TC and a PC to submit a
summary of confidential employee reports received in accordance with
section 102 to the Administrator at least twice per year. Therefore,
the FAA is proposing to add a new Sec.  5.71(c), which would require
holders of both a TC and a PC for the same product to submit a summary
of the confidential employee reports received under Sec.  5.71(a)(7) to
the FAA once every six months.
    The FAA recognizes that its proposed rule language, which would
require holders of both a TC and a PC for the same product to submit a
summary of the confidential employee reports received under Sec.
5.71(a)(7) to the FAA once every 6 months, slightly differs from the
statutory language. Section 102(e) of ACSAA requires the summary of
reports to be submitted at least ``twice a year.'' As the statute does
not require a particular interval for submission of the ``twice a
year'' reports, the FAA finds it reasonable to require the reports
every six months as it would preclude a person from submitting the same
summary of reports twice in the same month and provide the FAA with an
opportunity to assess reports received throughout the year.
Accordingly, the FAA proposes to require the submission of these
reports once every 6 months.
    Although the ACSAA mandate was specific to part 21 certificate
holders with both a TC and a PC, employees of all persons required to
comply with part 5 should be protected from reprisal if they report
hazards, issues, concerns, occurrences, or incidents. Further, the
intent of the confidential system would be to provide some protection
to employees, so they are able to report issues without concern of
reprisal. Therefore, the FAA is proposing to apply the revision to the
employee reporting system requirements in Sec.  5.71(a)(7) to all
persons required to comply with part 5. The FAA notes that this
protection extends to the reporting of hazards, issues, concerns,
occurrences, or incidents. If the individual reporting is responsible
for creation of the hazard due to intentional actions or gross
negligence, this provision would not protect them from employment
actions based on the underlying offense.
    However, the FAA is proposing in Sec.  5.71(c) to require only
holders of both a TC and a PC for the same product to submit a summary
of the confidential employee reports to the FAA. This proposed
requirement is targeted at part 21 certificate holders as this
additional agency oversight is consistent with ACSAA. Summaries of
confidential employee reports submitted by certificate holders with
both a TC and a PC are protected from public disclosure by 49 U.S.C.
44735(a)(2), if the summaries are requested pursuant to the Freedom of
Information Act (FOIA). The FAA is not proposing to extend this
requirement to all persons required to have an SMS because the
information would not be protected under 49 U.S.C. 44735(a)(2) for
persons that are not covered by the ACSAA requirement.
4. Safety Promotion (Subpart E)
    Safety promotion requires communication to promote safety
practices. Safety promotion also requires that employees within an
organization attain and maintain the competencies necessary to perform
the duties relevant to the operation and performance of the SMS.
Training to maintain the SMS may vary depending upon the position and
responsibilities of the employee and may range from formal classroom
training to simple notices to employees. In addition to training, an
organization ensures that employees are aware of the SMS policies,
processes, and tools that are relevant to their responsibilities.
a. Summary of Current Requirements in Subpart E
    The requirements for safety promotion are established in subpart E
of part 5. Section 5.91 requires training for the employees of the
organization to ensure they attain and maintain the competencies
necessary to perform their duties relevant to the operation and
performance of the SMS. Section 5.93 requires the organization to
develop and maintain a means of communicating safety information that:
(1) ensures employees are aware of the SMS policies, processes, and
tools that are relevant to their responsibilities; (2) conveys hazard
information relevant to the employee's responsibilities; (3) explains
why safety actions have been taken; and (4) explains why safety
procedures are introduced or changed.
b. Proposed Amendments to Subpart E
    The FAA is proposing two amendments to the safety promotion
requirements of subpart E. First, as in the other subparts, Sec.  5.91
and Sec.  5.93 would be amended to reflect the broader applicability of
proposed part 5 by replacing ``certificate holder'' with ``any person
required to have an SMS under this part.'' Second, the FAA proposes to
add new Sec.  5.94 to require notification of hazards to interfacing
persons, and require any person subject to part 5 to develop and
maintain procedures for reporting hazard information to interfacing
persons and for receiving hazard information from other parties.
    In some circumstances, a hazard might be identified by a person who
is not in a position to address the hazard or there may be another
person who could implement a more effective mitigation. For example,
there may be a hazard identified by an aircraft operator that needs to
be addressed by an aircraft manufacturer to mitigate the hazard for
other operators. Similarly, an aircraft manufacturer may identify a
hazard for which crew procedures or training are an appropriate
mitigation to be taken by an operator. In Sec.  5.94, the FAA proposes

that persons required to have an SMS under part 5 must share
information regarding identified hazards with interfacing persons
identified in their system description under proposed Sec.  5.5 who, to
the best of their knowledge, could address the hazard or mitigate the
risk. Interfacing persons may be other private entities or a government
entity, including the FAA. For example, a person required to have an
SMS might determine that, to the best of their knowledge, the FAA's Air
Traffic Organization is the interfacing person who would be in the best
position to address the hazard. The number of business connections that
would fall within the scope of an ``interfacing person'' is not
limitless, however. An interfacing person would be an entity providing
a good or service connected to aviation safety. A payroll accounting
firm, for example, would not fall within this requirement. Within that
boundary, an organization's total number of interfacing persons would
likely be related to the size and complexity of the operation. The more