See Full Document Text
Official Journal EN
of the European Union L series
2025/2293 11.11.2025
COMMISSION IMPLEMENTING REGULATION(EU) 2025/2293
of 10 November 2025
amending Implementing Regulation (EU) 2023/203 as regards the requirements applicable to
organisations subject to a declaration and correcting Regulations (EU) No 1178/2011, (EU)
No 748/2012, (EU) No 965/2012, (EU) No 139/2014, (EU) No 1321/2014, (EU) 2015/340, and
Implementing Regulation (EU) 2017/373
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common
rules in the field of civil aviation and establishing a European Union Aviation Safety Agency, and amending Regulations
(EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU
and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and (EC)
No 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No 3922/91(1), and in
particular Article 17(1), point (b), Article 27(1), point (a), Article 31(1), point (b), Article 43(1), point (b), Article 53(1),
point (a), and Article 62(15), point (c), thereof,
Whereas:
(1) To ensure consistency of requirements introduced by Commission Implementing Regulation (EU) 2023/203(2)
applicable to organisations subject to a declaration with other requirements applicable to those organisations,
Annex II to that Regulation should be amended to remove the approval required of them.
(2) Implementing Regulation (EU) 2023/203 added point (g) to point ARA.GEN.300 of Annex VI (Part-ARA) to
Commission Regulation (EU) No 1178/2011(3). That additional point includes an incorrect reference, which should
be corrected.
(3) Implementing Regulation (EU) 2023/203 amended Annex I (Part 21) to Commission Regulation (EU)
No 748/2012(4) by adding point (g) to point 21.B.221 of that Annex. The new point includes an incorrect
reference. Furthermore, a new point (d) was added to point 21.B.431 of Annex I to Regulation (EU) No 748/2012. It
also includes an incorrect reference. Both references should be corrected.
(1) OJ L 212, 22.8.2018, p. 1, ELI: http://data.europa.eu/eli/reg/2018/1139/oj.
(2) Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 laying down rules for the application of Regulation
(EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security
risks with a potential impact on aviation safety for organisations covered by Commission Regulations (EU) No 1321/2014, (EU)
No 965/2012, (EU) No 1178/2011, (EU) 2015/340, Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664, and
for competent authorities covered by Commission Regulations (EU) No 748/2012, (EU) No 1321/2014, (EU) No 965/2012, (EU)
No 1178/2011, (EU) 2015/340 and (EU) No 139/2014, Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664
and amending Commission Regulations (EU) No 1178/2011, (EU) No 748/2012, (EU) No 965/2012, (EU) No 139/2014, (EU)
No 1321/2014, (EU) 2015/340, and Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664 (OJ L 31, 2.2.2023,
p. 1, ELI: http://data.europa.eu/eli/reg_impl/2023/203/oj).
(3) Commission Regulation (EU) No 1178/2011 of 3 November 2011 laying down technical requirements and administrative procedures
related to civil aviation aircrew pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 311,
25.11.2011, p. 1, ELI: http://data.europa.eu/eli/reg/2011/1178/oj).
(4) Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules for the airworthiness and
environmental certification or declaration of compliance of aircraft and related products, parts, appliances, control and monitoring
units and control and monitoring unit components, as well as for the capability requirements of design and production organisations
(OJ L 224, 21.8.2012, p. 1, ELI: http://data.europa.eu/eli/reg/2012/748/oj).
ELI: http://data.europa.eu/eli/reg_impl/2025/2293/oj 1/11EN
OJ L, 11.11.2025
(4) Implementing Regulation (EU) 2023/203 added point (g) to point ARO.GEN.300 of Annex II (Part-ARO) to
Commission Regulation (EU) No 965/2012(5). The new point includes an incorrect reference, which should be
corrected.
(5) Implementing Regulation (EU) 2023/203 amended as well point ADR.AR.C.005 of Annex II (Part-ADR.AR) to
Commission Regulation (EU) No 139/2014(6), by adding to it point (f). The new point includes an incorrect
reference that should be corrected.
(6) Implementing Regulation (EU) 2023/203 also added point (g) to point 145.B.300 of Annex II (Part-145) to
Commission Regulation (EU) No 1321/2014(7). The new point includes an incorrect reference. Furthermore, point
(g) was added to point CAMO.B.300 to Annex Vc (Part-CAMO). The new point includes an incorrect reference.
Those references should be corrected.
(7) Implementing Regulation (EU) 2023/203 added point (f) to point ATCO.AR.C.001 of Annex II (Part ATCO.AR) to
Commission Regulation (EU) 2015/340(8). The new point includes an incorrect reference, which should be
corrected.
(8) Implementing Regulation (EU) 2023/203 amended Annex II (Part-ATM/ANS.AR) to Commission Implementing
Regulation (EU) 2017/373(9)by adding point (d) to point ATM/ANS.AR.C.010. The new point includes an incorrect
reference that should be corrected.
(9) To ensure a coherent legal framework, the date of application of this Regulation should be aligned with that of
Implementing Regulation (EU) 2023/203.
(10) The measures provided for in this Regulation are in accordance with the opinion of the Committee for the
application of common safety rules in the field of civil aviation,
HAS ADOPTED THIS REGULATION:
Article 1
Annex II to Implementing Regulation (EU) 2023/203 is amended in accordance with Annex I to this Regulation.
Article 2
Annex VI to Regulation (EU) No 1178/2011 is corrected in accordance with Annex II to this Regulation.
(5) Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and administrative procedures
related to air operations pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 296,
25.10.2012, p. 1, ELI: http://data.europa.eu/eli/reg/2012/965/oj).
(6) Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to
aerodromes pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council (OJ L 44, 14.2.2014, p. 1, ELI:
http://data.europa.eu/eli/reg/2014/139/oj).
(7) Commission Regulation (EU) No 1321/2014 of 26 November 2014 on the continuing airworthiness of aircraft and aeronautical
products, parts and appliances, and on the approval of organisations and personnel involved in these tasks (OJ L 362, 17.12.2014,
p. 1, ELI: http://data.europa.eu/eli/reg/2014/1321/oj).
(8) Commission Regulation (EU) 2015/340 of 20 February 2015 laying down technical requirements and administrative procedures
relating to air traffic controllers’ licences and certificates pursuant to Regulation (EC) No 216/2008 of the European Parliament and of
the Council, amending Commission Implementing Regulation (EU) No 923/2012 and repealing Commission Regulation (EU)
No 805/2011 (OJ L 63, 6.3.2015, p. 1, ELI: http://data.europa.eu/eli/reg/2015/340/oj).
(9) Commission Implementing Regulation (EU) 2017/373 of 1 March 2017 laying down common requirements for providers of air traffic
management/air navigation services and other air traffic management network functions and their oversight, repealing Regulation (EC)
No 482/2008, Implementing Regulations (EU) No 1034/2011, (EU) No 1035/2011 and (EU) 2016/1377 and amending Regulation
(EU) No 677/2011 (OJ L 62, 8.3.2017, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2017/373/oj).
2/11 ELI: http://data.europa.eu/eli/reg_impl/2025/2293/ojEN
OJ L, 11.11.2025
Article 3
Annex I to Regulation (EU) No 748/2012 is corrected in accordance with Annex III to this Regulation.
Article 4
Annex II to Regulation (EU) No 965/2012 is corrected in accordance with Annex IV to this Regulation.
Article 5
Annex II to Regulation (EU) No 139/2014 is corrected in accordance with Annex V to this Regulation.
Article 6
Annexes II and Vc to Regulation (EU) No 1321/2014 are corrected in accordance with Annex VI to this Regulation.
Article 7
Annex II to Regulation (EU) 2015/340 is corrected in accordance with Annex VII to this Regulation.
Article 8
Annex II to Implementing Regulation (EU) 2017/373 is corrected in accordance with Annex VIII to this Regulation.
Article 9
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the
European Union.
It shall apply from 22 February 2026.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels, 10 November 2025.
For the Commission
The President
Ursula VON DER LEYEN
ELI: http://data.europa.eu/eli/reg_impl/2025/2293/oj 3/11EN
OJ L, 11.11.2025
ANNEX I
Annex II to Implementing Regulation (EU) 2023/203 is amended as follows:
(1) in point IS.I.OR.250, points (b) and (c) are replaced by the following:
‘(b) The initial issue of the ISMM shall be approved and a copy shall be retained by the competent authority. An
approval shall not be required for declared organisations. The ISMM shall be amended as necessary to remain
an up-to-date description of the ISMS of the organisation. A copy of any amendments to the ISMM shall be
provided to the competent authority;
(c) Amendments to the ISMM shall be managed in a procedure established by the organisation. Any amendments
that are not included within the scope of that procedure and any amendments related to the changes referred
to in point IS.I.OR.255(b), shall be approved by the competent authority. An approval shall not be required for
declared organisations.’;
(2) point IS.I.OR.255 is replaced by the following:
‘IS.I.OR.255 Changes to the information security management system
(a) Changes to the ISMS may be managed and notified to the competent authority in a procedure developed by the
organisation. That procedure shall be approved by the competent authority, except for declared organisations.
(b) With regard to changes to the ISMS not covered by the procedure referred to in point (a), the organisation shall
apply for and obtain an approval issued by the competent authority, except for declared organisations, for
which an approval is not required.
With regard to those changes:
(1) the application shall be submitted before any such change takes place, in order to enable the competent
authority to determine continued compliance with this Regulation and to amend, if necessary, the
organisation certificate and related terms of approval attached to it;
(2) the organisation shall make available to the competent authority any information it requests to evaluate
the change;
(3) the change shall be implemented only upon receipt of a formal approval by the competent authority,
except for declared organisations, which may implement the change immediately;
(4) the organisation shall operate under the conditions prescribed by the competent authority during the
implementation of such changes.’.
4/11 ELI: http://data.europa.eu/eli/reg_impl/2025/2293/ojEN
OJ L, 11.11.2025
ANNEX II
In Annex VI to Regulation (EU) No 1178/2011, point ARA.GEN.300(g) is replaced by the following:
‘(g) With regard to the certification and oversight of the organisation’s compliance with point ORA.GEN.200A of this
Annex, in addition to complying with points (a) to (f) of this point, the competent authority shall review any
approval granted under point IS.I.OR.200(e) of Annex II to Commission Implementing Regulation
(EU) 2023/203(*) following the applicable oversight audit cycle and whenever changes are implemented in the
scope of work of the organisation.
_____________
(*) Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 laying down rules for the application of
Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the
management of information security risks with a potential impact on aviation safety for organisations covered by
Commission Regulations (EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011, (EU) 2015/340,
Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664, and for competent authorities covered
by Commission Regulations (EU) No 748/2012, (EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011,
(EU) 2015/340 and (EU) No 139/2014, Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664
and amending Commission Regulations (EU) No 1178/2011, (EU) No 748/2012, (EU) No 965/2012, (EU)
No 139/2014, (EU) No 1321/2014, (EU) 2015/340, and Commission Implementing Regulations (EU) 2017/373 and
(EU) 2021/664 (OJ L 31, 2.2.2023, p. 1, ELI: http://data.europa.eu/eli/reg_impl/2023/203/oj).’.
ELI: http://data.europa.eu/eli/reg_impl/2025/2293/oj 5/11EN
OJ L, 11.11.2025
ANNEX III
Annex I to Regulation (EU) No 748/2012 is corrected as follows:
(1) in point 21.B.221, point (g) is replaced by the following:
‘(g) With regard to the certification and oversight of the organisation’s compliance with point 21.A.139A of this
Annex, in addition to complying with points (a) to (f) of this point, the competent authority shall review any
approval granted under point IS.D.OR.200(e) of the Annex to Commission Delegated Regulation
(EU) 2022/1645(*)following the applicable oversight audit cycle and whenever changes are implemented in
the scope of work of the organisation.
_____________
(*) Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 laying down rules for the application of
Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the
management of information security risks with a potential impact on aviation safety for organisations covered
by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission
Regulations (EU) No 748/2012 and (EU) No 139/2014 (OJ L 248, 26.9.2022, p. 18, ELI: http://data.europa.eu/
eli/reg_del/2022/1645/oj).’;
(2) in point 21.B.431, point (d) is replaced by the following:
‘(d) With regard to the certification and oversight of the organisation’s compliance with point 21.A.239A of this
Annex, in addition to complying with points (a) to (c) of this point, the competent authority shall review any
approval granted under point IS.D.OR.200(e) of the Annex to Delegated Regulation (EU) 2022/1645
following the applicable oversight audit cycle and whenever changes are implemented in the scope of work of
the organisation.’.
6/11 ELI: http://data.europa.eu/eli/reg_impl/2025/2293/ojEN
OJ L, 11.11.2025
ANNEX IV
In Annex II to Regulation (EU) No 965/2012, point ARO.GEN.300(g) is replaced by the following:
‘(g) With regard to the certification and oversight of the organisation’s compliance with point ORO.GEN.200A, in
addition to complying with points (a) to (f) of this point, the competent authority shall review any approval granted
under point IS.I.OR.200(e) of Annex II to Implementing Regulation (EU) 2023/203 following the applicable
oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.’.
ELI: http://data.europa.eu/eli/reg_impl/2025/2293/oj 7/11EN
OJ L, 11.11.2025
ANNEX V
In Annex II to Regulation (EU) No 139/2014, point ADR.AR.C.005(f) is replaced by the following:
‘(f) With regard to the certification and oversight of the organisation’s compliance with point ADR.OR.D.005A , in
addition to complying with points (a) to (e) of this point, the competent authority shall review any approval granted
under point IS.D.OR.200(e) of the Annex to Delegated Regulation (EU) 2022/1645 following the applicable
oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.’.
8/11 ELI: http://data.europa.eu/eli/reg_impl/2025/2293/ojEN
OJ L, 11.11.2025
ANNEX VI
Annexes II and Vc to Regulation (EU) No 1321/2014 are corrected as follows:
(1) in Annex II, point 145.B.300(g) is replaced by the following:
‘(g) With regard to the certification and oversight of the organisation’s compliance with point 145.A.200A, in
addition to complying with points (a) to (f) of this point, the competent authority shall review any approval
granted under point IS.I.OR.200(e) of Annex II to Implementing Regulation (EU) 2023/203 following the
applicable oversight audit cycle and whenever changes are implemented in the scope of work of the
organisation.’;
(2) in Annex Vc , point CAMO.B.300(g) is replaced by the following:
‘(g) With regard to the certification and oversight of the organisation’s compliance with point CAMO.A.200A, in
addition to complying with points (a) to (f) of this point, the competent authority shall review any approval
granted under point IS.I.OR.200(e) of Annex II to Implementing Regulation (EU) 2023/203 following the
applicable oversight audit cycle and whenever changes are implemented in the scope of work of the
organisation.’.
ELI: http://data.europa.eu/eli/reg_impl/2025/2293/oj 9/11EN
OJ L, 11.11.2025
ANNEX VII
In Annex II to Regulation (EU) 2015/340, point ATCO.AR.C.001(f) is replaced by the following:
‘(f) With regard to the certification and oversight of the organisation’s compliance with point ATCO.OR.C.001A, in
addition to complying with points (a) to (e) of this point, the competent authority shall review any approval granted
under point IS.I.OR.200(e) of Annex II to Implementing Regulation (EU) 2023/203 following the applicable
oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.’.
10/11 ELI: http://data.europa.eu/eli/reg_impl/2025/2293/ojEN
OJ L, 11.11.2025
ANNEX VIII
In Annex II to Implementing Regulation (EU) 2017/373, point ATM/ANS.AR.C.010(d) is replaced by the following:
‘(d) With regard to the certification and oversight of the organisation’s compliance with point ATM/ANS.OR.B.005A, in
addition to complying with points (a) to (c) of this point, the competent authority shall review any approval granted
under point IS.I.OR.200(e) of Annex II to Implementing Regulation (EU) 2023/203 following the applicable
oversight audit cycle and whenever changes are implemented in the scope of work of the organisation.’.
ELI: http://data.europa.eu/eli/reg_impl/2025/2293/oj 11/11