Part-IS: information security is now in audit scope

Two regulations, two dates

Part-IS is the name for two EU regulations on information-security risks that could affect aviation safety.

1. 16 Oct 2025Delegated Regulation (EU) 2022/1645: design and production organisations, aerodrome operators and apron management service providersApplies
2. 22 Feb 2026Implementing Regulation (EU) 2023/203: air operators, maintenance organisations, continuing airworthiness management organisations, training organisations, air navigation service providers and the authorities themselvesApplies

The Swiss Federal Office of Civil Aviation publishes the same timeline and implements Part-IS for the organisations it oversees.

What it requires

• An information-security management system proportionate to the organisation's size, complexity and risk
• Identification and assessment of information-security risks that could affect safety
• Named accountability and defined roles
• The ability to detect, respond to and recover from incidents
• Reporting of incidents and vulnerabilities to the competent authority
• Attention to the risks that suppliers and contracted services bring in

Where organisations get caught

Digital flight operations sit squarely in scope. An electronic flight bag, an electronic technical log and cloud-based scheduling or crew systems all carry data that matters to safety.

The regulation allows the new system to be integrated with existing management systems. Organisations that build it as a separate structure end up maintaining two of everything.

A security incident often involves personal data as well. The same event can then start a Part-IS report and a data-protection notification, each to a different authority and on a different clock.