The Aviation Safety (Amendment) Regulations 2023

Amendment of Section B of Annex I to Commission Regulation (EU) No 748/2012

7.—(1) Section B (procedures for the CAA) is amended as follows.

(2) In Subpart A (general provisions)—

(a) in point 21.B.5—

(i) for point (a) substitute—

“(a) This section establishes the conditions for conducting the certification oversight and enforcement tasks as well as the administrative and management system requirements to be complied with by the CAA when exercising its tasks and responsibilities referred to in this Annex.”;

(ii) in point (b), for “Article 19 of Regulation (EC) No 216/2008” substitute “Article 76 Regulation (EU) 2018/1139”;

(b) after point 21.B.5 insert—

21.B.6    Immediate reaction to a safety problem

(a) Without prejudice to Regulation (EU) No 376/2014, the CAA must implement a system to appropriately collect, analyse and disseminate safety information.

(b) Upon analysing the safety information, the CAA must take adequate measures to address any safety problem identified.

(c) The CAA must immediately notify measures taken under point (b) to all persons who need to comply with them under Regulation (EU) 2018/1139.”;

(c) for point 21.B.25 (including the heading) substitute—

21.B.25    Management system

(a) The CAA must establish and maintain a management system, including at least the following:

1. documented policies and procedures to describe the organisation, the means and methods for establishing compliance with Regulation (EU) 2018/1139. Those policies and procedures must be kept up to date, and must serve as the basic working documents within the CAA for all its related tasks;

2. sufficient personnel to perform its tasks and discharge its responsibilities, together with a system to plan the availability of personnel to ensure proper completion of all tasks;

3. qualified personnel that have the necessary knowledge and experience and training to perform their allocated tasks and receive initial and recurrent training to ensure continuing competency;

4. adequate facilities and office accommodation for personnel to perform their allocated tasks;

5. a means of monitoring compliance of the management system with the relevant requirements and the adequacy of the procedures, including an internal audit process and a safety risk management process. This must include a system for feedback of audit findings to the senior management of the CAA to ensure the implementation of corrective actions as necessary;

6. a person with responsibility to the senior management of the CAA for compliance monitoring.

(b) The CAA must, for each field of activity, including the management system, appoint one or more persons with the overall responsibility for the management of the relevant task.”;

(d) for point 21.B.30 (including the heading) substitute—

21.B.30    Allocation of tasks to qualified entities

(a) The CAA may allocate tasks related to the initial certification or to the continuing oversight of products and parts and persons subject to Regulation (EU) 2018/1139 to qualified entities. When allocating tasks, the CAA must:

1. ensure it has a system in place to continuously assess compliance of the qualified entity with Annex VI to Regulation (EU) 2018/1139. That system and the assessment results must be documented;

2. establish a written agreement with the qualified entity, approved by both parties at the appropriate management level, which specifies:

(i) the tasks to be performed;

(ii) the declarations, reports and records to be provided;

(iii) the technical conditions to be met when performing such tasks;

(iv) the related liability coverage;

(v) the protection given to the information acquired when carrying out such tasks.

(b) The CAA must ensure that the internal audit process and the safety risk management process established under point 21.B.25(a)(5) covers all the certification and continuing oversight tasks performed by the qualified entity on its behalf.”;

(e) for point 21.B.35 (including the heading) substitute—

21.B.35    Changes in the management system

(a) The CAA must have a system in place to identify changes that affect its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139. That system must enable the CAA to take action necessary to ensure that its management system remains adequate and effective.

(b) The CAA must, in a timely manner, update its management system to reflect any changes to Regulation (EU) 2018/1139 to ensure its effective implementation.”;

(f) omit point 21.B.40;

(g) for point 21.B.55 (including the heading) substitute—

21.B.55    Record keeping

(a) The CAA must establish a record-keeping system that allows the adequate storage, accessibility and traceability of:

1. the documented policies and procedures of the management system;

2. personnel training, qualification and authorisation records;

3. allocation of tasks, covering the elements required by point 21.B.30, as well as the details of tasks allocated;

4. certification processes and continuing oversight of certified organisations, including:

(i) the application for a certificate, approval, authorisation and letter of agreement;

(ii) the CAA’s continuing oversight programme, including all the assessments, audits and inspection records;

(iii) the certificates, approvals, authorisations and letters of agreement issued, including any changes to them;

(iv) a copy of the oversight programme, listing the dates when audits are due and when audits were carried out;

(v) copies of all formal correspondence;

(vi) recommendations for the issue or continuation of a certificate, an approval, authorisation or a letter of agreement, details of findings and actions taken by the organisations to close those findings, including the date of closure, enforcement actions and observations;

(vii) any relevant assessment, audit and inspection report issued by the competent authority of a third country;

(viii) copies of any other documents approved by the CAA;

5. Statements of Conformity (CAA Form 52, Appendix VIII) and Authorised Release Certificates (CAA Form 1, Appendix I) that have been validated by the CAA for organisations that produce products, parts or appliances without a production organisation approval certificate according to Subpart F of Section A of this Annex.

(b) The CAA must include in the record keeping:

1. documents supporting the use of alternative means of compliance;

2. safety information in accordance with point 21.B.6(a) and follow-up measures;

3. the use of safeguard and flexibility provisions in accordance with Articles 70, 71(1) and 76(4) of Regulation (EU) 2018/1139.

(c) The CAA must maintain a list of all the certificates, approvals, authorisations and letters of agreement it has issued.

(d) All the records referred to in points (a) to (c) must be kept for at least 5 years, in so far as that is compatible with data protection legislation.”;

(h) at the end of Subpart A insert—

21.B.65    Suspension, limitation and revocation

(a) The CAA must:

1. suspend a relevant approval where it considers there are reasonable grounds to believe that such action is necessary to prevent a credible threat to aircraft safety;

2. suspend, revoke or limit a relevant approval where such action is required pursuant to point 21.B.125, 21.B.225 or 21.B.433;

3. suspend or revoke a certificate of airworthiness or a noise certificate upon evidence that any of the conditions specified in points 21.A.181(a) and 21.A.211(a) are not met;

4. suspend or limit in whole or in part a relevant approval where unforeseeable circumstances outside the control of the CAA prevent its inspectors from discharging their oversight responsibilities over the oversight planning circle.

(b) In this point, “relevant approval” means a certificate, approval, permit to fly, authorisation or letter of agreement.”.

(3) In Subpart E (supplemental type-certificates), after point 21.B.111 insert—

21.B.115    Means of compliance

(a) AMC may be used to establish compliance with Regulation (EU) 2018/1139 and this Regulation.

(b) Alternative means of compliance may be used by an organisation to establish compliance with this Regulation when approved by the CAA.”.

(4) In Subpart F (production without production organisation approval)—

(a) for point 21.B.120 (including the heading) substitute—

21.B.120    Initial certification procedure

(a) The CAA must:

1. upon receipt of an application for a letter of agreement for the purpose of demonstrating conformity of the individual products, parts and appliances, verify the applicant’s compliance with the applicable requirements;

2. record all the findings issued, closure actions and recommendations for the issue of the letter of agreement;

3. confirm in writing to the applicant all findings raised during the verification;

4. issue the letter of agreement (CAA Form 65, Appendix XI) when satisfied that the applicant complies with the applicable requirements.

(b) The letter of agreement must:

1. contain the scope of the agreement, a termination date and, where applicable, the appropriate limitations;

2. not exceed one year in duration.

(c) Where the application is in relation to initial certification, the CAA may only issue the letter of agreement after being satisfied that all findings have been corrected to its satisfaction.”

(b) for point 21.B.125 (including the heading) substitute—

21.B.125    Findings and corrective actions; observations

(a) The CAA must have a system in place to analyse findings for their safety significance.

(b) The CAA must issue a level 1 finding where any significant non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139, with the organisation’s procedures or manuals, or with the certificate including the terms of approval, which lowers safety or seriously endangers flight safety.

(c) Level 1 findings include:

1. any failure to grant the CAA access to the organisation’s facilities referred to in point 21.A.8 during normal operating hours and after two written requests;

2. obtaining the letter of agreement or maintaining its validity by falsification of the submitted documentary evidence; and

3. any evidence of malpractice or fraudulent use of the letter of agreement.

(d) The CAA must issue a level 2 finding where any non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139, the organisation’s procedures and manuals, or with the terms of the letter of agreement, which is not classified as a level 1 finding.

(e) When a finding is detected during oversight or by any other means, the CAA must, without prejudice to any additional action required by Regulation (EU) 2018/1139, issue the finding to the organisation and request corrective action to address the non-compliance identified.

1. Where there are any level 1 findings, the CAA must take immediate and appropriate action to prohibit or limit the activities of the organisation involved. Where appropriate, this action may be to revoke the letter of agreement or limit or suspend it in whole or in part, depending on the extent of the finding, until successful corrective action has been taken by the organisation.

2. Where there are any level 2 findings, the CAA must:

(i) grant the organisation a corrective action implementation period appropriate to the nature of the finding which must not be more than 3 months from the date of the written communication under point (e). At the end of that period, and subject to the nature of the finding, the CAA may extend the 3-month period provided that a corrective action plan has been agreed with the CAA;

(ii) assess the corrective action plan and implementation method proposed by the organisation following the written communication under point (e), and if the assessment concludes that they are sufficient to address the non-compliance, accept them.

3. Where the organisation fails to submit an acceptable corrective action plan or fails to perform the corrective action within the time period accepted or extended by the CAA, the CAA must raise the finding to level 1 and action must be taken as laid down in point (e)(1).

(f) The CAA may issue observations for any of the following cases not requiring level 1 or level 2 findings:

1. for any item whose performance has been assessed to be ineffective;

2. when it has been identified that an item has the potential to cause a non-compliance under point (d) or (e);

3. when suggestions or improvements are of interest for the overall safety performance of the organisation.

(g) The CAA must communicate the observations issued under this point in writing to the organisation and must keep a record of those observations and communications.

(h) The CAA, subject to the nature of the finding, may extend the 3 month corrective action implementation period provided that a corrective action plan has been agreed with the CAA.”

(c) omit points 21.B.130, 21.B.145 and 21.B.150;

(d) at the end of Subpart F, insert—

21.B.215    Means of compliance

(a) AMC may be used to establish compliance with Regulation (EU)2018/1139.

(b) Alternative means of compliance may be used by an organisation to establish compliance with this Regulation when approved by the CAA.”.

(5) In Subpart G (production organisation approval)—

(a) for point 21.B.220 (including the heading) substitute—

21.B.220    Initial certification procedure

(a) Upon receipt of an application for the initial issue of a production organisation approval certificate, the CAA must verify the applicant’s compliance with the applicable requirements.

(b) The CAA must convene a meeting with the accountable manager of the applicant at least once during the investigation for initial certification to ensure that this person understands their role and accountability.

(c) The CAA must record all findings issued, closure actions and recommendations for the issue of the production organisation approval certificate.

(d) The CAA must confirm to the applicant in writing all the findings raised during the verification.

(e) For initial certification, all findings must be corrected to the satisfaction of the CAA before the certificate can be issued.

(f) When the CAA is satisfied that the applicant complies with the applicable requirements, the CAA must issue the production organisation approval certificate (CAA Form 55 in Appendix X).

(g) The certificate reference number must be included on the production organisation approval certificate.

(h) The certificate must be issued for an unlimited duration. The privileges and scope of the activities that the organisation is approved to conduct, including any limitations as applicable, must be specified in the terms of approval attached to the certificate.”;

(b) after point 21.B.220 insert—

21.B.221    Oversight principles

(a) In carrying out the oversight programme under point 21.B.222, the CAA must verify:

1. compliance with the requirements that are applicable to organisations prior to issue of the production organisation approval certificate;

2. continued compliance with the applicable requirements of the organisations it has certified;

3. the implementation of appropriate safety measures mandated by the CAA according to point 21.B.6(c).

(b) This verification must:

1. be supported by documentation specifically intended to provide CAA personnel responsible for oversight with guidance to perform their functions;

2. provide the organisations concerned with the results of oversight activities;

3. be based on assessments, audits, inspections and, if needed, unannounced inspections;

4. provide the CAA with the evidence of non-compliance needed in case further action is required, including the measures provided for in point 21.B.225.

(c) The CAA must establish the scope of the oversight in points (a) and (b) taking into account the results of past oversight activities and the safety priorities.

(d) The CAA must collect and process any information deemed necessary for performing its oversight activities.

21.B.222    Oversight programme

(a) The CAA must establish and maintain an oversight programme covering the oversight activities in point 21.B.221(a).

(b) The oversight programme must be based on the assessment of the associated risks and take into account the specific nature of the organisation, the complexity of its activities, and the results of past certification and past oversight activities. Within each oversight planning cycle, it must include:

1. assessments, audits and inspections, including, as appropriate:

(i) management system assessments and process audits;

(ii) product audits of a relevant sample of the products, parts and appliances that are within the scope of the approval of the organisation;

(iii) sampling of the work performed;

(iv) unannounced inspection;

2. meetings between the accountable manager and the CAA to ensure both parties remain informed of all significant issues.

(c) The oversight planning cycle must not exceed 24 months.

(d) Notwithstanding point (c), the oversight planning cycle may be extended to 36 months if the CAA has, in the preceding 24 months, established that:

1. the organisation has demonstrated that it can effectively identify aviation safety hazards and manage the associated risks;

2. the organisation has continuously demonstrated compliance with points 21.A.147 and 21.A.148 and it has full control over all changes to the production management system;

3. no level 1 findings have been issued;

4. all corrective actions have been implemented within the time period agreed with the CAA under point 21.B.225.

(e) Notwithstanding points (c) and (d), the oversight planning cycle may be further extended to a maximum of 48 months if, in addition to the conditions set out at point (d), the organisation has established, and the CAA has approved, an effective, continuous system for reporting to the CAA on the safety performance and regulatory compliance of the organisation itself.

(f) The oversight planning cycle may be reduced if there is evidence that the safety performance of the organisation has decreased.

(g) The oversight programme must include records of the dates when assessments, audits, inspections and meetings are due, and when assessments, audits, inspections and meetings have been effectively carried out.

(h) At the completion of each oversight planning cycle, the CAA must issue a recommendation report on the continuation of the approval, reflecting the results of the oversight.”;

(c) for point 21.B.225 (including the heading) substitute—

21.B.225    Findings and corrective actions; observations

(a) The CAA must have a system in place to analyse findings for their safety significance.

(b) The CAA must issue a level 1 finding where any significant non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139, with the organisation’s procedures or manuals, or with the certificate including the terms of approval, which lowers safety or seriously endangers flight safety.

(c) Level 1 findings include:

1. any failure to grant the CAA access to the organisation’s facilities mentioned in point 21.A.8 during normal operating hours and after two written requests;

2. obtaining the production organisation approval certificate or maintaining its validity by falsification of submitted documentary evidence;

3. any evidence of malpractice or fraudulent use of the production organisation approval certificate;

4. failure to appoint an accountable manager pursuant to point 21.A.245(a).

(d) The CAA must issue a level 2 finding where any non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139, with the organisation’s procedures or manuals, or with the certificate including the terms of approval, which is not classified as a level 1 finding.

(e) When a finding is detected during oversight or by any other means, the CAA must, without prejudice to any additional action required by Regulation (EU) 2018/1139, write to the organisation and request corrective action to address the non-compliance identified.

1. If there are any level 1 findings, the CAA must take immediate and appropriate action to prohibit or limit the activities of the organisation involved and, if appropriate, revoke the production organisation approval certificate or limit or suspend it in whole or in part, depending on the extent of the level 1 finding, until successful corrective action has been taken by the organisation.

2. If there are any level 2 findings, the CAA must grant the organisation a corrective action implementation period appropriate to the nature of the finding which must not be more than 3 months from the date of the written communication under point (e).

3. If there are any level 2 findings, the CAA must assess the corrective action and implementation plan proposed by the organisation following the written communication under point (e), and if the assessment concludes that these are sufficient to address the non-compliance, accept them.

4. Subject to the nature of the finding, at the end of the 3 month period referred to in point (e)(2), the CAA may extend the 3 month period provided that the organisation has agreed a corrective action plan with the CAA.

5. If there are any level 2 findings, if the organisation fails to submit an acceptable corrective action plan or fails to perform the corrective action within the time period accepted or extended by the CAA, the finding must be raised to level 1, and action must be taken as laid down in point (e)(1).

(f) The CAA may issue observations for any of the following cases not requiring level 1 or level 2 findings:

1. for any item whose performance has been assessed to be ineffective; or

2. when it has been identified that an item has the potential to cause a non-compliance under point (b) or (d);

3. when suggestions or improvements are of interest for the overall safety performance of the organisation.

(g) The CAA must notify the production organisation in writing of any observations issued under point (f) and must keep a record of those observations.”;

(d) omit points 21.B.230 and 21.B.235;

(e) for point 21.B.240 (including heading) substitute—

21.B.240    Changes in the production management system

(a) Upon receipt of an application for a significant change to the production management system, the CAA must verify the organisation’s compliance with the applicable requirements of this Annex before issuing the approval.

(b) The CAA must establish the conditions under which the organisation may operate during the evaluation of a change unless the CAA determines that the production organisation approval certificate needs to be suspended.

(c) When satisfied the organisation complies with the applicable requirements, the CAA must approve the change.

(d) Without prejudice to any other enforcement measures, where the organisation implements a significant change to the production management system without prior approval of the CAA under point (c), the CAA may suspend, limit or revoke the organisation’s certificate if it considers necessary.

(e) For non-significant changes to the production management system, the CAA must include the review of such changes in its continuing oversight in accordance with the principles set out in point 21.B.221. Where any non-compliance is found, the CAA must notify the organisation, request further changes and act in accordance with point 21.B.225.”;

(f) omit points 21.B.245 and 21.B.260.

(6) In Subpart H (certificates of airworthiness and restricted certificates of airworthiness)—

(a) for point 21.B.325(c) substitute—

“(c) For new aircraft, and used aircraft originating from a third country, in addition to the appropriate airworthiness certificate referred to in point (a) or (b), the CAA must issue:

1. for aircraft subject to Annex I (Part-M) to Regulation (EU) No 1321/2014, an initial airworthiness review certificate (CAA Form 15a, Appendix II);

2. for new aircraft subject to Annex Vb (Part-ML) to Regulation (EU) No 1321/2014, an initial airworthiness review certificate (CAA Form 15c, Appendix II);

3. for used aircraft originating from a third country, and subject to Annex Vb (Part-ML) to Regulation (EU) No 1321/2014, an initial airworthiness review certificate (CAA Form 15c, Appendix II), when the CAA has performed the airworthiness review.”;

(b) omit points 21.B.330 and 21.B.345.

(7) In Subpart I (noise certificates), omit points 21.B.430 and 21.B.445.

(8) For Subpart J (design organisation approval), substitute—

21.B.430    Initial certification procedure

(a) Upon receiving an application for the initial issue of a design organisation approval, the CAA must verify the applicant’s compliance with the applicable requirements.

(b) A meeting with the head of the design organisation must be convened at least once during the investigation for initial certification to ensure that this person understands their role and accountability.

(c) The CAA must record all the findings issued, closure actions and recommendations for the issue of the design organisation approval.

(d) The CAA must confirm to the applicant in writing all the findings raised during the verification. For initial certification, all findings must be corrected to the satisfaction of the CAA before the design organisation approval can be issued.

(e) When satisfied that the applicant complies with the applicable requirements, the CAA must issue the design organisation approval.

(f) The certificate reference number must be included in the design organisation approval in a manner specified by the CAA.

(g) The certificate must be issued for an unlimited period of time. The privileges and the scope of the activities that the design organisation is approved to perform, including any limitations as applicable, must be specified in the terms of approval attached to the design organisation approval.

21.B.431    Oversight principles

(a) The CAA must verify whether certified organisations continue to comply with the applicable requirements.

(b) The verification must:

1. be supported by documentation specifically intended to provide CAA personnel responsible for oversight with guidance to perform their functions;

2. provide the organisations concerned with the results of oversight activities;

3. be based on assessments, audits, and inspections pursuant to point 21.B.432 and, if needed, unannounced inspections;

4. provide the CAA with the evidence needed in case further action is required, including the measures provided for in point 21.B.433.

(c) The CAA must establish the scope of the oversight set out in point (b) taking into account the results of past oversight activities and the safety priorities.

(d) The CAA must collect and process any information deemed necessary for performing oversight activities.

21.B.432    Oversight programme

(a) The CAA must establish and maintain an oversight programme covering the oversight activities required to comply with point 21.A.431(a).

(b) The oversight programme must take into account the specific nature of the organisation, the complexity of its activities, and the results of past certification and oversight activities, and it must be based on the assessment of the associated risks. It must include, within each oversight planning cycle:

1. assessments, audits and inspections, including, where appropriate:

(i) management system assessments and process audits;

(ii) product audits of a relevant sample of the design and certification of the products, parts and appliances that are within the scope of work of the organisation;

(iii) sampling of the work performed;

(iv) unannounced inspections;

2. meetings between the head of the design organisation and the CAA to ensure that both parties remain informed of all significant issues.

(c) The oversight planning cycle must not exceed 24 months.

(d) Notwithstanding point (c), the oversight planning cycle may be extended to 36 months if the CAA has established that during the previous 24 months:

1. the organisation has demonstrated that it can effectively identify aviation safety hazards and manage the associated risks;

2. the organisation has continuously demonstrated compliance with point 21.A.247 and has full control over all changes to the design management system;

3. no level 1 findings have been issued;

4. all corrective actions have been implemented within the time period that was accepted or extended by the CAA as provided for in point 21.B.433(e).

(e) Notwithstanding points (c) and (d), the oversight planning cycle may be further extended to a maximum of 48 months if, in addition to the conditions laid down in point (d), the organisation has established, and the CAA has approved, an effective continuous system for reporting to the CAA on the safety performance and regulatory compliance of the organisation itself.

(f) The oversight planning cycle may be reduced if there is evidence that the safety performance of the organisation has decreased.

(g) The oversight programme must include records of the dates when assessments, audits, inspections and meetings are due, and when assessments, audits, inspections and meetings have been effectively carried out.

(h) At the completion of each oversight planning cycle, the CAA must issue a recommendation report on the continuation of the approval, reflecting the results of the oversight.

21.B.433    Findings and corrective actions; observations

(a) The CAA must have a system in place to analyse findings for their safety significance.

(b) The CAA must issue a level 1 finding where a severe non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139, with the organisation’s procedures or manuals, or with the design organisation’s certificate including the terms of approval, which may lead to uncontrolled non-compliances and to a potential unsafe condition.

(c) Level 1 findings include:

1. any failure to grant the CAA access to the organisation’s facilities referred to in point 21.A.8 during normal operating hours and after two written requests;

2. obtaining the design organisation approval or maintaining its validity by falsification of the submitted documentary evidence;

3. any evidence of malpractice or fraudulent use of the design organisation approval;

4. failure to appoint a head of the design organisation pursuant to point 21.A.245(a).

(d) The CAA must issue a level 2 finding where any non-compliance, which is not classified as a level 1 finding is detected with the applicable requirements of Regulation (EU) 2018/1139, with the organisation’s procedures or manuals, or with the certificate including the terms of approval.

(e) Where a finding is detected during oversight or by any other means, the CAA must, without prejudice to any additional action required by Regulation (EU) 2018/1139, communicate the finding in writing to the organisation and request corrective action to address the non-compliance identified.

1. Where there are any level 1 findings:

(i) the CAA must grant the organisation a corrective action implementation period, appropriate to the nature of the finding, which must not be more than 1 month commencing from the date of the written communication of the finding to the organisation under point (e);

(ii) the CAA must assess the corrective action plan and implementation plan proposed by the organisation, and if it concludes that they are sufficient to address the non-compliance, accept them;

(iii) where the organisation fails to submit an acceptable corrective action plan, or fails to perform the corrective action within the time period accepted by the CAA, take immediate and appropriate action to prohibit or limit the activities of the organisation involved and, if appropriate, take action to revoke the design organisation approval or to limit or suspend it in whole or in part, depending on the extent of the level 1 finding, until successful corrective action has been taken by the organisation.

2. Where there are any level 2 findings:

(i) the CAA must grant the organisation a corrective action implementation period, appropriate to the nature of the finding, which must not be more than 3 months commencing from the date of the written communication of the finding to the organisation under point (e). At the end of the 3 month period, and subject to the nature of the finding, the CAA may extend the 3 month period provided that a corrective action plan has been agreed by the CAA;

(ii) the CAA must assess the corrective action and the implementation plan proposed by the organisation, and if it concludes that they are sufficient to address the non-compliance, accept them;

(iii) where the organisation fails to submit an acceptable corrective action plan or fails to perform the corrective action within the time period accepted or extended by the CAA, the CAA must raise the finding to level 1 and action must be taken as laid down in point (e)(1).

(f) The CAA may issue observations for any of the following cases not requiring level 1 or level 2 findings:

1. for any item whose performance has been assessed as ineffective;

2. when it has been identified that an item has the potential to cause a non-compliance under points (b), (c) or (d);

3. when suggestions or improvements are of interest for the overall safety performance of the organisation.

(g) The observations issued under this point must be communicated in writing to the organisation and recorded by the CAA.

21B.435    Changes in the design management system

(a) Upon receiving an application for a significant change to the design management system, the CAA must verify the organisation’s compliance with the applicable requirements of Regulation (EU) 2018/1139 before issuing the approval.

(b) The CAA must establish the conditions under which the organisation may operate during the change unless the CAA determines that the design organisation approval needs to be suspended.

(c) When it is satisfied that the organisation complies with the applicable requirements of Regulation (EU) 2018/1139, the CAA must approve the change.

(d) Without prejudice to any additional enforcement measures, if the organisation implements a significant change to the design management system without having received the approval of the CAA pursuant to point (c), the CAA must consider the need to suspend, limit or revoke the organisation’s certificate.

(e) For non-significant changes to the design management system, the CAA must include the review of such changes in its continuing oversight in accordance with the principles set out in point 21.B.431. If any non-compliance is found, the CAA must notify the organisation, request further changes and act in accordance with point 21.B.433.”.

(9) In Subpart P (permit to fly), omit points 21.B.445, 21.B.530 and 21.B.545.