News
Bureau Veritas at AD2S Exhibition in BordeauxFrom September 22nd to 24th
global cyber
PART-IS: Securing the aviation sector in the midst of digital transformation
EU Regulations 2022/1645 and 2023/203, collectively known as PART-IS, require organizations across the European aviation sector to implement robust information security risk management processes where information security risks may affect aviation safety. Bureau Veritas supports you throughout this regulatory transition.
What is PART-IS and its objectives?
PART-IS (Information Security) is the European regulatory framework for managing information security risks in civil aviation. It is based on two regulations: Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203, complemented by the Acceptable Means of Compliance and Guidance Material (AMC/GM) published by EASA.
It requires affected organizations to identify and address information security risks that could impact aviation safety, including governance, risk management, incident detection and management, and business continuity.
Its objectives are to prevent cybersecurity incidents affecting aviation safety, harmonize information security practices across European aviation, and strengthen cooperation between competent authorities and organizations.
When does PART-IS apply?
PART-IS applies in several phases, depending on the regulation applicable to your organization:
| Application Date | Regulation | Organizations Concerned |
| 16 October 2025 | Delegated Regulation (EU) 2022/1645 | Design organizations (Part 21 Subpart J), production organizations (Part 21 Subpart G), aerodrome operators, and apron management service providers |
| 1 January 2026 | Implementing Regulation (EU) 2023/203 | EGNOS air navigation service provider |
| 22 February 2026 | Implementing Regulation (EU) 2023/203 | All other affected organizations and competent authorities, including EASA |
Who is affected by PART-IS?
In addition to organizations covered by Delegated Regulation (EU) 2022/1645, Implementing Regulation (EU) 2023/203 applies to a broad range of civil aviation stakeholders, including:
- Maintenance organizations (Part-145)
- Continuing Airworthiness Management Organizations (Part-CAMO)
- Air operators (Part-ORO)
- Approved Training Organizations (ATO - Part-ORA)
- Aviation medical centers for flight crew
- U-space service providers
- Air traffic controller training organizations (ATCO TOs)
- ATM/ANS service providers (Part-ATM/ANS.OR)
- Flight Simulation Training Device (FSTD) operators
- Aeromedical centers for air traffic controllers
- Organizations involved in the design or production of ATM/ANS systems and constituents
competent authorities, including EASA
Some activities are excluded, such as maintenance organizations operating exclusively under Part-ML or training organizations limited to ELA2 aircraft.
Possible exemption: An organization may apply for an exemption from its competent authority if it can demonstrate, through a documented risk assessment, that its activities, facilities, and resources present no information security risks that could affect aviation safety.
What are the PART-IS requirements?
PART-IS requires organizations to implement an Information Security Management System (ISMS) proportionate to their size, complexity, and risk exposure, integrated into their existing management system. Key requirements include:
- Governance: Information security policy, defined roles and responsibilities, and accountable manager commitment.
- Risk assessment and treatment: Identification of critical assets and threats, assessment of potential aviation safety impacts, and implementation of mitigation measures.
- Detection, response, and recovery: Incident detection capabilities, response procedures, and business recovery arrangements.
- Reporting: Internal reporting system and notification of significant incidents and vulnerabilities to the competent authority.
- Supplier management: Management of risks related to outsourced activities and the supply chain.
- Personnel: Competence, training, and awareness of personnel involved in the ISMS.
Documentation: Information Security Management Manual (ISMM), records, and change management. - Continuous improvement: Internal audits and regular reviews of ISMS effectiveness.
PART-IS, NIS 2 and ISO/IEC 27001: What are the differences?
PART-IS is an aviation-specific regulation focused on information security risks that may impact aviation safety. It does not replace the NIS 2 Directive. According to EASA, organizations classified as essential or important entities under NIS 2 remain subject to NIS 2 obligations, even if they comply with PART-IS.
An existing ISMS, for example one certified to ISO/IEC 27001, provides a useful foundation. However, it must be supplemented to address PART-IS-specific requirements, particularly aviation safety impact assessment and incident reporting to the competent authority
Bureau Veritas SUPPORT for PART-IS compliance
Bureau Veritas offers a comprehensive solution to help you achieve PART-IS compliance:
- Gap Analysis: Assessment of your current level of compliance against PART-IS requirements.
- ISMS Implementation: Support in structuring and deploying a compliant Information Security Management System.
- Training: Training sessions covering regulatory requirements, risk management, and best practices.
- Tailored Workshops: Practical workshops to strengthen internal competencies and prepare for audits.
- Risk Assessment: Identification of critical assets and evaluation of their potential impact on aviation safety.
- Documentation: Preparation of the ISMM and incident reporting and management procedures.
- Mock Audit: Assessment of your ISMS before oversight by the competent authority.
Why Choose Bureau Veritas?
Drawing on our expertise in cybersecurity and regulatory compliance, we help you secure your operations while meeting European requirements. Our multidisciplinary teams support you through every stage of your PART-IS compliance journey.
- Combined aviation and cybersecurity expertise to address digital risks within the context of your aviation activities.
- End-to-end support covering training, gap analysis, ISMS implementation, and audit preparation.
An independent trusted partner, globally recognized in testing, inspection, and certification.
BUREAU VERITAS, A GLOBAL LEADER IN TESTING, INSPECTION AND CERTIFICATION
A trusted partner throughout every stage of your projects, we help you address current challenges by leveraging our international expertise.
Frequently Asked Questions about PART-IS
-
Is PART-IS mandatory?
Yes. It has applied since 16 October 2025 to organizations covered by Delegated Regulation (EU) 2022/1645 and since 22 February 2026 to those covered by Implementing Regulation (EU) 2023/203, unless an exemption has been granted by the competent authority. -
Who verifies PART-IS compliance?
Compliance is verified by the competent authority responsible for each organization as part of its routine oversight activities. In France, this is the DSAC (Directorate for Civil Aviation Safety), or EASA for organizations directly approved by the Agency. -
What is the difference between PART-IS and the NIS 2 Directive?
PART-IS is an aviation regulation addressing information security risks that affect aviation safety. NIS 2 is a cross-sector cybersecurity directive for essential and important entities. Both can apply simultaneously to the same organization. -
Is ISO/IEC 27001 certification sufficient for PART-IS compliance?
No. An ISO/IEC 27001-certified ISMS provides a solid foundation but must incorporate the specific requirements of PART-IS, particularly aviation safety impact assessment and incident reporting obligations. -
What are the consequences of non-compliance?
Non-conformities may be identified during oversight activities, requiring corrective action plans. In the most serious cases, an organization's approval may be limited, suspended, or withdrawn. -
Can an organization be exempt from PART-IS?
An organization may apply for an exemption if it demonstrates through a documented risk assessment that its activities do not present information security risks capable of affecting aviation safety. -
Where should an organization start?
Start with a gap analysis comparing current practices against PART-IS requirements, followed by a risk assessment. This approach helps prioritize actions and establish a roadmap toward an operational and effective ISMS.
