30

Section B is replaced by the following: ‘SECTION B AUTHORITY REQUIREMENTS 145.B.005 Scope This section establishes the conditions for conducting the certification, oversight and enforcement tasks as well as the administrative and management system requirements to be followed by the competent authority that is responsible for the implementation and enforcement of Section A. 145.B.115 Oversight documentation The competent authority shall provide all the legislative acts, standards, rules, technical publications, and related documents to the relevant personnel in order to allow them to perform their tasks and to discharge their responsibilities. 145.B.120 Means of compliance (a) The Agency shall develop acceptable means of compliance (“AMC”) that may be used to establish compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts. (b) Alternative means of compliance may be used to establish compliance with this Regulation. (c) Competent authorities shall inform the Agency of any alternative means of compliance used by organisations under their oversight or by themselves for establishing compliance with this Regulation. 145.B.125 Information to the Agency (a) The competent authority of the Member State shall notify the Agency in case of any significant problems with the implementation of Regulation (EU) 2018/1139 and its delegated and implementing acts within 30 days from the time the authority became aware of the problems. (b) Without prejudice to Regulation (EU) No 376/2014 and its delegated and implementing acts, the competent authority shall provide the Agency as soon as possible with any safety-significant information stemming from the occurrence reports stored in the national database pursuant to Article 6(6) of Regulation (EU) No 376/2014. 145.B.135 Immediate reaction to a safety problem (a) Without prejudice to Regulation (EU) No 376/2014 and its delegated and implementing acts, the competent authority shall implement a system to appropriately collect, analyse and disseminate safety information. (b) The Agency shall implement a system to appropriately analyse any relevant safety information received and, without undue delay, provide the relevant authority of the Member States and the Commission with any information, including recommendations or corrective actions to be taken, that is necessary for them to react in a timely manner to a safety problem involving products, parts, appliances, persons or organisations that are subject to Regulation (EU) 2018/1139 and its delegated and implementing acts. (c) Upon receiving the information referred to in points (a) and (b), the competent authority shall take adequate measures to address the safety problem. (d) The competent authority shall immediately notify measures taken under point (c) to all persons or organisations which need to comply with them under Regulation (EU) 2018/1139 and its delegated and implementing acts. The competent authority shall also notify those measures to the Agency and, when combined action is required, to the other Member States concerned. 145.B.200 Management system (a) The competent authority shall establish and maintain a management system, including as a minimum: (1) documented policies and procedures to describe its organisation, the means and methods for establishing compliance with Regulation (EU) 2018/1139 and its delegated and implementing acts. The procedures shall be kept up to date, and serve as the basic working documents within that competent authority for all its related tasks; (2) a sufficient number of personnel to perform its tasks and discharge its responsibilities. A system shall be in place to plan the availability of personnel in order to ensure the proper completion of all tasks; (3) personnel that are qualified to perform their allocated tasks and that have the necessary knowledge and experience and receive initial and recurrent training to ensure continuing competency; (4) adequate facilities and office accommodation for personnel to perform their allocated tasks; (5) a function to monitor the compliance of the management system with the relevant requirements, and the adequacy of the procedures, including the establishment of an internal audit process and a safety risk management process. Compliance monitoring shall include a feedback system of audit findings to the senior management of the competent authority to ensure the implementation of corrective actions as necessary; (6) a person or group of persons having a responsibility to the senior management of the competent authority for the compliance monitoring function. (b) The competent authority shall, for each field of activity, including the management system, appoint one or more persons with the overall responsibility for the management of the relevant task(s). (c) The competent authority shall establish procedures for the participation in a mutual exchange of all necessary information and assistance with any other competent authorities concerned, whether from the same Member State or from other Member States, including on: (1) all findings raised and any follow-up actions taken as a result of the oversight of persons and organisations that carry out activities in the territory of a Member State, but certified by the competent authority of another Member State or by the Agency; (2) information stemming from mandatory and voluntary occurrence reporting as required by 145.A.60. (d) A copy of the procedures related to the management system and their amendments shall be made available to the Agency for the purpose of standardisation. 145.B.205 Allocation of tasks to qualified entities (a) The competent authority may allocate tasks related to the initial certification or to the continuing oversight of organisations subject to Regulation (EU) 2018/1139 and its delegated and implementing acts, to qualified entities. When allocating tasks, the competent authority shall ensure that it has: (1) put a system in place to initially and continuously assess whether the qualified entity complies with Annex VI to Regulation (EU) 2018/1139. That system and the results of the assessments shall be documented; (2) established a written agreement with the qualified entity, approved by both parties at the appropriate management level, which stipulates: (i) the tasks to be performed; (ii) the declarations, reports and records to be provided; (iii) the technical conditions to be met when performing such tasks; (iv) the related liability coverage; (v) the protection given to the information acquired when carrying out such tasks. (b) The competent authority shall ensure that the internal audit process and safety risk management process established pursuant to point 145.B.200(a)(5) cover all the certification and continuing oversight tasks performed by the qualified entity on its behalf. 145.B.210 Changes in the management system (a) The competent authority shall have a system in place to identify the changes that affect its capability to perform its tasks and discharge its responsibilities as defined in Regulation (EU) 2018/1139 and its delegated and implementing acts. That system shall enable the competent authority to take action necessary to ensure that its management system remains adequate and effective. (b) The competent authority shall update in a timely manner its management system to reflect any changes to Regulation (EU) 2018/1139 and its delegated and implementing acts so as to ensure its effective implementation. (c) The competent authority shall notify the Agency of any changes affecting its capability to perform its tasks and discharge its responsibilities as provided for in Regulation (EU) 2018/1139 and its delegated and implementing acts. 145.B.220 Record-keeping (a) The competent authority shall establish a record-keeping system that allows the adequate storage, accessibility and reliable traceability of: (1) the management system’s documented policies and procedures; (2) the training, qualifications and authorisations of its personnel; (3) the allocation of tasks, covering the elements required by point 145.B.205, as well as the details of tasks allocated; (4) certification processes and continuing oversight of certified organisations, including: (i) the application for an organisation certificate; (ii) the competent authority’s continuing oversight programme, including all the assessments, audits and inspection records; (iii) the organisation certificate, including any changes to it; (iv) a copy of the oversight programme, listing the dates when audits are due and when audits were carried out; (v) copies of all formal correspondence; (vi) recommendations for the issue or continuation of a certificate, details of findings and actions taken by the organisations to close those findings, including the date of closure, enforcement actions and observations; (vii) any assessment, audit and inspection report issued by another competent authority pursuant to point 145.B.300(d); (viii) copies of all the organisation MOEs or manuals, and of any amendments to them; (ix) copies of any other documents approved by the competent authority; (5) documents supporting the use of alternative means of compliance; (6) safety information provided in accordance with point 145.B.125 and follow-up measures; (7) the use of safeguard and flexibility provisions in accordance with Article 70, Article 71(1) and Article 76(4) of Regulation (EU) 2018/1139. (b) The competent authority shall maintain a list of all the organisation certificates it has issued. (c) All the records referred to in points (a) and (b) shall be kept for a minimum period of 5 years, subject to applicable data protection law. (d) All the records referred to in points (a) and (b) shall be made available, upon request, to a competent authority of another Member State or to the Agency. 145.B.300 Oversight principles (a) The competent authority shall verify: (1) compliance with the requirements that are applicable to organisations, prior to issuing an organisation certificate; (2) continued compliance with the applicable requirements of the organisations it has certified; (3) the implementation of appropriate safety measures mandated by the competent authority in accordance with points 145.B.135(c) and (d). (b) This verification shall: (1) be supported by documentation specifically intended to provide personnel responsible for oversight with guidance to perform their functions; (2) provide the organisations concerned with the results of oversight activities; (3) be based on assessments, audits and inspections and, if needed, unannounced inspections; (4) provide the competent authority with the evidence needed in case further action is required, including the measures provided for in point 145.B.350. (c) The competent authority shall establish the scope of the oversight set out in points (a) and (b) taking into account the results of past oversight activities and the safety priorities. (d) If the facilities of an organisation are located in more than one State, the competent authority, as defined in point 145.1, may agree to have the oversight tasks performed by the competent authority(ies) of the Member State(s) where the facilities are located, or by the Agency for facilities that are located outside a territory for which Member States are responsible under the Chicago Convention. Any organisation that is subject to such an agreement shall be informed of its existence and of its scope. (e) For any oversight activities that are performed at facilities located in a Member State other than where the organisation has its principal place of business, the competent authority, as defined in point 145.1, shall inform the competent authority of that Member State before performing any on-site audit or inspection of the facilities. (f) The competent authority shall collect and process any information deemed necessary for performing oversight activities. 145.B.305 Oversight programme (a) The competent authority shall establish and maintain an oversight programme covering the oversight activities required by point 145.B.300. (b) The oversight programme shall take into account the specific nature of the organisation, the complexity of its activities, the results of past certification or oversight activities, or both, and it shall be based on the assessment of the associated risks. It shall include, within each oversight planning cycle: (1) assessments, audits and inspections, including, as appropriate: (i) management system assessments and process audits; (ii) product audits of a relevant sample of the maintenance carried out by the organisation; (iii) sampling of the airworthiness reviews performed; (iv) unannounced inspections; (2) meetings convened between the accountable manager and the competent authority to ensure that both parties remain informed of all significant issues. (c) The oversight planning cycle shall not exceed 24 months. (d) Notwithstanding point (c), the oversight planning cycle may be extended to 36 months if the competent authority has established that during the previous 24 months: (1) the organisation has demonstrated that it can effectively identify aviation safety hazards and manage the associated risks; (2) the organisation has continuously demonstrated compliance with point 145.A.85 and it has full control over all changes; (3) no level 1 findings have been issued; (4) all corrective actions have been implemented within the time period that was accepted or extended by the competent authority as provided for in point 145.B.350. Notwithstanding point (c), the oversight planning cycle may be further extended to a maximum of 48 months if, in addition to the conditions provided in points (d)(1) to (4), the organisation has established, and the competent authority has approved, an effective continuous system for reporting to the competent authority on the safety performance and regulatory compliance of the organisation itself. (e) The oversight planning cycle may be shortened if there is evidence that the safety performance of the organisation has decreased. (f) The oversight programme shall include records of the dates when assessments, audits, inspections and meetings are due, and when assessments, audits, inspections and meetings have been effectively carried out. (g) At the completion of each oversight planning cycle, the competent authority shall issue a recommendation report on the continuation of the approval, reflecting the results of the oversight. 145.B.310 Initial certification procedure (a) Upon receiving an application from an organisation for the initial issue of a certificate, the competent authority shall verify the organisation’s compliance with the applicable requirements. (b) A meeting with the accountable manager of the organisation shall be convened at least once during the investigation for initial certification to ensure that that person understands his or her role and accountability. (c) The competent authority shall record all the findings issued, closure actions as well as the recommendations for the issue of the certificate. (d) The competent authority shall confirm to the organisation in writing all the findings raised during the verification. For initial certification, all findings must be corrected to the satisfaction of the competent authority before the certificate can be issued. (e) When satisfied that the organisation complies with the applicable requirements, the competent authority shall: (1) issue the certificate as established in Appendix III “EASA Form 3-145” in accordance with the class and rating system provided for in Appendix II; (2) formally approve the MOE. (f) The certificate reference number shall be included on the EASA Form 3-145 certificate in a manner specified by the Agency. (g) The certificate shall be issued for an unlimited duration. The privileges and the scope of the activities that the organisation is approved to conduct, including any limitations as applicable, shall be specified in the terms of approval attached to the certificate. (h) To enable the organisation to implement changes without prior competent authority approval in accordance with point 145.A.85(c), the competent authority shall approve the relevant MOE procedure that sets out the scope of such changes and describes how such changes will be managed and notified to the competent authority. 145.B.330 Changes – organisations (a) Upon receiving an application for a change that requires prior approval, the competent authority shall verify the organisation’s compliance with the applicable requirements before issuing the approval. (b) The competent authority shall establish the conditions under which the organisation may operate during the change unless the competent authority determines that the organisation’s certificate needs to be suspended. (c) When it is satisfied that the organisation complies with the applicable requirements, the competent authority shall approve the change. (d) Without prejudice to any additional enforcement measures, if the organisation implements changes requiring prior approval without having received the approval of the competent authority pursuant to point (c), the competent authority shall consider the need to suspend, limit or revoke the organisation’s certificate. (e) For changes not requiring prior approval, the competent authority shall include the review of such changes in its continuing oversight in accordance with the principles set forth in point 145.B.300. If any non-compliance is found, the competent authority shall notify the organisation, request further changes, and act in accordance with point 145.B.350. 145.B.350 Findings and corrective actions; observations (a) The competent authority shall have a system in place to analyse findings for their safety significance. (b) A level 1 finding shall be issued by the competent authority when any significant non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, with the organisation’s procedures and manuals, or with the organisation’s certificate including the terms of approval, which lowers safety or seriously endangers flight safety. Level 1 findings shall also include: (1) any failure to grant the competent authority access to the organisation’s facilities referred to in point 145.A.140 during normal operating hours and after two written requests; (2) obtaining the organisation certificate or maintaining its validity by falsification of the submitted documentary evidence; (3) any evidence of malpractice or fraudulent use of the organisation certificate; (4) the lack of an accountable manager. (c) A level 2 finding shall be issued by the competent authority when any non-compliance is detected with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts, with the organisation’s procedures and manuals, or with the organisation’s certificate including the terms of approval, which is not classified as a level 1 finding. (d) When a finding is detected during oversight or by any other means, the competent authority shall, without prejudice to any additional action required by Regulation (EU) 2018/1139 and its delegated and implementing acts, communicate in writing the finding to the organisation and request corrective action to address the non-compliance identified. If a level 1 finding directly relates to an aircraft, the competent authority shall inform the competent authority of the Member State in which the aircraft is registered. (1) If there are any level 1 findings, the competent authority shall take immediate and appropriate action to prohibit or limit the activities of the organisation involved and, if appropriate, it shall take action to revoke the certificate or to limit or suspend it in whole or in part, depending on the extent of the level 1 finding, until successful corrective action has been taken by the organisation. (2) If there are any level 2 findings, the competent authority shall: (i) grant the organisation a corrective action implementation period that is appropriate to the nature of the finding, and that in any case shall initially not be more than 3 months. The period shall commence from the date of the written communication of the finding to the organisation requesting corrective action to address the non-compliance identified. At the end of that period, and subject to the nature of the finding, the competent authority may extend the 3-month period provided that a corrective action plan has been agreed with the competent authority; (ii) assess the corrective action plan and implementation plan proposed by the organisation, and if the assessment concludes that they are sufficient to address the non-compliance, accept them. (3) If the organisation fails to submit an acceptable corrective action plan, or fails to perform the corrective action within the time period accepted or extended by the competent authority, the finding shall be raised to level 1 and action shall be taken as laid down in point (d)(1). (4) The competent authority shall record all the findings that it has raised or that have been communicated to it in accordance with point (e) and, where applicable, the enforcement measures it has applied, as well as all corrective actions and the dates of the action closures for all the findings. (e) Without prejudice to any additional enforcement measures, when an authority performing the oversight tasks pursuant to point 145.B.300(d) identifies any non-compliance with the applicable requirements of Regulation (EU) 2018/1139 and its delegated and implementing acts by an organisation certified by the competent authority of another Member State or the Agency, it shall inform that competent authority and provide an indication of the level of the finding. (f) The competent authority may issue observations for any of the following cases not requiring level 1 or level 2 findings: (1) for any item whose performance has been assessed to be ineffective; (2) when it has been identified that an item has the potential to cause a non-compliance under points (b) or (c); (3) when suggestions or improvements are of interest for the overall safety performance of the organisation. The observations issued under this point shall be communicated in writing to the organisation and recorded by the competent authority. 145.B.355 Suspension, limitation and revocation The competent authority shall: (a) suspend a certificate when it considers that there are reasonable grounds that such action is necessary to prevent a credible threat to aircraft safety; (b) suspend, revoke or limit a certificate if such action is required pursuant to point 145.B.350; (c) suspend or limit in whole or in part a certificate if unforeseeable circumstances outside the control of the competent authority prevent its inspectors from discharging their oversight responsibilities over the oversight planning cycle.’;