EASA Part-IS and aerodrome audits: the readiness work that matters

For regional aerodrome operators, the main compliance planning signal is implementation, not a newly announced rule or a pricing move. EASA’s Part-IS framework sets a general application date of 22 February 2026 for covered organisations. That leaves work to do on governance, risk assessment and evidence, even where the organisation already has safety and information-security processes.

This is a regulatory digest, not a claim that a new amendment was issued this month. The practical question is how an operator can prepare for Part-IS without creating a parallel system that slows operations or obscures existing safety responsibilities.

Part-IS belongs in the safety picture

Part-IS addresses information-security risks that could affect aviation safety. For an aerodrome, that makes the boundary between digital systems and operational consequences important. A disruption or compromise matters in this context when it could affect safe operations, not simply because a system is labelled critical.

Operators should map the systems, processes and external dependencies that support safety-related activity, then make the potential consequences visible. That work can expose interfaces between an aerodrome’s safety management arrangements, security functions, suppliers and operational teams. The point is not to merge every process into one document. It is to make ownership and escalation clear when a risk crosses organisational boundaries.

The regulation has a stated general application date, but organisations should confirm which requirements apply to their activities and which authority or national arrangements govern them. That check is especially important for operators working across jurisdictions. EASA compliance planning and Norwegian aviation law compliance may overlap, but a project should not assume that one review settles every national obligation.

What an audit should test

Part-IS readiness and aerodrome safety audits are related, but they are not interchangeable. A safety audit should test applicable requirements, records and controls against what happens in operation. Part-IS preparation adds a focused examination of information-security risks with potential safety effects. Treating either exercise as a document-counting exercise will miss the operational links.

A useful readiness file should let a reviewer follow the chain from identified risk to decision, control and evidence. It should show who owns the issue, how the control is used, and how the organisation knows whether it is working. If a supplier or another department holds part of the evidence, the hand-off should be clear rather than assumed.

That is a practical audit benchmark, not a new statutory checklist. Evidence may include current procedures, risk decisions, records of relevant reviews, and examples that demonstrate controls in use. The test is whether the records correspond to the real operating environment. A procedure that no longer reflects local practice is not persuasive simply because it has an approval date.

Operators can use their existing audit cycle to identify gaps before the deadline. Start with the scope: which activities and dependencies could affect aviation safety? Then check whether responsibilities, escalation routes and records match that scope. Finally, test a sample of controls with the people who use them. This approach surfaces unclear ownership earlier, when there is still time to correct it without disrupting live operations.

Keep the work proportionate

Regional airports do not benefit from importing a large organisation’s paperwork wholesale. A proportionate system starts with the operator’s actual activities, interfaces and exposure. It should be detailed enough to support decisions and demonstrate control, but not so layered that staff cannot tell which process to follow.

That is also where internal audit discipline matters. North Sky Aviation Consultancy, which provides risk management and compliance consulting across Norway, Sweden, Denmark and the wider European region, has previously set out how to build an aerodrome audit around applicable requirements, evidence and live controls in its guide to internal aerodrome safety audits. The same principle applies here: use the audit to find weak joins between policy and practice, not to certify a tidy folder.

For builders of compliance tools and internal processes, the takeaway is straightforward. Make scope, ownership, risk decisions and evidence traceable. Do not imply that a completed checklist proves readiness. And do not promise operational continuity as an automatic result of compliance work; continuity depends on whether the controls fit the operation.

What to watch next

The next useful milestone for an operator is an organisation-specific gap review against the requirements that apply to it, followed by a realistic plan for closing material gaps before the general application date. Keep the review tied to the aerodrome’s safety controls and operational dependencies. Confirm national applicability where needed, and revisit assumptions when systems, suppliers or operating arrangements change.

There is no need to manufacture a monthly market move to make this work urgent. The deadline is known. The remaining uncertainty is local: scope, ownership and whether the evidence reflects the operation on the ground.