2023-03597. Airport Safety Management System

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final rule.

SUMMARY:

This final rule requires certain airport certificate holders to develop, implement, maintain, and adhere to an airport safety management system (SMS). Certificated airports that qualify under one or more of the following triggering criteria (triggers) are required to develop a SMS under this final rule: are classified as large, medium, or small hubs based on passenger data extracted from the FAA Air Carrier Activity Information System; have a 3-year rolling average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures; or serve any international operation other than general aviation. This rule would expand the safety benefits of SMS to certain certificated airports and further the FAA's aviation-wide approach to SMS implementation in order to address safety at an organizational level.

DATES:

This rule is effective April 24, 2023.

ADDRESSES:

For information on where to obtain copies of rulemaking documents and other information related to this final rule, see “How to Obtain Additional Information” in SECTION VI of this document.

FOR FURTHER INFORMATION CONTACT:

For technical questions about this action, contact James Schroeder, Airport Safety and Operations Division, AAS-300, Office of Airport Safety and Standards, Federal Aviation Administration, 800 Independence Avenue SW, Washington, DC 20591; telephone [phone]; email [e-mail].

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Executive Summary

II. Background

III. Discussion of Public Comments and Final Rule

A. Applicability

1. General Applicability

2. Triggers

i. Hub Trigger

ii. Operations Trigger

iii. International Trigger

3. Authority To Implement Triggers

4. Annual Review of Applicability

B. Implementation

1. Phased Implementation

2. Staggered Implementation

3. FAA Review of Documents

4. Timeline for Document Submission and Full Implementation

5. Timeline for New Airports Qualifying After the Effective Date of This Final Rule, or Due to Changes in Status

C. Non-Movement Area

1. Regulatory Authority in the Non-Movement Area

2. Inclusion of Fuel Farms, Baggage-Makeup, and Military Areas

3. Inconsistency With ICAO Standard

4. Air Carrier Operations in Non-Movement Areas

D. Data Protection

1. State-Level Fix

2. Federal-Level Protection

3. Creation of a National Data Repository

4. De-Identified Data

E. Safety Reporting and Interoperability

1. Change in Terminology

2. Data Sharing and Reporting Plan

3. Crewmembers Accessing Non-Movement Areas

F. Training and Orientation

1. Identification of Roles, Responsibilities, and Minimum Training Elements

2. Training Estimates Used in Regulatory Evaluation calculations

3. Safety Awareness Orientation

4. Development of Training Materials

5. Clarification of “Comprehensive SMS Training”

6. Clarification of “Access”

G. Accountable Executive

1. Amendment or Elimination of the Accountable Executive Requirement

2. Delegation

3. Personal Liability and Oversight

H. Definitions

1. “Hazard” Definition

2. “Non-Movement Area” Definition

3. Harmonization of “Safety Policy,” “Safety Risk Management,” “Safety Assurance,” and “Safety Promotion” Definitions

I. Miscellaneous Topics

1. FAA's Rulemaking Authority

2. Applicability to Non-Certificated Airports

3. FAA Oversight

4. Safety Risk Management

5. Record Retention

6. SMS Manual Updates

7. Guidance and Work Groups

IV. Regulatory Notices and Analyses

V. Executive Order Determinations

VI. How To Obtain Additional Information

List of Abbreviations and Acronyms Frequently Used in This Document

AC Advisory Circular

ACAIS Air Carrier Activity Information System

ACM Airport Certification Manual

AOC Airport operating certificate

ARP FAA Office of Airports

ATO FAA Air Traffic Organization

AVS FAA Aviation Safety Organization

CFR Code of Federal Regulations

CBP Customs and Border Protection

DSR Plan Data Sharing and Reporting Plan

E.O. Executive Order

FAA Federal Aviation Administration

FOIA Freedom of Information Act

ICAO International Civil Aviation Organization

NPIAS National Plan of Integrated Airport Systems

NPRM Notice of Proposed Rulemaking

NTSB National Transportation Safety Board

OMB Office of Management and Budget

OpsNet FAA Operations Network

SBREFA Small Business Regulatory Enforcement Fairness Act of 1996

SMS Safety Management System

SNPRM Supplemental Notice of Proposed Rulemaking

SRM Safety Risk Management

SSI Sensitive Security Information

I. Executive Summary

A. Purpose of the Regulatory Action

SMS has generated wide support in the aviation community as an effective approach that can deliver real safety and financial benefits.^[1] SMS integrates modern safety concepts into repeatable, proactive processes in a single system, emphasizing safety management as a fundamental business process to be considered in the same manner as other aspects of business management. The development and implementation of SMS improves safety at the organizational level and is the next step in the continuing evolution of aviation safety. Therefore, the FAA is pursuing an aviation-wide approach that would require the implementation of SMS by those organizations in the best position to prevent future accidents. As part of that process, the FAA is expanding SMS's benefits to certain certificated airports by requiring them to proactively identify and mitigate safety hazards, thereby reducing the possibility or recurrence of incidents or accidents in air transportation. The purpose of this final rule is to require certain Title 14 Code of Federal Regulations (CFR) part 139 ^[2] certificate holders to develop, implement, maintain, and adhere to an airport safety management system (SMS).

A SMS is a formal means for organizations to identify and manage safety risks in their operations. It includes systematic procedures, practices, and policies for the management of safety risk. SMS enforces the concept that safety should be managed with as much emphasis, commitment, and focus as any other critical area of an organization. It prompts organizations to develop decision-making processes and procedures and use effective safety risk controls to proactively identify and mitigate or address any detected noncompliant or unsafe conditions in their operations. As discussed in the FAA Airport SMS Pilot Study report,^[3] airports that voluntarily implemented SMS have reported better efficiency in identifying and mitigating hazards in daily activities such as pedestrian safety on ramps and operations with ground support equipment.^[4] These airports also used SMS processes for significant events, such as construction safety and phasing planning, to proactively identify and mitigate hazards before the start of the project. This proactive approach, along with the communication of safety issues, provides a robust mechanism for airports to improve safety. The FAA has not formally tracked the number of airports that have implemented SMS since it is not yet a required element under part 139.

The purpose of a SMS is to reduce incidents, accidents, and fatalities in the airfield operations environment. A specific example cited in the RIA was the FOD damage to 14 aircraft in 2007 (NTSB Accident No: DEN07IA069). The advanced communication procedures in a SMS could have expedited the reporting, assessment and mitigation of the FOD hazard, thus limiting the likelihood and severity of this hazard. Expanding SMS to certain certificated airports is the best strategy to continue to reduce incidents and accidents, and improve safety in aviation. ICAO, other Civil Aviation Authorities, industry advisory groups, and the NTSB all support the use of SMS to improve safety. In the U.S., safety management systems have been implemented by part 121 operators and the FAA has voluntary programs designed to expand the use of SMS throughout the aviation system. The FAA has even implemented SMS within many of its organizations. Further, expansion of SMS would also align the U.S. with current ICAO Standards and Recommended Practices.

This final rule requires airport certificate holders that qualify under one or more of the following triggering criteria (triggers) to develop a SMS: airports: (a) classified as large, medium, or small hubs, based on passenger data extracted from the FAA Air Carrier Activity Information System; (b) that have a 3-year rolling average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures; ^[5] or (c) that serve any international operation other than general aviation. The FAA applied a primarily risk-based approach to the final rule's applicability. The criteria are designed to maximize SMS's safety benefits to stakeholders in the least burdensome manner. Instead of requiring SMS at all certificated airports, only certificated airports with the highest passenger enplanements, the largest total operations, and those hosting international air traffic must have a SMS under this rule. This final rule applies to approximately 265 certificated airports. These airports cover over 90 percent of all U.S. passenger enplanements and include the facilities with the largest number of commercial air transportation operations. This allows safety benefits to flow to airports with the majority of aircraft operations in the United States in addition to airports with international passenger operations to ensure conformity with international standards and recommended practices with the least regulatory burden. This rule does not require SMS implementation at small airports with fewer resources where creating a SMS may be a larger proportional burden and may not be cost beneficial.

This final rule includes an exception to the applicability of the SMS requirement. If a certificate holder qualifies exclusively under the international services trigger, then it may file a waiver request to seek relief from the regulatory requirement to implement SMS. To do so, it must certify that it does not host any operation by any tenant ^[6] that is required to implement SMS under the applicable laws or regulations of its country of origin ( i.e., the jurisdiction that issued the tenant's air carrier certificate, air operator certificate, or equivalent) or any other governing jurisdiction. For example, if international services at an airport are solely provided for operators engaged in general aviation operations, then—absent another trigger—the FAA will not require the airport to implement SMS. By linking the international trigger for part 139 airports to the presence of international tenants with SMS requirements, the FAA supports a holistic approach that encourages the sharing of data and proactive risk management inherent to SMS. Without this linkage, neither SMS reaches its full potential safety benefit. However, if an air carrier tenant commences international service to or from such airport, and the country of origin of such air carrier tenant requires that it adhere to a SMS, then the exception does not apply and the airport must implement SMS.

In the interest of safety, this final rule requires the implementation of SMS in both the movement and non-movement areas ^[7] of qualifying airports. This rule allows airports to enter into data sharing and reporting arrangements with certain air carrier tenants. Such arrangements allow tenants to share with part 139 certificate holders any hazard report submitted though the tenants' confidential employee reporting systems. This reduces the burden of having to report hazards under two different reporting systems and fosters cooperation and increased communication of safety issues among interested parties, while avoiding gaps in SMS coverage. Separately, this final rule adds an authority citation inadvertently omitted from a previous final rule and amends § 139.101 by removing paragraph (c), which no longer applies.

Airport SMS will help FAA develop its oversight processes so that FAA targets its involvement on the areas of highest safety risk. For airports with a fully implemented SMS and that have a consistent history of compliance with the requirements of part 139, the FAA will transition to system-based inspections, thereby allowing inspectors to focus on areas of greater risk and the FAA to modify the duration of time between inspections for those airports. In addition to focusing FAA's resources to best address safety needs, the FAA anticipates this approach will create government cost savings from reduced inspector time and travel costs.

B. Summary of the Major Provisions of the Regulatory Action

In its most general form, SMS is a set of decision-making tools that a certificate holder uses to plan, organize, direct, and control its everyday activities in a manner that enhances safety. An airport SMS must include, at a minimum, four components: (a) safety policy, (b) safety risk management, (c) safety assurance, and (d) safety promotion.

Certificate holders must identify their plans for developing and implementing SMS through an FAA-approved Implementation Plan (see § 139.403). Pursuant to § 139.401(f), certificate holders may choose to either document their airport SMS in a separate SMS Manual or in their FAA-approved ACM (see also §§ 139.201-139.203).

The submission of SMS Implementation Plans is staggered based on which trigger prompts certificate holders to comply with this final rule. Airports qualifying under the hub trigger must submit their Implementation Plans first, within 12 months of the effective date of this rule. Certificate holders qualifying under the annual operations trigger must submit Implementation Plans within 18 months, and airports qualifying under the international trigger must submit their Implementation Plans within 24 months.

All certificate holders subject to this final rule must submit their SMS Manual and/or revised ACM to the FAA within the 12 months immediately following the FAA's approval of the Implementation Plan. Certificate holders have 36 months following approval of the Implementation Plan to fully implement their SMS.

Table 1 provides a brief summary of the major provisions of this final rule and changes from the SNPRM.

Table 1—Summary of Major Provisions

Issue	Proposed requirement (from the SNPRM)	Adopted requirement
Applicability of SMS requirements	Limited to certificate holders: (a) Classified as large, medium, or small hub; or (b) Having more than 100,000 total annual operations; or (c) Classified as a port of entry, designated international airport, landing rights airport, or user fee airport.	Limited to certificate holders: (a) Classified as large, medium, or small hub; or (b) Having an average of 100,000 or more total annual operations (the sum of all arrivals and departures) over the previous three calendar years; or (c) Classified as a port of entry, designated international airport, landing rights airport, or user fee airport.
		§ 139.401(a).
Waiver for International Trigger	NONE	Allow a certificate holder that qualifies exclusively under the international trigger to obtain a waiver from complying with the SMS requirements if it has no tenants that are required to comply with SMS requirements of any jurisdiction.
		§ 139.401(d).
Scope	SAME AS ADOPTED	Encompass aircraft operations in the movement and non-movement areas (and other airport operations addressed in part 139).
		§ 139.401(b).
Scale	SAME AS ADOPTED	Correspond in size, nature, and complexity to the operations, activities, and risks associated with the airport's operations.
		§ 139.401(c).
Implementation Plan	SAME AS ADOPTED	Detail how the airport will meet the requirements of this final rule; include a schedule for implementing the SMS components; describe any existing programs or policies the airport will use to meet the SMS requirements.
		§ 139.403(b).
Documenting the SMS requirements	SAME AS ADOPTED	Include methods of compliance contained within the ACM or a separate SMS Manual with incorporation by reference in the ACM.
		§ 139.401(f).
Document Submission and Implementation Deadlines	Submit Implementation Plan on or before 12 months Submit SMS Manual and/or ACM update on or before 24 months Fully implement the SMS on or before 24 months	Submit Implementation Plan on or before: • 12 months for hub triggers; • 18 months for operations triggers; and • 24 months for international triggers. § 139.403(a). Submit SMS Manual and/or ACM update on or before 12 months after FAA-approval of the Implementation Plan.
		§ 139.403(c).
		Fully implement the SMS no later than 36 months after FAA-approval of the Implementation Plan.
		§ 139.403(d).
Accountable executive	SAME AS ADOPTED	Identify the accountable executive; report pertinent safety information and data on a regular basis to the accountable executive.8
		§ 139.402(a)(1); § 139.402(c)(3).
Safety Policy Statement	SAME AS ADOPTED	Establish and maintain a safety policy statement signed by the accountable executive.
		§ 139.402(a)(2).
Safety Objectives	SAME AS ADOPTED	Establish and maintain safety objectives; define methods, processes, and organizational structure necessary to meet those safety objectives; monitor safety performance.
		§ 139.402(a)(6) & (7); § 139.402(c)(1).
Safety Risk Management	SAME AS ADOPTED	Establish a system to identify operational safety issues and a process to analyze hazards and their risks.
		§ 139.402(b).
Safety Reporting System	SAME AS ADOPTED	Establish and maintain a reporting system that provides for reporter confidentiality.
		§ 139.402(c)(2).
Data Sharing and Reporting Plan	NONE	Provides option to develop data sharing and reporting plan with tenant(s) required to maintain a SMS subject to requirements of 14 CFR part 5. When such a plan exists, relieves airport from providing safety awareness orientation to applicable tenants or their employees.
		§ 139.401(e).
Training and Orientation	SAME AS ADOPTED	Provide all persons authorized access to movement and non-movement areas safety awareness orientation; provide all employees with responsibilities under the SMS training appropriate to their roles.
		§ 139.402(d)(1) & (3).
Safety Communications	SAME AS ADOPTED	Develop and maintain formal means for communicating important safety information.
		§ 139.402(d)(5).
Record Keeping	SAME AS ADOPTED	Retain: • SMS training records and orientation materials for 24 consecutive calendar months; • SRM documentation for the longer of 36 consecutive calendar months after the risk analysis has been completed or 12 consecutive calendar months after mitigations completed; and • Safety communications for 12 consecutive calendar months.
		§ 139.301(b)(1) & (9) & (10).

C. Summary of Costs and Benefits

The goal of this rule is to improve the safety of the airfield environment (including movement and non-movement areas) by providing an airport with decision-making tools to plan, organize, direct, and control its everyday activities in a manner that enhances safety. The FAA envisions airports being able to use all of the components of a SMS to enhance their ability to identify safety issues and spot trends before they result in a near-miss incident or accident. While the FAA's use of prescriptive regulations and technical operating standards has been effective, such regulations may leave gaps best addressed through performance-based management practices. For example, pilots and controllers may be required to report incidents (such as bird-strikes or runway incursions) under their respective SMS. However, they may not be required to notify the airport of the incident. Because the airport operator best understands its own operating environment, it is in the best position to address many of its own safety issues providing it has sufficient data to address the hazard. A SMS may provide an airport with the capacity to anticipate and address safety issues before they lead to an incident or accident. Table 2 shows quantified present value and annualized benefits and costs over 10 years. The FAA anticipates additional benefits at airports with an implemented Airport SMS in the form of cost savings from reductions in the frequency and breadth of the traditional airport inspection and inspection cycle. Table 2 also includes the FAA's estimated cost savings of changing the traditional inspection cycle at airports with a fully implemented SMS.

Table 2—Comparison of Costs and Benefits Over 10 Years

[Millions of 2020 dollars]

	Present value (3%)	Annualized (3%)	Present value (7%)	Annualized (7%)
Benefits	$199.2	$23.4	$144.1	$20.5
Costs	179.8	21.1	139.0	19.8
Cost Savings	3.1	0.4	2.2	0.3
Net Benefits (includes mitigation benefits, but excludes mitigation costs)	22.5	2.6	7.3	1.0
Table notes: The sum of the individual items may not equal totals due to rounding. Estimates are provided at three and seven percent discount rates per Office of Management and Budget (OMB) guidance.

II. Background

A. Authority for This Rulemaking

The FAA's authority to issue rules on aviation safety is found in Title 49 of the United States Code. This rulemaking is promulgated under the authority described in: (a) 49 U.S.C. 44702, which authorizes the Administrator to issue airport operating certificates; (b) 49 U.S.C. 44706, which authorizes the Administrator to (i) issue an AOC to a person desiring to operate an airport if the person properly and adequately is equipped and able to operate safely; and (ii) include in such AOC all necessary terms to ensure safety in air transportation; and (c) 49 U.S.C. 44701, which requires the Administrator to—among other things—promote safety, prescribe minimum safety standards, and carry out functions that best tend to reduce or eliminate the possibility or recurrence of accidents in air transportation. This regulation is within the scope of the aforementioned authorities because it requires certain certificated airports to develop and maintain a SMS to improve the safety of operations conducted at such airports. The development and implementation of SMS ensures safety in air transportation by helping airports proactively identify and mitigate safety hazards, thereby reducing the possibility or recurrence of accidents in air transportation.

B. Statement of the Problem

The FAA has determined that there are unmitigated risks and safety gaps in the airport environment necessitating a systems approach to improve safety at part 139 certificated airports. The goal of this rule is to improve the safety of the airfield environment (including movement and non-movement areas). The FAA intends to evolve the current part 139 compliance program into a proactive, and ultimately predictive approach using the structured discipline of SMS principles.

The increasing demands on the U.S. air transportation system, including additional air traffic and surface operations, and airport construction, present a potential increased presence of operational hazards in the airfield environment. However, many accidents and incidents that may be mitigated under SMS may not be shared outside the organization, especially in regards to the non-movement area, thus limiting FAA's insight into the breadth or scale of near-miss and other types of potentially hazardous incidents. While the FAA's use of prescriptive regulations and technical operating standards has been effective, such regulations may leave gaps best addressed through improved management practices. As the certificate holder best understands its own operating environment, it is in the best position to address many of its own safety issues. A SMS may provide an airport with the capacity to anticipate and address safety issues before they lead to an incident or accident.

C. Related Actions

In 2015, the FAA issued a final rule requiring 14 CFR part 119 certificate holders authorized to conduct operations under 14 CFR part 121 to develop and implement a SMS (see 14 CFR part 5, Safety Management Systems).^[9] The part 5 rule established a general framework and minimum requirements for designing and implementing SMS and allowed air carriers to adapt the SMS to ensure it appropriately dealt with the size, scope, and complexity of their part 121 operations. Additionally, under FAA Order 8000.369, the FAA uses SMS internally in offices such as Airports, Air Traffic Organization, Aviation Safety, Security and Hazardous Materials, Next Generation Air Transportation, and Commercial Space Transportation.

As of the effective date of this final rule, part 5 applies to part 119 certificate holders authorized to conduct operations in accordance with part 121. The FAA acknowledges, however, that the applicability of part 5 may be expanded in the future, which could impact this final rule by allowing greater coordination between part 139 certificate holders and tenants through increased use of data sharing and reporting plans (as discussed later).

This final rule targets part 139 certificated airport operators. It follows a similar framework and harmonizes definitions and requirements with the SMS requirements established under part 5 SMS, when and if appropriate. Nonetheless, this final rule recognizes that there might be differences in SMS requirements depending on the scope and complexity of the operations and types of regulated parties subject to 14 CFR. For example, the FAA recognizes that an airport operation is inherently different from the operation of an air carrier and that the vast majority of part 139 certificate holders are public entities (owned and/or operated by a State or local government or a department, agency, special purpose district, political subdivision, or other instrumentality of a State or local government) rather than private entities like those operating as part 121 air carriers. The revised definition proposed in the SNPRM, and adopted in this final rule of an accountable executive eliminates the substantive differences between the part 121 and part 139 definitions, and clarifies that the accountable executive should not be personally liable to the FAA through certificate action or civil penalty. Thus, in the interest of safety, harmonization is not feasible in all instances and differences in the SMS framework, definitions, and requirements are warranted to best deal with the types and varying degrees of operation of the part 139 certificate holders subject to SMS.

This final rule imposes a SMS requirement on certain airports certificated under part 139. It does not impose any additional SMS requirement on part 119 certificate holders, nor does it expand, revise, or amend the provisions, requirements, or responsibilities established in part 5. A Part 139 airport may choose to update its contractual agreements with applicable tenants. However, in most cases, airport operators have additional means to direct critical safety actions through other controlling documents including airport rules and regulations or minimum standards. Usually, contractual agreements with tenants point to, or incorporate by reference, those other documents to allow for more timely implementation of procedures and actions without the need for changes to the agreement. While the final rule does not impose additional SMS requirements on tenants, it is plausible that to achieve its own SMS requirements under part 139, an airport will use these controlling documents to extend certain SMS requirements onto part 119 certificate holders or other tenants.

For the purposes of this final rule, the terms “certificate holder” (when used without part 139 before) and “operator” refer to any entity holding an AOC under part 139. The term “tenant” refers to any person or entity occupying space or property under a lease or other agreement (such as an air carrier or maintenance repair and overhaul company) that does business at the airport.

D. National Transportation Safety Board (NTSB) Recommendations

The NTSB has recommended SMS as a means to prevent future accidents and improve safety in air transportation. The NTSB has cited organizational factors contributing to aviation accidents and has recommended SMS for several sectors of the aviation industry, including aircraft operators and aerodromes (airports). The FAA agrees with the NTSB, concluding the organizational factors and benefits of SMS apply across the aviation industry, including airports.

NTSB submitted comments to the SNPRM concurring with the FAA's “proposal that implementation of SMS at airports is warranted and that SMS should apply to the entire airfield environment, including non-movement areas.” ^[10] NTSB approved of the FAA's proposal to include non-movement areas by stating: “[they] have investigated accidents that clearly demonstrate that the potential for significant events is not limited to only the movement areas.”

E. International Movement Toward SMS

ICAO's Annex 19—Safety Management document establishes a framework for member States to develop and implement SMS requirements. State Safety Programs, as implemented by member States, require SMS for the management of safety risk. Many member States, including the U.S., started developing and implementing in-country SMS requirements after Annex 19 became applicable in November 2013 (amended Annex 19 applicable November 2019). ICAO requires SMS requirements for international commercial air transportation, international general aviation, design and manufacturing, maintenance, air traffic services, training organizations, and certified aerodromes. It is FAA policy to comply with ICAO standards to the maximum extent practicable. This rule would further align U.S. safety management system requirements for airports with international standards, which are recognized and followed by many international product and service providers also complying with ICAO Standards and Recommended Practices.

F. Summary of the NPRM and SNPRM

On October 7, 2010, the FAA published in the Federal Register a notice of proposed rulemaking (NPRM) titled “Safety Management System for Certificated Airports” (75 FR 62008). The NPRM proposed to require all part 139 certificate holders to establish a SMS for the entire airfield environment, including movement and non-movement areas, to improve safety at airports hosting air carrier operations.

While reviewing the comments received in response to the NPRM, the FAA began to re-evaluate whether requiring a SMS at all part 139 certificated airports was the appropriate approach. As part of the re-evaluation, the FAA assessed various combinations of criteria that could trigger the requirement to implement the SMS rule and to maximize safety benefits in the least burdensome manner.

On July 14, 2016, the FAA published a supplemental notice of proposed rulemaking (SNPRM) titled “Safety Management System for Certificated Airports” (81 FR 45872). The SNPRM proposed creating triggers for SMS and proposed the FAA's preferred alternative to impose a SMS requirement on airports that (a) are large, medium, or small hubs; (b) serve international air traffic; or (c) have more than 100,000 total annual operations. The FAA also revised the proposed implementation schedule to extend the implementation period from 18 months to 24 months and requires the submission of an Implementation Plan within 12 months (instead of 6 months) from the effective date of the rule. The SNPRM clarified the training requirements and revised certain definitions to ensure consistency—when deemed appropriate—among various FAA SMS initiatives. The SNPRM comment period closed on September 12, 2016.

In 2021, the FAA decided to reopen the comment period in order to solicit comments on any new information or data generated since the close of the 2016 comment period. The FAA was aware of many airports that had voluntarily implemented SMS since 2016 that might provide additional insight to the SNPRM. The FAA also took into account the Covid-19 pandemic and the five years that had elapsed since the close of the 2016 comment period, and determined that these factors taken together warranted reopening the comment period. Accordingly, the FAA reopened the comment period for the SNPRM, published at 81 FR 45872, for 30 days. When the FAA reopened the comment period, the agency stated that the most helpful comments would: provide only data and information that was not previously submitted to the rulemaking docket; reference a specific portion of the proposal; and explain the reason for any recommended change, including supporting data. The reopened SNPRM comment period closed on September 23, 2021.

G. General Overview of Comments

The FAA received submissions from commenters in 2016 and 2021 in response to the SNPRM. The FAA received comments from 38 commenters during the 2016 comment period, and 17 commenters during the comment period that it reopened in 2021. In general, the 2021 comments were similar to the 2016 comments, and were from many of the same commenters that commented during the 2016 comment period. This preamble identifies comments that were received in 2021 and comments that were received in both 2016 and 2021 by indicating the year the comment was received. Any comments for which the preamble does not note a year were received in 2016.

Although most commenters were certificate holders, some were air carriers, consultants, academics, and individuals. The following industry associations submitted comments: Airlines for America (A4A), Airports Council International-North America (ACI-NA), American Association of Airport Executives (AAAE), Helicopter Association International (HAI), and the National Business Aviation Association (NBAA). The comments addressed the following areas of the proposal:

• Applicability;
• Implementation;
• Non-movement area;
• Data protection;
• Safety reporting and interoperability;
• Training and orientation;
• Accountable executive;
• Definitions; and
• Miscellaneous topics.

III. Discussion of Public Comments and Final Rule

A. Applicability

(1) General Applicability

The majority of airport and industry commenters submitted comments about the FAA's preferred alternative for the applicability of the rule. Instead of applying the SMS rule to all certificated airports, the SNPRM amended the proposed applicability to cover only certificate holders identified as (a) large, medium, or small hubs; (b) having more than 100,000 total annual operations; or (c) having international services (triggers (a) through (c) are hereinafter referred to collectively as, the “preferred alternative”).

Most commenters generally supported the use of the hub classification as a trigger for the applicability of this final rule. However, smaller airports and industry associations questioned the operational and international triggers.

One commenter disagreed with the FAA's revised approach, instead suggesting the FAA require SMS for all certificated airports, as proposed in the NPRM. The commenter believed that applying SMS to a select number of airports could create two levels of safety for airports. The FAA disagrees. The FAA has determined that its approach achieves the most safety benefits in the least burdensome manner, while also strengthening its alignment with international standards. Consistent with other provisions of part 139, this approach relieves relatively small airports from compliance costs when the safety benefits are lower. These small airports have the opportunity to voluntarily implement a SMS, if they believe it is beneficial to their operations.

The FAA continues to encourage airports not certificated under part 139 and part 139 certificate holders that are not subject to this final rule to voluntarily implement SMS and has made Federal funding available for SMS Manuals and Implementation Plan development.

Commenters also proposed alternate frameworks for SMS applicability. For example, some commenters suggested SMS be required on a case-by-case basis. The FAA disagrees with these suggestions because these alternative frameworks would generally cause ambiguity as to when a certificate holder would be required to comply with the SMS requirements. In the case-by-case example referenced above, suggested application of SMS may be regarded as a punitive measure FAA could use to address a certificate holder failing to comply with part 139 requirements. The perception of using SMS as an enforcement tool, contradicts the non-punitive, safety culture critical to a SMS. The FAA's actual intent is for SMS to serve as a risk-based tool targeting highest-risk areas. A case-by-case approach would also be highly subjective because of the unique conditions of each non-compliance issue.

Another commenter suggested that the FAA exclude airports holding a Class IV AOC from the preferred alternative. A Class IV airport is an airport certificated to serve unscheduled passenger operations of large air carrier aircraft. A Class IV airport cannot serve scheduled large or small air carrier aircraft. The FAA disagrees that Class IV airports should be completely excluded, as they serve air carrier aircraft. If a Class IV airport meets one of the triggers because it could serve a large number of air carrier ^[11] operations or host international operations, it meets the standard identified through the risk-based approach. As discussed later, if a Class IV airport is only identified under the international trigger, the certificate holder may obtain a waiver from the SMS requirements if it meets all of the conditions established in § 139.401(d).

One comment received during the 2021 comment period recommended allowing for a single SMS for use in multi-airports systems. The FAA agrees with this recommendation, and notes that the regulations allow this use, provided that each airport can still meet the requirements of this final rule.

Finally, one commenter observed the preferred alternative could result in certain airports used by air carriers as alternate or emergency airports not being subject to the SMS requirement. This observation is correct: airports designated as an alternate airport are subject to part 139 requirements only if they fulfill one of the triggers.

(2) Triggers

(i) Hub trigger: In the SNPRM, the FAA proposed using data from the National Plan of Integrated Airport Systems (NPIAS) to identify which certificate holders would qualify under the hub trigger. One commenter stated that there is a lag between when NPIAS data is gathered, published, and becomes publicly available. While the commenter requested the FAA use a different data source to determine hub applicability, it also asked the FAA to report SMS applicability within the biennial NPIAS Report to Congress. The FAA partially agrees with these requests. The FAA will use the annually updated Enplanements at All Airports (Primary, Non-primary Commercial Service, and General Aviation) by State and Airport data available on FAA.gov to determine hub applicability. The FAA pulls this data from the Air Carrier Activity Information System (ACAIS), an FAA database containing data reported by the air carriers to the U.S. Department of Transportation, Bureau of Transportation Statistics. The FAA has used ACAIS since the 1980s to categorize airports based on enplanements and determine entitlement funding under the Airport Improvement Program. The FAA shares this data with airports annually and uses it to inform the NPIAS report. The FAA does not plan to add information about SMS applicability to the NPIAS ( e.g., adding a column/field to indicate whether the airport is required to implement SMS) as inconsistencies might exist due to a reporting lag. Instead, the FAA will maintain a separate list of airports required to implement SMS on our public website, FAA.gov.

(ii) Operations trigger: In the SNPRM, the FAA proposed using operational data submitted through FAA Form 5010-1, Airport Master Record. To determine which airports would be subject to the SMS requirement under this trigger, the FAA used a “snapshot” approach, gathering operational data reported in the system on August 1, 2012. Commenters requested changes to either the operations trigger or the source data. Commenters also expressed concerns about the FAA's snapshot approach, explaining that multiple factors could cause airport operations to vary on a yearly basis, causing an airport to exceed 100,000 operations for a particular year but fall below the trigger threshold in the preceding or following years.

The FAA agrees with commenters' concerns about the snapshot approach. Therefore, the FAA will use a 3-year rolling average to determine applicability under the operations trigger.

Accordingly, this final rule retains the operations trigger with minor modifications. This final rule will not use FAA Form 5010-1 as the sole source of data used to determine who qualifies under the operations trigger. Instead, the FAA will use the following: (a) traffic counts reported by the Air Traffic Control Tower through FAA Operations Network (OpsNet) for airports with FAA or contract towers; (b) FAA Form 5010-1 data for non-towered airports; or c) other FAA-validated counting systems. Historical OpsNet data is publicly available through FAA.gov.

Lastly, the final rule adds a clause to § 139.401(a)(2) to clarify that operations for the purposes of this trigger mean the sum of all arrivals and departures. This addition does not change the meaning of operations as it is used in the context of the operations trigger and as it was proposed in the SNPRM, but merely provides additional clarity.

(iii) International trigger: In the SNPRM, the FAA proposed requiring SMS at all airports with international services, specifically: (a) those identified as a port of entry (under 19 CFR 101.3), (b) designated international airports (under 19 CFR 122.13), (c) landing rights airports (under 19 CFR 122.14), or (d) user fee airports (under 19 CFR 122.15). Seven commenters expressed general concern that small airports with Customs and Border Protection (CBP) facilities accommodating international general aviation traffic, not scheduled air carrier operations, are unnecessarily included in the international trigger. Several commenters recommended that the FAA should only require airports with scheduled international service to have SMS. In 2021, commenters reiterated concerns about the SMS requirements that would apply to airports under this particular trigger.

The FAA requested comments on alternate methods for identifying international airports, since the FAA no longer maintains Advisory Circular 150/5000-5, Designated U.S. International Airports.

Commenters had mixed responses to the Agency's use of CBP's Guide for Private Flyers list. Many requested the FAA not use the list because it is outdated and is not hosted by the Agency. One commenter recommended the FAA modify FAA Form 5010-1 to include a new field for certificate holders to self-report the availability of international services. Some commenters requested the FAA establish a joint government/industry task force to assess the accuracy of CBP's lists and develop another method to identify international status, which could include self-reporting by airports.

The FAA also agrees with commenters' concerns about the data source for international applicability. It does not appear that any one data source document contains the most up-to-date list of airports with international services. Therefore, this final rule removes reference to CBP regulations. Instead, the FAA will use appropriate available sources of data to determine applicability under this trigger. In addition to CBP regulations, the Agency will use CBP website information and the private flyers list of available airports. The combined use of these lists provides a more comprehensive source of information to determine which airports host international services. The FAA determined that it is unnecessary to establish a joint government/industry task force to develop this information since it is available directly from CBP. The FAA will defer to the expert agency and will not question the accuracy, data gathering systems, analysis, or processes of CBP. As previously stated, the FAA intends to maintain the master list of qualified airports. The FAA determined that it is unnecessary to note this applicability in other lists such as the FAA Form 5010-1 database or the NPIAS because doing so could lead to inconsistent data due to potential reporting lags.

The FAA also agrees with comments submitted in 2016 and 2021 that the intent of the international trigger is not to impose a burdensome regulation on certificate holders with international service capabilities aimed exclusively at general aviation traffic. Thus, the FAA incorporated a provision into this final rule allowing airports hosting international services exclusively for general aviation traffic to obtain a waiver from the SMS requirement. An airport may obtain a waiver as long as there is no tenant at the airport that is required to comply with a SMS requirement imposed by any applicable law or regulation of its country of origin ( i.e., the jurisdiction that issued the operator's air carrier certificate, air operator certificate, or equivalent) or any other applicable governing jurisdiction.^[12] To obtain a waiver, a certificate holder must submit a formal, written request to the appropriate FAA Regional Airports Division Manager justifying its waiver request, pursuant to § 139.401(d). As discussed later in the preamble, FAA estimates that approximately 74 airports would meet this provision and be eligible to apply for a waiver.

The FAA recognizes that an airport's status could change based on the turnover of tenants conducting business at any given moment. For certificate holders granted a waiver, this final rule (§ 139.401(d)) requires the certificate holder to report to the FAA whether it has had any change in international air carrier service that affects the applicability of part 139 SMS requirements every 2 years.

The FAA also received comments in 2016 and 2021 alleging the framework did not comply with ICAO standards. The FAA concludes that ICAO Annex 14 identifies standards and recommended practices that address certificated airports with international air carrier service. This final rule's international trigger framework is consistent with the overarching intent of the international standards.

(3) Authority To Implement Triggers

Several commenters asserted that the FAA does not have sufficient authority to implement the proposed triggers. As stated in the SNPRM, the FAA has sufficient statutory authority under Title 49 of the United States Code, Subtitle VII, part A, subpart III, section 44706, “Airport operating certificates,” as well as section 44701, “General requirements,” and section 44702, “Issuance of certificates,” to require SMS at any certificated airport—including those identified as having international services.

(4) Annual Review of Applicability

The FAA was asked to clarify: (a) the timeline and process for reviewing the final rule's applicability to an airport; (b) how the FAA will review each airport's status including when the review will occur; and (c) how much time a newly identified airport would have to comply with this final rule.

The FAA plans to conduct its annual applicability review at the end of each calendar year after this final rule becomes effective. After each annual review, the FAA will post a list of qualifying airports on FAA.gov and send airports that qualify due to a status change a letter notifying them of their qualification.

This final rule requires a newly qualified airport to submit its Implementation Plan within 18 months from notification of qualification by the FAA (see § 139.403(a)(4)). After the FAA approves the Implementation Plan, the certificate holder has 12 months to submit its SMS Manual and/or ACM update and 36 months to fully implement SMS.

For an airport that initially qualified under any of the triggers but no longer qualifies due to a status change, the certificate holder will be required under § 139.401(h) to continue to develop, implement, maintain, and adhere to the SMS for the longest of either 24 consecutive calendar months after full implementation; or 24 consecutive calendar months from the date it no longer qualifies under § 139.401(a). Additionally, some airports may cross the threshold of the 100,000 operations criteria from one year to the next. The 24 consecutive calendar months ensure greater continuity and predictability in the airport's SMS. The FAA determined 24 calendar months was the minimum time that would be necessary to accurately validate the withdrawal of the triggering requirements. FAA believes a period beyond 24 consecutive calendar months would be overly burdensome to airport operators.

If at any time during the application process for an AOC, an airport operator becomes subject to this final rule under any of the triggers identified in § 139.401(a), then the FAA expects that such airport operator will develop a SMS simultaneously with the development of its certification program. The FAA does not expect the Implementation Plan requirement for airport operators seeking an AOC under § 139.103 to create an additional burden because the FAA anticipates that the process will occur simultaneously with the certification process.

B. Implementation

Nearly every commenter from both 2016 and 2021, including certificate holders, industry associations, and consultants, commented on the FAA's proposed timeline for submission of the certificate holder's Implementation Plan, SMS Manual, ACM update, and full implementation. While most agreed the amended proposal for submitting the Implementation Plan and SMS Manual was acceptable, none thought a certificate holder could be fully implemented within 2 years. Commenters from the 2021 comment period requested further clarity on how the final rule would affect existing SMS programs. The final rule supplemental guidance incorporates more detail for airports implementing an existing SMS into their part 139 compliance program.

(1) Phased Implementation

In the SNPRM, the FAA addressed comments to the NPRM requesting the FAA mandate a phased approach to implementation. This would entail setting different regulatory timelines for implementation based upon, for example, each SMS component, or requiring the implementation of the SMS in the movement area prior to non-movement areas. As explained in the SNPRM, to facilitate maximum flexibility and scalability, the FAA did not propose a one-size-fits-all implementation approach. A certificate holder is granted flexibility in structuring and fine-tuning its Implementation Plan to best fit its operations and capabilities. Certificate holders are therefore able to phase implementation, either by SMS component or by movement versus non-movement area, as long as they fully implement SMS by the required deadline.

During both the 2016 and 2021 comment periods, commenters reiterated previous comments to the NPRM asking the FAA to require a phased approach and permit more time for implementation.

The FAA maintains that it will not require airports to use a phased approach. This final rule is performance-based and allows flexibility in how the certificate holder implements SMS within the required deadlines. A certificate holder could choose to phase its implementation, as long as that phasing occurs within the full implementation deadline. The FAA addresses potential phasing options and considerations in the related AC, which takes into account experiences from pilot studies and other implementing countries. The AC is a guidance document and the FAA stresses that certificate holders may choose to pursue a phased approach—or not—and to structure their implementation to best fit their operations, needs, and capabilities.

The FAA also acknowledges that safety assurance processes and procedures, including program evaluation and auditing, would require experience under the SMS to be meaningful. By the deadline for full implementation, the FAA expects a certificate holder to identify those safety assurance processes and procedures and a timeline for rolling out those activities identified in the SMS Manual or ACM; not actually apply those practices prior to full implementation.

(2) Staggered Implementation

In addition to requesting a phased implementation, numerous commenters requested the FAA impose a staggered approach to implementation. The meaning and scope of “staggered” varied per commenter, but commenters focused on staggering by size and complexity of airport operations, by applicability triggers, or based on airport human and financial resources.

The FAA agrees that a staggered approach will benefit industry implementation as well as FAA review and oversight. Therefore, this final rule staggers rollout of document submission and implementation requirements based on the applicability triggers. This approach conforms to commenters' requests to implement a staggered approach based on size and complexity of the airport's operation. By being the last to implement, smaller, less complex operations gain the ability to learn and seek advice from larger, more complex airports that already underwent the process. They will also have more time to identify resources and program appropriate funding, where needed.

(3) FAA Review of Documents

The majority of commenters requested the FAA provide a detailed timeline for FAA review, and approval or acceptance, of the certificate holder's Implementation Plan and SMS Manual/ACM update. Several commenters specifically requested that this final rule include regulatory text imposing deadlines for FAA review. Commenters also requested the FAA conclude that if a certificate holder receives no feedback from the FAA Regional staff within a certain number of days after document submission ( e.g., 60 or 90), then the Implementation Plan or SMS Manual should be deemed approved or accepted.

Lastly, the FAA was asked to explain whether it expects a certificate holder who has already voluntarily implemented (or begun implementation of) a SMS to submit an Implementation Plan. The commenter suggested these airports conduct a gap analysis to determine gaps between their established programs and this final rule and submit a letter to the FAA summarizing those gaps.

The FAA acknowledges the importance of approval of the Implementation Plan to full SMS implementation. Therefore, the deadlines for submission of the SMS Manual and/or ACM update and full implementation dates are calculated based on the FAA's approval of the Implementation Plan, rather than the effective date of this final rule. This approach is similar to the one used in part 5, except that it does not provide an absolute deadline by which the FAA must approve each Implementation Plan.

On average, the FAA estimates it will take an inspector 60 days to review an Implementation Plan and 90 days to review a SMS Manual and/or ACM update. The FAA deems these estimates reasonable and achievable under the staggered implementation approach. FAA Regional inspectors will work closely with their team leads, managers, and Headquarters liaisons should any problem or question arise about the submission or review process. Furthermore, the change to how the deadlines are calculated ( i.e., based on the Implementation Plan approval date) allows for more communication between the inspector and certificate holder, should changes be required.

The FAA intends to leverage existing long-standing processes, whereby the FAA Regional inspectors work closely with the airport operator to review and approve submitted changes to their ACM. These processes are typically explained in FAA Orders, which are publicly available documents. FAA Order 5280.5, “Airport Certification Program Handbook,” will provide inspectors with guidance on how to review, approve, and accept document submissions, and also inspect SMS implementation. Part 139 does not include a process for certificate holders to resolve disapproval of changes to their ACM, and the FAA has not added such a process in this final rule.^[13] The ACM review processes have historically been successful under the part 139 program.

The FAA developed a standardized Implementation Plan template in AC 150/5200-37A and has updated the material along with this final rule. Certificate holders are not required to use the template but are encouraged to do so to simplify and expedite FAA review and approval.

A certificate holder is not required to submit changes to its approved Implementation Plan. As discussed in the SNPRM, the Implementation Plan serves as a tool to help certificate holders develop and implement the various components and elements of SMS within the prescribed and/or approved deadlines. Once approved, the FAA expects the certificate holder to make necessary adjustments to ensure compliance with the prescribed deadlines.

Airports that have already voluntarily implemented SMS also must provide an Implementation Plan detailing how they will comply with this final rule. The FAA has determined that the Implementation Plan requirements are scalable, flexible and not overly burdensome. The certificate holder could use the AC guidance material and template to identify whether it has already completed the elements required under this final rule to assess any gaps between the final rule and its existing programs. Certificate holders may use an existing gap analysis as the basis for their Implementation Plan. However, the FAA would not accept a gap analysis alone, in lieu of the Implementation Plan.

(4) Timeline for Document Submission and Full Implementation

The SNPRM proposed an amended schedule for submission of a certificate holder's-Implementation Plan (12 months after the rule's effective date) and the SMS Manual and/or ACM update (24 months after the rule's effective date). The SNPRM implied that full implementation would be completed as of the date the SMS Manual was submitted. Most commenters agreed the amount of time proposed for submitting the Implementation Plan and SMS Manual was acceptable. However, many commenters from the 2016 and 2021 comment periods believed that full implementation was unachievable within 2 years. Numerous comments supported ICAO's model allowing 3 years for full implementation, while others supported alternate timelines ranging from 3 to 8 years. One commenter during the 2021 comment period argued that the implementation period of 2 years was too long. Commenters during both the 2016 and 2021 comment periods stated that by extending the timeline for full implementation, certificate holders would have more time to (a) amend existing tenant leases in non-movement areas, and change applicable leaseholds, contracts, policies and procedures; (b) work with State legislatures to protect SMS-related data; (c) implement based on FAA review and approval of the Implementation Plan; (d) effectively manage the number of hazards reported; (e) garner support and buy-in, hold partnering sessions with all stakeholders, and ensure that the written program will be positively received and accepted upon implementation; and (f) obtain local, state, or Federal funding to meet SMS requirements ( e.g., to obtain consultant services, acquire software systems, etc.). One commenter from the 2021 comment period recommended that the FAA reconsider its submittal timelines for SMS Implementation Plans and Manuals/ACM SMS sections.

The FAA agrees it is appropriate to increase the time allotted for full implementation. Thus, under this final rule, certificate holders qualifying under the hub trigger must be fully implemented approximately 4 years from the effective date of this final rule, plus any additional time that is required for FAA approval of the Implementation Plan. Because the FAA is using a staggered approach to submission of the Implementation Plan, certificate holders qualifying under the operations trigger have over 4.5 years and those qualifying under the international trigger have over 5 years to fully implement from this final rule's effective date.

Table 3 depicts the timeline for submission of the Implementation Plan, SMS Manual and/or ACM update, and full implementation based on a trigger. It also provides an estimated full implementation date based on a 60-day FAA review and approval of the Implementation Plan. The only documents required for submission are the Implementation Plan and SMS Manual and/or ACM update.

During the 2021 comment period, the FAA received several comments urging the FAA to reconsider SMS rulemaking and required implementation at this time due to the economic impact airports are facing as a result of the COVID-19 pandemic. The FAA recognizes the pandemic's impact on many airports; however, this rule's triggering criteria in § 139.401(a) account for factors that influence the triggers, such as the COVID-19 pandemic. The final rule also includes an implementation schedule based on the trigger and continues to be scalable and flexible to accommodate changes in airport operations. As previously addressed, Federal funding is also available for SMS Manuals and Implementation Plan development.

Table 3—Timeline for Submission of the Implementation Plan, SMS Manual and/or ACM Update, and Full Implementation Based on Trigger

Triggers	Submit implementation plan	Submit SMS Manual and/or ACM update	Fully implement *
Large, medium, and small hubs	12 months from effective date	12 months from date on which the FAA approves the Implementation Plan	36 months from the date on which the FAA approves the Implementation Plan.
+100,000 average annual operations	18 months from effective date	12 months from date on which the FAA approves the Implementation Plan	36 months from the date on which the FAA approves the Implementation Plan.
International airports	24 months from effective date	12 months from date on which the FAA approves the Implementation Plan	36 months from the date on which the FAA approves the Implementation Plan.
*Approximate dates assume 60-day FAA review of Implementation Plan.

(5) Timeline for New Airports Qualifying After the Effective Date of This Final Rule, or Due to Changes in Status

In the SNPRM, the FAA discussed SMS requirements imposed on: (a) airports that were subject to the rule at the time of the effective date of this final rule, and (b) airport operators requesting an AOC (newly certificated airports) after the effective date of this final rule. The FAA failed to address certain circumstances that could arise after the effective date of this final rule; particularly, when a certificate holder could become subject to, or no longer subject to, the requirements of this final rule due to a change in its hub, operations, or international status. In these instances, two commenters requested clarification of the timelines for submission of Implementation Plans, SMS Manuals and/or ACM updates, and full implementation.

As further discussed in section A, “Applicability,” this final rule addresses these circumstances and requires the certificate holder to: (a) submit an Implementation Plan within 18 months of notification of qualification by the FAA; (b) submit a SMS Manual and/or ACM update within 12 months of Implementation Plan approval; and (c) fully implement a SMS within 36 months of Implementation Plan approval. This final rule also addresses circumstances in which a certificate holder no longer meets any of the qualification triggers. Section 139.401(h) requires the certificate holder to continue to develop, implement, maintain, and adhere to its SMS for the longest of either twenty-four consecutive calendar months after full implementation; or twenty-four consecutive calendar months from the date it no longer qualifies under § 139.401(a). For illustration purposes only, assume a certificated airport qualified only under the international trigger due to the presence of a part 129 international carrier. If the international air carrier ceases operations at the airport, and if there are no other commercial international operations, then the airport no longer will be subject to the SMS requirements, but § 139.401(h) requires the airport to continue to develop, implement, maintain, and adhere to its SMS for the longest of either twenty-four consecutive calendar months after full implementation; or twenty-four consecutive calendar months from the date it no longer qualifies under § 139.401(a). Some airports may cross the threshold of the international flights criteria frequently. The FAA determined twenty-four calendar months was the minimum time that would be necessary to accurately validate the withdrawal of the triggering requirements. FAA believes a period beyond twenty-four consecutive calendar months would be overly burdensome to airport operators.

C. Non-Movement Area

The FAA believes it is essential that SMS regulatory requirements apply to non-movement areas through part 139 because. . . . We received comments during the 2016 and 2021 comment periods from numerous entities, including associations, certificate holders, and air carriers, on the proposed application of SMS to non-movement areas. Except for a few notable exceptions, most disagreed with the FAA's proposal to include non-movement areas in an airport's SMS. Nearly all of these commenters suggested ways—through either regulatory text or preamble discussion—for the FAA to clarify its intentions with respect to applicability of SMS to non-movement areas and to improve the requirements to reflect the practicalities of airport operations.

Several of these commenters from both the 2016 and 2021 comment periods also urged the FAA to resolve potential duplication and conflicts between the SMS of an air carrier tenant ( i.e., a part 119 certificate holder subject to part 5 SMS) and the SMS of an airport operator for activities conducted in leased facilities located in non-movement areas. Commenters from both comment periods suggested that airport involvement in air carrier tenant leased areas could introduce new risks for air carriers because the air carriers would have to ensure compliance with different procedural mitigations at each airport they fly into. Commenters from both comment periods also addressed potential duplication and conflict for passenger operations in non-movement areas. However, both airport and cargo operators indicated that operations on cargo ramps are unique since they are managed exclusively by cargo operators. Lastly, commenters from both comment periods asked the FAA to exclude non-movement areas subject to exclusive area agreements with the Transportation Security Administration (TSA), when the certificate holders have implemented SMS.

The FAA received and considered the following suggestions to address the implementation in non-movement areas:

1. Make SMS implementation in non-movement areas voluntary for part 139 certificate holders;

2. Apply SMS in the non-movement areas only for “traditional” airport responsibilities ( e.g., infrastructure condition, driving, airport-provided or required marking and lighting, and public protection), and let air carriers or other third parties address other functions ( e.g., pushback and towing, aircraft servicing, jet bridge operation, and baggage/cargo handling);

3. Encourage (or require) part 139 certificate holders to implement SMS first in the movement area and then in the non-movement areas (phasing in areas in which the airport has complete control, areas in which the airport shares control, and areas in which a third-party has control);

4. Permit part 139 certificate holders to exclude SMS applicability from areas specifically identified in the SMS Manual that are under the control of one or more air carrier tenants with part 5 SMS;

5. Allow part 139 certificate holders to delegate their authority to their tenants to implement SMS in certain non-movement areas where the certificate holder can show the tenant has greater control, or limit the role of the airport operator in such areas to that of a “coordinator”;

6. Permit part 139 certificate holders to delegate SMS oversight and responsibility to a designated senior official of each affected tenant; and

7. Clarify whether the part 139 certificate holder SMS or the air carrier tenant SMS has precedence for safety issues in non-movement areas, subject to the SMS requirements of parts 5 and 139 ( e.g., gate operations near aircraft, ground servicing vehicles, etc.).

(1) Regulatory Authority in the Non-Movement Area

One commenter reasserted its argument—first brought forth in its comments to the NPRM—that the FAA lacks the necessary authority to regulate non-movement areas pursuant to 49 U.S.C. 44706. Another commenter stated the FAA has not offered a compelling reason to substantiate the proposed expansion of its regulatory oversight to non-movement areas.

The FAA has broad authority under 49 U.S.C. 44702 to issue AOCs. Under 49 U.S.C. 44706, the FAA can issue an AOC to a person desiring to operate an airport if it finds that the certificate holder “properly and adequately is equipped and able to operate safely under this part and regulations and standards prescribed under this part.” Furthermore, 49 U.S.C. 44701(c) allows the FAA to regulate to “reduce or eliminate the possibility or recurrence of accidents in air transportation.”

The FAA acknowledges that the majority of the quantified benefits related to wildlife strikes are primarily occurring in the movement area, which make up about 50 percent of benefits. However, the FAA has identified numerous safety concerns, events, accidents, and incidents in non-movement areas that constitute hazards and may reasonably contribute or lead to accidents in air transportation (examples of which are discussed both later in the preamble as well as in the accompanying RIA). Instituting SMS in movement and non-movement areas is consistent with the FAA's authority and safety mission, because it provides significant benefits and contributes to the reduction or elimination of the possibility of recurrent air transportation related accidents.

In one example, discussed further in the RIA, an airport identified a hazard to passengers walking on a ramp between parked aircraft and the terminal. The airport mitigated the hazard by adding pavement markings to guide passengers along a safe path between aircraft and the terminal. In another example, an airport identified a trend regarding collisions between moving aircraft wingtips or service vehicles and the tails of stationary aircraft parked at gates. The airport mitigated the hazard using pavement markings as a clear indicator for ramp wing-walkers and marshallers to maintain proper clearances.

The regulatory evaluation of this final rule provides additional examples of past events that justify the need for implementation of SMS in non-movement areas. See Section IV, Benefits, in the regulatory evaluation for this rule. Accidents and incidents continue to occur. For example, during the 2-month period encompassing January and February 2017, a large hub airport reported four damaging incidents in the non-movement area. Two of the incidents occurred during pushback, and all four incidents involved vehicle movements or safety personnel required to monitor such movements. In February, May, and July 2017, a second large hub airport (owned and operated by the same entity) reported three more damaging incidents in the non-movement area, similar to those experienced at the first airport.

Furthermore, as discussed in the SNPRM, and in direct support for instituting SMS in non-movement areas, pilot studies found that it was difficult to apply SMS concepts only to the movement area because aircraft and airside personnel routinely flow between movement and non-movement areas. Airport operators and/or airport owners currently have sufficient authority to implement the training, safety reporting, and Safety Risk Management (SRM) processes required in this final rule, as well as to undertake the additional responsibility and burden in the non-movement area that will result from this rule, including potential development of new expertise in this area.

(2) Inclusion of Fuel Farms, Baggage-Makeup, and Military Areas

A commenter argued against the inclusion of fuel farms as part of the SMS requirements. The FAA disagrees that SMS implementation in fuel farms should be voluntary for airports. As stated in the SNPRM, fuel farms are regulated under § 139.321 as part of the certificate holder's AOC. Therefore, it is a natural progression to implement relevant portions of the SMS in the fuel farm environment.

Another commenter requested the FAA include baggage-makeup areas within the definition of non-movement area. The FAA previously responded to issues about applicability to baggage-makeup areas in both the “Responses to Clarifying Questions (to the NPRM)” and the SNPRM. The FAA continues to disagree with including baggage-makeup areas explicitly within the definition of non-movement areas. At the majority of airports, these areas are located in the terminal environment. The purpose of addressing non-movement areas in SMS is to address conditions, events, incidents, or accidents that could potentially threaten, or harm, passenger-carrying operations, and to reduce or eliminate the possibility of recurrence of accidents in air transportation (as authorized by 49 U.S.C. 44701, 49 U.S.C. 44702, and 49 U.S.C. 44706). However, if a baggage-makeup area is located outside the landside facilities—in proximity to air carrier operations—the certificate holder would need to ensure the implementation of relevant portions of this final rule, like awareness of the safety reporting system for individuals working in the external baggage-makeup areas. The “non-movement area” definition covers these rare instances without explicitly identifying baggage-makeup areas.

The FAA addressed certain issues about joint-use airport facilities in the NPRM and SNPRM. Notwithstanding, several commenters—including various certificate holders—stated the SNPRM was unclear with respect to non-movement areas that are under the exclusive control of the military or other governmental entities. The FAA maintains its position that non-movement areas under the exclusive control of military units or other governmental agencies are excluded from the applicability of SMS requirements. This exclusion will apply to military facilities at joint-use airports or leased areas at joint-use airports. All such areas must be identified in the SMS Manual and/or ACM update, and the certificate holders should include the exclusion in any “lease and use agreement”—or similar legal instrument—with applicable military units or governmental agencies. Certificate holders can—at their own initiative—promote the voluntary inclusion of the military and governmental bodies in SMS-related activities and programs.

(3) Inconsistency With ICAO Standard

A commenter noted that ICAO Annex 19, Appendix 2, states an “organization's SMS should identify hazards and mitigate risks associated with its products or services.” It argued that an airport's SMS should only be applicable to products or services provided by the airport or its contractors, meaning that services provided in non-movement areas by parties other than the airport operator would not be covered ( e.g., baggage handlers or provisioning crews). The commenter believed the FAA's proposal is inconsistent with this international standard and may lead to negative consequences.

The FAA does not agree with the commenter's interpretation. “Note 2” of Amendment 1 to ICAO's Annex 19 states: “the service provider's interface with other organizations can have a significant contribution to the safety of its products or services.” Section 2.1.1 of Appendix 2 states: “the service provider shall develop and maintain a process to identify hazards associated with its aviation products or services.” Furthermore, pursuant to section 2.1.2: “hazard identification shall be based on a combination of reactive and proactive methods.”

The sections referenced above evidence and recognize the complexity of certain operations ( i.e., airport operations). The interface between a service provider and other organizations can significantly contribute to the safety of the service provider's products or services. Airport operations are complex, and certain actions occurring in movement and non-movement areas could pose a threat to the safety of aircraft and air transportation. Airports should consider all conditions that could pose a threat or hazard to the airport's operations, whether partly or completely located in the movement or non-movement areas. This is not an issue of where the hazard occurs, but if it could occur. Conditions in the non-movement areas could constitute hazards because they can foreseeably lead—or be part of a chain of events that leads—to aircraft accidents ( e.g., An aircraft taxis over wheel chocks left on the ramp, causing damage to the aircraft's nose wheel spray deflector. The damaged deflector prevents extension or retraction of nose gear after takeoff, causing an emergency diversion and nose gear-up landing.^[14]

Based on the above, and on the FAA's authority to regulate the non-movement area pursuant to 49 U.S.C. 44701, 44702, and 44706, the FAA determined the regulation of the non-movement area for SMS purposes is consistent with ICAO standards.

(4) Air Carrier Operations in Non-Movement Areas

Commenters that commented during both the 2016 and 2021 comment periods were confused about the applicability of SMS regulatory requirements in non-movement areas. Some air carriers and airport operators believed the SMS requirements proposed in the SNPRM would duplicate requirements already imposed on air carriers through part 5. These entities believed the part 139 final rule should exclude non-movement areas under the exclusive control of air carriers since they are already covered through the air carrier's SMS.

The part 5 final rule limited the FAA's oversight of the air carrier's SMS to aviation activities conducted under part 121. The FAA acknowledged in the preamble of the part 5 final rule that some air carriers may opt to extend their SMS to other aviation and non-aviation-related activities. The FAA clarified that it would only conduct oversight of SMS activities related to aviation operations that the air carriers conduct under part 121. Many air carriers have voluntarily extended their SMS to include ramp operations, but these programs are not required to comply with part 5, nor are they inspected by the FAA.

The part 5 final rule also narrowed the definition of the term “hazard” to ensure consistency with the NTSB's definition of “aircraft accident.” Accordingly, the part 5 definition of “hazard” involves a condition that could foreseeably cause or contribute to an aircraft accident as defined in 49 CFR 830.2. An “aircraft accident” is defined as: “an occurrence associated with the operation of an aircraft which takes place between the time any person boards the aircraft with the intention of flight and all such persons have disembarked, and in which any person suffers death or serious injury, or in which the aircraft receives substantial damage.” By limiting the scope of the definition of “hazard” in part 5, the FAA's oversight is narrowed to the air carrier's operation.

The FAA notes that certain aspects of an air carrier's operations conducted in non-movement areas are not subject to the provisions of part 121. Similarly, unfavorable occurrences, which could lead to an accident, injury, or damage, may not involve an aircraft with the intention of flight but could still be of concern to an airport operator. As previously discussed, the need for proactive safety management in the non-movement area is evidenced by the large number of safety accidents and incidents in non-movement areas. Therefore, the FAA believes it is essential that SMS regulatory requirements apply to non-movement areas through part 139.

The FAA Office of Airports' (ARP) oversight and inspection related to application of the SMS to non-movement areas will focus on the airport operator's processes and practices to ensure proactive safety management, since ARP inspectors are not authorized to inspect air carrier operations for compliance with part 5, 119, or 121.

As for implementation of SMS in non-movement areas, the FAA does not agree that it should be voluntary or dictated by regulation (see section B, “Implementation”). However, the FAA agrees that additional flexibility—to facilitate compliance with the requirements for SMS implementation in non-movement areas—will be beneficial to account for unique contractual, business, or operational arrangements involving air carrier tenants required to implement SMS. For example, the airport operator could establish a means for air carriers' tenants to share with the airport any reports, safety information, and analysis relevant to the air carrier's operations in the movement and non-movement areas of the airport. The air carrier tenant employees could file the information through the airport's safety reporting system. However, the flexibility of this final rule allows for—but does not require—the certificate holders to enter into an arrangement in which air carrier tenant employees continue using their employer's confidential employee reporting system (See 14 CFR 5.71(a)(7)) to communicate relevant safety data and reports, as long as the air carrier tenant shares relevant information derived from such reports or findings with the airport. Section 139.401(e) affords certificate holders such flexibility by alleviating duplicative reporting and encourages sharing of information by addressing interoperability issues between the regulated entities. If the part 139 certificate holder chooses to develop a Data Sharing and Reporting (DSR) Plan, this option is available.

A certificate may develop a DSR Plan as a means of compliance with § 139.401(e). If the certificate holder chooses this means of compliance, the DSR Plan must include, as a minimum: (a) the types of information ( e.g., hazard reports, investigation findings, etc.) the airport operator expects the air carrier tenants to share if they are reported through their part 5 confidential employee reporting system or other hazard collection means; (b) the timeliness of sharing relevant safety data and reports; (c) the process for analyzing joint safety issues or hazards; (d) other processes, procedures, and policies to aid the part 139 certificate holder's compliance with its obligations under the airport SMS; and (e) the identification of means by which the requirements of the plan will be executed ( e.g., private agreement, internal bylaws, internal regulations, internal policies, memorandums of understanding, etc.). The part 139 certificate holder may choose to incorporate the DSR Plan into the ACM or SMS Manual.

Establishing a DSR does not necessarily require any additional capital investment by the airport or the tenant to facilitate data sharing as § 139.401(e) does not prescribe how data sharing should occur (for example, data sharing could be achieved through routine meetings between the airport and the part 121 air carrier). A DSR might also reduce the total amount of incidents that would otherwise be reported to the airport, as the DSR Plan may allow for a tenant, through its own internal reporting system and SMS, to analyze and mitigate reported hazards that it determines do not require further analysis or mitigation by the airport.

Airport operators must work with air carrier tenants that chose to participate in the DSR Plan to ensure they agree to the terms it established. The FAA stresses that the development and participation in the DSR Plan is voluntary both for the airport operator and air carrier tenants. Airports that develop a DSR Plan may encourage participation by, among other things, reminding air carrier tenants of the benefits afforded through the DSR Plan, such as relief from duplicative reporting.

The DSR Plan affords the airport operator flexibility in how it engages applicable air carrier tenants. This final rule does not dictate the means by which the airport operator must carry out the provisions; rather, it requires airport operators choosing this option to describe how they will implement the provisions. For example, an airport operator may have sufficient rights and powers to institute requirements such as data sharing through airport issued rules, regulations, or policies. In other cases, an airport operator may need to enter into a private agreement or amendment to an agreement or an internal directive or guideline to implement such provisions. The part 139 certificate holder will simply identify the means by which it will implement the minimum requirements of the DSR Plan to allow for the sharing of information ( e.g., private agreement, rules and regulations, memorandum of understanding, etc.). It will not have to incorporate the agreements, rules, or other provisions into the DSR Plan.

Regardless of the existence or form of delegation, the FAA emphasizes that the burden of compliance with the regulatory requirements established by this final rule rests solely on the part 139 certificate holder. Any failure of an air carrier tenant to uphold any term or condition established in an arrangement or agreement between the air carrier tenant and the part 139 certificate holder that is used to carry out the provisions of the DSR Plan is not a valid or reasonable justification for lack of compliance with the regulation.^[15]

Further, an FAA inspector could request to inspect the optional documentation ( e.g., private agreement, internal bylaws, internal regulations, internal policies, memorandums of understanding, etc.) referenced in the DSR Plan, whenever the FAA determines—or has reasonable belief—that the airport is not complying with related provisions of the regulation. The inspection of the documentation facilitates the FAA's assessment of compliance with the regulation and the FAA's understanding of the delegation of responsibilities among the parties. Therefore, the FAA recommends that certificate holders include a clause or provision in such agreements or documents that all parties involved facilitate access to the FAA for the review of the agreements or documents—at the FAA's request—so the FAA can assess compliance with all applicable regulatory requirements when in question. As discussed in Section D, Data Protection, the FAA may request additional SMS-related data or information under existing regulatory oversight processes to ensure that systemic or national compliance issues are reported when appropriate. In most cases, the FAA will review requested documents while on the airport. The only time the FAA will take physical possession of SMS-related data off airport will be as part of an investigation. Otherwise, the part 139 certificate holder will retain all other SMS-related information.

Airport operators executing a DSR Plan with a tenant would not be required to make their safety reporting systems available to the tenants or tenant's employees for safety reporting purposes. The airport operators would also not be required to extend their SMS training or make available SMS materials to the tenant's employees if the tenant's SMS covers such training or materials.

D. Data Protection

Most commenters to the SNPRM that commented during both the 2016 and the 2021 comment periods, including certificate holders, associations, and air carriers, claim the FAA has not adequately considered the effects that a lack of data protection will have on SMS implementation. Commenters asked the FAA to take action to protect from public disclosure SMS-related information such as hazard reports, safety risk management documentation, investigations, and Safety Assurance reports. Without Federal action, these commenters believed a lack of data protection could significantly impact the effectiveness of the certificate holder's safety reporting system and overall SMS.

A commenter noted that airport operators generally have greater difficulty than air carriers in protecting against the disclosure of safety information because most airports are owned and operated by governmental entities that may be subject to a state's freedom of information laws. In the absence of effective protection mechanisms, most certificate holders could be required to disclose safety data gathered as part of their SMS.

The FAA was asked to provide guidance on the appropriate way to handle open records act and Freedom of Information Act (FOIA) obligations if an airport operator comes into possession of, or has access to, air carrier SMS information. A commenter stated that if the FAA intends for safety reporting to be independent of other governmental functions, it must explicitly include language in this final rule that prohibits the airport operator from sharing information with other government entities, notwithstanding any contrary local or State requirements or law. Another commenter mentioned that airport operators may not have authority to ignore non-safety implications of data they receive in connection with shared SMS data. A commenter from the 2021 comment period requested that the FAA codify a FOIA exemption for SMS reporting.

The FAA assessed various suggestions for dealing with potential data protection issues:

(1) State-Level Fix

Two commenters believed that if the FAA finds a way to provide Federal protection, existing state legislation (in some states) would grant similar protection. One of the commenters stated that the FAA would have to opine that grant-obligated airports are required to keep confidential those records collected in compliance with a SMS rule, thus allowing protection under its state's open records laws. However, another commenter explained that its state's existing public records laws are broad and would not protect any data submitted to the airport's safety reporting system. While these commenters are not averse to working with their state legislatures to ensure protections, they request additional time for implementation to address these issues. In 2021, one commenter requested an exclusion of SMS-related data from state level public records requests in the final regulation, provided the FAA determines it has the authority to create such an exclusion.

In contrast, two commenters disagreed with the State-level fix, explaining that the FAA has underestimated the monetary and schedule challenges posed by putting the onus on the certificate holder to work with state authorities. The commenter also believes a patchwork of different protection standards is not conducive to the success of the SMS effort.

The FAA recognizes that most certificate holders are owned by public entities, whether it is a State, a subdivision of a State, a local governmental body or other similar entity. Certificate holders are in the best position to seek legal guidance to determine the most appropriate way to handle and protect data and information gathered. They should assess applicable State legal frameworks to determine how to comply with data privacy laws and reporting requirements. (For example, SMS data that is required to be redacted as part of a disclosure requirement might also be subject to applicable State law.) Furthermore, certificate holders have the ability to evaluate whether States afford data and information protection mechanisms through local statutes and regulations or through other legal or contractual arrangements such as confidential disclosure agreements. Notably, the FAA does not have the authority to preempt State freedom on information laws without a congressional mandate. The FAA is also not in a position to assess any State's legal framework, to impose any requirement to create or implement State laws and regulations to protect data and information, or to counsel about handling and protection of data shared amongst third parties. Thus, the FAA cannot determine whether FOIA exceptions preclude disclosure requirements under applicable State laws, or if other laws, regulations, or contractual arrangements would preclude disclosures made amongst third parties.

(2) Federal-Level Protection

Commenters from the 2016 and 2021 comment period re-stressed their assertions that existing Federal protections could be used to protect SMS data. Commenters disagreed with the FAA's finding that data protection under SSI provisions is inapplicable and may be impermissible because those procedures are for information obtained or developed in the conduct of security activities as described in 49 CFR part 1520. The commenters argued that hazard reports and SRM processes could identify airport vulnerabilities. Another commenter believed the FAA should commit to using the provisions of 49 U.S.C. 44735(b)(4) to assist certificate holders in securing exemptions from state law. One commenter argued that the FAA already has the legal authority to exempt SMS-data from disclosure under Federal, state, and local freedom of information and sunshine laws. The commenter stated that Congress imposed on the FAA the responsibility of overseeing and regulating aviation safety in the U.S., and that pursuant to that authority, the FAA adopted a comprehensive regulatory scheme for certain activities. As such, the commenter maintained that Federal protection could be afforded since, whenever the FAA preempts the field, U.S. courts tend to invalidate state laws and regulations that conflict with the FAA safety regulations.

Commenters that commented during both the 2016 and 2021 comment periods agreed that a single Federal standard or statutory exemption should apply to all airports regarding data and information protection. Some commenters wanted the FAA to seek legislative protection to address data protection. Numerous commenters believed that the FAA should explicitly address data protection in this final rule's regulatory text and pressed for Federal legislation to protect such information.

Pursuant to 49 U.S.C. 44735, as amended, the FAA must protect certain voluntarily submitted reports, data, or other information produced or collected for purposes of developing and implementing a safety management system acceptable to the Administrator; however, this protection is not afforded to any SMS information required to be submitted to the FAA. Consequently, the FAA is limiting the SMS information that certificate holders are required provide the Agency ( i.e., certificate holder's implementation plan and SMS Manual, and/or ACM update).

Specifically, the FAA is not incorporating regulatory language requiring certificate holders to report to the FAA any safety-related data developed under a SMS. This approach should have no repercussions under FOIA and is consistent with the authority under 49 U.S.C. 44735. It should also not affect the FAA's ability to review a certificate holder's documentation to assess compliance with part 139; meaning, the FAA might take possession of such documentation when investigating a potential issue of non-compliance.

Certificate holders are not prohibited from voluntarily sharing information with other governmental entities. The protection under 44735 only safeguards against release by the FAA, and does not extend to other governmental entities nor to private entities. This means that whenever a certificate holder releases or submits information to any other governmental entity, the information rendered is not protected from release by such governmental entity, absent other applicable law.

The information might also not be protected from discovery in civil litigation, although the certificate holder could request that a court extend additional or ancillary protections available under the laws of the relevant jurisdiction. Furthermore, the FAA cannot protect data that is shared by and among third parties; such protection would have to be granted statutorily or under a legally-binding agreement to protect the information that is recognized as protected under state or local law.

As previously stated in the SNPRM, data protection under SSI provisions is inapplicable and may be impermissible because those procedures are for information obtained or developed in the conduct of security activities, as described in 49 CFR part 1520.

(3) Creation of a National Data Repository

Numerous commenters from both the 2016 and 2021 comment periods believed data could be protected under existing Federal protections if the FAA established a national repository for certificate holders to voluntarily submit hazard data. Two commenters during the 2021 comment period suggested that such a repository would be advantageous and reduce the financial burden to airports. One commenter explained that while the FAA may have little to no need for such information, the approach would allow certificate holders to take advantage of the narrow legislative provision.

Regarding the request for the creation of a national data repository, the FAA acknowledges that such a database would allow it to protect all SMS data submitted voluntarily to the FAA. Notwithstanding, the FAA has concluded that a national data repository will not provide an immediate solution to data protection. As one of the commenters accurately stated, certificate holders could inundate the FAA with hazard reports and documentation to gain Federal protection. Further, a national database would not prevent disclosure under State or local laws. Certificate holders would still be in possession of the data before submitting it to the national database.

The FAA remains interested in the long-term idea of a national database, as a means to identify systemic safety issues and hazards. The FAA will re-explore this option after certificate holders' SMS mature, and the FAA has more time to analyze and consider the types of information that could be submitted as well as all resource requirements regarding collection. When deemed appropriate, the FAA may consider implementing a national data repository, pursuant to the provisions of 49 U.S.C. 44735, which allows the FAA to protect from disclosure all “reports, data, or other information produced or collected for purposes of developing and implementing a safety management system” as long as the data is furnished voluntarily and is not required to be submitted to the FAA pursuant to other provisions of law. In addition, the implementing regulations to 49 U.S.C. 40123, codified at 14 CFR part 193, afford the FAA the option of designating voluntarily submitted safety information as “protected” information, thereby preventing its disclosure to unauthorized third parties.

(4) De-Identified Data

During the part 139 SMS pilot studies, certain participants explored the use of third parties to de-identify hazard reports before these were filed with the certificate holder. One commenter noted that such a system would add cost and complexity to SMS implementation and operation, although it did not address whether the option would result in the protection of SMS data.

As a clarification, the FAA realizes that some confusion exists regarding the information that a certificate holder must submit to the FAA. One commenter from the 2021 comment period stated that the requirement for airports to share de-identified data with the FAA was unreasonable.

As stated in the SNPRM, the FAA decided not to propose data reporting requirements for safety-related data created under a SMS. The only documents or information that must be submitted to the FAA under the SMS provisions are the certificate holder's Implementation Plan and SMS Manual and/or ACM update. While at the entity's facility, the FAA may request to review additional SMS-related data or information under existing regulatory oversight processes to ensure that systemic or national compliance issues are reported when appropriate. The only time the FAA will take physical possession of SMS-related data off airport will be as part of an investigation. Otherwise, the certificate holder will retain all other SMS-related information.

E. Safety Reporting and Interoperability

The SNPRM proposed to require certificate holders to establish and maintain a confidential hazard reporting system and to encourage all persons accessing the movement and non-movement areas to report hazards to the certificate holders. The SNPRM also acknowledged the numerous ongoing SMS efforts ( e.g., part 5 and internal efforts to implement SMS within the FAA) and the overlapping responsibilities related to hazard reporting. Commenters to the SNPRM—including certificate holders, air carriers, an association, and a consultant—commented on the proposed requirement to establish and maintain a confidential hazard reporting system.

In addition to concerns about data protection (see section D. “ Data Protection ”), commenters sought clarification on how SMS reporting systems are meant to work and how they should be implemented. These commenters requested the FAA address how it expects information and data to flow between the airport tenants (including those required to implement reporting systems under their own certificate programs) and certificate holders. Multiple commenters, including certificate holders and air carriers, believed that requiring employees to report to multiple SMS systems is duplicative and could cause confusion. A commenter also expressed concerns about how hazard reporting would be implemented for crewmembers or air carriers operating into multiple part 139 airports, stating that it is not reasonable to expect the crewmembers to be trained to comply with each individual airport's SMS and reporting systems. Another commenter requested the FAA clarify whether it considers a confidential hazard reporting system to be the same as an operational safety issues system.

One commenter from the 2021 comment period asked whether this rule would apply to air carriers, and whether airports would be expected to investigate airline incidents or only act as a repository of lessons learned and corrective actions to be shared with all employees and employers.

(1) Change in Terminology

As stated in the SNPRM, the FAA agrees the term “hazard reporting system” is confusing and does not adequately address the genesis of the requirement. The intent of the reporting system is to ensure a transparent means of reporting safety issues within the movement and non-movement areas. As such, this final rule changes the terminology in § 139.402(c)(2) from “hazard reporting system” to “safety reporting system.”

(2) Data Sharing and Reporting Plan

The FAA agrees that, for air carriers or other tenants that are required to maintain a SMS, the reporting system as proposed in the SNPRM could be duplicative. The FAA believes that the DSR Plan (See section C. “ Non-Movement Area ”), could alleviate the duplicative reporting burden.

Under § 139.402(c)(2), the airport operator is required to maintain a confidential safety reporting system. The system must be accessible by all individuals with access to the movement and non-movement areas (except those excluded through an optional DSR Plan). The certificate holder needs access to this type of data to proactively address safety issues in the movement and non-movement areas. While the FAA acknowledges that the majority of incidents related to wildlife strikes account for about 50 percent of the estimated benefits primarily occurring in the movement area, the FAA finds that the conditions for events, accidents, and incidents that occur are originating in the non-movement area. The majority of conditions, events, accidents, and incidents that occur in an airport transpire in the non-movement area. These conditions that—if unreported, unanalyzed, or unmitigated—could directly result or indirectly contribute to a chain of events that lead to accidents in air transportation.

The FAA reiterates that part 5 works in parallel to this final rule, as it encourages air carriers and airports to communicate with one another when hazards and safety issues are identified through their respective SMS procedures and processes. Consistent with the intent of this rule and the FAA's SMS policy, the part 5 final rule also recommended that air carriers notify airports of hazards identified in airport facilities, so all certificate holders are aware of issues, analyze the risks, and take appropriate remedial action.

One commenter from the 2021 comment period recommended that the FAA speed up the development of SMS software to enable data sharing with an FAA-supported vendor in a manner similar to how the FAA implemented the SMS requirements under part 5. The FAA does not intend to develop data sharing software at this time, but reiterates that Federal funding may be available for SMS software development.

(3) Crewmembers Accessing Non-Movement Areas

The FAA agrees that it is unreasonable to expect that all air carrier crewmembers would have knowledge of the reporting systems of all airports they fly into. For air carriers or other tenants not addressed through an optional DSR Plan, the FAA recommends, but does not require, that all crewmembers based at a particular airport and those crewmembers most often accessing an airport's non- movement area receive safety awareness orientation and report safety issues to the airport's safety reporting system. The FAA anticipates that crewmembers who are not based at an airport, or with limited access to the non-movement area of other airports, will continue to report safety issues through their air carrier's employee reporting system.^[16]

The FAA deems it crucial for all individuals with access to the movement and non-movement areas to have a means of reporting safety issues and hazards, since there are limited numbers of certificate holder employees with access to these areas at any given time. The availability of alternate reporting venues increases the possibility that an air carrier employee or an employee of another tenant located at the airport will, upon witnessing safety issues not readily visible to certificate holder employees, report those observations. This, in turn, allows the certificate holder to analyze the situation and take prompt action to fix any problems found or implement ancillary measures to enhance safety at the airport.

F. Training and Orientation

The SNPRM identified a 2-prong approach to training requirements. First, a small number of certificate holder employees (those involved in the implementation and compliance with the SMS) would be required to receive SMS-specific training. Second, all other individuals with access to the movement and non-movement areas of the airport would not have to undergo SMS-specific training, but would instead receive hazard (safety) awareness orientation ( e.g., they could be provided with brochures or be required to complete training modules that discuss what a hazard is and how to report it to the airport's safety reporting system).^[17]

Most commenters agreed with the FAA, but some from both the 2016 and 2021 comment periods requested that the FAA provide clarification.

(1) Identification of Roles, Responsibilities, and Minimum Training Elements

Most commenters requested that this final rule include job roles, responsibilities, and minimum training elements for compliance. Comments received during the 2021 comment period reiterated these requests.

The FAA finds it would be overly prescriptive to (a) identify specific roles or job titles, or (b) set the minimum elements of SMS-specific training in regulatory text. This rule is performance-based and grants latitude to certificate holders in establishing and tailoring their SMS to their particular operations.

Although the FAA requires the certificate holder to identify an accountable executive, it grants airport operators discretion as to how to allocate resources to comply with the remaining requirements of the rule. Smaller airports may use their accountable executive to implement other provisions of the rule. For example, the certificate holder can require the accountable executive to be responsible for both SRM and continuous oversight under safety assurance, instead of acting exclusively as the overarching decision maker or figurehead. Accordingly, the FAA has determined it would be overly restrictive or burdensome to identify certain roles or job titles warranting training and orientation.

The FAA does not identify minimum elements of SMS-specific training for the same reason it does not identify specific roles or job titles. As explained above, the FAA wants certificate holders to have maximum flexibility in implementing the SMS, in such a way that it can be tailored to their unique operating environment, and to facilitate their compliance with the broad requirements and intent of the rule. Notwithstanding, in the interest of addressing commenters' concerns, the FAA decided to incorporate a non-binding, non-exhaustive list of examples of training programs implemented by pilot study participants in the AC.

The FAA received several comments in 2021 concerning the training, qualifications, and deployment of qualified FAA SMS inspectors. Some commenters from the 2021 comment period were also concerned that FAA's oversight would encroach into certificate holders' decision-making and the judgments certificate holders make during the safety risk assessment process, including the proposed and implemented mitigations. The FAA intends to train current part 139 inspectors on overseeing compliance with this rule in the current inspection process, and on how to provide additional guidance to assist certificate holders with complying with the rule.

Commenters also questioned whether the FAA would accept the completion of SMS-related coursework to demonstrate compliance with the FAA SMS requirements.

Training received in support of the FAA Air Traffic Organization (ATO) or ARP SMS does not meet the intent of the SMS-specific training requirements identified in this final rule. Any existing training provided by ATO or ARP would be specific to compliance with the FAA's internal SMS efforts and not specific to the individual airport's SMS.

(2) Training Estimates Used in Regulatory Evaluation Calculations

A few commenters from both the 2016 and 2021 comment periods requested that the FAA provide clarification on how it developed the training estimates. Many of these commenters offered an approximation of the number of employees that would require training at their airport.

The FAA agrees that the number of employees requiring SMS-specific training will vary per certificate holder. The FAA requested training information from the airports that participated in the pilot study programs.^[18] That data was used to develop an average for large-sized (large, medium, and small hub airports) and small-sized (all other airports) operations. The FAA analyzed those responses and included the number of employees needing training based on the specific requirements of this final rule. The FAA notes that many of the pilot study airports appeared to provide training on topics outside the scope of this rulemaking and those courses were not included as part of the analysis.

In the 2016 comment period, four airport operators (one of which holds two AOCs) provided estimated numbers of employees needing training. One airport operator, who operates a large hub airport, agreed with the FAA's average estimates of 3 and 10 employees. The other three airport operators provided their own estimates. One operator, who holds AOCs for a large hub and a reliever airport, estimated a total of 40 employees in these airports will require training. Another large hub airport estimated 30 to 40 employees will require training. A third large hub airport estimated approximately 2 to 3 people per division will require training. In the 2021 comment period, one commenter stated that it believed the FAA estimate of 10 employees requiring comprehensive SMS training at large airports was low. Another commenter noted that some airports are expanding SRM training to include Planning, Engineering, and Capital Development teams, which increases the total anticipated trainees to more than 50 at some airports (as many as 80 total).

The FAA affirms its preliminary estimates as averages for the regulated community's unique operations. The FAA recognizes that some airport operators may have to train more employees than others to ensure compliance with the rule. The FAA also understands that some certificate holders may train employees in topics that are well beyond the scope of this regulation—such as occupational health and safety issues—but those programs are separate from this final rule (as violations of other regulations would not necessarily result in part 139 violations). If a certificate holder elects to include training on topics beyond the scope of this regulation, the FAA would only conduct oversight of the SMS activities related to the applicable provisions of part 139. For example, an airport could be cited for a violation of an OSHA requirement if compliance with OSHA requirements was incorporated into its ACM, or if the OSHA violation also resulted in a failure to comply with its SMS process. However, the basis for the noncompliance would be failure to comply with the SMS process, not non-compliance with the OSHA requirement.

(3) Safety Awareness Orientation

Commenters expressed concerns about the potential duplicate requirements already imposed on air carriers through part 5. As addressed in section C of the preamble, “ Non-Movement Area, ” certificate holders executing a DSR Plan with a tenant are not required to duplicate safety awareness orientation materials provided in the tenant's SMS to that tenant's employees. Those employees would be reporting to the tenant's part 5 confidential employee reporting system and would not need to be advised of how to report to the airport's safety reporting system.

One commenter requested that the FAA revise the proposed requirement to “update” awareness materials every twenty-four months (§ 139.402(d)(1)). The FAA agrees and this final rule requires the airport operator to review and update the safety awareness orientation materials every twenty-four months or sooner when necessary. An earlier review and update of the orientation material is necessary when there has been a change in the material.

(4) Development of Training Materials

Numerous commenters requested the FAA develop and make available SMS-related training materials that would be compliant with SMS training requirements.

The FAA notes that the certificate holder is in the best position to determine the competencies necessary for the individuals with roles and responsibilities under its SMS. The FAA plans to provide briefings and guidance materials, including conducting webinars, to help communicate this information.

While the FAA believes that most certificate holders will rely upon industry-developed training materials, certificate holders may develop their own training materials based on industry publications and guidance. For example, the Airports Cooperative Research Program of the Transportation Research Board has published numerous reports on SMS-related topics. Some of these reports provide detailed information, processes, and examples associated with each of the four components of SMS. Airport operators could use these publications, as well as other publicly available SMS material, to develop their own training materials.

(5) Clarification of “Comprehensive SMS Training”

The FAA received comments requesting clarification of “comprehensive SMS training” as it relates to the training and orientation requirements. While not in the regulatory text, the term was used in the SNPRM preamble to identify all training that is necessary to ensure personnel overseeing the SMS are competent to perform their roles and responsibilities. Individuals responsible for analyzing hazard (safety) reports to determine appropriate mitigation actions must be properly trained in SRM and hazard assessment procedures. Similarly, individuals with responsibility for daily oversight of the SMS must be trained in all requirements of the SMS. The certificate holder may use train-the-trainer formats where necessary.

(6) Clarification of “Access”

Commenters requested the FAA clarify or define the term “access,” as it is used in § 139.402(d)(1). The term “access” applies to both vehicular and pedestrian access to the movement and non-movement areas. The intent of this requirement is to ensure that all individuals who may have an opportunity to witness a safety issue understand what they should be reporting, when, and how.

G. Accountable Executive

In the SNPRM, the FAA proposed a new definition for “accountable executive.” The new definition addressed the diversity of business structures and varying degrees of complexity of certificate holders. The FAA explained that it anticipated most certificate holders would designate an airport manager or airport director as the accountable executive, and that accountability could not be delegated. Numerous entities, including associations, certificate holders, and air carriers, commented on the revised definition of “accountable executive.”

(1) Amendment or Elimination of the Accountable Executive Requirement

While most commenters agreed with the concept of an accountable executive, the FAA received requests for revisions or explanations. One 2021 commenter incorrectly interpreted the FAA's proposal to allow certificate holders to designate an accountable organization structure instead of one executive. This commenter further stated that while there is a need for an Accountable Executive, in many cases, airport structure could call for one or more “responsible executive(s)” to oversee the implementation and operation of the SMS.

The FAA is not persuaded by arguments recommending changes to, or elimination of, the “accountable executive.” The concept of an accountable executive is key to the successful development and implementation of a SMS and consistent with international standards. Additionally, this rule requires the identification of an individual as an accountable executive, rather than the designation of an accountable organization structure in place of an accountable executive or one or more responsible executives. A certificate holder may choose to identify support staff to assist the accountable executive, as discussed further in the supplemental guidance AC.

(2) Delegation

Commenters asserted that certificate holders should have the option to delegate the accountable executive's roles and responsibilities to a lower-level or operational manager with direct oversight of the SMS. As stated in the SNPRM, accountability cannot be delegated. The accountable executive's role is meant to instill safety as a core organizational value and to ensure that SMS is properly implemented and maintained through the allocation of resources and tasks. By designating an accountable executive, responsibility for the certificate holder's overall safety performance is placed at a high level within the organization. Some airports may choose to designate additional positions to implement the daily operation of the SMS. However, such designations are left to the discretion of the certificate holders, based on their unique operating environments and management structures. For guidance purpose, the FAA has included in the AC examples of accountable executive designations and addressed the issue of “responsible executive or manager” for the day-to-day oversight of SMS activities.

(3) Personal Liability and Oversight

Commenters from both the 2016 and 2021 comment periods believed the FAA should make stronger statements limiting the personal liability of accountable executives. They requested the FAA include preamble language: (a) stating that the accountable executive is not personally liable to the FAA through certificate action or civil penalty, and (b) establishing a clear regulatory intent that this final rule is not intended to increase or create personal liability for the accountable executive. Additionally, one 2021 commenter requested that the rule be revised to allow the accountable executive to seek indemnification from tenants in respect to SMS compliance issues within their leaseholds, and to appoint a tenant accountable executive for that purpose.

The definition of “accountable executive” also limits both control and responsibility to “operations conducted under the certificate holder's Airport Operating Certificate.” As “an individual designated by the certificate holder,” the FAA does not expect the definition to usurp the oversight role of the legislative body or authority that is the certificate holder.

Concerns regarding the accountable executive's personal liability for the actions of tenant organizations, air carriers, or leaseholds, are misplaced. As stated in the SNPRM, the new definition clarifies that accountable executives are not personally liable to the FAA, through either certificate action or civil penalty. The FAA limited the “control” and “responsibility” of an accountable executive to operations conducted under the certificate holder's AOC. Since the scope of action and responsibility of an accountable executive is limited, the FAA decided not to include nor require indemnification by the accountable executive to any third party under this final rule. While the FAA does not intend for accountable executives acting within the scope of their powers and duties to have personal liability to any third party, the FAA must stress that liability issues are typically controlled by state law, and the parties remain subject to applicable state law with regard to liability issues and remedial action.

Generally speaking, the airport manager or director's role of ensuring compliance with the AOC does not change under this final rule. Prior to this final rule, violations of part 139 requirements would be found against the certificate holder. The same logic holds true under the SMS final rule.

Along the same lines, while the FAA allows an airport operator to establish a DSR Plan (See section C. “ Non-Movement Area”) to address reporting and data sharing with applicable tenants required to comply with part 5, if the certificate holder discovers that the tenant is not complying with the terms of the agreement, or policy and relevant safety issues or findings are not being properly or timely conveyed to the airport operator, the onus for compliance remains with the airport operator. The airport operator is responsible for ensuring the airport's safety reporting system is accessible for reports by tenant employees and that those employees receive safety awareness orientation materials.

H. Definitions

In the SNPRM, the FAA revised the definitions of numerous terms, either in response to comments or to conform to agency policy at the time of the proposal. The FAA received many comments regarding the new definitions of hazard and non-movement area. The FAA also received suggestions during both the 2016 and the 2021 comment periods to revise other terms related to this final rule.

(1) “Hazard” Definition

Commenters from the 2016 and 2021 comment periods disagreed with the FAA's use of the part 5 definition of the term “hazard.” They believed that the term is not applicable to the airport environment since it is centered on the operation of an aircraft and aircraft accidents, as defined by the NTSB. These commenters recommended the FAA use the “hazard” definitions included in FAA Order 5200.11, FAA Airports (ARP) Safety Management System (SMS), FAA Order 8040.4, Safety Risk Management Policy, and the ICAO Safety Management Manual (3rd edition).

The FAA understands the confusion arising from the SNPRM definition of “hazard” and the limited reporting that may occur through a strict reading of the regulatory text. To ensure consistent application and reporting across the airport-airline industry, as well as to ensure applicability to the non-movement area, the FAA amends the definition in this final rule. For this rule, we define the term “hazard” as “a condition that could foreseeably cause or contribute to: (a) injury, illness, death, damage to or loss of system, equipment, or property, or (b) an aircraft accident as defined in 49 CFR 830.2.” The FAA determined this revised definition establishes a suitable parameter that encompasses the wide range of conditions that airports may encounter and deem as hazards, and it enables airports to include conditions that are not necessarily related to an aircraft accident. For example, part (a) of the definition allows for ramp incidents; accidents and fatalities involving aircraft ground service equipment and other vehicles; construction-related fatalities; and damage to airfield facilities including lighting, signage, pavement, safety areas, and navigational aids to qualify as a hazard. These incidents would not constitute “hazards” if the definition was limited to part (b) (conditions that could foreseeably cause or contribute to an aircraft accident). As a result, the FAA revised the definition to more broadly encompass the myriad of conditions in the airport environment, including in movement and non-movement areas and conditions involving and not involving aircraft. The FAA notes that this definition will also provide flexibility to airport organizations for defining what a reportable hazard is for their organization, and as a part of developing their SMS they may define thresholds for what might entail a reportable incident. This will allow, for example, a small airport to treat an incident that results in $1,000 in damage as a potentially reportable incident, whereas a large airport may consider property damage at that level to be de minimis.

(2) “Non-Movement Area” Definition

Commenters requested the FAA retain a more generic definition of the term “non-movement area” as opposed to a definition that specifies the types of areas included. The FAA was asked: (a) to exclude “fuel farms” from the definition of “non-movement area” or to at a minimum allow their inclusion at the option of the certificate holder, and (b) to re-evaluate its decision not to include baggage-makeup areas in the definition of “non-movement area.”

As discussed in section C. “ Non-Movement Area,” the FAA is adopting the definition for “non-movement area” as proposed.

(3) Harmonization of “Safety Policy,” “Safety Risk Management,” “Safety Assurance,” and “Safety Promotion” Definitions

The FAA agrees with commenters' request from the 2016 comment period to update the definitions of “safety policy” and “safety assurance.” One commenter from the 2021 comment period emphasized the need for consistent terminology related to the SRM process. Any revision must be carefully assessed since both definitions sync with part 5 instead of internal FAA Orders. Where commenters requested the FAA use ICAO definitions, the FAA's intent is to first synchronize these definitions with part 5 or other Agency definitions—if possible—to ensure the industry uses similar taxonomy. Therefore, this final rule revises the definitions of the terms “safety policy,” “safety assurance,” and “safety promotion,” to sync with the current definitions in part 5. This final rule also updates the definition of the term “safety risk management” to more closely align it to the definition in part 5. The notable difference is that airports typically use the term “risk mitigation,” whereas air carriers use the term “risk control.” To address this difference, this final rule uses both terms for the definition of “safety risk management.”

I. Miscellaneous Topics

(1) FAA's Rulemaking Authority

A commenter stated that the FAA Aviation Act of 1958 does not give the Administrator the power to require regulated parties to self-analyze, self-disclose, self-report, and self-implement procedures beyond those stipulated through legislative and administrative processes.

The FAA's authority to issue rules regarding aviation safety is found in Title 49 of the U.S.C. The FAA proposed this rulemaking under the authority described in 49 U.S.C. 106(f), 44701, 44702, and 44706 (See section II. A. of this preamble). In the Federal Aviation Act of 1958, as amended and recodified, 49 U.S.C. 40101, et seq., Congress provided the FAA with (a) exclusive authority to regulate safety, (b) the efficient use of the airspace, (c) protection of people and property on the ground, (d) air traffic control, (e) navigational facilities, and (f) the regulation of aircraft noise at its source.

Title 49 of the U.S.C., section 44706, provides for the FAA to regulate airport safety through the issuance of airport operating certificates. Under this statute, Congress requires the certificate to contain the terms necessary to ensure safety in air transportation.

Under the implementing regulations for section 44706, codified at 14 CFR part 139, the FAA regulates airport certificate holders in many areas, including: (a) records, (b) personnel, (c) paved areas, (d) unpaved areas, (e) safety areas, (f) airport marking/signs/lighting, (g) aircraft rescue and firefighting, (h) snow and ice control, (i) handling and storing hazardous substances and materials, (j) traffic and wind indicators, (k) airport emergency plans, (l) self-inspection programs, (m) pedestrian and ground vehicles, (n) obstructions, (o) protection of navigation aids, (p) public protection, (q) wildlife hazard management, (r) airport condition reporting, (s) identifying, marking, and lighting construction and other unserviceable areas, and (t) noncomplying conditions.

Requiring certain certificated airports to implement a SMS for the entire airfield environment is consistent with the FAA's statutory and regulatory framework described above. The primary purpose of section 44706 and its implementing regulations is to ensure safety in air transportation and such safety is advanced by the additional safety measures applicable to airports subject to this final rule. The FAA has the authority to implement regulations to improve safety at airports hosting air carrier operations including requiring certificate holders to develop and implement measures to ensure safety in air transportation by proactively identifying and mitigating safety hazards, thereby reducing the possibility or recurrence of accidents in air transportation. This final rule is a performance-based regulation that requires certificated airports that meet pre-established qualification criteria (triggers) to develop and maintain a SMS to improve the safety of operations conducted at such airports; therefore, it is within the scope of authority of the Agency.

(2) Applicability to Non-Certificated Airports

The FAA stated in the SNPRM that the proposed rule would only apply to holders of a part 139 AOC. Commenters asked The FAA to (a) confirm that it did, and (b) clarify whether the SMS requirement was voluntary for general aviation airports that are not certificated under part 139.

The FAA confirms that this final rule does not apply to non-certificated airports, but continues to encourage such airports to voluntarily adopt SMS. The rule is not affected by, nor does it depend on, whether an airport has accepted Federal financial assistance or property conveyances. Further, this final rule does not require airport tenants to have a separate SMS because it only applies to holders of part 139 AOCs. As previously discussed, this fact does not prevent certificate holders from engaging with tenants to implement alternatives that facilitate compliance with the requirements of the SMS.

(3) FAA Oversight

The SNPRM included a discussion of the FAA's role and oversight of certificate holders under the proposed SMS rule. This discussion noted SMS is not a substitute for compliance with existing regulations and provided general expectations about inspections in a SMS environment, emphasizing the importance of implementing a systems-based approach to oversight.

Commenters from both the 2016 and 2021 comment periods asked the FAA to clarify certain aspects of its oversight activities, particularly: (a) how SMS fits in relation to other federal regulations such as the Occupational Safety and Health Administration (OSHA) rules, National Environmental Policy Act (NEPA) rules, State regulations, and other local ordinances; (b) how SMS brings value beyond standards imposed elsewhere, and (c) whether hazards identified through their SMS will qualify as items of concern. Commenters also requested the FAA state that the SMS rule will not alter existing State laws regarding standards of care or duty of care.

Commenters from both the 2016 and 2021 comment periods requested that the FAA clarify its oversight approach in either the final rule preamble or the regulatory text.

The FAA does not intend for the implementation of SMS at an airport to implicate regulations issued by other agencies. In some instances, airport SMS may complement compliance with other regulations (such as OSHA, NEPA). An airport SMS is the next critical step in the FAA's ongoing transition to a more streamlined and performance-based regulatory framework for airports. Airport SMS will evolve the FAA's oversight processes so FAA involvement targets the areas of highest safety risk. For airports with a fully implemented SMS and that have a consistent history of compliance with the requirements of part 139, the FAA will transition to a system-based inspection allowing an inspector to focus on areas of greater risk. As a consistent history of compliance under SMS develops, the FAA will have data to support modifying the duration of time between an airport's periodic inspections. The FAA will continue to use a traditional approach and cycle for inspections at airports without a SMS, with higher risks, or a history of non-compliance. The FAA retains the ability to use a traditional inspection cycle for airports with a fully implemented SMS when deemed necessary ( e.g., increase in number of discrepancies with part 139 requirements).

A comment received in 2021 emphasized that the FAA should be flexible and less prescriptive in its approach. Another comment received in 2021 emphasized that the FAA should provide training and resources for SMS education. The FAA acknowledges that shifting from a prescriptive to performance-based regulation and systems-based oversight will take time and require educating and guiding both FAA inspectors and airport operators. The FAA will update FAA inspector guidance, provide training to the FAA inspectors on the requirements of this final rule, and provide outreach to the industry regarding the final rule requirements.

The FAA received comments during both the 2016 and 2021 comment periods asking the FAA to: (a) collaborate with airports with existing voluntary SMS and other stakeholders to develop SMS oversight guidelines based on lessons learned that explicitly define the systems-based approach and how it changes inspector responsibilities and activities; (b) commit to a timetable and process for training its inspectors on the new approach and clarify that no SMS inspections will take place until inspectors have been trained; (c) cross train all part 121 and part 139 inspectors in the respective SMS requirements; and (d) invite airport industry representatives to participate in the training of FAA inspectors.

The FAA does not normally invite industry representatives to participate in the training of FAA inspectors and does not believe SMS requirements would cause it to change this position. While the FAA does not agree that part 139 and part 121 inspectors require cross-training in the respective SMS requirements, ARP and AVS will identify the various SMS requirements and areas of connectivity in Agency materials.

The SMS final rule will not alter the responsibilities of the FAA's regional inspector staff. Like other part 139 related activities, the regional inspector staff is responsible for reviewing, approving, accepting, and inspecting the airport's SMS documents and program. As discussed in the SNPRM, FAA Headquarters staff will supplement these activities—by providing support and guidance to our regional inspection staff—to ensure national consistency and timely program implementation. Questions regarding federal financial assistance for SMS related activities should be directed to the appropriate FAA Regional Office or Airport District Office personnel.

(4) Safety Risk Management

The SNPRM proposed minimum requirements for SRM, including establishing a systematic process for analyzing hazards and related risks, using a standard five-step process. As part of the SRM component, the SNPRM also included standard documentation and record retention requirements.

The FAA was asked to re-evaluate the requirement to handle all hazards through the five-step process, in light of a comment that certificate holders should have the flexibility to determine which hazards require analysis using the five-step process and which hazards only need review and mitigation.

Commenters questioned (a) the FAA inspector's role in the risk determination process, and (b) whether the FAA will be able to overrule a certificate holder's determination, even when safety standards are met.

The SNPRM did not propose to require the use of a predictive risk matrix for hazard assessment, but suggested its use as an effective method to analyze and prioritize risk. The FAA was asked whether a specific matrix must be used, or if airport operators will be allowed to modify the risk matrix included in the NPRM to better fit the airport's needs and goals. While encouraged, this final rule does not require the use of a predictive risk matrix.

Commenters from both the 2016 and 2021 comment periods: (a) noted that many large hub and international airports have existing, comprehensive safety and risk management programs; (b) requested the FAA explain how these existing programs will be integrated into SMS processes; and (c) recommended that the FAA accept or provide credit to airports with existing processes similar to those outlined in the proposal.

This final rule provides airport operators flexibility in how they resolve safety issues and hazards. It does not require certificate holders to use the five-step process to address all safety concerns. Instead, the regulatory text requires certificate holders to use the five-step process to analyze “hazards.” The FAA acknowledges that not all reports through the airports' safety reporting system or other sources constitute hazards. Therefore, certificate holders would only need to use the systematic analysis for identified hazards.

Nothing in this final rule requires consensus decision making. While the FAA encourages certificate holders to work with affected stakeholders, it is not a requirement of this final rule. If the airport operator develops a DSR Plan, the FAA expects it to identify when and how the airport and tenant will work together to analyze and resolve joint safety issues. In most cases, the certificate holder is also the airport owner and, as owner, has ultimate control over their airport's decisions. Similarly, the FAA expects that whenever the certificate holder is an entity other than the airport owner, the agreement allowing the certificate holder to operate the airport should have adequate controls and provisions ( i.e. sufficient authority and resources) to allow them to make all pertinent decisions to enable compliance with part 139 and the FAA-approved ACM (the FAA notes that this scope of oversight is similar to existing expectations under part 139 and the FAA-approved ACM). In extreme cases, if the airport identifies hazard mitigations under the SRM process that a tenant is unwilling to implement, an airport might be expected to restrict or break its contract and cease operations with the tenant to ensure that the hazardous condition does not continue. Regardless of the existence of any agreement, policy, or arrangement, and regardless of the decision-making process or determinations made under them, the certificate holder remains solely responsible before the FAA for full compliance with the SMS requirements of this final rule. Notwithstanding, the FAA committed in the NPRM and SNPRM to not second guess certificate holder decisions under SRM processes, and the FAA's position has not changed in this final rule. The only time the FAA will weigh in is if the certificate holder uses SRM processes to circumvent regulation or standards.

The certificate holder may identify in its FAA-approved Implementation Plan any existing programs, policies, or activities it plans to use as a means of compliance with the rule. Where an existing program is used as a foundation, the certificate holder will explain what additional actions will be put in place to ensure the programs fully meet the intent of the requirement. As long as existing safety and risk management programs meet the requirements of this final rule, they can be used “as is” to comply. However, if there are gaps between the existing program and this final rule requirements, the certificate holder would still be required to comply with this final rule and must identify in its Implementation Plan how it will address those gaps prior to the full implementation deadline.

In the SNPRM, the FAA acknowledged that the definition of “risk mitigation” did not harmonize with part 5's “risk control” terminology. The FAA's conclusion was that the term “mitigate” was straightforward and aligned with other guidance certificate holders have received related to FAA SMS initiatives. While this final rule retains the definition of “risk mitigation,” it expands the definition of “safety risk management” and “safety assurance” to incorporate the term “control” or “controlling” to provide better harmonization with part 5.

A commenter from the 2021 comment period recommended that the FAA create an FAA “Airport Safety” web page, similar in format to the FAA web page “Airline Safety.” Once the rule is published, the Office of Airports intends to update the public facing web page to contain current and relevant part 139 SMS material.

(5) Record Retention

Under the SRM component, the FAA proposed to require a certificate holder to develop processes to identify hazards that may impact the airport's operations. The certificate holder will use these processes to analyze those hazards and risks and retain any documentation developed through these processes to assist in trend and root cause analysis. The FAA proposed to require a certificate holder to retain records associated with SRM processes for the longer of (a) 36 months after the risk analysis of identified hazards has been completed or (b) 12 months after required mitigations have been implemented. Under the Safety Promotion component (see § 139.402(d)), the FAA proposed to require certificate holders to also retain training records and hazard awareness orientation briefing materials. Commenters asked the FAA to clarify how long a certificate holder should retain data.

The record retention requirements proposed in the NPRM and SNPRM sync with existing record retention requirements under part 139. In this case, the FAA found it more useful to apply existing part 139 retention standards for ease of document retention instead of syncing requirements with part 5. A certificate holder may always choose to retain records for longer, especially where State laws require longer retention. This final rule provides the minimum requirement for compliance.

(6) SMS Manual Updates

While drafting this final rule, the FAA recognized some confusion regarding the requirement in § 139.401(g) to provide the FAA with copies of any changes to the Airport SMS Manual, on an annual basis. This final rule retains this provision but adds the caveat “or upon FAA request.” One commenter from the 2021 comment period incorrectly interpreted the SNPRM as requiring FAA approval of SMS manuals, and noted that such approval will impede SMS development.

Unlike the ACM, the SMS Manual is not approved; rather, it is accepted by the FAA. The certificate holder could implement new provisions in the SMS Manual without previously sharing those changes with the FAA, unlike the requirement for changes to the FAA-approved ACM. Therefore, regulatory text was necessary to ensure that the FAA has the most up-to-date version of the SMS Manual prior to conducting the annual certification inspection, or during any other surveillance activities.

If no changes have been made to the SMS Manual over the past year (or upon FAA request), the certificate holder can simply send an electronic or written message to the FAA stating no changes have been made.

(7) Guidance and Work Groups

The FAA received numerous comments during both the 2016 and 2021 comment periods from certificate holders and associations, requesting clarification on how the FAA would (a) update existing draft guidance with publication of this final rule, and (b) provide timely updates to guidance, during implementation.

The FAA received comments during the 2021 comment period inquiring about industry participation in development of the final rule. The FAA provided industry an opportunity to participate in the development of the final rule through the 2016 and 2021 comment periods, in accordance with the Administrative Procedure Act.

AC 150/5200-37A has been updated to address requirements contained in this final rule and is being published simultaneously with this final rule. All comments related to AC material were catalogued and adjudicated during the update to AC 150/5200-37A. Industry was given additional time to submit comments on the AC and the FAA received detailed comments within the comment period. Regarding comments received during the 2016 and 2021 comment periods on guidance updates, the FAA has several existing methods for disseminating timely updates including Policy Guidance Letters and Cert Alerts that could be used to disseminate implementation and oversight guidance as the programs evolve.

One commenter from the 2021 comment period recommended the addition of an awards and recognition section in the FAA's guidance to provide existing examples of SMS, in an effort to encourage the growth of SMS. The FAA encourages certificate holders to explore means of developing their SMS safety culture at their airport and currently considers the available guidance publications sufficient.

IV. Regulatory Notices and Analyses

Changes to Federal regulations must undergo several economic analyses. First, Executive Order 12866 and Executive Order 13563 direct that each Federal agency shall propose or adopt a regulation only upon a reasoned determination that the benefits of the intended regulation justify its costs. Second, the Regulatory Flexibility Act of 1980 (Pub. L. 96-354) requires agencies to analyze the economic impact of regulatory changes on small entities. Third, the Trade Agreements Act (Pub. L. 96-39 as amended) prohibits agencies from setting standards that create unnecessary obstacles to the foreign commerce of the United States. In developing U.S. standards, the Trade Agreements Act requires agencies to consider international standards and, where appropriate, that they be the basis of U.S. standards. Fourth, the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires agencies to prepare a written assessment of the costs, benefits, and other effects of proposed or final rules that include a Federal mandate likely to result in the expenditure by State, local, or tribal governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. The FAA has provided a more detailed Regulatory Impact Analysis of this final rule in the docket of this rulemaking. This portion of the preamble summarizes the FAA's analysis of the economic impacts of this rule.

In conducting these analyses, the FAA has determined that this final rule: (1) has benefits that justify its costs; (2) is not an economically “significant regulatory action” as defined in section 3(f) of Executive Order 12866; (3) is “significant” as defined in DOT's Regulatory Policies and Procedures; (4) will have a significant economic impact on a substantial number of small entities; (5) will not create unnecessary obstacles to the foreign commerce of the United States; and (6) will not impose an unfunded mandate on state, local, or tribal governments, or on the private sector by exceeding the threshold identified above. These analyses are summarized below.

A. Regulatory Evaluation

Total Benefits and Costs of This Rule

The rule requires a SMS at certain U.S. airports in an effort to improve airport safety, complement existing airport safety regulations in part 139, and meet the intent of the ICAO standard.

The goal of this rule is to improve the safety of the airfield environment (including movement and non-movement areas) by providing an airport with decision-making tools to plan, organize, direct, and control its everyday activities in a manner that enhances safety. Table 4 shows benefits and costs over ten years. Table 4 also includes the FAA's estimated cost savings of changing the traditional inspection cycle at airports with a fully implemented SMS. The benefits discussed below are only achievable through airports implementing mitigation measures identified through their SMS processes; however, the regulatory evaluation does not quantify the potential costs to implement these mitigations. There are no available empirical retrospective analyses of existing SMS programs that the FAA could leverage to quantitatively estimate the benefits related to the potential effectiveness of airport SMSs at mitigating accidents and incidents. Transport Canada's initial 2019 report on airport SMS implementation notes, in part, “we were not able to quantify the extent of SMS's contribution to aviation safety,” although it does discuss perceived qualitative benefits, particularly at larger airports.^[19] Similarly, not enough time has elapsed since the implementation of Part 121 SMS to measure the potential effectiveness of SMS for air carriers, particularly in light of disruptions to air travel due to the COVID-19 pandemic. As a result, to estimate some potential benefits related to accident and incident mitigation, FAA used a panel of subject matter experts to assign quantitative probabilities to the mitigation effectiveness in each selected event. As described in further detail in the Regulatory Impact Analysis, of the 1,840 accidents and incidents used for this analysis, the FAA assumed a 20-39 percent chance of preventing similar accidents or incidents for 81 percent of these events through a SMS, and for the other 19 percent of events the FAA assumed between a 40-59 percent chance of effective mitigation.

Table 4—Comparison of Costs and Benefits Over 10 Years

[Millions of 2020 dollars]

	Present value (3%)	Annualized (3%)	Present value (7%)	Annualized (7%)
Benefits	$199.2	$23.4	$144.1	$20.5
Costs	179.8	21.1	139.0	19.8
Cost Savings	3.1	0.4	2.2	0.3
Net Benefits (includes mitigation benefits, but excludes mitigation costs)	22.5	2.6	7.3	1.0
Note: The sum of the individual items may not equal totals due to rounding.

Over the ten-year period of analysis, the estimated present value benefit of the final rule is $144.1 million at a seven percent discount rate with an annualized benefit of $20.5 million. At a three percent discount rate, the present value benefit is $199.2 million with an annualized benefit of $23.4 million. Excluding mitigation costs, the estimated present value cost of the final rule is $139 million at a seven percent discount rate with an annualized cost of $19.8 million. At a three percent discount rate, the cost in present value is $179.8 million with an annualized cost of $21.1 million. The cost savings, at a seven percent discount rate, is $2.2 million with an annualized cost savings of $0.3 million and $3.1 million, at a three percent discount rate, with annualized cost savings of $0.4 million.

Who is potentially affected by this rule?

After updating the list to account for the new data sources, there are 191 applicable airports (as of February 2017). Part 139 certificated airports that meet one or more of the following triggering criteria: (a) classified as a small, medium, or large hub airport based on passenger data extracted from the Air Carrier Activity Information System, (b) has a three-year rolling average of 100,000 or more total annual operations ^[20] or (c) serves any international operation other than general aviation. Table 5 below provides an estimated number of impacted airports by the three different triggering criteria.

Table 5—Estimated Number of Affected Airports by Category

Airport categories	Number of airports
Large, Medium, and Small Hub	132
>100,000 Operations	27
International Traffic	32

General Assumptions:

• Cost and benefit estimates are in 2020 dollars.
• Costs and benefits are estimated over a ten-year period.
• Costs to airports begin to accrue in year 1.
• Benefits of SMS begin to accrue in year 5 or year 6 after full implementation.

• The present value discount rates of seven percent and three percent are applied per Office of Management and Budget guidance.^[21]

Benefits of This Rule

The objective of SMS is to proactively manage safety, identify potential hazards or risks, and implement measures that mitigate those risks. The FAA envisions airports being able to use all of the components of SMS to enhance the airport's ability to identify safety issues and spot trends before they result in a near-miss, incident, or accident. Anecdotally, based on the FAA Airport SMS Pilot Study, airports indicate benefits from increased communication and reporting that are all fundamental components of SMS. These efforts are expected to prevent accidents and incidents. Over the ten-year period of analysis, the benefits of the rule are estimated to be $144.1 million at seven percent present value or $20.5 million annualized. At a 3 percent discount rate, the benefit in present value is $199.2 million or $23.4 million annualized.

Costs of This Rule

The rule requires certain part 139 certificated airports to establish a SMS based on the four components: (i) safety policy; (ii) safety risk management (SRM); (iii) safety assurance; and (iv) safety promotion. These components include costs to document an airport's Implementation Plan and SMS manual, staffing, equipment/material, training, update training records, and recording potential hazards over ten years. The costs vary based on the size of the airport. The total cost, over 10 years, in present value at a seven percent discount rate is $139 million or $19.8 million annualized. At a three percent discount rate, the cost in present value is $179.8 million or $21.1 million annualized.

Alternatives Considered

The FAA analyzed the following applicability alternatives in the SNPRM:

1. All part 139 airports;

2. Airport operators holding a Class I AOC;

3. Certificated international airports;

4. Large, medium, and small hub airports and certificated airports with more than 100,000 total annual operations; and

5. Large, Medium, and Small hub airports, certificated airports with more than 100,000 total annual operations, and certificated international airports.

The SNPRM identified the last alternative as the preferred alternative. Upon receiving comments on how affected airports were selected, the FAA reviewed the selection process and refined some of the triggering criteria. This final rule will continue to apply to large, medium, and small hub airports, certificated airports with more than 100,000 total annual operations, and certificated airports that serve any international operation other than general aviation. The change in this final rule further reduces the number of applicable airports from approximately 265 impacted airports to 191.

B. Regulatory Flexibility Act

The Regulatory Flexibility Act of 1980 (Pub. L. 96-354) (RFA) establishes “as a principle of regulatory issuance that agencies shall endeavor, consistent with the objectives of the rule and of applicable statutes, to fit regulatory and informational requirements to the scale of the businesses, organizations, and governmental jurisdictions subject to regulation. To achieve this principle, agencies are required to solicit and consider flexible regulatory proposals and to explain the rationale for their actions to assure that such proposals are given serious consideration.” The RFA covers a wide range of small entities, including small businesses, not-for-profit organizations, and small governmental jurisdictions.

Section 604 of the Act requires agencies to prepare a final regulatory flexibility analysis (FRFA) describing the impact of final rules on small entities. After preparing the FRFA, the FAA estimates that a substantial number of small-entity airports will be affected by the final rule and does not certify that there will not be a significant effect on a substantial number of small entities.

(i) A Statement of the Need for, and Objectives of, the Rule

The FAA remains committed to continuously improving safety in air transportation. The FAA believes that a SMS can address potential safety gaps that are not completely eliminated through effective FAA regulations and technical operating standards. The certificate holder best understands its own operating environment and, therefore, is in the best position to address safety issues through improved management practices.

Both the NTSB and ICAO support SMS as a means to prevent future accidents and improve safety. The NTSB has cited organizational factors contributing to aviation accidents and has recommended SMS for several sectors of the aviation industry, including aircraft operators. The FAA has concluded those same organizational factors and benefits of SMS apply across the aviation industry, including airports. In 2001, ICAO adopted a standard in Annex 14 that all member states establish SMS requirements for airport operators hosting international operations. The FAA supports conformity of U.S. aviation safety regulations with ICAO standards and recommended practices.

(ii) A Statement of the Significant Issues Raised by the Public Comments in Response to the Initial Regulatory Flexibility Analysis, a Statement of the Assessment of the Agency of Such Issues, and a Statement of Any Changes Made in the Proposed Rule as a Result of Such Comments

Many commenters reported an additional burden on small airports that they believe was not included on the Initial Regulatory Evaluation.

FAA Response: The FAA reevaluated the impact by class to assess the burden on smaller airports. While the FAA originally believed that Class II, III, IV certificate holders would gain benefits similar to Class I certificate holders from formalized hazard identification, risk analysis, training and communications processes; the cost impact is substantial on these certificate holders. Based on this analysis the FAA changed the scope of this final rule to affect a smaller population of small airports. The change in this requirement still advances the FAA's safety goals by targeting airports with over 90 percent of all passenger enplanements.

Additionally, SMS is scalable. Airport characteristics, such as size, organization and governance structures, type of air carrier operations, and number of operations, are all factors that affect a certificate holder's version of SMS. This final rule further clarifies the scalability of SMS, which the FAA believes mitigates the burden on smaller airports and this final rule also increases the time for implementation.

A commenter disputes the definition of a small airport by operation and class.

FAA Response: The FAA maintains that the number of operations and class help determine the size of an airport. Effectively all non-Class I airports are treated as small. The FAA agrees that a substantial number of small-entity airports will be affected. Many of the smaller airport employees have broad responsibilities—an airport employee could cut the grass, remove foreign-object debris, and drive the fire truck. The classification of small in the regulatory evaluation was done based on operation and size. The regulatory flexibility analysis uses the SBA definition.

(iii) The Response of the Agency to Any Comments Filed by the Chief Counsel for Advocacy of the Small Business Administration in Response to the Proposed Rule, and a Detailed Statement of Any Change Made to the Proposed Rule in This Final Rule as a Result of the Comments

The FAA did not receive comments to the SNPRM from the Small Business Administration.

(iv) A Description of an Estimate of the Number of Small Entities to Which the Rule Will Apply or an Explanation of Why No Such Estimate Is Available

There are an estimated 191 part 139 certificated airports impacted by the rule. From the 191 airports, the FAA identified at least 32 airports that meet the Small Business Administration (SBA) definition of small governmental jurisdictions such as governments of cities, counties, towns, townships, villages, school districts, or special districts with populations of less than 50,000.^[22] The FAA considers this a substantial number of small entities. The 2015 revenue, for these airports, ranges from about $123 thousand to $41.0 million. Using the preceding information, the FAA estimates that their ratio of annualized costs to annual revenues is higher than 2 percent for several of the airports, as shown in Table 6 below.

Table 6—Breakout of Airports Meeting SBA Definition

Number	Airport ident.	New part 139 classification	2015 Population estimate 23	2015 NPIAS classification	2015 Revenue 24	Total annualized costs 25	Ratio (%)
1	ACK	Class I	10,858	Non Hub	$7,744,371	$85,175	1.10.
2	ACY	Class I	39,091	Small Hub	12,012,655	85,175	0.71.
3	BGM	Class I	46,058	Non Hub	3,185,093	85,175	2.67.
4	BGR	Class I	32,309	Non Hub	12,036,215	85,175	0.71.
5	BTV	Class I	42,477	Small Hub	16,639,848	85,175	0.51.
6	BZN	Class I	43,399	Small Hub	8,918,137	85,175	0.96.
7	CIU	Class I	13,787	Non Hub	1,031,955	85,175	8.25.
8	COE	Class IV	49,131	GA	not available	85,175	not available.
9	DRT	Class I	36,000	Non Hub	not available	85,175	not available.
10	ECP	Class I	37,495	None	10,320,416	85,175	0.83.
11	EGE	Class I	6,840	Non Hub	4,860,347	85,175	1.75.
12	ELM	Class I	28,291	Non Hub	3,002,954	85,175	2.84.
13	FAI	Class I	32,453	Small Hub	9,971,203	85,175	0.85.
14	FRG	Class IV	8,685	Reliever	not available	85,175	not available.
15	GCN	Class I	585	Non Hub	1,359,481	85,175	6.27.
16	GSP	Class I	28,340	Small Hub	8,309,709	85,175	1.03.
17	IAG	Class I	48,888	Reliever	2,559,262	85,175	3.33.
18	INL	Class I	6,172	Non Hub	123,838	85,175	68.78.
19	JNU	Class I	32,603	Small Hub	6,224,563	85,175	1.37.
20	KTN	Class I	8,176	Non Hub	not available	85,175	not available.
21	MDT	Class I	49,070	Small Hub	26,150,106	85,175	0.33.
22	MLI	Class I	42,636	Small Hub	11,064,089	85,175	0.77.
23	MRY	Class I	28,394	Non Hub	8,468,100	85,175	1.01.
24	MYR	Class I	31,027	Small Hub	18,799,347	85,175	0.45.
25	PGD	Class I	18,155	Non Hub	7,048,500	85,175	1.21.
26	PRC	Class I	41,603	Comm Serv	1,448,110	85,175	5.88.
27	PSP	Class I	47,201	Small Hub	19,063,440	85,175	0.45.
28	SGJ	Class I	14,061	Non Hub	3,657,899	85,175	2.33.
29	TEB	Class IV	69	Reliever	41,039,253	85,175	0.21.
30	TIX	Class IV	45,278	GA	not available	85,175	not available.
31	TRI	Class I	26,651	Non Hub	6,583,279	85,175	1.29.
32	VRB	Class IV	16,343	GA	not available	85,175	not available.

(v) A description of the Projected Reporting, Recordkeeping and Other Compliance Requirements of the Rule, Including an Estimate of the Classes of Small Entities Which Will Be Subject to the Requirement and the Type of Professional Skills Necessary for Preparation of the Report or Record

Table 7—Small Airport

[Costs over 10 years]

Small airport costs	Total hours	Total cost per airport	Description
Manual & Implementation Plan (One-time)	N/A	$138,150	One-time cost of $138,150 per small airport.
Manual Revisions (Annually)	72	1,990	Clerical Employee Wage × 12 hours × 6 years.
Staffing	N/A	774,918	129,159 staffing cost per airport × 6 years.
Initial Software (One-time)	N/A	26,074	Initial Software Cost of $26,074 per airport.
Recurrent Software (Annually)	N/A	32,595	Recurring Software Cost of $6519 per airport × 5 years.
Initial Training fee (One-time)	N/A	810	1 Manager, 1 Maintenance Person, 1 Clerical × $270 training fee per person.
Initial Training Time (One-time)	9	462	1 Manager, 1 Maintenance Person, 1 Clerical × 3 hours for each.
Recurrent Training Fee (Biennial)	NA	540	1 Manager, 1 Maintenance Person, 1 Clerical × $90 training fee per person × 2 years.
Recurrent Training Time (Biennial)	9	462	1 Manager, 1 Maintenance Person, 1 Clerical × 1.5 hours for each × 2 years.
Hazard Awareness Orientation (One-time)	8	692	SMS Manager × 8 hours.
Hazard Awareness Orientation (Biennial)	4	346	SMS Manager × 2 hours to update awareness orientation × 2 Years.
Promotional Material (Biennial)	N/A	7,020	2340 spent every other year on promotional material × 3 years.
Record Potential Hazards (Annually)	65	1,797	Clerical Wage × 15 min × 52 hazards per year × 5 years.
Reporting Potential Hazards (Annually)	65	4,668	Blended Wage × 15 min × 52 hazards per year × 5 years for small airports.
Update Distribution Log (Biennial)	2.5	69	Clerical Wage × 5 min × 10 tenants per small airport × 3 years.
Update Training Records (Biennial)	0.8	22	Clerical Wage × 5 min × 3 employee training records per airport × 3 years.
Documenting Safety Risk Management (Annually)	130	5,188	Operations Specialist Wage × 30 min × 52 documents per year × 5 years.
Reporting Safety Information under Safety Assurance (Annually)	10	631	Operations Research Wage × 1 hour × 2 reports per year × 5 years.
Total	375	996,434
Table notes:
Clerical Employee 26  $27.64.
Operation Research Analyst 27  $63.12.
General and Operations Manager 28  $86.50.
Airfield Operations Specialist 29  $39.31.
Blended Wage (Mechanic, Pilot, Flight Attendant, Airfield Ops Specialist) 30  $71.82.

 

Small airport costs	Total hours	Total cost per airport	Description
Manual & Implementation Plan (One-time)	N/A	$138,150	One-time cost of $138,150 per small airport.
Manual Revisions (Annually)	72	1,990	Clerical Employee Wage × 12 hours × 6 years.
Staffing	N/A	774,918	$129,159 staffing cost per airport × 6 years.
Initial Software (One-time)	N/A	26,074	Initial Software Cost of $26,074 per airport.
Recurrent Software (Annually)	N/A	32,595	Recurring Software Cost of $6,519 per airport × 5 years.
Initial Training fee (One-time)	N/A	810	1 Manager, 1 Maintenance Person, 1 Clerical × $270 training fee per person.
Initial Training Time (One-time)	9	462	1 Manager, 1 Maintenance Person, 1 Clerical × 3 hours for each.
Recurrent Training Fee (Biennial)	NA	540	1 Manager, 1 Maintenance Person, 1 Clerical × $90 training fee per person × 2 years.
Recurrent Training Time (Biennial)	9	462	1 Manager, 1 Maintenance Person, 1 Clerical × 1.5 hours for each × 2 years.
Hazard Awareness Orientation (One-time)	8	692	SMS Manager × 8 hours.
Hazard Awareness Orientation (Biennial)	4	346	SMS Manager × 2 hours to update awareness orientation × 2 Years.
Promotional Material (Biennial)	N/A	7,020	$2,340 spent every other year on promotional material × 3 years.
Record Potential Hazards (Annually)	65	$1,797	Clerical Wage × 15 min × 52 hazards per year × 5 years.
Reporting Potential Hazards (Annually)	65	4,150	Blended Wage × 15 min × 52 hazards per year × 5 years for small airports.
Update Distribution Log (Biennial)	2.5	69	Clerical Wage × 5 min × 10 tenants per small airport × 3 years.
Update Training Records (Biennial)	0.8	22	Clerical Wage × 5 min × 3 employee training records per airport × 3 years.
Documenting Safety Risk Management (Annually)	130	5,188	Operations Specialist Wage × 30 min × 52 documents per year × 5 years.
Reporting Safety Information under Safety Assurance (Annually)	10	631	Operations Research Wage × 1 hour × 2 reports per year × 5 years.
Total	375	995,916
Table notes:
Clerical Employee 31  $27.64.
Operation Research Analyst 32  $63.12.
General and Operations Manager 33  $86.50.
Airfield Operations Specialist 34  $39.31.
Blended Wage (Mechanic, Pilot, Flight Attendant, Airfield Ops Specialist) 35  $63.85.

(vi) A Description of the Steps the Agency Has Taken To Minimize the Significant Economic Impact on Small Entities Consistent With the Stated Objectives of Applicable Statutes, Including a Statement of the Factual, Policy, and Legal Reasons for Selecting the Alternative Adopted in This Final Rule and Why Each One of the Other Significant Alternatives to the Rule Considered by the Agency Which Affect the Impact on Small Entities Was Rejected

The FAA analyzed the following four alternatives in the SNPRM: (a) all part 139 airports; (b) airport operators holding a Class I AOC; (c) certificated international airports; (d) large, medium, and small hub airports and certificated airports with more than 100,000 total annual operations; and (e) large, medium, and small hub airports, certificated airports with more than 100,000 total annual operations (the sum of all arrivals and departures), and certificated international airports. The fourth alternative was identified as the preferred alternative in the SNPRM. This alternative reduced the qualified population of airports from all 531 part 139 airports to approximately 265 by eliminating a number of small airports. This alternative focused on airports with high passenger traffic and included facilities with the largest number of arrivals and departures so that safety benefits would flow to the overwhelming majority of aircraft operations.

This final rule will continue to apply to large, medium, and small hub airports, certificated airports with 100,000 or more total annual operations using a three-year rolling average, and certificated airports that serve any international operation other than general aviation. However, after reviewing public comments to the SNPRM, the FAA modified the preferred alternative to allow airports identified under the international trigger with no international commercial traffic to obtain a waiver from this regulation. This change in this final rule reduces the number of airports from approximately 265 to 191 qualified airports. The additional estimated 74 airports that the FAA projects will obtain waivers are also small airports.

C. International Trade Impact Assessment

The Trade Agreements Act of 1979 (Pub. L. 96-39), as amended by the Uruguay Round Agreements Act (Pub. L. 103-465), prohibits Federal agencies from establishing standards or engaging in related activities that create unnecessary obstacles to the foreign commerce of the United States. Pursuant to these Acts, the establishment of standards is not considered an unnecessary obstacle to the foreign commerce of the United States, so long as the standard has a legitimate domestic objective, such as the protection of safety, and does not operate in a manner that excludes imports that meet this objective. The statute also requires consideration of international standards and, where appropriate, that they be the basis for U.S. standards. The FAA has assessed the potential effect of this final rule and determined that it will have only a domestic impact and, therefore, will not create unnecessary obstacles to the foreign commerce of the United States.

D. Unfunded Mandates Assessment

Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4) requires each Federal agency to prepare a written statement assessing the effects of any Federal mandate in a proposed or final agency rule that may result in an expenditure of $100 million or more (in 1995 dollars) in any one year by State, local, and tribal governments, in the aggregate, or by the private sector; such a mandate is deemed to be a “significant regulatory action.” The FAA uses an inflation-adjusted value of $158.0 million in lieu of $100 million. This final rule does not contain such a mandate; therefore, the requirements of Title II of the Act do not apply.

E. Paperwork Reduction Act

The Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)) requires that the FAA consider the impact of paperwork and other information collection burdens imposed on the public. According to the 1995 amendments to the Paperwork Reduction Act (5 CFR 1320.8(b)(2)(vi)), an agency may not collect or sponsor the collection of information, nor may it impose an information collection requirement unless it displays a valid Office of Management and Budget (OMB) control number.

This final rule will impose the following amended information collection requirements to the existing information collection requirements previously approved under OMB Control Number 2120-0675. As required by the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)), the FAA submitted these information collection amendments for its review and OMB approved the amended information collection requirements under existing OMB Control Number 2120-0675.

Summary: This final rule requires certain certificate holders to establish a SMS for the entire airfield environment (including movement and non-movement areas) to improve safety at airports hosting air carrier operations. A SMS is a formalized approach to managing safety by developing an organization-wide safety policy, developing formal methods for identifying hazards, analyzing and mitigating risk, developing methods for ensuring continuous safety improvement, and creating organization-wide safety promotion strategies.

Under this final rule, applicable certificate holders are required to submit an Implementation Plan, SMS Manual and/or ACM update under a staggered implementation schedule. The intent of the Implementation Plan is for a certificate holder to identify its plan for implementing SMS within applicable areas, and map its schedule for implementing requirements. The certificate holder will describe its means for complying with this final rule by either developing a SMS Manual and updating its ACM with cross-references, or documenting the SMS requirements directly in the ACM.

This final rule also requires applicable certificate holders to maintain records related to formalized hazard identification and analysis under Safety Risk Management, training records under Safety Promotion, and other Safety Promotion materials (also referred to as safety communications).

Public comments: The FAA received a few comments in the 2016 and 2021 comment periods that expressed concern that the initial SMS planning, data collection, software, documentation, and implementation process were underestimated. Another commenter stated that the regulatory evaluation did not account for the cost of attrition on training records.

The FAA used information from pilot study participants before and after the initial regulatory evaluation to estimate costs and cannot validate the cost estimates provided above. Additionally, the FAA had no basis to account for attrition on the small number of employees that are estimated to require training under the rule. Attrition is a normal course of business cost. The FAA expects little to no attrition solely due to SMS.

Use: While the Implementation Plan's main purpose is to guide a certificate holder's implementation, the plan also provides a basis for the FAA's oversight during the development and implementing phases. The FAA's review and approval of the Implementation Plan ensures that a certificate holder is given feedback early and before it may make significant capital improvements as part of its SMS development and implementation.

The ACM update and/or the SMS Manual establishes the foundation for a SMS. Like the Implementation Plan, the FAA will approve the ACM update (a current practice under the existing rule). However, the FAA will accept the certificate holder's SMS Manual.

Collection and analysis of safety data is an essential part of a SMS. Types of data to be collected, retention procedures, analysis processes, and organizational structures for review and evaluation will be documented in either the ACM or SMS Manual, with cross-references in the ACM. These records will be used by a certificate holder in the operation of its SMS and to facilitate continuous improvement through evaluation and monitoring. While this final rule does not require a certificate holder to submit these records to the FAA, it is required to make these records available upon request.

Respondents (including number of): The FAA estimates that 191 part 139 certificated airports will be impacted by the paperwork requirements in this rule.

Table 8—Affected Population

Airport* categories	Number of airports	Data source
Large, Medium, and Small Hub	132	2015 annual passenger boarding (enplanements) and all-cargo data from Air Carrier Activity Information System (ACAIS) available on FAA.gov.
>100,000 Operations	27	Rolling average of 2013 to 2015 FAA Form 5010-1, Airport Master Record for non-towered airports and Operations Network (OPSNET) data for towered airports.
International Traffic	32	All available CBP data sources including CBP regulations, public website information, and the private flyers list of available airports to determine international applicability (excludes airports with no commercial international traffic).

Frequency and Annual Burden Estimate: The FAA used the information below to estimate the paperwork burden for the approximately 132 large and 59 small part 139 certificated airports impacted by the rule.

Table 9—Wages

Clerical Employee	$27.64
Operation Research Analyst	63.12
Management Occupations	86.50
Airfield Operations Specialist	39.91
Blended Wage (Mechanic, Pilot, Flight Attendant, Airfield Operations Specialist	63.85

Table 10—Impact on Small Airports

[Over 10 years]

Paperwork requirements	Hours per airport	Small airport	Description
Manual & Implementation Plan (One-time)	NA	$138,150	One-time cost of $138,150 per small airport.
Manual Revisions (Annually)	72	1,990	Clerical Employee Wage × 12 hours × 6 years for small airports.
Initial Software (One-time)	NA	26,074	Initial Software Cost of $26,074 per airport.
Recurrent Software (Annually)	NA	32,595	Recurring Software Cost of $6,519 per airport × 5 years for small airports.
Promotional Material (Biennially)	NA	7,020	$2,340 spent every other year on promotional material × 3 years.
Record Potential Hazards (Annually)	65	1,797	Clerical Wage × 15 min × 52 hazards per year × 5 years for small airports.
Reporting Potential Hazards (Annually)	65	4,150	Blended Wage × 15 min × 52 hazards per year × 5 years for small airports.
Update Distribution Log (Biennially)	2.5	69	Clerical Wage × 5 min × 10 tenants per small airport × 3 years.
Update Training Records (Biennially)	0.8	22	Clerical Wage × 5 min × 3 employee training records per airport × 3 years.
Documenting Safety Risk Management (Annually)	130	5,188	Operations Specialist Wage × 30 min × 52 documents per year × 5 years for small airports.
Reporting Safety Information under Safety Assurance (Annually)	10	631	Operations Research Wage × 1 hour × 2 reports per year × 5 years for small airports.
Total	345.3	217,686

Table 11—Impact on Large Airports

[Over 10 years]

Paperwork requirements	Hours per airport	Large airport	Description
Manual & Implementation Plan (One-time)	NA	$250,460	One-time cost of $250,460 per large airport.
Manual Revisions (Annually)	84	2,322	Clerical Employee Wage × 12 hours × 7 years for large airports.
Initial Software (One-time)	NA	26,074	Initial Software Cost of $26,074 per airport.
Recurrent Software (Annually)	NA	39,114	Recurring Software Cost of $6,519 per airport × 6 years for large airports.
Promotional Material (Biennially)	NA	7,020	$2,340 spent every other year on promotional material × 3 years.
Record Potential Hazards (Annually)	78	2,156	Clerical Wage × 15 min × 52 hazards per year × 6 years for large airports.
Reporting Potential Hazards (Annually)	78	4,980	Blended Wage × 15 min × 52 hazards per year × 6 years for large airports.
Update Distribution Log (Biennially)	37.5	1,037	Clerical Wage × 15 min × 50 tenants per large airport × 3 years.
Update Training Records (Biennially)	3.3	91	Clerical Wage × 5 min × 10 employee training records per airport × 4 years.
Documenting Safety Risk Management (Annually)	156	6,226	Operations Specialist Wage × 30 min × 52 documents per year × 6 years for large airports.
Reporting Safety Information under Safety Assurance (Annually)	12	757	Operations Research Wage × 1 hour × 2 reports per year × 6 years for large airports.
Total	448.8	340,237

The hourly burden, over 10 years, for small airports is 345.3 hours multiplied by 59 airports for a total of 20,373 hours. Annually, this is equivalent to 2,037 hours per year. For the 132 large airports, the hourly burden is 59,242 over 10 years or 5,924 hours per year.

While Tables 8 and 9 identify the cost per airport, there are a few airports that will not purchase software. For small airports, there are 44 airports with a per airport cost of $217,686 and 15 airports with a per airport cost of $191,612 (excluding the $26,074 initial software cost). For large airports, there are 99 airports with an estimated per airport cost of $340,237. The remaining 33 airports have a per airport cost of $314,163 (excluding the $26,074 initial software cost). The total cost burden combined over a 10-year period, for small and large airports, sums to $556.4 million ($51 million at 7 percent present value).

F. International Compatibility and Cooperation

In keeping with U.S. obligations under the Convention on International Civil Aviation, it is FAA policy to conform to International Civil Aviation Organization (ICAO) Standards and Recommended Practices to the maximum extent practicable. The FAA has reviewed the corresponding ICAO Standards and Recommended Practices and has identified no differences with these proposed regulations.

G. Environmental Analysis

FAA Order 1050.1F identifies FAA actions that are categorically excluded from preparation of an environmental assessment or environmental impact statement under the National Environmental Policy Act in the absence of extraordinary circumstances. The FAA has determined this rulemaking action qualifies for the categorical exclusion identified in paragraph 5-6.6 and involves no extraordinary circumstances.

V. Executive Order Determinations

A. Executive Order 13132, Federalism

The FAA has analyzed this final rule under the principles and criteria of Executive Order 13132, Federalism. Most airports subject to this final rule are owned, operated, or regulated by a local government body (such as a city or council government), which, in turn, is incorporated by or as part of a State. The FAA determined that this action will not have a substantial direct effect on the States, or the relationship between the Federal Government and the States, or on the distribution of power and responsibilities among the various levels of government, and, therefore, does not have Federalism implications.

B. Executive Order 13211, Regulations That Significantly Affect Energy Supply, Distribution, or Use

The FAA analyzed this final rule under Executive Order 13211, Actions Concerning Regulations that Significantly Affect Energy Supply, Distribution, or Use (May 18, 2001). The FAA has determined that it is not a “significant energy action” under the executive order and it is not likely to have a significant adverse effect on the supply, distribution, or use of energy.

C. Executive Order 13609, Promoting International Regulatory Cooperation

Executive Order 13609, Promoting International Regulatory Cooperation, promotes international regulatory cooperation to meet shared challenges involving health, safety, labor, security, environmental, and other issues and reduce, eliminate, or prevent unnecessary differences in regulatory requirements. The FAA has analyzed this action under the policy and agency responsibilities of Executive Order 13609, Promoting International Regulatory Cooperation. The FAA has determined that this action would eliminate differences between U.S. aviation standards and those of other civil aviation authorities by requiring certain certificated airports to have a SMS.

VI. How To Obtain Additional Information

A. Rulemaking Documents

An electronic copy of a rulemaking document may be obtained by using the internet—

1. Search the Federal eRulemaking Portal ( www.regulations.gov);

2. Visit the FAA's Regulations and Policies web page at www.faa.gov/​regulations_​policies/​; or

3. Access the Government Printing Office's web page at www.GovInfo.gov.

Copies may also be obtained by sending a request (identified by notice, amendment, or docket number of this rulemaking) to the Federal Aviation Administration, Office of Rulemaking, ARM-1, 800 Independence Avenue SW, Washington, DC 20591, or by calling [phone].

B. Comments Submitted to the Docket

Comments received may be viewed by going to www.regulations.gov and following the online instructions to search the docket number for this action. Anyone is able to search the electronic form of all comments received into any of the FAA's dockets by the name of the individual submitting the comment (or signing the comment, if submitted on behalf of an association, business, labor union, etc.).

C. Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act (SBREFA) of 1996 requires FAA to comply with small entities' requests for information or advice about compliance with statutes and regulations within its jurisdiction. A small entity with questions regarding this document may contact its local FAA official or the person listed under the FOR FURTHER INFORMATION CONTACT heading at the beginning of the preamble. To find out more about SBREFA on the internet, visit https://www.faa.gov/​regulations_​policies/​rulemaking/​sbre_​act/​.

List of Subjects in 14 CFR Part 139

• Air carriers
• Airports
• Aviation safety
• Reporting and recordkeeping requirements
• Safety Management Systems (SMS)

The Amendment

In consideration of the foregoing, the Federal Aviation Administration amends chapter I of title 14, Code of Federal Regulations as follows:

PART 139—CERTIFICATION OF AIRPORTS

1. The authority citation for part 139 is revised to read as follows:

Authority: 49 U.S.C. 106(f), 106(g), 40113, 44701-44706, 44709, 44719, 47175.

2. Amend § 139.5 by adding in alphabetical order definitions for “Accountable executive”, “Airport Safety Management System (SMS)”, “Hazard”, “Non-movement area”, “Risk”, “Risk analysis”, “Risk mitigation”, “Safety assurance”, “Safety policy”, “Safety promotion”, and “Safety risk management” to read as follows:

§ 139.5

Definitions.

* * * * *

Accountable executive means an individual designated by the certificate holder to act on its behalf for the implementation and maintenance of the Airport Safety Management System. The accountable executive has control of the certificate holder's human and financial resources for operations conducted under an Airport Operating Certificate. The accountable executive has ultimate responsibility to the FAA, on behalf of the certificate holder, for the safety performance of operations conducted under the certificate holder's Airport Operating Certificate.

* * * * *

Airport Safety Management System (SMS) means an integrated collection of processes and procedures that ensures a formalized and proactive approach to system safety through risk management.

* * * * *

Hazard means a condition that could foreseeably cause or contribute to: (1) injury, illness, death, damage to or loss of system, equipment, or property, or (2) an aircraft accident as defined in 49 CFR 830.2.

* * * * *

Non-movement area means the area, other than that described as the movement area, used for the loading, unloading, parking, and movement of aircraft on the airside of the airport (including ramps, apron areas, and on-airport fuel farms).

* * * * *

Risk means the composite of predicted severity and likelihood of the potential effect of a hazard.

Risk analysis means the process whereby a hazard is characterized for its likelihood and the severity of its effect or harm. Risk analysis can be either a quantitative or qualitative analysis; however, the inability to quantify or the lack of historical data on a particular hazard does not preclude the need for analysis.

Risk mitigation means any action taken to reduce the risk of a hazard's effect.

* * * * *

Safety assurance means processes within the SMS that function systematically to ensure the performance and effectiveness of risk controls or mitigations and that the organization meets or exceeds its safety objectives through the collection, analysis, and assessment of information.

Safety policy means the certificate holder's documented commitment to safety, which defines its safety objectives and the accountabilities and responsibilities of its employees in regard to safety.

Safety promotion means a combination of training and communication of safety information to support the implementation and operation of a SMS in an organization.

Safety risk management means a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing, and controlling or mitigating the risk.

* * * * *

§  139.101

[Amended]

3. Amend §  139.101 by removing paragraph (c).

4. Amend §  139.103 by revising paragraph (b) to read as follows:

§  139.103

Application for certificate.

* * * * *

(b) Submit with the application, two copies of an Airport Certification Manual, and a Safety Management System Manual (where applicable), prepared in accordance with subparts C and E of this part.

5. Amend §  139.203, in the table in paragraph (b) titled “Required Airport Certification Manual Elements,” by redesignating entry 29 as entry 30 and adding a new entry 29.

The addition reads as follows:

§  139.203

Contents of Airport Certification Manual.

* * * * *

(b) * * *

Required Airport Certification Manual Elements

Manual elements	Airport certificate class
	Class I	Class II	Class III	Class IV
*         *         *         *         *         *         *
29. Policies and procedures for the development of, implementation of, maintenance of, and adherence to, the Airport's Safety Management System, as required under subpart E of this part. Section 139.401(1) prescribes which certificate holders are subject to this requirement.	X	X	X	X
*         *         *         *         *         *         *

6. Amend § 139.301 by revising paragraph (b)(1) and adding paragraphs (b)(9) and (10) to read as follows:

§  139.301

Records.

* * * * *

(b) * * *

(1) Personnel training. Twenty-four consecutive calendar months for personnel training records and orientation materials, as required under §§ 139.303, 139.327, and 139.402(d).

* * * * *

(9) Safety risk management documentation. The longer of thirty-six consecutive calendar months after the risk analysis of identified hazards under § 139.402(b)(2) has been completed, or twelve consecutive calendar months after mitigations required under §  139.402(b)(2)(v) have been completed.

(10) Safety communications. Twelve consecutive calendar months for safety communications, as required under § 139.402(d).

* * * * *

7. Amend §  139.303 by revising paragraphs (e)(5) and (6) and adding paragraph (e)(7) to read as follows:

§  139.303

Personnel.

* * * * *

(e) * * *

(5) §  139.337, Wildlife hazard management;

(6) §  139.339, Airport condition reporting; and

(7) §  139.402, Components of airport safety management system.

* * * * *

8. Add subpart E to read as follows:

Subpart E—Airport Safety Management System

139.401

General requirements.

139.402

Components of Airport Safety Management System.

139.403

Airport Safety Management System implementation.

Subpart E—Airport Safety Management System

§  139.401

General requirements.

(a) Each certificate holder or applicant for an Airport Operating Certificate meeting at least one of the following criteria must develop, implement, maintain, and adhere to an Airport Safety Management System pursuant to the requirements established in this subpart. If the certificate holder:

(1) Is classified as a large, medium, or small hub based on passenger data extracted from the Air Carrier Activity Information System;

(2) Has an average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures, over the previous three calendar years; or

(3) Is classified as a port of entry, designated international airport, landing rights airport, or user fee airport.

(b) The scope of an Airport Safety Management System must encompass aircraft operation in the movement area, aircraft operation in the non-movement area, and other airport operations addressed in this part.

(c) The Airport Safety Management System should correspond in size, nature, and complexity to the operations, activities, hazards, and risks associated with the certificate holder's operations.

(d) If a certificate holder qualifies exclusively under paragraph (a)(3) of this section and has no tenants that are required to comply with SMS requirements of any jurisdiction, the certificate holder is eligible for a waiver from the requirements of paragraph (a) of this section.

(1) To obtain the waiver, the certificate holder must submit a written request to the Regional Airports Division Manager justifying its request.

(2) If FAA grants a certificate holder's request for a waiver, the certificate holder must validate its waiver eligibility to the Regional Airports Division Manager every two years.

(e) If an airport has a tenant required to maintain a SMS subject to the requirements of part 5 of this title, then the certificate holder may develop a data sharing and reporting plan to address the reporting and sharing of hazard and safety data with the tenant.

(1) Any data sharing and reporting plan must include, at a minimum:

(i) The types of information the certificate holder expects the tenant to share;

(ii) The timeliness of sharing relevant safety data and reports;

(iii) Processes for analyzing joint safety issues or hazards;

(iv) Other processes, procedures, and policies to aid the certificate holder's compliance with its obligations under the Airport Safety Management System; and

(v) Identification of the mechanisms through which the certificate holder will ensure compliance with the plan to achieve the full implementation of the requirements.

(2) With a data sharing and reporting plan, the requirement for the certificate holder to provide safety awareness orientation to the tenants or their employees under § 139.402(d)(1) is waived.

(3) The certificate holder remains the ultimate responsible party for compliance with its Airport Safety Management System.

(f) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must describe its compliance with the requirements identified in § 139.402, either:

(1) Within a separate section of the certificate holder's Airport Certification Manual titled Airport Safety Management System; or

(2) Within a separate Airport Safety Management System Manual. If the certificate holder chooses to use a separate Airport Safety Management System Manual, the Airport Certification Manual must incorporate by reference the Airport Safety Management System Manual.

(g) On an annual basis or upon FAA request, the certificate holder shall provide the FAA copies of any changes to the Airport Safety Management System Manual.

(h) A certificate holder that starts implementation of an Airport Safety Management System but no longer qualifies under paragraph (a) of this section must continue to develop, implement, maintain, and adhere to its Airport Safety Management System for the longest of the following periods:

(1) Twenty-four consecutive calendar months after full implementation; or

(2) Twenty-four consecutive calendar months from the date it no longer qualifies under paragraph (a) of this section.

§  139.402

Components of Airport Safety Management System.

An Airport Safety Management System must include:

(a) Safety Policy. A Safety Policy that, at a minimum:

(1) Identifies the accountable executive;

(2) Establishes and maintains a safety policy statement signed by the accountable executive;

(3) Ensures the safety policy statement is available to all employees and tenants;

(4) Identifies and communicates the safety organizational structure;

(5) Describes management responsibility and accountability for safety issues;

(6) Establishes and maintains safety objectives; and

(7) Defines methods, processes, and organizational structure necessary to meet safety objectives.

(b) Safety Risk Management. Safety Risk Management processes and procedures for identifying hazards and their associated risks within airport operations and for changes to those operations covered by this part that, at a minimum:

(1) Establish a system for identifying operational safety issues.

(2) Establish a systematic process to analyze hazards and their associated risks, which include:

(i) Describing the system;

(ii) Identifying hazards;

(iii) Analyzing the risk of identified hazards and/or analyzing proposed mitigations;

(iv) Assessing the level of risk associated with identified hazards; and

(v) Mitigating the risks of identified hazards, when appropriate.

(3) Establish and maintain records that document the certificate holder's Safety Risk Management processes.

(i) The records shall provide a means for airport management's acceptance of responsibility for assessed risks and mitigations.

(ii) Records associated with the certificate holder's Safety Risk Management processes must be retained for the longer of:

(A) Thirty-six consecutive calendar months after the risk analysis of identified hazards under paragraph (b)(2) of this section has been completed; or

(B) Twelve consecutive calendar months after mitigations required under paragraph (b)(2)(v) of this section have been completed.

(c) Safety assurance. Safety assurance processes and procedures to ensure mitigations developed through the certificate holder's Safety Risk Management processes and procedures are adequate, and the Airport's Safety Management System is functioning effectively. Those processes and procedures must, at a minimum:

(1) Provide a means for monitoring safety performance including a means for ensuring that safety objectives identified under paragraph (a)(6) of this section are being met.

(2) Establish and maintain a safety reporting system that provides a means for reporter confidentiality.

(3) Report pertinent safety information and data on a regular basis to the accountable executive. Reportable data includes:

(i) Compliance with the requirements under this subpart and subpart D of this part;

(ii) Performance of safety objectives established under paragraph (a)(6) of this section;

(iii) Safety critical information distributed in accordance with paragraph (d)(5)(ii) of this section;

(iv) Status of ongoing mitigations required under the Airport's Safety Risk Management processes as described under paragraph (b)(2)(v) of this section; and

(v) Status of a certificate holder's schedule for implementing the Airport Safety Management System as described under § 139.403.

(d) Safety Promotion. Safety Promotion processes and procedures to foster an airport operating environment that encourages safety. Those processes and procedures must, at a minimum:

(1) Provide all persons authorized to access the airport areas regulated under this part with a safety awareness orientation, which includes hazard identification and reporting. The safety awareness orientation materials must be readily available and must be reviewed and updated every twenty-four calendar months or sooner if necessary.

(2) Maintain a record of all safety awareness orientation materials made available under paragraph (d)(1) of this section including any revisions and means of distribution. Such records must be retained for twenty-four consecutive calendar months after the materials are made available.

(3) Provide safety training on those requirements of SMS and its implementation to each employee with responsibilities under the certificate holder's SMS that is appropriate to the individual's role. This training must be completed at least every twenty-four months.

(4) Maintain a record of all training by each individual under paragraph (d)(3) of this section that includes, at a minimum, a description and date of training received. Such records must be retained for twenty-four consecutive calendar months after completion of training.

(5) Develop and maintain formal means for communicating important safety information that, at a minimum:

(i) Ensures all persons authorized to access the airport areas regulated under this part are aware of the SMS and their safety roles and responsibilities;

(ii) Conveys critical safety information;

(iii) Provides feedback to individuals using the airport's safety reporting system required under paragraph (c)(2) of this section; and

(iv) Disseminates safety lessons learned to relevant airport employees or other stakeholders.

(6) Maintain records of communications required under this section for 12 consecutive calendar months.

§  139.403

Airport Safety Management System implementation.

(a) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must submit an Implementation Plan to the FAA for approval according to the following schedule:

(1) For certificate holders identified under § 139.401(a)(1), on or before April 24, 2024;

(2) For certificate holders identified under § 139.401(a)(2), on or before October 24, 2024;

(3) For certificate holders identified under § 139.401(a)(3), on or before April 24, 2025.

(4) For a certificate holder that qualifies under § 139.401(a) after April 24, 2023, on or before 18 months after the certificate holder receives notification from the Regional Airports Division Manager of the change in its status.

(b) An Implementation Plan must provide:

(1) A detailed proposal on how the certificate holder will meet the requirements prescribed in this subpart.

(2) A schedule for implementing SMS components and elements prescribed in § 139.402. The schedule must include timelines for the following requirements:

(i) Developing the safety policy statement as prescribed in § 139.402(a)(2) and when it will be made available to all employees and tenants as prescribed in § 139.402(a)(3);

(ii) Identifying and communicating the safety organizational structure as prescribed in § 139.402(a)(4);

(iii) Establishing a system for identifying operational safety issues as prescribed in § 139.402(b)(1);

(iv) Establishing a safety reporting system as prescribed in § 139.402(c)(2);

(v) Developing, providing, and maintaining safety awareness orientation materials as prescribed in § 139.402(d)(1);

(vi) Providing SMS-specific training to employees with responsibilities under the certificate holder's SMS as prescribed in § 139.402(d)(3); and

(vii) Developing, implementing, and maintaining formal means for communicating important safety information as prescribed in § 139.402(d)(5).

(3) A description of any existing programs, policies, or procedures that the certificate holder intends to use to meet the requirements of this subpart.

(c) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must submit its amended Airport Certification Manual and Airport Safety Management System Manual, if applicable, to the FAA in accordance with its Implementation Plan but not later than 12 months after receiving FAA approval of the certificate holder's Implementation Plan.

(d) A certificate holder that qualifies under § 139.401(a) must fully implement its Airport Safety Management System no later than 36 months after the approval of its Implementation Plan.

Issued in Washington, DC, under authority provided by 49 U.S.C. 106(f), 44701, 44702, and 44706 on or about February 15, 2023.

Billy Nolen,

Acting Administrator.

Footnotes

1.   See, e.g., National Transportation Safety Board, NTSB Calls for Enhanced Safety Standards in Some Revenue Passenger-Carrying General Aviation Operations (Mar. 23, 2021), https://www.ntsb.gov/​news/​press-releases/​Pages/​NR20210323.aspx; Transportation Research Board, Airport Cooperative Research Program (ACRP) Synthesis 37: Lessons Learned from Airport Safety Management Systems Pilot Studies at 46 (2012) (explaining that airports that participated in the SMS program reported increased safety awareness and improved collaboration).

2.  Part 139 requires airports serving scheduled air carrier aircraft with more than 9 seats or unscheduled air carrier aircraft with more than 30 seats to hold an Airport Operating Certificate (AOC). Under part 139, a certificate holder must develop and maintain an Airport Certification Manual (ACM). The ACM contains the processes and procedures the airport uses to comply with part 139 requirements, and the FAA approves the ACM and updates to it.

3.  Federal Aviation Administration, Airport Safety Management Systems (SMS) Pilot Studies, https://www.faa.gov/​sites/​faa.gov/​files/​airports/​airport_​safety/​safety_​management_​systems/​external/​smsPilotTechReportMay2011.pdf (May 2011).

4.  FAA has not evaluated an airport's safety record prior to participating in SMS under the pilot program. In general, however, the FAA recognizes that airports participating in the pilot studies were proactive about the safety of their operations.

5.  For the purposes of this trigger, the FAA will use the following sources of data to determine number of operations: (a) traffic counts reported by the Air Traffic Control Tower through FAA Operations Network (OpsNet), for airports with FAA or contract towers; (b) FAA Form 5010-1 data for non-towered airports; or (c) other FAA-validated counting systems. Historical OpsNet data is publicly available through FAA.gov.

6.  As discussed later in this document, tenant refers to any person or entity occupying space or property under a lease or other agreement (such as an air carrier or maintenance repair and overhaul company) that does business at the airport.

7.  “Movement area” is defined as the runways, taxiways, and other areas of an airport that are used for taxiing, takeoff, and landing of aircraft, exclusive of loading ramps and aircraft parking areas, and that are under the control of an air traffic control tower. “Non-movement Area” is defined as taxiways, aprons, and other areas not under the control of air traffic or at airports without an operating airport traffic control tower.

8.  The FAA anticipates that some airports will provide routine updates to their accountable executive, such as through a continuously updated dashboard.

9.  Part 119 refers to the Certification of Air Carriers and Commercial Operators. Part 121 refers to Operating Requirements for Domestic, Flag, and Supplemental operations. Operations that occur under part 121 with a part 119 certificate are scheduled commercial air carrier operations. On January 8, 2015, the FAA published the Safety Management Systems for Domestic, Flag, and Supplemental Operations Certificate Holders final rule requiring operators authorized to conduct operations under part 121 to develop and implement a SMS. The rule added a new part 5 to Title 14 of the CFR, creating the set of requirements for SMS that a part 121 certificate holder must meet. The rule also modified part 119 to specify applicability and implementation of the new SMS framework. Part 119 refers to the certification of part 121 air carriers and commercial operators. Part 121 air carriers are regularly scheduled air carriers and are generally large, U.S.-based airlines, regional air carriers, and all cargo operators.

10.  National Transportation Safety Board response to SNPRM, September 6th, 2016, Docket Number FAA-2010-0997-0179, Christopher A. Hart, Chairman, page 2.

11.  See § 139.5, definition of large air carrier aircraft.

12.  If an airport has any tenant required to implement a SMS pursuant to any foreign law or regulation, such foreign jurisdiction could prevent the tenant from operating into, or out of, a U.S. airport that does not have a SMS.

13.  The FAA notes that part 5 also does not detail resolution of disapproval or non-acceptance.

14.  Ref. https://www.asias.faa.gov/​apex/​f?​p=​100:17:::NO::AP_​BRIEF_​RPT_​VAR:CHI01FA270.

15.  The FAA notes that the scope of oversight burden under this final rule is not different than current requirements in part 139. Airports are currently responsible for compliance in all areas covered under part 139 and the airport ACM. Moreover, almost every part 139 airport is federally obligated through the federal grant program and is required to meet certain federal grant assurances including the requirement to operate in a safe and serviceable manner. The oversight expectations present under existing part 139 rules are sustained in this final rule; the SMS process simply establishes a systematic approach to the airport's already-existing responsibilities and helps mitigate incidents or accidents that may occur.

16.  FAA anticipates that most air carriers with part 5 SMS programs will develop DSRs between tenants and airports; however, this rule does not establish a regulatory requirement for an airport to develop a DSR. Non-DSR agreement airports will continue to operate as they do currently to meet current requirements of other established regulations. In situations where a DSR does not exist, a pilot, for example, would continue to report hazards through their company's reporting mechanism, or through the airport's Safety Management System.

17.  Airport SMS safety awareness/orientation can be accomplished through such methods as written communication, presentation, or brochures.

18.  External SMS Efforts—Part 139 Rulemaking, Airport SMS Pilot Studies (Sept. 22, 2020), available at https://www.faa.gov/​airports/​airport_​safety/​safety_​management_​systems/​external/​pilot_​studies/​./​

19.  (Evaluation summary—Evaluation of Safety Management Systems in Civil Aviation—July 2019 (canada.ca)).

20.  In the context of the operations trigger, the term operations means the sum of all arrivals and departures.

21.   https://www.whitehouse.gov/​sites/​whitehouse.gov/​files/​omb/​circulars/​A4/​a-4.pdf.

22.   https://www.sba.gov/​sites/​default/​files/​advocacy/​How-to-Comply-with-the-RFA-WEB.pdf.

23.  Data retrieved 10/4/2017 from https://data.census.gov/​cedsci/​table?​tid=​GOVSTIMESERIES.CG00ORG01.

24.  Revenue data from Compliance Activity Tracking System (CATS) accessed on 10/5/2017 from https://cats.airports.faa.gov/​.

25.  Annualized using a capital recovery factor of 0.14238, over 10 years, using a 7 percent rate of interest.

26.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 43-6014; May 2020. This wage includes compensation information from BLS.

27.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 15-2031; May 2020. This wage includes compensation information from BLS.

28.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 11-1021; May 2020. This wage includes compensation information from BLS.

29.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 53-2022; May 2020. This wage includes compensation information from BLS.

30.  Blended wage: Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 53-2022; May 2020. This wage includes compensation information from BLS.

31.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 43-6014; May 2020. This wage includes compensation information from BLS.

32.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 15-2031; May 2020. This wage includes compensation information from BLS.

33.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 11-1021; May 2020. This wage includes compensation information from BLS.

34.  Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Code 53-2022; May 2020. This wage includes compensation information from BLS.

35.  Blended wage computed by taking the average of four occupation wages: Bureau of Labor Statistic (BLS); Annual Mean Wage, Occupation Codes 53-2022, 53-2011, 49-3011, 53-2031; May 2020. This wage includes compensation information from BLS.