Aviation SMS and ICAO Annex 19: Implementing Safety Management at Airports

What is a safety management system and who must have one?

A safety management system (SMS) is a structured approach to managing aviation safety risk: it identifies hazards before they become accidents and measures whether controls are working. The International Civil Aviation Organization (ICAO) brought its provisions together in Annex 19, whose first edition was adopted on 25 February 2013; Amendment 1 followed and became applicable on 7 November 2019. ^[1]

The Annex requires States to oblige several categories of service provider to implement an SMS, including operators of certified aerodromes under Annex 14, Volume I. The SMS must be acceptable to the certifying State and commensurate with the operator’s size and the complexity of its services. ^[2]

Amendment 2: what changes in November 2026?

The ICAO Council adopted Amendment 2 on 23 June 2025; it became effective on 4 November 2025 and becomes applicable on 26 November 2026. It enhances State safety programme and SMS provisions, extends SMS to certified heliports and to certified remotely piloted aircraft system operators authorised for international operations and the maintenance organisations that serve them, and adds provisions on developing safety intelligence, that is, analysing safety data to support decisions. ^[1] These requirements reach operators through updates to each State’s regulations, so follow what your national civil aviation authority issues.

What are the four components and twelve elements?

Appendix 2 of Annex 19 sets out a framework of four components and twelve elements, all of which apply regardless of an organisation’s size, although how far each is developed is scaled to its size and complexity. ^{[2, 3]}

The fourth edition of the Safety Management Manual (Doc 9859), published in 2018, stresses that implementation should be commensurate with size and complexity, and devotes a full chapter to safety culture. ^[4]

How do Saudi Arabia and the UAE apply these requirements?

Operators do not apply the ICAO text directly but their own State’s regulations. In Saudi Arabia, GACAR Part 5, issued by the General Authority of Civil Aviation, applies to Part 139 aerodrome operators except heliports, requires the SMS to suit the organisation’s size, nature and complexity, and requires it to be submitted for acceptance. ^[5] In the UAE, CAR SMS, issued by the General Civil Aviation Authority, covers the aerodrome regulations (CAR Part IX) and requires organisations holding more than one approval to integrate their systems. ^[6]

Elsewhere in the GCC, refer to your national civil aviation authority’s regulations, as terminology and detailed requirements differ from country to country.

Who leads the SMS within the airport?

Under GACAR Part 5, the accountable executive holds final authority over operations and financial and human resources and has ultimate responsibility for safety performance; they sign the safety policy, review performance, direct action on substandard performance and designate a safety manager acceptable to the authority. ^[5] Under CAR SMS, the accountable manager must be at the highest level of the organisation, chairs the Safety Review Board and cannot delegate core accountabilities. ^[6]

ICAO’s guidance describes the safety manager as a function rather than just a job title, responsible to the accountable executive for the SMS’s performance and for providing safety services to other departments. ^[3]

Who needs SMS training?

GACAR Part 5 requires people with SMS duties to be trained to attain and maintain the qualifications those duties need, and training records to be kept for at least five years after completion. ^[5] CAR SMS requires a safety training and education programme that ensures all safety-related personnel are competent, with a scope matching each person’s safety responsibilities. ^[6] In practice, the accountable executive needs training on their accountability and decisions, the safety team needs in-depth training in risk analysis and investigation, and apron and maintenance staff need to know what to report and how.

How is safety risk managed at an airport?

Risk management starts with hazard identification: conditions that could cause harm through deficient system design, human-machine interaction, process failures or failure to adapt to a changing operating environment. Risks are then assessed by likelihood and severity, and ICAO’s examples use risk matrices and bow-tie analysis to show which barriers are in place and which are missing. ^[3]

One of the most important safety assurance elements is the management of change: assessing the risk of any change to operations, equipment or procedures before it is introduced. ICAO’s guidance cites an airport that requires every change to be risk-assessed. ^[3]

Hypothetical example: works on a taxiway

Hypothetical example: an airport plans to close part of a taxiway for two weeks for resurfacing. Before work starts, the safety team holds a risk assessment session with air traffic control, ground handling companies and maintenance. The hazards identified are inadvertent entry into the works area, foreign object debris on the surface, and confusion over taxi routes.

The controls agreed are amended signage and temporary lighting, a NOTAM, extra FOD inspections and a briefing for equipment drivers. The authorised person signs off acceptance of the residual risk, and during the works the number of reports of route confusion is tracked as an early indicator.

How do you measure safety performance?

GACAR Part 5 requires safety performance to be assessed against objectives, using high- and low-consequence indicators with alert levels acceptable to the authority, and substandard performance to be corrected. ^[5] The fourth edition of ICAO’s manual strengthens the link between safety objectives, safety performance indicators and targets, while allowing more flexibility in how they are set. ^[4]

In practice, choose for each objective one indicator for a rare outcome, such as runway incursions, and more frequent indicators that precede it, such as apron permit violations or FOD inspection findings. Low-consequence indicators give you enough data to act before the serious outcome occurs.

Why is reporting culture the foundation of the system?

An SMS depends on what staff report. That is why GACAR Part 5 requires a confidential employee reporting system for hazards, errors, safety concerns and incidents, ^[5] and CAR SMS describes internal reporting systems as non-punitive and confidential for voluntary reports, with feedback to the reporter. ^[6]

Annex 19’s protection principles state that safety data should not be used in disciplinary, civil, administrative or criminal proceedings except in defined cases, such as gross negligence, wilful misconduct or criminal activity. ^[2] GACAR Part 5 also requires a local runway safety committee at each aerodrome, headed by the accountable executive, meeting at least every three months at international aerodromes. ^[5]

Conclusion

An aviation SMS is not a manual submitted to the authority and then filed away; it is a continuous cycle of identifying hazards, assessing them and measuring performance. Start from your State’s regulations, check your readiness for Amendment 2 before 26 November 2026, and make protecting reporters the rule rather than the exception.