EASA Part-IS

Nothing changed in the last 90 days. Sign in to read further back.

1. 2031-03-27 in 1599 days Part-IS extends to certain organisations providing ground handling services (Regulation (EU) 2025/22)
2. 2026-02-22 Regulation (EU) 2023/203 applies to operators, maintenance, training, ATM/ANS and U-space organisations and competent authorities
3. 2026-01-01 Regulation (EU) 2023/203 applies to the EGNOS air navigation service provider
4. 2025-10-16 Delegated Regulation (EU) 2022/1645 applies to design and production organisations and aerodrome operators
5. 2023-02-22 Implementing Regulation (EU) 2023/203 enters into force

1. 2025-11-10
   Regulation (EU) 2023/203 as amended by Regulation (EU) 2025/2293 AmendmentCurrent text

   Changes the requirements for organisations subject to a declaration, including points IS.I.OR.250 (management manual) and IS.I.OR.255 (changes to the ISMS); it applies from 22 February 2026. source

2. 2024-12-19
   Regulation (EU) 2022/1645 amended by Regulation (EU) 2025/22 Amendment

   Extends Delegated Regulation (EU) 2022/1645 from 27 March 2031 to ground handling organisations that process third-party data or supply operational data to aircraft operators, and amends several Annex points from 16 October 2025. source

3. 2024-04-10
   Regulation (EU) 2023/203 amended by Regulation (EU) 2024/1109 Amendment

   Adds Article 2(3a) and replaces Article 4(2), in connection with competent authorities for the continuing airworthiness of certified unmanned aircraft systems; applies from 1 May 2025. source

4. 2023-09-12
   Regulation (EU) 2023/203 amended by Regulation (EU) 2023/1769 Amendment

   Adds organisations involved in the design or production of ATM/ANS systems and constituents to the scope (Article 2(1)(j)); in force from 5 October 2023. source

5. 2022-10-27
   Implementing Regulation (EU) 2023/203 Major version

   Information security requirements for air operators, maintenance, training, ATM/ANS and U-space organisations and for competent authorities; it applies from 22 February 2026, and from 1 January 2026 for the EGNOS air navigation service provider. source

Part-IS covers most approved aviation organisations whose information security failures could affect aviation safety, with exemptions for some light aviation activities.

Regulation 2023/203

Part-145 maintenance organisations, CAMOs, air operators, approved training organisations, aero-medical centres, FSTD operators, ATCO training organisations, ATM/ANS providers and U-space service providers (Article 2(1)). source

Regulation 2022/1645

Production and design organisations under Part 21, and aerodrome operators and apron management service providers under Part-ADR.OR (Article 2(1)). source

Light aviation exemptions

Excluded are, for example, air operators solely operating ELA2 aircraft or small single-engine aircraft under day VFR from and to the same site, and organisations solely involved with Part-ML aircraft (Article 2(1) of Regulation 2023/203). source

Competent authorities

The Regulation also applies to the competent authorities, including EASA (Article 2(2) of Regulation 2023/203). source

Organisations run an information security management system overseen by their competent authority, which approves their information security management manual.

ISMS

Set up, implement and maintain an ISMS covering policy, risk assessment and treatment, internal and external reporting, incident detection and response, contracting and personnel (IS.I.OR.200). source

Management manual

The initial information security management manual is approved by the competent authority, and certain amendments need its approval (IS.I.OR.250). source

Incident reporting

Report information security incidents or vulnerabilities that may represent a significant risk to aviation safety: notify as soon as known, report within 72 hours, then submit a follow-up report (IS.I.OR.230). source

National competent authorities and EASA oversee organisations, react to reported incidents and order measures that organisations must implement.

Immediate measures

Organisations must implement measures notified by the competent authority as an immediate reaction to an information security incident or vulnerability with an impact on aviation safety (IS.I.OR.200(a)(6)). source

Findings

Organisations must take appropriate action to address findings notified by the competent authority (IS.I.OR.200(a)(7) and IS.I.OR.225). source

1. Law text Commission Implementing Regulation (EU) 2023/203 (Part-IS)
2. Law text Commission Delegated Regulation (EU) 2022/1645 (Part-IS.D)
3. Law text Commission Delegated Regulation (EU) 2025/22 - ground handling organisations
4. Law text Commission Implementing Regulation (EU) 2025/2293 - organisations subject to a declaration
5. Guidance EASA cybersecurity domain page

1. NIS2

   The cross-sector EU cybersecurity directive, which also covers air transport entities; Part-IS addresses information security risks to aviation safety.

2. ISO 27001

   The international ISMS standard; Part-IS also requires an ISMS but is mandatory and focused on aviation safety.

3. Electricity cyber network code

   The sector-specific EU cybersecurity rules for the electricity sector.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to EASA Part-IS (RSS)