(a) Each certificate holder or applicant for an Airport Operating Certificate meeting at least one of the following criteria must develop, implement, maintain, and adhere to an Airport Safety Management System pursuant to the requirements established in this subpart. If the certificate holder:

(1) Is classified as a large, medium, or small hub based on passenger data extracted from the Air Carrier Activity Information System;

(2) Has an average of 100,000 or more total annual operations, meaning the sum of all arrivals and departures, over the previous three calendar years; or

(3) Is classified as a port of entry, designated international airport, landing rights airport, or user fee airport.

(b) The scope of an Airport Safety Management System must encompass aircraft operation in the movement area, aircraft operation in the non-movement area, and other airport operations addressed in this part.

(c) The Airport Safety Management System should correspond in size, nature, and complexity to the operations, activities, hazards, and risks associated with the certificate holder's operations.

(d) If a certificate holder qualifies exclusively under paragraph (a)(3) of this section and has no tenants that are required to comply with SMS requirements of any jurisdiction, the certificate holder is eligible for a waiver from the requirements of paragraph (a) of this section.

(1) To obtain the waiver, the certificate holder must submit a written request to the Regional Airports Division Manager justifying its request.

(2) If FAA grants a certificate holder's request for a waiver, the certificate holder must validate its waiver eligibility to the Regional Airports Division Manager every two years.

(e) If an airport has a tenant required to maintain a SMS subject to the requirements of part 5 of this title, then the certificate holder may develop a data sharing and reporting plan to address the reporting and sharing of hazard and safety data with the tenant.

(1) Any data sharing and reporting plan must include, at a minimum:

(i) The types of information the certificate holder expects the tenant to share;

(ii) The timeliness of sharing relevant safety data and reports;

(iii) Processes for analyzing joint safety issues or hazards;

(iv) Other processes, procedures, and policies to aid the certificate holder's compliance with its obligations under the Airport Safety Management System; and

(v) Identification of the mechanisms through which the certificate holder will ensure compliance with the plan to achieve the full implementation of the requirements.

(2) With a data sharing and reporting plan, the requirement for the certificate holder to provide safety awareness orientation to the tenants or their employees under § 139.402(d)(1) is waived.

(3) The certificate holder remains the ultimate responsible party for compliance with its Airport Safety Management System.

(f) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must describe its compliance with the requirements identified in § 139.402, either:

(1) Within a separate section of the certificate holder's Airport Certification Manual titled Airport Safety Management System; or

(2) Within a separate Airport Safety Management System Manual. If the certificate holder chooses to use a separate Airport Safety Management System Manual, the Airport Certification Manual must incorporate by reference the Airport Safety Management System Manual.

(g) On an annual basis or upon FAA request, the certificate holder shall provide the FAA copies of any changes to the Airport Safety Management System Manual.

(h) A certificate holder that starts implementation of an Airport Safety Management System but no longer qualifies under paragraph (a) of this section must continue to develop, implement, maintain, and adhere to its Airport Safety Management System for the longest of the following periods:

(1) Twenty-four consecutive calendar months after full implementation; or

(2) Twenty-four consecutive calendar months from the date it no longer qualifies under paragraph (a) of this section.

An Airport Safety Management System must include:

(a) Safety Policy. A Safety Policy that, at a minimum:

(1) Identifies the accountable executive;

(2) Establishes and maintains a safety policy statement signed by the accountable executive;

(3) Ensures the safety policy statement is available to all employees and tenants;

(4) Identifies and communicates the safety organizational structure;

(5) Describes management responsibility and accountability for safety issues;

(6) Establishes and maintains safety objectives; and

(7) Defines methods, processes, and organizational structure necessary to meet safety objectives.

(b) Safety Risk Management. Safety Risk Management processes and procedures for identifying hazards and their associated risks within airport operations and for changes to those operations covered by this part that, at a minimum:

(1) Establish a system for identifying operational safety issues.

(2) Establish a systematic process to analyze hazards and their associated risks, which include:

(i) Describing the system;

(ii) Identifying hazards;

(iii) Analyzing the risk of identified hazards and/or analyzing proposed mitigations;

(iv) Assessing the level of risk associated with identified hazards; and

(v) Mitigating the risks of identified hazards, when appropriate.

(3) Establish and maintain records that document the certificate holder's Safety Risk Management processes.

(i) The records shall provide a means for airport management's acceptance of responsibility for assessed risks and mitigations.

(ii) Records associated with the certificate holder's Safety Risk Management processes must be retained for the longer of:

(A) Thirty-six consecutive calendar months after the risk analysis of identified hazards under paragraph (b)(2) of this section has been completed; or

(B) Twelve consecutive calendar months after mitigations required under paragraph (b)(2)(v) of this section have been completed.

(c) Safety assurance. Safety assurance processes and procedures to ensure mitigations developed through the certificate holder's Safety Risk Management processes and procedures are adequate, and the Airport's Safety Management System is functioning effectively. Those processes and procedures must, at a minimum:

(1) Provide a means for monitoring safety performance including a means for ensuring that safety objectives identified under paragraph (a)(6) of this section are being met.

(2) Establish and maintain a safety reporting system that provides a means for reporter confidentiality.

(3) Report pertinent safety information and data on a regular basis to the accountable executive. Reportable data includes:

(i) Compliance with the requirements under this subpart and subpart D of this part;

(ii) Performance of safety objectives established under paragraph (a)(6) of this section;

(iii) Safety critical information distributed in accordance with paragraph (d)(5)(ii) of this section;

(iv) Status of ongoing mitigations required under the Airport's Safety Risk Management processes as described under paragraph (b)(2)(v) of this section; and

(v) Status of a certificate holder's schedule for implementing the Airport Safety Management System as described under § 139.403.

(d) Safety Promotion. Safety Promotion processes and procedures to foster an airport operating environment that encourages safety. Those processes and procedures must, at a minimum:

(1) Provide all persons authorized to access the airport areas regulated under this part with a safety awareness orientation, which includes hazard identification and reporting. The safety awareness orientation materials must be readily available and must be reviewed and updated every twenty-four calendar months or sooner if necessary.

(2) Maintain a record of all safety awareness orientation materials made available under paragraph (d)(1) of this section including any revisions and means of distribution. Such records must be retained for twenty-four consecutive calendar months after the materials are made available.

(3) Provide safety training on those requirements of SMS and its implementation to each employee with responsibilities under the certificate holder's SMS that is appropriate to the individual's role. This training must be completed at least every twenty-four months.

(4) Maintain a record of all training by each individual under paragraph (d)(3) of this section that includes, at a minimum, a description and date of training received. Such records must be retained for twenty-four consecutive calendar months after completion of training.

(5) Develop and maintain formal means for communicating important safety information that, at a minimum:

(i) Ensures all persons authorized to access the airport areas regulated under this part are aware of the SMS and their safety roles and responsibilities;

(ii) Conveys critical safety information;

(iii) Provides feedback to individuals using the airport's safety reporting system required under paragraph (c)(2) of this section; and

(iv) Disseminates safety lessons learned to relevant airport employees or other stakeholders.

(6) Maintain records of communications required under this section for 12 consecutive calendar months.

(a) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must submit an Implementation Plan to the FAA for approval according to the following schedule:

(1) For certificate holders identified under § 139.401(a)(1), on or before April 24, 2024;

(2) For certificate holders identified under § 139.401(a)(2), on or before October 24, 2024;

(3) For certificate holders identified under § 139.401(a)(3), on or before April 24, 2025.

(4) For a certificate holder that qualifies under § 139.401(a) after April 24, 2023, on or before 18 months after the certificate holder receives notification from the Regional Airports Division Manager of the change in its status.

(b) An Implementation Plan must provide:

(1) A detailed proposal on how the certificate holder will meet the requirements prescribed in this subpart.

(2) A schedule for implementing SMS components and elements prescribed in § 139.402. The schedule must include timelines for the following requirements:

(i) Developing the safety policy statement as prescribed in § 139.402(a)(2) and when it will be made available to all employees and tenants as prescribed in § 139.402(a)(3);

(ii) Identifying and communicating the safety organizational structure as prescribed in § 139.402(a)(4);

(iii) Establishing a system for identifying operational safety issues as prescribed in § 139.402(b)(1);

(iv) Establishing a safety reporting system as prescribed in § 139.402(c)(2);

(v) Developing, providing, and maintaining safety awareness orientation materials as prescribed in § 139.402(d)(1);

(vi) Providing SMS-specific training to employees with responsibilities under the certificate holder's SMS as prescribed in § 139.402(d)(3); and

(vii) Developing, implementing, and maintaining formal means for communicating important safety information as prescribed in § 139.402(d)(5).

(3) A description of any existing programs, policies, or procedures that the certificate holder intends to use to meet the requirements of this subpart.

(c) Each certificate holder required to develop, implement, maintain, and adhere to an Airport Safety Management System under this subpart must submit its amended Airport Certification Manual and Airport Safety Management System Manual, if applicable, to the FAA in accordance with its Implementation Plan but not later than 12 months after receiving FAA approval of the certificate holder's Implementation Plan.

(d) A certificate holder that qualifies under § 139.401(a) must fully implement its Airport Safety Management System no later than 36 months after the approval of its Implementation Plan.